fix(ashby): harden uploads and pagination

Author: waleedlatif1

apps/docs/content/docs/integrations/ashby.mdx

@@ -1183,7 +1183,7 @@ Lists all jobs in an Ashby organization. By default returns Open, Closed, and Ar
 | `cursor` | string | No | Opaque pagination cursor from a previous response nextCursor value |
 | `perPage` | number | No | Number of results per page \(default and max 100\). Ashby silently caps larger values rather than erroring. |
 | `syncToken` | string | No | Opaque token from a prior sync to fetch only jobs changed since then. Ashby only returns a new syncToken on the last page, so drain moreDataAvailable/nextCursor before persisting it. |
-| `status` | json | No | One job status or an array of statuses to include: Open, Closed, Archived, or Draft |
+| `status` | array | No | One job status or an array of statuses to include: Open, Closed, Archived, or Draft |
 | `createdAfter` | string | No | Only return jobs created after this ISO 8601 timestamp \(e.g. 2024-01-01T00:00:00Z\) |
 | `openedAfter` | string | No | Only return jobs opened after this ISO 8601 timestamp |
 | `openedBefore` | string | No | Only return jobs opened before this ISO 8601 timestamp |
@@ -1441,7 +1441,7 @@ Searches for candidates by name and/or email with AND logic. Results are limited
 
 ### Ashby Search Jobs
 
-Searches Ashby jobs by title and/or requisition ID.
+Searches Ashby jobs by title and/or requisition ID. Provide at least one of these filters.
 
 #### Input
 

apps/sim/blocks/blocks/ashby.test.ts

@@ -325,6 +325,13 @@ describe('AshbyBlock', () => {
       expect(condition.value).toContain('list_jobs')
     })
 
+    it('maps the editor status selection to the tool array contract', () => {
+      const result = AshbyBlock.tools.config.params!(
+        buildParams('list_jobs', { jobStatus: 'Open' })
+      )
+      expect(result.status).toEqual(['Open'])
+    })
+
     it('maps the shared draft-posting switch to the endpoint-specific parameter', () => {
       const listParams = AshbyBlock.tools.config.params!(
         buildParams('list_jobs', { includeUnpublishedJobPostingIds: true })
@@ -340,6 +347,25 @@ describe('AshbyBlock', () => {
     })
   })
 
+  describe('expanded list controls', () => {
+    it('exposes only provider-supported pagination and sync controls', () => {
+      const cursor = AshbyBlock.subBlocks.find((s) => s.id === 'cursor')
+      const cursorOperations = (cursor?.condition as { value: string[] }).value
+      expect(cursorOperations).not.toContain('search_candidates')
+      expect(cursorOperations).not.toContain('search_jobs')
+
+      const syncToken = AshbyBlock.subBlocks.find((s) => s.id === 'syncToken')
+      const syncOperations = (syncToken?.condition as { value: string[] }).value
+      expect(syncOperations).toContain('list_application_feedback')
+    })
+
+    it('exposes archived interview plans in the editor', () => {
+      const includeArchived = AshbyBlock.subBlocks.find((s) => s.id === 'includeArchived')
+      const operations = (includeArchived?.condition as { value: string[] }).value
+      expect(operations).toContain('list_interview_plans')
+    })
+  })
+
   describe('alternate lookup identifiers', () => {
     it('does not require the Ashby UUID when an alternate lookup is supported', () => {
       const candidateId = AshbyBlock.subBlocks.find((s) => s.id === 'candidateId')

