fix(triggers): v2 reports only triggers that run, restore executor PATCH, switch all or nothing

The v2 list and block target require the active version of a deployed
workflow for both tables, since webhook processing refuses a versionless or
undeployed row; the legacy row-id routes keep the editor's view. PATCH
/api/webhooks/[id] admits a workflow run's executor delegation again, and
setTriggerEnabled admits the executor service. A multi-row switch rolls back
entirely when any row was retired or switched concurrently, so a conflict
commits nothing. Adds the two new CLI fences to the docs content baseline.

Author: waleedlatif1

apps/docs/scripts/fixtures/content-baseline.json

@@ -12986,6 +12986,20 @@
           "bytes": 28,
           "line": 8128
         },
+        {
+          "lang": "bash",
+          "meta": null,
+          "sha256": "7579bd6ac197afa0afa5f62d9b412a7e265725bd507c1c63b438a60fd72ce1d0",
+          "bytes": 40,
+          "line": 8235
+        },
+        {
+          "lang": "bash",
+          "meta": null,
+          "sha256": "63aac11606dc0eeb6cc452c20c405806840960425372cf2cf7c8b4b90a7de878",
+          "bytes": 62,
+          "line": 8255
+        },
         {
           "lang": "bash",
           "meta": null,
@@ -17159,6 +17173,20 @@
           "bytes": 54,
           "line": 404
         },
+        {
+          "lang": "bash",
+          "meta": null,
+          "sha256": "7579bd6ac197afa0afa5f62d9b412a7e265725bd507c1c63b438a60fd72ce1d0",
+          "bytes": 40,
+          "line": 436
+        },
+        {
+          "lang": "bash",
+          "meta": null,
+          "sha256": "63aac11606dc0eeb6cc452c20c405806840960425372cf2cf7c8b4b90a7de878",
+          "bytes": 62,
+          "line": 454
+        },
         {
           "lang": "bash",
           "meta": null,

apps/sim/app/api/webhooks/[id]/route.ts

@@ -23,7 +23,6 @@ import {
   internalErrorResponse,
   internalOrchestrationErrorPolicy,
   internalRateLimits,
-  internalSessionAuth,
 } from '@/lib/api/server/routes'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { InsufficientWorkspacePermissionsError } from '@/lib/core/application'
@@ -32,6 +31,7 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { cleanupExternalWebhook } from '@/lib/webhooks/provider-subscriptions'
+import { internalWorkflowSessionOrExecutorAuth } from '@/lib/workflows/api'
 import { workflowOperations } from '@/lib/workflows/application/operations'
 import { setWorkflowTriggerEnabled } from '@/lib/workflows/application/triggers'
 
@@ -103,10 +103,12 @@ export const GET = withRouteHandler(
  * `triggers.webhook` gate on re-enabling. The id must name the live
  * deployment's row: a candidate, retired, or older-version registration answers
  * 404 instead of being revived.
+ * Admits a session or a workflow run's executor delegation; the executor is not
+ * judged against the triggering member's permission group.
  */
 export const PATCH = defineInternalJsonRoute({
   contract: updateWebhookContract,
-  auth: internalSessionAuth,
+  auth: internalWorkflowSessionOrExecutorAuth,
   operation: workflowOperations.setTriggerEnabled,
   rateLimit: internalRateLimits.none({
     reason: 'Webhook enablement retains its existing session admission policy.',

apps/sim/lib/workflows/application/operations.ts

@@ -22,6 +22,18 @@ const WORKFLOW_READ_PRINCIPAL_POLICY = {
   delegatedServices: ['copilot', 'executor'],
 } as const
 
+/** Every caller, including a workflow run's executor delegation. */
+const EXECUTOR_REACHABLE_WORKFLOW_PRINCIPAL_POLICY = {
+  principalKinds: [
+    'session',
+    'personal_api_key',
+    'oauth_access_token',
+    'workspace_api_key',
+    'delegated',
+  ],
+  delegatedServices: ['copilot', 'executor'],
+} as const
+
 const HUMAN_WORKFLOW_PRINCIPAL_POLICY = {
   principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'delegated'],
   delegatedServices: ['copilot'],
@@ -356,6 +368,8 @@ export const workflowOperations = {
    * Pausing or resuming one trigger of the live deployment. Not a deploy: the
    * deployed graph and its provider registrations are untouched, so it is a
    * write rather than an admin act, and a workspace key may perform it.
+   * A workflow run's executor delegation may too, as it could before this
+   * moved onto the use case.
    *
    * permission-group-exempt: `triggers.webhook` is asserted inside the use case and only for enabling a webhook-table row, because a group that withholds inbound webhooks must still let a member switch a live one off
    */
@@ -366,7 +380,7 @@ export const workflowOperations = {
     workspaceApiKey: 'allow',
     capability: 'none',
     contentDelivery: 'none',
-    ...ALL_WORKFLOW_PRINCIPAL_POLICY,
+    ...EXECUTOR_REACHABLE_WORKFLOW_PRINCIPAL_POLICY,
   }),
   activateVersion: defineWorkspaceOperation({
     id: 'workflows.versions.activate',

