fix(zoho-desk): fall back to the credential Desk domain in webhook JWT verify

verifyAuth chose the JWKS host from providerConfig.apiDomain and otherwise
defaulted to the US host (desk.zoho.com), so a non-US webhook row missing
apiDomain would verify against the wrong JWKS and reject legitimate events. When
apiDomain is absent, resolve it from the OAuth credential's __zoho_domain__ scope
marker (mirroring deleteSubscription). The persisted-apiDomain fast path stays
DB-free to respect the 5s delivery deadline. Adds tests for both paths.

Author: mzxchandra

apps/sim/lib/webhooks/providers/zoho-desk.test.ts

@@ -41,6 +41,10 @@ describe('zohoDeskHandler', () => {
   })
 
   describe('verifyAuth', () => {
+    afterEach(() => {
+      vi.mocked(getCredentialOwner).mockReset()
+    })
+
     it('rejects requests without the X-ZDesk-JWT header', async () => {
       const result = await zohoDeskHandler.verifyAuth?.(
         // biome-ignore lint/suspicious/noExplicitAny: minimal context for the header-only path
@@ -49,6 +53,33 @@ describe('zohoDeskHandler', () => {
       expect(result).not.toBeNull()
       expect(result?.status).toBe(401)
     })
+
+    it('falls back to the credential Desk domain when the webhook row has no apiDomain', async () => {
+      vi.mocked(getCredentialOwner).mockResolvedValue({
+        accountId: 'acct-1',
+        userId: 'u1',
+        // biome-ignore lint/suspicious/noExplicitAny: partial owner shape is enough for this path
+      } as any)
+      await zohoDeskHandler.verifyAuth?.(
+        makeAuthContext(
+          { 'x-zdesk-jwt': 'not-a-real-jwt' },
+          { orgId: '1', externalId: '2', credentialId: 'cred-1' }
+          // biome-ignore lint/suspicious/noExplicitAny: minimal context for the fallback path
+        ) as any
+      )
+      expect(getCredentialOwner).toHaveBeenCalledWith('cred-1', 'test')
+    })
+
+    it('uses the persisted apiDomain without a credential lookup (fast path)', async () => {
+      await zohoDeskHandler.verifyAuth?.(
+        makeAuthContext(
+          { 'x-zdesk-jwt': 'not-a-real-jwt' },
+          { orgId: '1', externalId: '2', credentialId: 'cred-1', apiDomain: 'https://desk.zoho.eu' }
+          // biome-ignore lint/suspicious/noExplicitAny: minimal context for the fast path
+        ) as any
+      )
+      expect(getCredentialOwner).not.toHaveBeenCalled()
+    })
   })
 
   describe('createSubscription', () => {

apps/sim/lib/webhooks/providers/zoho-desk.ts

@@ -313,10 +313,22 @@ export const zohoDeskHandler: WebhookProviderHandler = {
       return new NextResponse('Unauthorized - webhook not fully provisioned', { status: 401 })
     }
 
-    const apiDomain =
-      typeof providerConfig.apiDomain === 'string'
+    // Prefer the apiDomain persisted on the webhook row (fast path, no DB hit on
+    // the 5s-deadline verification path). Only when it is absent - older rows, or
+    // a config that never captured it - fall back to the Desk base stored on the
+    // OAuth credential (`__zoho_domain__` scope marker), mirroring
+    // deleteSubscription, so a non-US org verifies against its own JWKS rather
+    // than defaulting to the US host and rejecting legitimate events.
+    let apiDomain =
+      typeof providerConfig.apiDomain === 'string' && providerConfig.apiDomain
         ? providerConfig.apiDomain
-        : DEFAULT_ZOHO_DESK_BASE
+        : ''
+    if (!apiDomain) {
+      const credentialId =
+        typeof providerConfig.credentialId === 'string' ? providerConfig.credentialId : undefined
+      const owner = credentialId ? await getCredentialOwner(credentialId, requestId) : null
+      apiDomain = owner ? await resolveZohoDeskApiDomain(owner.accountId) : DEFAULT_ZOHO_DESK_BASE
+    }
 
     let deskHost: string
     try {