apps/sim/blocks/blocks/ashby.ts

@@ -854,8 +854,6 @@ Output only the ISO 8601 timestamp string, nothing else.`,
           'list_application_feedback',
           'list_application_history',
           'list_interview_plans',
-          'search_candidates',
-          'search_jobs',
         ],
       },
       mode: 'advanced',
@@ -906,6 +904,7 @@ Output only the ISO 8601 timestamp string, nothing else.`,
           'list_custom_fields',
           'list_offers',
           'list_jobs',
+          'list_application_feedback',
         ],
       },
       mode: 'advanced',
@@ -992,6 +991,7 @@ Output only the JSON array, nothing else.`,
           'list_departments',
           'list_custom_fields',
           'list_locations',
+          'list_interview_plans',
         ],
       },
       mode: 'advanced',
@@ -1428,7 +1428,7 @@ Output only the JSON array.`,
         if (params.openingIdentifier) result.identifier = params.openingIdentifier
         if (params.filterStatus) result.status = params.filterStatus
         if (params.filterJobId) result.jobId = params.filterJobId
-        if (params.jobStatus) result.status = params.jobStatus
+        if (params.jobStatus) result.status = [params.jobStatus]
         if (params.sendNotifications === 'true' || params.sendNotifications === true) {
           result.sendNotifications = true
         }

apps/sim/connectors/ashby/ashby.test.ts

@@ -63,4 +63,40 @@ describe('ashbyConnector', () => {
       'feedback unavailable'
     )
   })
+
+  it('continues through short non-final note pages beyond the former page ceiling', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch')
+    fetchMock.mockResolvedValueOnce(ashbyResponse({ id: 'c1', name: 'One', applicationIds: [] }))
+    for (let page = 1; page <= 6; page++) {
+      fetchMock.mockResolvedValueOnce(
+        ashbyResponse(
+          [{ content: `note-${page}`, createdAt: `2026-01-0${page}T00:00:00Z` }],
+          page < 6 ? { moreDataAvailable: true, nextCursor: `cursor-${page}` } : {}
+        )
+      )
+    }
+    const document = await ashbyConnector.getDocument('key', {}, 'c1')
+    expect(document?.content).toContain('note-6')
+    expect(fetchMock).toHaveBeenCalledTimes(7)
+  })
+
+  it('fails hydration on a repeated note cursor instead of storing partial content', async () => {
+    vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(ashbyResponse({ id: 'c1', name: 'One', applicationIds: [] }))
+      .mockResolvedValueOnce(
+        ashbyResponse([{ content: 'note-1' }], {
+          moreDataAvailable: true,
+          nextCursor: 'same-cursor',
+        })
+      )
+      .mockResolvedValueOnce(
+        ashbyResponse([{ content: 'note-2' }], {
+          moreDataAvailable: true,
+          nextCursor: 'same-cursor',
+        })
+      )
+    await expect(ashbyConnector.getDocument('key', {}, 'c1')).rejects.toThrow(
+      /repeated a pagination cursor/
+    )
+  })
 })

apps/sim/connectors/ashby/ashby.ts

@@ -31,13 +31,6 @@ const MAX_DOCUMENT_CHARACTERS = 2_000_000
  */
 const MAX_APPLICATIONS_FOR_FEEDBACK = 10
 
-/**
- * Defensive page ceiling for the per-candidate note and feedback cursor loops. Ashby
- * terminates them via `moreDataAvailable`, but a repeated cursor would otherwise spin
- * forever inside a single `getDocument` call.
- */
-const MAX_SUB_PAGES = 5
-
 type UnknownRecord = Record<string, unknown>
 
 /**
@@ -457,9 +450,9 @@ function candidateMetadata(candidate: AshbyCandidateSummary): Record<string, unk
 async function fetchAllNotes(accessToken: string, candidateId: string): Promise<AshbyNote[]> {
   const notes: AshbyNote[] = []
   let cursor: string | undefined
-  let hasMore = true
+  const seenCursors = new Set<string>()
 
