Merge remote-tracking branch 'origin/staging' into fix/release-audit-hardening

Author: waleedlatif1

apps/docs/content/docs/search/gitlab.mdx

@@ -91,7 +91,7 @@ To rotate the PAT, supply its replacement in source settings. A blank token reta
 
 After an admin configures a source in **Non-admin token** mode, a job can [read its revision](/api-reference/organizations/getSearchSourcePermissions) and [replace both CSVs](/api-reference/organizations/replaceSearchSourcePermissions). Copy `SIM_ORG_ID` and `SIM_SOURCE_ID` from the source settings URL: `/o/<organizationId>/settings/integrations/sources/<sourceId>`. Set `SIM_BASE_URL` to your Sim origin (for hosted Sim, `https://www.sim.ai`).
 
-Store an organization admin's [personal Sim API key](/api-reference/authentication) as a [masked, protected GitLab CI variable](https://docs.gitlab.com/ci/variables/) named `SIM_API_KEY`. A personal key inherits its owner's access. This endpoint can only read the revision or replace both CSVs; it cannot change the GitLab PAT, host, or project.
+Store an organization admin's [personal Sim API key](/api-reference/authentication) with [**Full access**](/api-reference/authentication#key-access) as a [masked, protected GitLab CI variable](https://docs.gitlab.com/ci/variables/) named `SIM_API_KEY`. A personal key inherits its owner's access; a read-only key can read the revision but not replace the CSVs. This endpoint can only read the revision or replace both CSVs; it cannot change the GitLab PAT, host, or project.
 
 This example runs on a schedule against a protected branch. Replace `./ci/export-gitlab-permissions` with your existing export command. It must write a fresh, complete `users.csv` and `project-permissions.csv` and exit nonzero if it cannot finish.
 

apps/sim/app/api/cli/auth/poll/route.ts

@@ -3,6 +3,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { pollCliAuthContract } from '@/lib/api/contracts'
 import { parseRequest } from '@/lib/api/server'
 import {
+  apiKeyCreationErrorStatus,
   performCreatePersonalApiKey,
   performCreateWorkspaceApiKey,
 } from '@/lib/api-key/orchestration'
@@ -83,7 +84,7 @@ async function mintForGrant(
   if (!result.success || !result.key) {
     return {
       ok: false,
-      status: result.errorCode === 'conflict' ? 409 : 500,
+      status: apiKeyCreationErrorStatus(result.errorCode),
       message: result.error ?? 'Failed to generate API key',
     }
   }

apps/sim/app/api/resume/[workflowId]/[executionId]/[contextId]/route.ts

@@ -160,7 +160,7 @@ export const GET = withRouteHandler(
     }
   ) => {
     const { workflowId: requestedWorkflowId } = await context.params
-    const access = await validateWorkflowAccess(request, requestedWorkflowId, false)
+    const access = await validateWorkflowAccess(request, requestedWorkflowId)
     if (access.error) {
       return NextResponse.json({ error: access.error.message }, { status: access.error.status })
     }

apps/sim/app/api/v2/workspaces/[workspaceId]/members/[userId]/route.ts

@@ -1,9 +1,11 @@
+import { isUserCredentialPrincipal } from '@sim/auth/principal'
 import {
   v2RemoveWorkspaceMemberContract,
   v2UpdateWorkspaceMemberContract,
 } from '@/lib/api/contracts/v2/workspaces'
 import { defineV2JsonRoute, v2ApiKeyAuth, v2RateLimits } from '@/lib/api/server/routes'
 import { presentWorkspaceMember } from '@/lib/api/server/workspace-presenters'
+import { captureServerEvent } from '@/lib/posthog/server'
 import { v2WorkspaceErrorPolicies } from '@/lib/workspaces/api/route-policies'
 import { updateWorkspaceMember } from '@/lib/workspaces/application/manage-permissions'
 import {
@@ -22,6 +24,17 @@ export const PATCH = defineV2JsonRoute({
   mapInput: ({ params, body }) => ({ ...params, ...body }),
   useCase: updateWorkspaceMember,
   present: ({ member }) => ({ data: presentWorkspaceMember(member) }),
+  onSuccess: ({ principal, input, result }) => {
+    if (!isUserCredentialPrincipal(principal)) return
+    for (const change of result.changes) {
+      captureServerEvent(
+        principal.userId,
+        'workspace_member_role_changed',
+        { workspace_id: input.workspaceId, new_role: change.newRole },
+        { groups: { workspace: input.workspaceId } }
+      )
+    }
+  },
 })
 
