Skip to content

Commit 8009578

Browse files
waleedlatif1claude
waleedlatif1
and
claude
authored
feat(microsoft-excel): add SharePoint drive support for Excel integration (#4162)
* feat(microsoft-excel): add SharePoint drive support for Excel integration * fix(microsoft-excel): address PR review comments - Validate siteId/driveId format in drives route to prevent path traversal - Use direct single-drive endpoint for fetchById instead of filtering full list - Fix dependsOn on sheet/spreadsheet selectors so driveId flows into context - Fix NextRequest type in drives route for build compatibility * fix(microsoft-excel): validate driveId in files route Add regex validation for driveId query param in the Microsoft OAuth files route to prevent path traversal, matching the drives route. * fix(microsoft-excel): unblock OneDrive users and validate driveId in sheets route - Add credential to any[] arrays so OneDrive users (no drive selected) still pass the dependsOn gate while driveSelector remains in the dependency list for context flow to SharePoint users - Add /^[\w-]+$/ validation for driveId in sheets API route * fix(microsoft-excel): validate driveId in getItemBasePath utility Add regex validation for driveId at the shared utility level to prevent path traversal through the tool execution path, which bypasses the API route validators. * fix(microsoft-excel): use centralized input validation Replace inline regex validation with platform validators from @/lib/core/security/input-validation: - validateSharePointSiteId for siteId in drives route - validateAlphanumericId for driveId in drives, sheets, files routes and getItemBasePath utility * lint * improvement(microsoft-excel): add File Source dropdown to control SharePoint visibility Replace always-visible optional SharePoint fields with a File Source dropdown (OneDrive/SharePoint) that conditionally shows site and drive selectors. OneDrive users see zero extra fields (default). SharePoint users switch the dropdown and get the full cascade. * fix(microsoft-excel): fix canonical param test failures Make fileSource dropdown mode:'both' so it appears in basic and advanced modes. Add condition to manualDriveId to match driveSelector's condition, satisfying the canonical pair consistency test. * fix(microsoft-excel): address PR review feedback for SharePoint drive support - Clear stale driveId/siteId/spreadsheetId when fileSource changes by adding fileSource to dependsOn arrays for siteSelector, driveSelector, and spreadsheetId selectors - Reorder manualDriveId before manualSpreadsheetId in advanced mode for logical top-down flow - Validate spreadsheetId with validateMicrosoftGraphId in getItemBasePath() and sheets route to close injection vector (uses permissive validator that accepts ! chars in OneDrive item IDs) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(microsoft-excel): use validateMicrosoftGraphId for driveId validation SharePoint drive IDs use the format b!<base64-string> which contains ! characters rejected by validateAlphanumericId. Switch all driveId validation to validateMicrosoftGraphId which blocks path traversal and control characters while accepting valid Microsoft Graph identifiers. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(microsoft-excel): use validatePathSegment with strict pattern for driveId/spreadsheetId Replace validateMicrosoftGraphId with validatePathSegment using a custom pattern ^[a-zA-Z0-9!_-]+$ for all URL-interpolated IDs. validatePathSegment blocks /, \, path traversal, and null bytes before checking the pattern, preventing URL-modifying characters like ?, #, & from altering the Graph API endpoint. The pattern allows ! for SharePoint b!<base64> drive IDs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * lint * fix(microsoft-excel): reorder driveId before spreadsheetId in v1 block Move driveId subBlock before manualSpreadsheetId in the legacy v1 block to match the logical top-down flow (Drive ID → Spreadsheet ID), consistent with the v2 block ordering. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(microsoft-excel): clear manualDriveId when fileSource changes Add dependsOn: ['fileSource'] to manualDriveId so its value is cleared when switching from SharePoint back to OneDrive. Without this, the stale driveId would still be serialized and forwarded to getItemBasePath, routing through the SharePoint drive path instead of me/drive. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor(microsoft-excel): use getItemBasePath in sheets route to remove duplication Replace inline URL construction and validation logic with the shared getItemBasePath utility, eliminating duplicated GRAPH_ID_PATTERN regex and conditional URL building. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * lint --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 61b33e5 commit 8009578

