fix(api): withhold resolved pause input fields from viewers whose group hides execution data

Author: waleedlatif1

apps/docs/content/docs/workflows/deployment/api.mdx

@@ -260,7 +260,7 @@ A completed response includes the result when requested:
 
 Stop polling on `completed`, `failed`, or `cancelled`. A paused Human run requires submitted input; a time pause can resume automatically. See [Human](/workflows/blocks/human-in-the-loop) and [Wait](/workflows/blocks/wait). Resuming an originally streaming run through the v2 resume endpoint returns an async receipt, not an SSE continuation.
 
-A paused run lists every point it waits at in `paused.points`: the block, whether it is a `human` or `time` pause, its resume state, any parallel branch or loop iteration, its place in the resume queue, and the `inputFields` a Human pause asks for. With `includeOutput=true`, each point also carries the reviewer `display` content with resolved secrets redacted; organization permission groups that hide execution data withhold it. Resume a point by sending its `contextId` to `POST /api/v2/workflows/{workflow-id}/runs/{runId}/resume`.
+A paused run lists every point it waits at in `paused.points`: the block, whether it is a `human` or `time` pause, its resume state, any parallel branch or loop iteration, its place in the resume queue, and the `inputFields` a Human pause asks for. With `includeOutput=true`, each point also carries the reviewer `display` content with resolved secrets redacted; organization permission groups that hide execution data withhold it, along with `inputFields`, whose labels and descriptions are resolved from run data. Resume a point by sending its `contextId` to `POST /api/v2/workflows/{workflow-id}/runs/{runId}/resume`.
 
 ## Select outputs and handle large values [#oversized-outputs]
 

apps/docs/openapi-v2-workflows.json

@@ -15381,7 +15381,7 @@
                 "type": "null"
               }
             ],
-            "description": "Fields a human pause asks for, without default values. Null for a time pause, a pause with no declared form, fields over 64 KiB or not provably free of secrets, or one recorded before pause details were captured."
+            "description": "Fields a human pause asks for, without default values. Labels and descriptions are resolved, so they are withheld when organization permission groups hide execution data. Null then, for a time pause, a pause with no declared form, fields over 64 KiB or not provably free of secrets, or one recorded before pause details were captured."
           },
           "display": {
             "anyOf": [

apps/sim/lib/api/contracts/v2/workflows.ts

@@ -2096,7 +2096,7 @@ const v2WorkflowRunPausePointSchema = z
       .array(v2PauseInputFieldSchema)
       .nullable()
       .describe(
-        'Fields a human pause asks for, without default values. Null for a time pause, a pause with no declared form, fields over 64 KiB or not provably free of secrets, or one recorded before pause details were captured.'
+        'Fields a human pause asks for, without default values. Labels and descriptions are resolved, so they are withheld when organization permission groups hide execution data. Null then, for a time pause, a pause with no declared form, fields over 64 KiB or not provably free of secrets, or one recorded before pause details were captured.'
       ),
     display: z
       .unknown()

apps/sim/lib/workflows/application/read-workflow-run-pause.integration.ts

@@ -279,12 +279,10 @@ describe('a deployed run paused at a human-in-the-loop block', () => {
     ])
   })
 
-  it('withholds reviewer content from a viewer whose group hides execution data', async () => {
+  it('withholds reviewer content and resolved input fields from a viewer whose group hides execution data', async () => {
     const runId = await pausedRun()
 
     const run = await readRun(restricted, runId, { includeOutput: true })
-    expect(run.pausePoints).toEqual([
-      expect.objectContaining({ display: null, inputFields: INPUT_FIELDS }),
-    ])
+    expect(run.pausePoints).toEqual([expect.objectContaining({ display: null, inputFields: null })])
   })
 })

apps/sim/lib/workflows/application/read-workflow-run.ts

@@ -157,8 +157,9 @@ export const readWorkflowRun = defineAuthorizedWorkflowUseCase({
        *
        * A point's `display` is what the block rendered from upstream outputs, so it
        * follows `finalOutput`'s gating: withheld unless output was asked for and the
-       * viewer's group shows execution data. `inputFields` are the block's own
-       * configuration and stay.
+       * viewer's group shows execution data. `inputFields` are resolved before the
+       * pause is captured, so a label or description can carry upstream values too:
+       * they are withheld from a viewer whose group hides execution data.
        *
        * permission-group-enforced: logs.trace_spans
        */
@@ -169,7 +170,11 @@ export const readWorkflowRun = defineAuthorizedWorkflowUseCase({
               workflowId: context.workflowId,
               executionId: context.runId,
             })) ?? []
-          ).map((point) => (showsDisplay ? point : { ...point, display: null }))
+          ).map((point) => ({
+            ...point,
+            display: showsDisplay ? point.display : null,
+            inputFields: projection.hideTraceSpans ? null : point.inputFields,
+          }))
         : null
 
       return { ...status, files, pausePoints }