apps/sim/lib/workflows/application/triggers.integration.ts

@@ -19,6 +19,7 @@ import {
 import { deleteWorkspaceFixture, insertWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
 import { createLogger } from '@sim/logger'
 import {
+  createExecutorPrincipal,
   createSessionPrincipal,
   createWorkspaceApiKeyPrincipal,
 } from '@sim/testing/factories/principal.factory'
@@ -29,6 +30,7 @@ import { and, eq, inArray } from 'drizzle-orm'
 import { afterAll, beforeAll, expect, it, vi } from 'vitest'
 import { markWebhookFailed } from '@/lib/webhooks/polling/utils'
 import { v2WorkflowErrorPolicies } from '@/lib/workflows/api'
+import { WORKFLOW_DELEGATION_AUDIENCE } from '@/lib/workflows/application/authorization'
 import {
   listWorkflowTriggers,
   setWorkflowTriggerEnabled,
@@ -72,6 +74,8 @@ const eventWebhookId = generateId()
 const twinWebhookIds = [generateId(), generateId()]
 const versionlessWebhookId = generateId()
 const scalarConfigWebhookId = generateId()
+const presaveWebhookId = generateId()
+const executorWebhookId = generateId()
 const flakyWebhookId = generateId()
 const hookPath = `trigger-health-${generateId()}`
 
@@ -400,6 +404,20 @@ beforeAll(async () => {
       path: `${hookPath}-scalar`,
       providerConfig: 'legacy-scalar-config',
     },
+    {
+      ...dormantWebhook,
+      id: presaveWebhookId,
+      workflowId: undeployedWorkflowId,
+      deploymentVersionId: null,
+      blockId: 'presave',
+      path: `${hookPath}-presave`,
+    },
+    {
+      ...dormantWebhook,
+      id: executorWebhookId,
+      blockId: 'exec',
+      path: `${hookPath}-exec`,
+    },
     {
       ...dormantWebhook,
       id: flakyWebhookId,
@@ -440,6 +458,7 @@ check('lists only the live deployment’s rows, disabled ones included', async (
     ['badcron', 'schedule', 'disabled'],
     ['done', 'schedule', 'completed'],
     ['evt', 'event', 'active'],
+    ['exec', 'webhook', 'disabled'],
     ['flaky', 'polling', 'active'],
     ['hook', 'webhook', 'disabled'],
     ['poll', 'polling', 'disabled'],
@@ -527,37 +546,54 @@ check('legacy row ids never revive a row the live deployment does not serve', as
   expect(viaRow.record.row.id).toBe(liveScheduleId)
 })
 
-check('the write itself refuses a row that is no longer live', async () => {
+check('a switch is all or nothing: one row no longer live rolls back the rest', async () => {
   const updated = await setLiveTriggersEnabled({
     workflowId,
     enabled: true,
-    schedules: [{ id: oldScheduleId, nextRunAt: new Date(Date.now() + 60_000) }],
-    webhookIds: [oldWebhookId, candidateWebhookId],
-    scheduleLiveness: 'editor',
+    schedules: [
+      { id: badCronScheduleId, nextRunAt: new Date(Date.now() + 60_000) },
+      { id: oldScheduleId, nextRunAt: new Date(Date.now() + 60_000) },
+    ],
+    webhookIds: [twinWebhookIds[1], oldWebhookId, candidateWebhookId],
+    liveness: 'editor',
     now: new Date(),
   })
-  expect(updated).toEqual([])
+  expect(updated).toBeNull()
   expect((await scheduleRow(oldScheduleId)).status).toBe('disabled')
+  expect((await scheduleRow(badCronScheduleId)).status).toBe('disabled')
+  expect((await webhookRow(twinWebhookIds[1])).isActive).toBe(false)
   expect((await webhookRow(oldWebhookId)).isActive).toBe(false)
   expect((await webhookRow(candidateWebhookId)).isActive).toBe(false)
 })
 
