Function fetchSapConcurAccessToken

apps/sim/app/api/tools/sap_concur/shared.ts:199–274

(
  auth: SapConcurAuth,
  requestId: string
)

 * Validates that the geolocation returned by Concur is a safe external URL.
 */
export async function fetchSapConcurAccessToken(
  auth: SapConcurAuth,
  requestId: string
): Promise<{ accessToken: string; geolocation: string }> {
  if (auth.grantType === 'password') {
    if (!auth.username) throw new Error('username is required for password grant')
    if (!auth.password) throw new Error('password is required for password grant')
  }

  const cacheKey = tokenCacheKey(auth)
  const cached = TOKEN_CACHE.get(cacheKey)
  if (cached && cached.expiresAt - TOKEN_SAFETY_WINDOW_MS > Date.now()) {
    return { accessToken: cached.accessToken, geolocation: cached.geolocation }
  }

  const tokenUrl = assertSafeExternalUrl(
    `https://${auth.datacenter}/oauth2/v0/token`,
    'tokenUrl'
  ).toString()

  const params = new URLSearchParams()
  params.set('client_id', auth.clientId)
  params.set('client_secret', auth.clientSecret)
  params.set('grant_type', auth.grantType)
  if (auth.grantType === 'password') {
    params.set('username', auth.username ?? '')
    params.set('password', auth.password ?? '')
    if (auth.companyUuid) params.set('credtype', 'authtoken')
  }

  const response = await secureFetchWithValidation(
    tokenUrl,
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
        Accept: 'application/json',
      },
      body: params.toString(),
      timeout: SAP_CONCUR_OUTBOUND_FETCH_TIMEOUT_MS,
    },
    'tokenUrl'
  )

  if (!response.ok) {
    const text = await response.text().catch(() => '')
    logger.warn(`[${requestId}] Concur token fetch failed (${response.status}): ${text}`)
    throw new Error(`Concur token request failed: HTTP ${response.status}`)
  }

  const data = (await response.json()) as {
    access_token?: string
    expires_in?: number
    geolocation?: string
  }

  if (!data.access_token) {
    throw new Error('Concur token response missing access_token')