Function validateWorkdayTenantUrl

apps/sim/lib/core/security/input-validation.ts:1592–1616

(
  url: string | null | undefined,
  paramName = 'tenantUrl'
)

 * ```
 */
export function validateWorkdayTenantUrl(
  url: string | null | undefined,
  paramName = 'tenantUrl'
): ValidationResult {
  const urlResult = validateExternalUrl(url, paramName)
  if (!urlResult.isValid) return urlResult

  const hostname = new URL(url as string).hostname.toLowerCase()
  const isAllowedHost = WORKDAY_ALLOWED_HOST_SUFFIXES.some(
    (suffix) => hostname === suffix.slice(1) || hostname.endsWith(suffix)
  )

  if (!isAllowedHost) {
    logger.warn('Workday tenant URL hostname not on allowlist', {
      paramName,
      hostname: hostname.substring(0, 100),
    })
    return {
      isValid: false,
      error: `${paramName} must be a Workday-hosted domain (e.g., *.workday.com or *.myworkday.com)`,
    }
  }

  return { isValid: true, sanitized: url as string }
}

/**
 * Validates a database identifier (table or column name) to prevent SQL injection.