-check('a versionless schedule is hidden from v2 but kept for the editor row id', async () => {
-  const { triggers } = await listWorkflowTriggers.execute({
-    principal: reader,
-    input: { workflowId: versionlessWorkflowId },
-  })
-  expect(triggers.map((trigger) => [trigger.blockId, trigger.kind])).toEqual([['hook', 'webhook']])
-  await expect(
-    setWorkflowTriggerEnabled.execute({
-      principal: writer,
-      input: {
-        target: { kind: 'block', workflowId: versionlessWorkflowId, blockId: 'sched' },
-        enabled: true,
-      },
+check('rows that never run are hidden from v2 but kept for the editor row id', async () => {
+  for (const id of [versionlessWorkflowId, undeployedWorkflowId]) {
+    const { triggers } = await listWorkflowTriggers.execute({
+      principal: reader,
+      input: { workflowId: id },
     })
-  ).rejects.toMatchObject({ code: 'not_found' })
+    expect(triggers).toEqual([])
+  }
+  for (const [id, blockId] of [
+    [versionlessWorkflowId, 'sched'],
+    [versionlessWorkflowId, 'hook'],
+    [undeployedWorkflowId, 'presave'],
+  ]) {
+    await expect(
+      setWorkflowTriggerEnabled.execute({
+        principal: writer,
+        input: { target: { kind: 'block', workflowId: id, blockId }, enabled: true },
+      })
+    ).rejects.toMatchObject({ code: 'not_found' })
+  }
   expect((await scheduleRow(versionlessScheduleId)).status).toBe('disabled')
+  expect((await webhookRow(presaveWebhookId)).isActive).toBe(false)
+
+  const presave = await setWorkflowTriggerEnabled.execute({
+    principal: writer,
+    input: { target: { kind: 'row', table: 'webhook', id: presaveWebhookId }, enabled: true },
+  })
+  expect(presave.changes).toHaveLength(1)
 
   const schedule = await setWorkflowTriggerEnabled.execute({
     principal: writer,
@@ -642,6 +678,23 @@ check('read access lists but cannot write; other tenants see not found', async (
   expect((await scheduleRow(liveScheduleId)).status).toBe('active')
 })
 
+check('a workflow run’s executor delegation may enable, ungoverned by the group', async () => {
+  const executor = createExecutorPrincipal({
+    audience: WORKFLOW_DELEGATION_AUDIENCE,
+    workspaceId,
+    subjectUserId: writerId,
+    delegationContext: { kind: 'workflow_execution', workflowId },
+  })
+  await setWebhookTriggersWithheld(true)
+  try {
+    const enabled = await setBlock('exec', true, executor)
+    expect(enabled.changes).toHaveLength(1)
+    expect((await webhookRow(executorWebhookId)).isActive).toBe(true)
+  } finally {
+    await setWebhookTriggersWithheld(false)
+  }
+})
+
 check('the webhook capability gates enabling only, and only governed callers', async () => {
   await setWebhookTriggersWithheld(true)
   try {

apps/sim/lib/workflows/application/triggers.ts

@@ -21,8 +21,8 @@ import {
   isInRequestedState,
   type LiveWorkflowTriggerRecord,
   listLiveWorkflowTriggers,
-  type ScheduleLiveness,
   setLiveTriggersEnabled,
+  type TriggerLiveness,
   toWorkflowTriggerHealth,
   type WorkflowTriggerHealth,
   type WorkflowTriggerStatus,
@@ -161,10 +161,10 @@ export const setWorkflowTriggerEnabled = defineAuthorizedWorkflowUseCase({
   operation: workflowOperations.setTriggerEnabled,
   resolveContext: resolveTriggerTargetContext,
   async execute({ principal, input, context }): Promise<SetWorkflowTriggerEnabledResult> {
-    // A legacy row id keeps the versionless schedules the editor shows; a block target sees only what fires.
-    const scheduleLiveness: ScheduleLiveness = context.row ? 'editor' : 'dispatched'
-    const readLive = () => findLiveBlockTriggers({ ...context, scheduleLiveness })
-    let [, current] = await Promise.all([requireMutableWorkflow(context.workflowId), readLive()])
+    // A legacy row id keeps the rows the editor shows; a block target sees only what runs.
+    const liveness: TriggerLiveness = context.row ? 'editor' : 'running'
+    const readLive = () => findLiveBlockTriggers({ ...context, liveness })
+    const [, current] = await Promise.all([requireMutableWorkflow(context.workflowId), readLive()])
     if (current.length === 0) throw new OrchestrationError('not_found', context.notFoundMessage)
     const pending = current.filter((record) => !isInRequestedState(record, input.enabled))
     if (pending.length === 0) {
@@ -190,15 +190,17 @@ export const setWorkflowTriggerEnabled = defineAuthorizedWorkflowUseCase({
       enabled: input.enabled,
       schedules,
       webhookIds,
-      scheduleLiveness,
+      liveness,
       now: new Date(),
     })
-    if (updated.length < pending.length) {
-      current = await readLive()
-      if (current.length === 0) throw new OrchestrationError('not_found', context.notFoundMessage)
-      if (current.some((record) => !isInRequestedState(record, input.enabled))) {
+    if (!updated) {
+      // Nothing was written. Succeed only if a concurrent request already reached the requested state.
+      const latest = await readLive()
+      if (latest.length === 0) throw new OrchestrationError('not_found', context.notFoundMessage)
+      if (latest.some((record) => !isInRequestedState(record, input.enabled))) {
         throw new OrchestrationError('conflict', 'Trigger changed during the update; retry')
       }
+      return { trigger: toWorkflowTriggerHealth(latest[0]), record: latest[0], changes: [] }
     }
 
     const previousStatusById = new Map(