File tree

14 files changed

+462
-118
lines changed

14 files changed

+462
-118
lines changed

‎apps/docs/content/docs/en/tools/microsoft_excel.mdx‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ Read data from a specific sheet in a Microsoft Excel spreadsheet
4545
| Parameter | Type | Required | Description |
4646
| --------- | ---- | -------- | ----------- |
4747
| `spreadsheetId` | string | Yes | The ID of the spreadsheet/workbook to read from \(e.g., "01ABC123DEF456"\) |
48+
| `driveId` | string | No | The ID of the drive containing the spreadsheet. Required for SharePoint files. If omitted, uses personal OneDrive. |
4849
| `range` | string | No | The range of cells to read from. Accepts "SheetName!A1:B2" for explicit ranges or just "SheetName" to read the used range of that sheet. If omitted, reads the used range of the first sheet. |
4950

5051
#### Output
@@ -67,6 +68,7 @@ Write data to a specific sheet in a Microsoft Excel spreadsheet
6768
| Parameter | Type | Required | Description |
6869
| --------- | ---- | -------- | ----------- |
6970
| `spreadsheetId` | string | Yes | The ID of the spreadsheet/workbook to write to \(e.g., "01ABC123DEF456"\) |
71+
| `driveId` | string | No | The ID of the drive containing the spreadsheet. Required for SharePoint files. If omitted, uses personal OneDrive. |
7072
| `range` | string | No | The range of cells to write to \(e.g., "Sheet1!A1:B2"\) |
7173
| `values` | array | Yes | The data to write as a 2D array \(e.g., \[\["Name", "Age"\], \["Alice", 30\]\]\) or array of objects |
7274
| `valueInputOption` | string | No | The format of the data to write |

‎apps/sim/app/api/auth/oauth/microsoft/files/route.ts‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
import { createLogger } from '@sim/logger'
22
import { type NextRequest, NextResponse } from 'next/server'
33
import { authorizeCredentialUse } from '@/lib/auth/credential-access'
4+
import { validatePathSegment } from '@/lib/core/security/input-validation'
45
import { generateRequestId } from '@/lib/core/utils/request'
56
import { getCredential, refreshAccessTokenIfNeeded } from '@/app/api/auth/oauth/utils'
67

@@ -19,6 +20,7 @@ export async function GET(request: NextRequest) {
1920
const { searchParams } = new URL(request.url)
2021
const credentialId = searchParams.get('credentialId')
2122
const query = searchParams.get('query') || ''
23+
const driveId = searchParams.get('driveId') || undefined
2224
const workflowId = searchParams.get('workflowId') || undefined
2325

2426
if (!credentialId) {
@@ -72,8 +74,21 @@ export async function GET(request: NextRequest) {
7274
)
7375
searchParams_new.append('$top', '50')
7476

77+
// When driveId is provided (SharePoint), search within that specific drive.
78+
// Otherwise, search the user's personal OneDrive.
79+
if (driveId) {
80+
const driveIdValidation = validatePathSegment(driveId, {
81+
paramName: 'driveId',
82+
customPattern: /^[a-zA-Z0-9!_-]+$/,
83+
})
84+
if (!driveIdValidation.isValid) {
85+
return NextResponse.json({ error: driveIdValidation.error }, { status: 400 })
86+
}
87+
}
88+
const drivePath = driveId ? `drives/${driveId}` : 'me/drive'
89+
7590
const response = await fetch(
76-
`https://graph.microsoft.com/v1.0/me/drive/root/search(q='${encodeURIComponent(searchQuery)}')?${searchParams_new.toString()}`,
91+
`https://graph.microsoft.com/v1.0/${drivePath}/root/search(q='${encodeURIComponent(searchQuery)}')?${searchParams_new.toString()}`,
7792
{
7893
headers: {
7994
Authorization: `Bearer ${accessToken}`,