-  for (let page = 0; hasMore && page < MAX_SUB_PAGES; page++) {
+  while (notes.length < MAX_NOTES_PER_CANDIDATE) {
     const body: UnknownRecord = { candidateId, limit: NOTES_PER_PAGE }
     if (cursor) body.cursor = cursor
     const data = await ashbyPost(accessToken, 'candidate.listNotes', body)
@@ -468,16 +461,19 @@ async function fetchAllNotes(accessToken: string, candidateId: string): Promise<
       if (notes.length >= MAX_NOTES_PER_CANDIDATE) break
       notes.push(mapNote(raw))
     }
-    cursor = data.nextCursor ?? undefined
-    hasMore =
-      notes.length < MAX_NOTES_PER_CANDIDATE && Boolean(data.moreDataAvailable) && Boolean(cursor)
-  }
-
-  if (hasMore) {
-    logger.warn('Stopped paginating Ashby candidate notes at the page ceiling', {
-      candidateId,
-      notes: notes.length,
-    })
+    if (!data.moreDataAvailable || notes.length >= MAX_NOTES_PER_CANDIDATE) break
+    const nextCursor = data.nextCursor?.trim()
+    if (!nextCursor) {
+      throw new Error('Ashby candidate.listNotes reported more data without a next cursor')
+    }
+    if (seenCursors.has(nextCursor)) {
+      throw new Error('Ashby candidate.listNotes repeated a pagination cursor')
+    }
+    if (results.length === 0) {
+      throw new Error('Ashby candidate.listNotes returned an empty non-final page')
+    }
+    seenCursors.add(nextCursor)
+    cursor = nextCursor
   }
 
   return notes
@@ -493,9 +489,9 @@ async function fetchFeedbackForApplication(
 ): Promise<AshbyFeedbackSummary[]> {
   const feedback: AshbyFeedbackSummary[] = []
   let cursor: string | undefined
-  let hasMore = true
+  const seenCursors = new Set<string>()
 
-  for (let page = 0; hasMore && page < MAX_SUB_PAGES; page++) {
+  while (feedback.length < MAX_FEEDBACK_PER_CANDIDATE) {
     const body: UnknownRecord = { applicationId, limit: FEEDBACK_PER_PAGE }
     if (cursor) body.cursor = cursor
     const data = await ashbyPost(accessToken, 'applicationFeedback.list', body)
@@ -504,18 +500,19 @@ async function fetchFeedbackForApplication(
       if (feedback.length >= MAX_FEEDBACK_PER_CANDIDATE) break
       feedback.push(mapFeedback(raw))
     }
-    cursor = data.nextCursor ?? undefined
-    hasMore =
-      feedback.length < MAX_FEEDBACK_PER_CANDIDATE &&
-      Boolean(data.moreDataAvailable) &&
-      Boolean(cursor)
-  }
-
-  if (hasMore) {
-    logger.warn('Stopped paginating Ashby application feedback at the page ceiling', {
-      applicationId,
-      submissions: feedback.length,
-    })
+    if (!data.moreDataAvailable || feedback.length >= MAX_FEEDBACK_PER_CANDIDATE) break
+    const nextCursor = data.nextCursor?.trim()
+    if (!nextCursor) {
+      throw new Error('Ashby applicationFeedback.list reported more data without a next cursor')
+    }
+    if (seenCursors.has(nextCursor)) {
+      throw new Error('Ashby applicationFeedback.list repeated a pagination cursor')
+    }
+    if (results.length === 0) {
+      throw new Error('Ashby applicationFeedback.list returned an empty non-final page')
+    }
+    seenCursors.add(nextCursor)
+    cursor = nextCursor
   }
 
   return feedback

apps/sim/lib/internal/ashby/operations.test.ts

@@ -2,10 +2,11 @@
  * @vitest-environment node
  */
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 
 const mocks = vi.hoisted(() => ({
   assertToolFileAccess: vi.fn(),
-  downloadFileFromStorage: vi.fn(),
+  downloadServableFileFromStorage: vi.fn(),
   secureFetchWithPinnedIP: vi.fn(),
   validateUrlWithDNS: vi.fn(),
 }))
@@ -14,14 +15,15 @@ vi.mock('@/app/api/files/authorization', () => ({
   assertToolFileAccess: mocks.assertToolFileAccess,
 }))
 vi.mock('@/lib/uploads/utils/file-utils.server', () => ({
-  downloadFileFromStorage: mocks.downloadFileFromStorage,
+  downloadServableFileFromStorage: mocks.downloadServableFileFromStorage,
 }))
 vi.mock('@/lib/core/security/input-validation.server', () => ({
   secureFetchWithPinnedIP: mocks.secureFetchWithPinnedIP,
   validateUrlWithDNS: mocks.validateUrlWithDNS,
 }))
 
