Merge remote-tracking branch 'origin/staging' into wip/platform-org-wiring

Author: waleedlatif1

apps/docs/content/docs/platform/self-hosting/networking.mdx

@@ -265,7 +265,7 @@ Most `/api` requests also pass through Next.js Proxy. The current app configurat
 
 The app makes outbound calls to model providers, integration APIs, your email provider, object storage, and your telemetry backend. Whether `HTTP_PROXY` / `HTTPS_PROXY` apply depends on which of those paths a call takes — there is no single answer, and no global setting that covers all of them.
 
-The server runs on Bun, and Bun's native `fetch` honors `$HTTP_PROXY`, `$HTTPS_PROXY`, and `$NO_PROXY`. Sim installs no global dispatcher. Default `fetch` uses the configured proxy unless `NO_PROXY` excludes the destination. The SSRF guard reads the same three variables, with the same rules, for every request it sends. The rest either build their own HTTP agent or speak a non-HTTP protocol.
+The server runs on Bun, and Bun's native `fetch` honors `$HTTP_PROXY`, `$HTTPS_PROXY`, and `$NO_PROXY`. Sim installs no global dispatcher. Default `fetch` uses the configured proxy unless `NO_PROXY` excludes the destination. The SSRF guard reads the same three variables for every request it sends, matching `NO_PROXY` the way curl does (see [Internal destinations and `NO_PROXY`](#internal-destinations-and-no_proxy)). The rest either build their own HTTP agent or speak a non-HTTP protocol.
 
 This depends on the runtime. The published images run Bun. If you build the standalone output and run it under Node instead, Node ignores these variables unless started with `NODE_USE_ENV_PROXY=1` (Node 22.21+ / 24.5+), and the `fetch`-based "Yes" rows stop being proxied — model providers, Resend, Gmail sending, the desktop update feed, and the telemetry relay. The Azure Blob, GCS and Azure Communication Services rows still hold: those SDKs read the proxy variables through their own agents rather than through `fetch`. See [Bun fetch](https://bun.sh/docs/runtime/networking/fetch) and [Node proxy configuration](https://nodejs.org/learn/http/enterprise-network-configuration).
 

apps/docs/openapi-v2-resources.json

@@ -4986,7 +4986,7 @@
                         "v2Enabled": true,
                         "keyType": "personal",
                         "expiresAt": null,
-                        "scopes": ["api:read", "api:write"]
+                        "scopes": ["api:read", "api:write", "search:read"]
                       }
                     }
                   }
@@ -18677,7 +18677,7 @@
               "v2Enabled": true,
               "keyType": "personal",
               "expiresAt": null,
-              "scopes": ["api:read", "api:write"]
+              "scopes": ["api:read", "api:write", "search:read"]
             }
           }
         ]

apps/docs/openapi-v2-workflows.json

@@ -14928,7 +14928,7 @@
                     "description": "Execute a deployed workflow version."
                   },
                   "version": {
-                    "description": "Deployment version to execute instead of the active one. Requires an API key or OAuth access token with workspace write access, and the workflow must be deployed. An unknown version returns `404`.",
+                    "description": "Deployment version to execute instead of the active one. Requires a full-access API key or an OAuth access token with `api:write`, plus workspace write access, and the workflow must be deployed. An unknown version returns `404`.",
                     "type": "integer",
                     "minimum": 1,
                     "maximum": 2147483647
@@ -15006,7 +15006,7 @@
           },
           "async": {
             "default": false,
-            "description": "Queue the run and return a 202 receipt. Requires an API key or OAuth access token and a deployed run source. Cannot stream, select outputs, enable thinking/tool events, or include file-inlining options (`includeFileBase64` or `base64MaxBytes`).",
+            "description": "Queue the run and return a 202 receipt. Requires a full-access API key or an OAuth access token with `api:write`, and a deployed run source. Cannot stream, select outputs, enable thinking/tool events, or include file-inlining options (`includeFileBase64` or `base64MaxBytes`).",
             "type": "boolean"
           },
           "executionTimeoutSeconds": {
@@ -15016,7 +15016,7 @@
             "maximum": 604800
           },
           "waitTimeoutSeconds": {
-            "description": "Wait at most this many seconds for a synchronous run; `0` waits until it settles. A run still going then continues in the background and the response carries its run receipt instead of its result: `202` on a JSON response, or a closing `detached` frame on an `application/x-ndjson` result stream, which keeps its `200`. The receipt is sent only once the run can be read on the runs resource, where it can also be cancelled. The run is admitted under asynchronous limits, and a dropped connection no longer cancels it. Requires an API key or OAuth access token. Cannot be combined with `async` or `stream`.",
+            "description": "Wait at most this many seconds for a synchronous run; `0` waits until it settles. A run still going then continues in the background and the response carries its run receipt instead of its result: `202` on a JSON response, or a closing `detached` frame on an `application/x-ndjson` result stream, which keeps its `200`. The receipt is sent only once the run can be read on the runs resource, where it can also be cancelled. The run is admitted under asynchronous limits, and a dropped connection no longer cancels it. Requires a full-access API key or an OAuth access token with `api:write`. Cannot be combined with `async` or `stream`.",
             "type": "integer",
             "minimum": 0,
             "maximum": 604800