 /** DELETE /api/v2/workspaces/[workspaceId]/members/[userId] — Remove a member, or leave. */
@@ -40,4 +53,13 @@ export const DELETE = defineV2JsonRoute({
       organizationMembershipRemoved: result.organizationRemoval,
     },
   }),
+  onSuccess: ({ principal, input, result }) => {
+    if (!isUserCredentialPrincipal(principal)) return
+    captureServerEvent(
+      principal.userId,
+      'workspace_member_removed',
+      { workspace_id: input.workspaceId, is_self_removal: result.selfRemoval },
+      { groups: { workspace: input.workspaceId } }
+    )
+  },
 })

apps/sim/app/api/workflows/[id]/executions/[executionId]/route.ts

@@ -23,7 +23,7 @@ export const GET = withRouteHandler(
     const { id: workflowId, executionId } = parsed.data.params
     const { includeOutput, selectedOutputs } = parsed.data.query
 
-    const access = await validateWorkflowAccess(request, workflowId, false)
+    const access = await validateWorkflowAccess(request, workflowId)
     if (access.error) {
       return NextResponse.json({ error: access.error.message }, { status: access.error.status })
     }

apps/sim/app/api/workflows/[id]/paused/route.ts

@@ -14,7 +14,7 @@ export const GET = withRouteHandler(
     if (!parsed.success) return parsed.response
     const { id: workflowId } = parsed.data.params
 
-    const access = await validateWorkflowAccess(request, workflowId, false)
+    const access = await validateWorkflowAccess(request, workflowId)
     if (access.error) {
       return NextResponse.json({ error: access.error.message }, { status: access.error.status })
     }

apps/sim/app/api/workflows/middleware.test.ts

@@ -1,6 +1,6 @@
 /**
  * Tests for workflow access middleware — focused on the workspace-scoped
- * API key boundary check in the `requireDeployment=false` branch.
+ * API key boundary check.
  */
 
 import {
@@ -13,10 +13,6 @@ import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@/lib/workflows/utils', () => workflowsUtilsMock)
-vi.mock('@/lib/api-key/service', () => ({
-  authenticateApiKeyFromHeader: vi.fn(),
-  updateApiKeyLastUsed: vi.fn(),
-}))
 
 import { WORKSPACE_KEY_SCOPE_DENIED } from '@/lib/api-key/policy-messages'
 import { validateWorkflowAccess } from '@/app/api/workflows/middleware'
@@ -25,7 +21,7 @@ function makeRequest() {
   return new NextRequest(new URL('https://example.com/api/workflows/wf-1'))
 }
 
-describe('validateWorkflowAccess (requireDeployment=false)', () => {
+describe('validateWorkflowAccess', () => {
   beforeEach(() => {
     workflowsUtilsMockFns.mockGetWorkflowById.mockResolvedValue({
       id: 'wf-1',
@@ -48,7 +44,7 @@ describe('validateWorkflowAccess (requireDeployment=false)', () => {
       workspaceId: 'ws-B',
     })
 
-    const result = await validateWorkflowAccess(makeRequest(), 'wf-1', false)
+    const result = await validateWorkflowAccess(makeRequest(), 'wf-1')
 
     expect(result.error).toEqual({
       message: WORKSPACE_KEY_SCOPE_DENIED,
@@ -70,7 +66,7 @@ describe('validateWorkflowAccess (requireDeployment=false)', () => {
       message: 'Access denied',
     })
 
-    const result = await validateWorkflowAccess(makeRequest(), 'wf-1', false)
+    const result = await validateWorkflowAccess(makeRequest(), 'wf-1')
 
     expect(result.error).toEqual({ message: 'Access denied', status: 403 })
   })

apps/sim/app/api/workflows/middleware.ts

@@ -2,11 +2,6 @@ import { createLogger } from '@sim/logger'
 import { authorizeWorkflowByWorkspacePermission } from '@sim/platform-authz/workflow'
 import type { NextRequest } from 'next/server'
 import { WORKSPACE_KEY_SCOPE_DENIED } from '@/lib/api-key/policy-messages'
-import {
-  type ApiKeyAuthResult,
-  authenticateApiKeyFromHeader,
-  updateApiKeyLastUsed,
-} from '@/lib/api-key/service'
 import { type AuthResult, checkHybridAuth } from '@/lib/auth/hybrid'
 import { getWorkflowById } from '@/lib/workflows/utils'
 
@@ -20,8 +15,7 @@ export interface ValidationResult {
 
 export async function validateWorkflowAccess(
   request: NextRequest,
-  workflowId: string,
-  requireDeployment = true
+  workflowId: string
 ): Promise<ValidationResult> {
   try {
     const workflow = await getWorkflowById(workflowId)
@@ -44,95 +38,40 @@ export async function validateWorkflowAccess(
       }
     }
 
