fix: preserve JSON types when extracting integration variables

[Copilot]

When extracting JSON body values in integrations, all values were converted to strings via fmt.Sprintf("%v", val), causing JSON objects to be passed as Go's internal representation (map[id:2 name:test]) instead of proper JSON structures.

Changes

• api/integration.go: Changed Extract return type from map[string]string to map[string]any, dropping the fmt.Sprintf("%v", val) coercion so gojsonq values are passed through as native Go types — objects as map[string]interface{}, arrays as []interface{}, numbers as float64, booleans as bool
• api/integration_test.go: Updated type assertions to match correct native types; added TestExtract_JSONBody_ObjectPreservedAsMap and TestGetTaskDefinition_JSONObjectInEnv covering the reported scenario end-to-end

Before / After

# Payload: {"data":{"id":2,"name":"test"}}

# Before — Ansible sees a string
ok: [localhost] => data: map[id:2 name:test]

# After — Ansible sees a proper dict
ok: [localhost] => data:
    id: 2
    name: test

[cursor]

Security review (automation)

Scope: api/integration.go change to Extract return type map[string]any and preserve native JSON values from gojsonq instead of fmt.Sprintf("%v", val); related tests.

Prior threads: Cleaned up previous automation review artifacts; re-validated against the current diff.

Findings: None at medium or higher confidence.

Rationale (summary): Webhook payload is still only accepted after the integration’s configured auth (HMAC, token, basic, or none) and optional matchers. The change only alters how parsed JSON is represented when merging into task environment (json.Marshal/Unmarshal) and task params (ExtractParams marshals Params then json.Unmarshal into typed structs). Nested maps/slices are handled by encoding/json as before for env merging; scalars now round-trip as JSON booleans/numbers instead of strings, which avoids json.Unmarshal failures into typed task-param structs rather than introducing a new trust boundary.

---

Slack summary: PR #3820 security pass — no medium/high/critical issues. Integration webhook extraction now keeps native JSON types for env/task params; auth model unchanged; no new injection or authz bypass identified in the diff.

  

_{Sent by Cursor Automation: Find vulnerabilities}