apps/sim/lib/api-key/orchestration/index.test.ts

@@ -0,0 +1,54 @@
+import { dbChainMockFns, resetDbChainMock } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { createWorkspaceKey } = vi.hoisted(() => ({ createWorkspaceKey: vi.fn() }))
+vi.mock('@/lib/api-key/auth', () => ({
+  createApiKey: vi.fn(),
+  createWorkspaceApiKey: createWorkspaceKey,
+}))
+
+import {
+  performCreatePersonalApiKey,
+  performCreateWorkspaceApiKey,
+} from '@/lib/api-key/orchestration'
+
+const INTERNAL_DETAIL = 'connect ECONNREFUSED 10.0.0.5:5432 for role april'
+
+describe('API key creation failures', () => {
+  beforeEach(() => {
+    resetDbChainMock()
+    createWorkspaceKey.mockReset()
+  })
+
+  it('never echoes an internal personal-key failure to the caller', async () => {
+    dbChainMockFns.limit.mockRejectedValueOnce(new Error(INTERNAL_DETAIL))
+
+    const result = await performCreatePersonalApiKey({ userId: 'user-1', name: 'CLI' })
+
+    expect(result).toMatchObject({ success: false, errorCode: 'internal' })
+    expect(result.error).not.toContain('ECONNREFUSED')
+  })
+
+  it('never echoes an internal workspace-key failure, but still names a conflict', async () => {
+    createWorkspaceKey.mockRejectedValueOnce(new Error(INTERNAL_DETAIL))
+    const internal = await performCreateWorkspaceApiKey({
+      workspaceId: 'ws-1',
+      userId: 'user-1',
+      name: 'CLI',
+    })
+    expect(internal).toMatchObject({ success: false, errorCode: 'internal' })
+    expect(internal.error).not.toContain('ECONNREFUSED')
+
+    createWorkspaceKey.mockRejectedValueOnce(new Error('A key named "CLI" already exists'))
+    const conflict = await performCreateWorkspaceApiKey({
+      workspaceId: 'ws-1',
+      userId: 'user-1',
+      name: 'CLI',
+    })
+    expect(conflict).toEqual({
+      success: false,
+      errorCode: 'conflict',
+      error: 'A key named "CLI" already exists',
+    })
+  })
+})

apps/sim/lib/api-key/orchestration/index.ts

@@ -208,7 +208,8 @@ export async function performCreatePersonalApiKey(
     return { success: true, key: { ...created, key: plainKey } }
   } catch (error) {
     logger.error('Failed to create personal API key', { error })
-    return { success: false, errorCode: 'internal', error: toError(error).message }
+    // The CLI poll route is unauthenticated, so an internal failure never echoes its cause.
+    return { success: false, errorCode: 'internal', error: 'Failed to create API key' }
   }
 }
 
@@ -266,10 +267,10 @@ export async function performCreateWorkspaceApiKey(
   } catch (error) {
     const message = toError(error).message
     logger.error('Failed to create workspace API key', { error })
-    return {
-      success: false,
-      error: message,
-      errorCode: message.includes('already exists') ? 'conflict' : 'internal',
+    if (message.includes('already exists')) {
+      return { success: false, error: message, errorCode: 'conflict' }
     }
+    // The CLI poll route is unauthenticated, so an internal failure never echoes its cause.
+    return { success: false, error: 'Failed to create API key', errorCode: 'internal' }
   }
 }

apps/sim/lib/api/contracts/v2/openapi/resources.ts

@@ -1939,7 +1939,7 @@ const declaredRoutes = [
               v2Enabled: true,
               keyType: 'personal',
               expiresAt: null,
-              scopes: ['api:read', 'api:write'],
+              scopes: ['api:read', 'api:write', 'search:read'],
             },
           },
         ]