 import { executeAshbyUpload } from '@/lib/internal/ashby/operations'
+import { ashbyUploadInputSchema } from '@/lib/internal/ashby/schema'
 
 const FILE = {
   id: 'file-1',
@@ -36,7 +38,10 @@ describe('executeAshbyUpload', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mocks.assertToolFileAccess.mockResolvedValue(null)
-    mocks.downloadFileFromStorage.mockResolvedValue(Buffer.from('resume'))
+    mocks.downloadServableFileFromStorage.mockResolvedValue({
+      buffer: Buffer.from('resume'),
+      contentType: 'application/pdf',
+    })
     mocks.validateUrlWithDNS.mockResolvedValue({ isValid: true, resolvedIP: '203.0.113.10' })
     mocks.secureFetchWithPinnedIP.mockResolvedValue({ ok: true, status: 204 })
     vi.stubGlobal(
@@ -77,7 +82,7 @@ describe('executeAshbyUpload', () => {
       output: { id: 'candidate-1' },
     })
     expect(mocks.assertToolFileAccess).toHaveBeenCalledOnce()
-    expect(mocks.downloadFileFromStorage).toHaveBeenCalledOnce()
+    expect(mocks.downloadServableFileFromStorage).toHaveBeenCalledOnce()
     expect(mocks.validateUrlWithDNS).toHaveBeenCalledWith(
       'https://uploads.example.com/form',
       'uploadUrl',
@@ -109,7 +114,65 @@ describe('executeAshbyUpload', () => {
       { userId: 'sim-user', requestId: 'request-1' }
     )
     expect(response.status).toBe(404)
-    expect(mocks.downloadFileFromStorage).not.toHaveBeenCalled()
+    expect(mocks.downloadServableFileFromStorage).not.toHaveBeenCalled()
+    expect(fetch).not.toHaveBeenCalled()
+  })
+
+  it('parses advanced-mode JSON file inputs and trims the candidate ID at the boundary', () => {
+    const parsed = ashbyUploadInputSchema.parse({
+      apiKey: 'key',
+      candidateId: ' candidate-1 ',
+      file: JSON.stringify(FILE),
+    })
+    expect(parsed.candidateId).toBe('candidate-1')
+    expect(parsed.file).toEqual(FILE)
+  })
+
+  it('uploads the servable artifact bytes with their resolved content type', async () => {
+    mocks.downloadServableFileFromStorage.mockResolvedValueOnce({
+      buffer: Buffer.from('compiled-docx'),
+      contentType: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    })
+    const response = await executeAshbyUpload(
+      {
+        apiKey: 'key',
+        candidateId: 'candidate-1',
+        file: FILE,
+        fileName: 'resume.docx',
+        onBehalfOfUserId: null,
+      },
+      'resume',
+      { userId: 'sim-user', requestId: 'request-1' }
+    )
+    expect(response.status).toBe(200)
+    const registrationBody = JSON.parse(String(vi.mocked(fetch).mock.calls[0][1]?.body))
+    expect(registrationBody).toMatchObject({
+      filename: 'resume.docx',
+      contentType: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+      contentLength: Buffer.byteLength('compiled-docx'),
+    })
+  })
+
+  it('returns 413 when the servable file exceeds Ashby upload limits', async () => {
+    mocks.downloadServableFileFromStorage.mockRejectedValueOnce(
+      new PayloadSizeLimitError({
+        label: 'servable file download',
+        maxBytes: 25 * 1024 * 1024,
+        observedBytes: 25 * 1024 * 1024 + 1,
+      })
+    )
+    const response = await executeAshbyUpload(
+      {
+        apiKey: 'key',
+        candidateId: 'candidate-1',
+        file: FILE,
+        fileName: null,
+        onBehalfOfUserId: null,
+      },
+      'file',
+      { userId: 'sim-user', requestId: 'request-1' }
+    )
+    expect(response.status).toBe(413)
     expect(fetch).not.toHaveBeenCalled()
   })
 })