‎apps/sim/app/api/tools/microsoft_excel/drives/route.ts‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
import { createLogger } from '@sim/logger'
2+
import { type NextRequest, NextResponse } from 'next/server'
3+
import { authorizeCredentialUse } from '@/lib/auth/credential-access'
4+
import { validatePathSegment, validateSharePointSiteId } from '@/lib/core/security/input-validation'
5+
import { generateRequestId } from '@/lib/core/utils/request'
6+
import { refreshAccessTokenIfNeeded } from '@/app/api/auth/oauth/utils'
7+
8+
export const dynamic = 'force-dynamic'
9+
10+
const logger = createLogger('MicrosoftExcelDrivesAPI')
11+
12+
interface GraphDrive {
13+
id: string
14+
name: string
15+
driveType: string
16+
webUrl?: string
17+
}
18+
19+
/**
20+
* List document libraries (drives) for a SharePoint site.
21+
* Used by the microsoft.excel.drives selector to let users pick
22+
* which drive contains their Excel file.
23+
*/
24+
export async function POST(request: NextRequest) {
25+
const requestId = generateRequestId()
26+
27+
try {
28+
const body = await request.json()
29+
const { credential, workflowId, siteId, driveId } = body
30+
31+
if (!credential) {
32+
logger.warn(`[${requestId}] Missing credential in request`)
33+
return NextResponse.json({ error: 'Credential is required' }, { status: 400 })
34+
}
35+
36+
if (!siteId) {
37+
logger.warn(`[${requestId}] Missing siteId in request`)
38+
return NextResponse.json({ error: 'Site ID is required' }, { status: 400 })
39+
}
40+
41+
const siteIdValidation = validateSharePointSiteId(siteId, 'siteId')
42+
if (!siteIdValidation.isValid) {
43+
logger.warn(`[${requestId}] Invalid siteId format`)
44+
return NextResponse.json({ error: siteIdValidation.error }, { status: 400 })
45+
}
46+
47+
const authz = await authorizeCredentialUse(request, {
48+
credentialId: credential,
49+
workflowId,
50+
})
51+
if (!authz.ok || !authz.credentialOwnerUserId) {
52+
return NextResponse.json({ error: authz.error || 'Unauthorized' }, { status: 403 })
53+
}
54+
55+
const accessToken = await refreshAccessTokenIfNeeded(
56+
credential,
57+
authz.credentialOwnerUserId,
58+
requestId
59+
)
60+
if (!accessToken) {
61+
logger.warn(`[${requestId}] Failed to obtain valid access token`)
62+
return NextResponse.json(
63+
{ error: 'Failed to obtain valid access token', authRequired: true },
64+
{ status: 401 }
65+
)
66+
}
67+
68+
// Single-drive lookup when driveId is provided (used by fetchById)
69+
if (driveId) {
70+
const driveIdValidation = validatePathSegment(driveId, {
71+
paramName: 'driveId',
72+
customPattern: /^[a-zA-Z0-9!_-]+$/,
73+
})
74+
if (!driveIdValidation.isValid) {
75+
return NextResponse.json({ error: driveIdValidation.error }, { status: 400 })
76+
}
77+
78+
const url = `https://graph.microsoft.com/v1.0/sites/${siteId}/drives/${driveId}?$select=id,name,driveType,webUrl`
79+
const response = await fetch(url, {
80+
headers: { Authorization: `Bearer ${accessToken}` },
81+
})
82+
83+
if (!response.ok) {
84+
const errorData = await response
85+
.json()
86+
.catch(() => ({ error: { message: 'Unknown error' } }))
87+
return NextResponse.json(
88+
{ error: errorData.error?.message || 'Failed to fetch drive' },
89+
{ status: response.status }
90+
)
91+
}
92+
93+
const data: GraphDrive = await response.json()
94+
return NextResponse.json(
95+
{ drive: { id: data.id, name: data.name, driveType: data.driveType } },
96+
{ status: 200 }
97+
)
98+
}
99+
100+
// List all drives for the site
101+
const url = `https://graph.microsoft.com/v1.0/sites/${siteId}/drives?$select=id,name,driveType,webUrl`
102+
103+
const response = await fetch(url, {
104+
headers: {
105+
Authorization: `Bearer ${accessToken}`,
106+
},
107+
})
108+
109+
if (!response.ok) {
110+
const errorData = await response.json().catch(() => ({ error: { message: 'Unknown error' } }))
111+
logger.error(`[${requestId}] Microsoft Graph API error fetching drives`, {
112+
status: response.status,
113+
error: errorData.error?.message,
114+
})
115+
return NextResponse.json(
116+
{ error: errorData.error?.message || 'Failed to fetch drives' },
117+
{ status: response.status }
118+
)
119+
}
120+
121+
const data = await response.json()
122+
const drives = (data.value || []).map((drive: GraphDrive) => ({
123+
id: drive.id,
124+
name: drive.name,
125+
driveType: drive.driveType,
126+
}))
127+
128+
logger.info(`[${requestId}] Successfully fetched ${drives.length} drives for site ${siteId}`)
129+
return NextResponse.json({ drives }, { status: 200 })
130+
} catch (error) {
131+
logger.error(`[${requestId}] Error fetching drives`, error)
132+
return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
133+
}
134+
}