apps/sim/lib/api/contracts/v2/workflows.ts

@@ -1508,7 +1508,7 @@ export const v2WorkflowRunSelectionSchema = z.discriminatedUnion('source', [
       version: versionNumberSchema
         .optional()
         .describe(
-          'Deployment version to execute instead of the active one. Requires an API key or OAuth access token with workspace write access, and the workflow must be deployed. An unknown version returns `404`.'
+          'Deployment version to execute instead of the active one. Requires a full-access API key or an OAuth access token with `api:write`, plus workspace write access, and the workflow must be deployed. An unknown version returns `404`.'
         ),
     })
     .strict(),
@@ -1599,7 +1599,7 @@ export const v2ExecuteWorkflowBodySchema = z
       .optional()
       .default(false)
       .describe(
-        'Queue the run and return a 202 receipt. Requires an API key or OAuth access token and a deployed run source. Cannot stream, select outputs, enable thinking/tool events, or include file-inlining options (`includeFileBase64` or `base64MaxBytes`).'
+        'Queue the run and return a 202 receipt. Requires a full-access API key or an OAuth access token with `api:write`, and a deployed run source. Cannot stream, select outputs, enable thinking/tool events, or include file-inlining options (`includeFileBase64` or `base64MaxBytes`).'
       ),
     /**
      * An upper bound on the request, not the effective timeout: the server
@@ -1628,7 +1628,7 @@ export const v2ExecuteWorkflowBodySchema = z
       .max(MAX_WORKFLOW_EXECUTION_TIMEOUT_SECONDS)
       .optional()
       .describe(
-        'Wait at most this many seconds for a synchronous run; `0` waits until it settles. A run still going then continues in the background and the response carries its run receipt instead of its result: `202` on a JSON response, or a closing `detached` frame on an `application/x-ndjson` result stream, which keeps its `200`. The receipt is sent only once the run can be read on the runs resource, where it can also be cancelled. The run is admitted under asynchronous limits, and a dropped connection no longer cancels it. Requires an API key or OAuth access token. Cannot be combined with `async` or `stream`.'
+        'Wait at most this many seconds for a synchronous run; `0` waits until it settles. A run still going then continues in the background and the response carries its run receipt instead of its result: `202` on a JSON response, or a closing `detached` frame on an `application/x-ndjson` result stream, which keeps its `200`. The receipt is sent only once the run can be read on the runs resource, where it can also be cancelled. The run is admitted under asynchronous limits, and a dropped connection no longer cancels it. Requires a full-access API key or an OAuth access token with `api:write`. Cannot be combined with `async` or `stream`.'
       ),
     stream: z
       .boolean()

apps/sim/lib/api/server/routes/v2-api-key-auth.test.ts

@@ -199,6 +199,26 @@ describe('v2 API key authentication', () => {
     )
   })
 
+  it('accepts a personal key whose owner has never had a ban state recorded', async () => {
+    queueTableRows(schemaMock.apiKey, [
+      {
+        id: 'key-1',
+        userId: 'user-1',
+        workspaceId: null,
+        type: 'personal',
+        access: 'write',
+        expiresAt: null,
+        ownerUserId: 'user-1',
+        userBanned: null,
+        userSuspendedAt: null,
+      },
+    ])
+
+    const result = await authenticateV2ApiKey({ apiKey: 'secret', bearer: null })
+
+    expect(result.principal).toEqual(createPersonalApiKeyPrincipal())
+  })
+
   it('refuses a personal key whose owner row is gone as invalid, expired or not', async () => {
     for (const expiresAt of [null, new Date(Date.now() - 1)]) {
       queueTableRows(schemaMock.apiKey, [
@@ -209,6 +229,7 @@ describe('v2 API key authentication', () => {
           type: 'personal',
           access: 'write',
           expiresAt,
+          ownerUserId: null,
           userBanned: null,
           userSuspendedAt: null,
         },

apps/sim/lib/api/server/routes/v2-api-key-auth.ts

@@ -77,14 +77,16 @@ interface ApiKeyRow {
   type: string
   access: ApiKeyAccess
   expiresAt: Date | null
+  /** The joined owner's id: `null` only when the owner row is gone (`user.banned` is itself nullable). */
+  ownerUserId: string | null
   userBanned: boolean | null
   userSuspendedAt: Date | null
 }
 
 function requireValidRow(row: ApiKeyRow | undefined): ApiKeyRow {
   if (!row) throw new V2ApiKeyUnauthenticatedError()
   if (row.type === 'personal' && row.workspaceId === null) {
-    if (row.userBanned === null) {
+    if (row.ownerUserId === null) {
       logger.error('Personal API key is missing its credential owner', { keyId: row.id })
       throw new V2ApiKeyUnauthenticatedError()
     }
@@ -118,6 +120,7 @@ async function authenticateApiKey(apiKeyHeader: string): Promise<V2ApiKeyAuthCon
       type: apiKey.type,
       access: apiKey.access,
       expiresAt: apiKey.expiresAt,
+      ownerUserId: user.id,
       userBanned: user.banned,
       userSuspendedAt: user.suspendedAt,
     })

apps/sim/lib/core/config/feature-flags.ts

@@ -91,7 +91,7 @@ const FEATURE_FLAGS = {
   },
   'api-key-read-only': {
     description:
-      'Allow creating read-only API keys. Turn on only after every pod runs a release that enforces key access, since older pods treat a read-only key as full access. Before rolling back below the release that added read-only keys, turn this off first: that older code also serves every existing read-only key as full access. Enforcement of existing read-only keys never depends on this flag. Global; disabled by default.',
+      'Allow creating read-only API keys. Turn on only after every pod runs a release that enforces key access, since older pods treat a read-only key as full access. Before rolling back below the release that added read-only keys, turn this off and revoke or replace every existing read-only key: turning the flag off only stops new ones, and that older code serves existing read-only keys as full access. Enforcement of existing read-only keys never depends on this flag. Global; disabled by default.',
     fallback: 'API_KEY_READ_ONLY',
   },
   'mothership-model-selector': {