feat(workday): block + tools + misc fixes

[icecrasher321]

Summary

Tools related to employee onboarding

Type of Change

• New feature

Testing

To be tested in staging env

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Mar 19, 2026 5:23am

[cursor]

PR Summary

High Risk
High risk due to introducing new Workday SOAP endpoints/tools that handle tenant credentials and trigger HR business processes (hire, terminate, job change), plus changes to local file path resolution used by file serving.

Overview
Adds a new Workday integration: internal-authenticated /api/tools/workday/* routes (SOAP-backed via new soap dependency) plus corresponding tool configs and a new WorkdayBlock surfaced in the block and tool registries.

Updates local file handling by making findLocalFile async, switching it to resolve only within UPLOAD_DIR_SERVER, and updating serve routes + path traversal tests accordingly; also changes default unnamed upload filenames to untitled.md and tweaks the workspace files UI to avoid a preview-mode effect depending on the files array identity.

^{Written by Cursor Bugbot for commit e74a668. Configure here.}

[greptile-apps]

Greptile Summary

This PR introduces a new Workday block and 10 HRIS tool integrations (get worker, list workers, create pre-hire, hire employee, update worker, assign onboarding, get organizations, change job, get compensation, terminate worker) using the soap npm package to communicate with Workday's SOAP APIs. It follows the same tool-route-block pattern used by other integrations in the codebase.

Key issues found:

• Create Pre-Hire: empty last name crashes Workday — Single-word names (e.g., "Madonna") produce an empty lastName, which Workday rejects at the SOAP layer. Input should be validated before the API call.
• Create Pre-Hire: hardcoded country 'US' — The Country_Reference is always 'US', making the tool unusable for non-US tenants.
• Get Compensation: raw SOAP data passthrough — compensationPlans is built with { ...p }, returning opaque Workday SOAP fields instead of the structured { id, planName, amount, currency, frequency } documented by the type definitions.
• Block: unhandled JSON.parse in update_worker params — Invalid JSON in the Fields block will throw an uncaught SyntaxError and crash the workflow executor.
• Icon: static SVG clipPath id — id='workday-clip' is hardcoded; rendering multiple WorkdayIcon instances on one page produces duplicate DOM ids and breaks the clipping mask on all but the first instance.

Confidence Score: 2/5

• This PR has multiple functional bugs that will cause runtime failures in the staging environment before they can be validated.
• Three P1 logic bugs are present: an empty lastName will cause SOAP faults in create-prehire, the get-compensation response returns raw unstructured SOAP data instead of the typed interface, and an unhandled JSON.parse exception will crash the workflow executor for update_worker. These are not edge-case issues — they will be hit in normal usage. The previous review thread also noted a wrong SOAP reference type in assign-onboarding that has not been addressed.
• apps/sim/app/api/tools/workday/create-prehire/route.ts, apps/sim/app/api/tools/workday/get-compensation/route.ts, and apps/sim/blocks/blocks/workday.ts need attention before merging.

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/workday/create-prehire/route.ts	Two issues: empty lastName will cause a Workday SOAP fault for single-word names, and country is hardcoded to 'US' preventing international use.
apps/sim/app/api/tools/workday/get-compensation/route.ts	Compensation plan data is returned as raw SOAP objects via { ...p } spread rather than being mapped to the documented typed structure (id, planName, amount, currency, frequency).
apps/sim/blocks/blocks/workday.ts	Well-structured block config for 10 Workday operations. JSON.parse in the params function lacks a try/catch, which will crash workflow execution on malformed JSON input.
apps/sim/components/icons.tsx	Adds WorkdayIcon SVG component, but uses a static id='workday-clip' for the clipPath which breaks when multiple icons are rendered on the same page.
apps/sim/tools/workday/soap.ts	Core SOAP client utility with buildWsdlUrl, createWorkdaySoapClient, wdRef, and extractRefId. Clean implementation; WSDL is fetched on every request (no caching), which may impact latency.
apps/sim/app/api/tools/workday/assign-onboarding/route.ts	Implements onboarding plan assignment via SOAP. The Action_Event_Reference uses Background_Check_ID as its type (previously flagged), which will likely cause SOAP faults.
apps/sim/app/api/tools/workday/hire/route.ts	Hires an employee from a pre-hire record. Both workerId and employeeId in the response are extracted from the same employeeRef, which is intentional but worth noting they will always be identical.
apps/sim/app/api/tools/workday/terminate/route.ts	Triggers the Workday Terminate Employee business process. Clean implementation with sensible defaults for optional fields.
apps/sim/tools/workday/types.ts	Defines all Workday tool parameter and response interfaces. Clean and well-organized; the WorkdayGetCompensationResponse output type won't match actual API output due to the raw passthrough issue.
apps/sim/app/api/tools/workday/change-job/route.ts	Handles job change (transfer, promotion, etc.) via Workday Staffing SOAP. No validation that at least one optional change field is provided alongside the mandatory reason.

Sequence Diagram

sequenceDiagram
    participant UI as Sim Block UI
    participant API as Next.js API Route
    participant SOAP as soap.createClientAsync
    participant WD as Workday SOAP API

    UI->>API: POST /api/tools/workday/{operation}
    API->>API: checkInternalAuth()
    API->>API: RequestSchema.parse(body)
    API->>SOAP: createWorkdaySoapClient(tenantUrl, tenant, service, user, pass)
    SOAP->>WD: GET {tenantUrl}/ccx/service/{tenant}/{svc}/{version}?wsdl
    WD-->>SOAP: WSDL XML
    SOAP-->>API: WorkdayClient (with BasicAuth)

    alt create_prehire
        API->>WD: Put_ApplicantAsync(Applicant_Data)
        WD-->>API: Applicant_Reference
        API-->>UI: { preHireId, descriptor }
    else hire_employee
        API->>WD: Hire_EmployeeAsync(Hire_Employee_Data)
        WD-->>API: Employee_Reference, Event_Reference
        API-->>UI: { workerId, employeeId, eventId, hireDate }
    else assign_onboarding
        API->>WD: Put_Onboarding_Plan_AssignmentAsync(Assignment_Data)
        WD-->>API: Onboarding_Plan_Assignment_Reference
        API-->>UI: { assignmentId, workerId, planId }
    else terminate_worker
        API->>WD: Terminate_EmployeeAsync(Terminate_Employee_Data)
        WD-->>API: Event_Reference
        API-->>UI: { eventId, workerId, terminationDate }
    else get_compensation
        API->>WD: Get_WorkersAsync(Include_Compensation: true)
        WD-->>API: Worker with Compensation_Plan_Assignment[]
        API-->>UI: { compensationPlans } (raw SOAP data)
    end

Loading

_{Last reviewed commit: "more type fixes"}

[icecrasher321]

bugbot run

[icecrasher321]

bugbot run

[icecrasher321]

bugbot run

[icecrasher321]

@greptile

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

[icecrasher321]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

[icecrasher321]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}