fix(zoho-desk): stop duplicating /api/v1 when resolving a relative attachment href

A relative attachment href that already starts with `api/v1` (as Zoho's hrefs
often do) was concatenated onto getZohoDeskApiBase (which ends in /api/v1),
producing `/api/v1/api/v1/...` and a failing download. Extract a tested
resolveZohoAttachmentUrl helper that uses absolute hrefs as-is and strips a
leading slash + `api/v1/` prefix from relative ones before joining, so the path
is correct for absolute, root-relative, and api/v1-prefixed hrefs alike.

Author: mzxchandra

apps/sim/app/api/tools/zoho_desk/attachment/route.ts

@@ -10,6 +10,7 @@ import {
   buildZohoDeskHeaders,
   deriveAttachmentName,
   getZohoDeskApiBase,
+  resolveZohoAttachmentUrl,
 } from '@/tools/zoho_desk/utils'
 
 export const dynamic = 'force-dynamic'
@@ -64,11 +65,10 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
   let downloadUrl: URL
   try {
-    downloadUrl = href.startsWith('http')
-      ? new URL(href)
-      : new URL(
-          `${getZohoDeskApiBase({ apiDomain: apiDomain ?? undefined })}/${href.replace(/^\/+/, '')}`
-        )
+    downloadUrl = resolveZohoAttachmentUrl(
+      href,
+      getZohoDeskApiBase({ apiDomain: apiDomain ?? undefined })
+    )
   } catch {
     return NextResponse.json({ success: false, error: 'Invalid attachment href' }, { status: 400 })
   }

apps/sim/tools/zoho_desk/utils.test.ts

@@ -9,6 +9,7 @@ import {
   deriveZohoContentText,
   getZohoDeskApiBase,
   getZohoDeskErrorMessage,
+  resolveZohoAttachmentUrl,
   withDerivedContentText,
 } from '@/tools/zoho_desk/utils'
 
@@ -92,6 +93,34 @@ describe('zoho desk tool utils', () => {
     })
   })
 
+  describe('resolveZohoAttachmentUrl', () => {
+    const apiBase = 'https://desk.zoho.com/api/v1'
+
+    it('uses an absolute http(s) href as-is', () => {
+      expect(
+        resolveZohoAttachmentUrl('https://desk.zoho.eu/api/v1/tickets/1/x/content', apiBase).href
+      ).toBe('https://desk.zoho.eu/api/v1/tickets/1/x/content')
+    })
+
+    it('does not duplicate /api/v1 when the relative href already includes it', () => {
+      expect(
+        resolveZohoAttachmentUrl('/api/v1/tickets/1/attachments/2/content', apiBase).href
+      ).toBe('https://desk.zoho.com/api/v1/tickets/1/attachments/2/content')
+      expect(resolveZohoAttachmentUrl('api/v1/tickets/1/attachments/2/content', apiBase).href).toBe(
+        'https://desk.zoho.com/api/v1/tickets/1/attachments/2/content'
+      )
+    })
+
+    it('resolves a relative href without an api/v1 prefix against the api base', () => {
+      expect(resolveZohoAttachmentUrl('/tickets/1/x/content', apiBase).href).toBe(
+        'https://desk.zoho.com/api/v1/tickets/1/x/content'
+      )
+      expect(resolveZohoAttachmentUrl('tickets/1/x/content', apiBase).href).toBe(
+        'https://desk.zoho.com/api/v1/tickets/1/x/content'
+      )
+    })
+  })
+
   describe('convertZohoHtmlToText', () => {
     it('strips HTML tags to readable plain text', () => {
       const html = '<div style="direction: ltr; font-size: 13px;"><div>testing</div></div>'

apps/sim/tools/zoho_desk/utils.ts

@@ -62,6 +62,20 @@ export function getZohoDeskApiBase(params: Pick<ZohoDeskBaseParams, 'apiDomain'>
   return `${base}/api/v1`
 }
 
+/**
+ * Resolve an attachment `href` into an absolute download URL. Absolute hrefs are
+ * used as-is; a relative href is resolved against the Desk API base (`apiBase`,
+ * which ends in `/api/v1`). A leading slash and an already-present `api/v1/`
+ * prefix are stripped first so a Zoho href like `/api/v1/tickets/1/.../content`
+ * does not produce a duplicated `/api/v1/api/v1/...` path. Throws on an
+ * unparseable result (the caller maps that to a 400).
+ */
+export function resolveZohoAttachmentUrl(href: string, apiBase: string): URL {
+  if (/^https?:\/\//i.test(href)) return new URL(href)
+  const path = href.replace(/^\/+/, '').replace(/^api\/v1\//i, '')
+  return new URL(`${apiBase.replace(/\/+$/, '')}/${path}`)
+}
+
 /** Build the auth + org headers required on every Zoho Desk API call. */
 export function buildZohoDeskHeaders(
   params: Pick<ZohoDeskBaseParams, 'accessToken' | 'orgId'>