-    if (!requireDeployment) {
-      const auth = await checkHybridAuth(request, { requireWorkflowId: false })
-      if (!auth.success || !auth.userId) {
-        return {
-          error: {
-            message: auth.error || 'Unauthorized',
-            status: 401,
-          },
-        }
-      }
-
-      if (auth.apiKeyType === 'workspace' && auth.workspaceId !== workflow.workspaceId) {
-        return {
-          error: {
-            message: WORKSPACE_KEY_SCOPE_DENIED,
-            status: 403,
-          },
-        }
-      }
-
-      const authorization = await authorizeWorkflowByWorkspacePermission({
-        workflowId,
-        userId: auth.userId,
-        action: 'read',
-      })
-      if (!authorization.allowed) {
-        return {
-          error: {
-            message: authorization.message || 'Access denied',
-            status: authorization.status,
-          },
-        }
+    const auth = await checkHybridAuth(request, { requireWorkflowId: false })
+    if (!auth.success || !auth.userId) {
+      return {
+        error: {
+          message: auth.error || 'Unauthorized',
+          status: 401,
+        },
       }
-
-      return { workflow, auth }
     }
 
-    if (requireDeployment) {
-      if (!workflow.isDeployed) {
-        return {
-          error: {
-            message: 'Workflow is not deployed',
-            status: 403,
-          },
-        }
-      }
-
-      let apiKeyHeader = null
-      for (const [key, value] of request.headers.entries()) {
-        if (key.toLowerCase() === 'x-api-key' && value) {
-          apiKeyHeader = value
-          break
-        }
-      }
-
-      if (!apiKeyHeader) {
-        return {
-          error: {
-            message: 'Unauthorized: API key required',
-            status: 401,
-          },
-        }
-      }
-
-      let validResult: ApiKeyAuthResult | null = null
-
-      const workspaceResult = await authenticateApiKeyFromHeader(apiKeyHeader, {
-        workspaceId: workflow.workspaceId as string,
-        keyTypes: ['workspace', 'personal'],
-      })
-
-      if (workspaceResult.success) {
-        validResult = workspaceResult
-      }
-
-      if (!validResult) {
-        return {
-          error: {
-            message: 'Unauthorized: Invalid API key',
-            status: 401,
-          },
-        }
+    if (auth.apiKeyType === 'workspace' && auth.workspaceId !== workflow.workspaceId) {
+      return {
+        error: {
+          message: WORKSPACE_KEY_SCOPE_DENIED,
+          status: 403,
+        },
       }
+    }
 
-      if (validResult.keyId) {
-        updateApiKeyLastUsed(validResult.keyId)
+    const authorization = await authorizeWorkflowByWorkspacePermission({
+      workflowId,
+      userId: auth.userId,
+      action: 'read',
+    })
+    if (!authorization.allowed) {
+      return {
+        error: {
+          message: authorization.message || 'Access denied',
+          status: authorization.status,
+        },
       }
     }
-    return { workflow }
+
+    return { workflow, auth }
   } catch (error) {
     logger.error('Validation error:', { error })
     return {

apps/sim/background/workflow-execution.ts

@@ -286,7 +286,8 @@ export async function executeWorkflowJob(
         /**
          * The version this run executes, loaded once: the core runs this same version's
          * blocks, so a deploy landing mid-setup cannot pair one version's variables with
-         * another's graph.
+         * another's graph. A pinned version runs with only its own snapshot, as a sync run
+         * of it does, never the editor's current variables.
          */
         const pinnedDeploymentVersionId = payload.pinnedDeploymentVersionId
         const deployedState = await withDatabaseReadRetry(
@@ -328,7 +329,9 @@ export async function executeWorkflowJob(
           metadata,
           workflow,
           payload.input,
-          resolveDeployedRunVariables(deployedState, workflow.variables),
+          pinnedDeploymentVersionId
+            ? (deployedState.variables ?? {})
+            : resolveDeployedRunVariables(deployedState, workflow.variables),
           []
         )
 

apps/sim/lib/integrations/credential-display.ts

@@ -22,6 +22,7 @@ import { CANONICAL_SERVICE_ACCOUNT_SLUGS } from '@/lib/integrations/oauth-servic
 import { OAUTH_PROVIDERS } from '@/lib/oauth/oauth'
 import type { OAuthProvider, OAuthServiceConfig } from '@/lib/oauth/types'
 import { getServiceConfigByProviderId, parseProvider } from '@/lib/oauth/utils'
+import { resolveAccessControlBlockType } from '@/lib/permission-groups/integration-allowlist'
 
 /**
  * Above this many covered integrations the subtitle states a count instead of
@@ -226,7 +227,7 @@ export function resolveCredentialDisplay(credential: DisplayableCredential): Cre
     return {
       service: null,
       integration,
-      blockType: 'gitlab',
+      blockType: resolveAccessControlBlockType('gitlab'),
       icon: GitlabIcon,
       familyName: null,
       coveredIntegrations: integration ? [integration] : [],