fix: add parseInt radix, return 403 on unauthorized log export

- bedrock provider and firecrawl block were calling Number.parseInt
  without a radix parameter which can misinterpret strings with
  leading zeros. added explicit radix 10 to both.
- logs export route was returning 200 with just CSV headers when
  access was denied — changed to return 403 so clients and monitoring
  can actually tell the request was unauthorized

Author: fix2015

apps/sim/app/api/logs/export/route.ts

@@ -75,13 +75,8 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
 
     const access = await checkWorkspaceAccess(params.workspaceId, userId)
     if (!access.hasAccess) {
-      return new NextResponse(`${header}\n`, {
-        status: 200,
-        headers: {
-          'Content-Type': 'text/csv; charset=utf-8',
-          'Content-Disposition': 'attachment; filename="logs-export.csv"',
-          'Cache-Control': 'no-cache',
-        },
+      return new NextResponse('Forbidden', {
+        status: 403,
       })
     }
 

apps/sim/blocks/blocks/firecrawl.ts

@@ -660,7 +660,7 @@ Example 2 - Product Data:
             }
             if (onlyMainContent != null) result.onlyMainContent = onlyMainContent
             if (params.maxConcurrency != null && params.maxConcurrency !== '') {
-              result.maxConcurrency = Number.parseInt(String(params.maxConcurrency))
+              result.maxConcurrency = Number.parseInt(String(params.maxConcurrency), 10)
             }
             if (params.ignoreInvalidURLs != null) {
               result.ignoreInvalidURLs = params.ignoreInvalidURLs

apps/sim/providers/bedrock/index.ts

@@ -344,7 +344,7 @@ export const bedrockProvider: ProviderConfig = {
       temperature: Number.parseFloat(String(request.temperature ?? 0.7)),
     }
     if (request.maxTokens != null) {
-      inferenceConfig.maxTokens = Number.parseInt(String(request.maxTokens))
+      inferenceConfig.maxTokens = Number.parseInt(String(request.maxTokens), 10)
     }
 
     const shouldStreamToolCalls = request.streamToolCalls ?? false