‎apps/sim/app/api/tools/microsoft_excel/sheets/route.ts‎

Lines changed: 19 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ import { type NextRequest, NextResponse } from 'next/server'
33
import { authorizeCredentialUse } from '@/lib/auth/credential-access'
44
import { generateRequestId } from '@/lib/core/utils/request'
55
import { refreshAccessTokenIfNeeded } from '@/app/api/auth/oauth/utils'
6+
import { getItemBasePath } from '@/tools/microsoft_excel/utils'
67

78
export const dynamic = 'force-dynamic'
89

@@ -30,6 +31,7 @@ export async function GET(request: NextRequest) {
3031
const { searchParams } = new URL(request.url)
3132
const credentialId = searchParams.get('credentialId')
3233
const spreadsheetId = searchParams.get('spreadsheetId')
34+
const driveId = searchParams.get('driveId') || undefined
3335
const workflowId = searchParams.get('workflowId') || undefined
3436

3537
if (!credentialId) {
@@ -61,17 +63,23 @@ export async function GET(request: NextRequest) {
6163
`[${requestId}] Fetching worksheets from Microsoft Graph API for workbook ${spreadsheetId}`
6264
)
6365

64-
// Fetch worksheets from Microsoft Graph API
65-
const worksheetsResponse = await fetch(
66-
`https://graph.microsoft.com/v1.0/me/drive/items/${spreadsheetId}/workbook/worksheets`,
67-
{
68-
method: 'GET',
69-
headers: {
70-
Authorization: `Bearer ${accessToken}`,
71-
'Content-Type': 'application/json',
72-
},
73-
}
74-
)
66+
let basePath: string
67+
try {
68+
basePath = getItemBasePath(spreadsheetId, driveId)
69+
} catch (error) {
70+
return NextResponse.json(
71+
{ error: error instanceof Error ? error.message : 'Invalid parameters' },
72+
{ status: 400 }
73+
)
74+
}
75+
76+
const worksheetsResponse = await fetch(`${basePath}/workbook/worksheets`, {
77+
method: 'GET',
78+
headers: {
79+
Authorization: `Bearer ${accessToken}`,
80+
'Content-Type': 'application/json',
81+
},
82+
})
7583

7684
if (!worksheetsResponse.ok) {
7785
const errorData = await worksheetsResponse

0 commit comments

Comments
 (0)