fix(triggers): match delivery liveness, switch every live row of a block, keep legacy route behavior

Live rows now use the delivery and editor deployment test (active version,
or versionless deploy with no version id) and no longer filter on
registration status, so the editor never shows a row the legacy toggle
rejects. A block target switches all of its live rows in one transaction;
a row id switches only that row. Disabling a completed schedule moves it to
disabled again, a cron with no future run is a 400 with the legacy message,
and same-workspace role denials keep their legacy 403 bodies.

Author: waleedlatif1

apps/docs/openapi-v2-workflows.json

@@ -2669,7 +2669,7 @@
       "patch": {
         "operationId": "updateWorkflowTrigger",
         "summary": "Update workflow trigger",
-        "description": "Enable or disable one trigger of the live deployment without redeploying. Requires workspace write access. Enabling resets `failedCount`, schedules the next run, and clears any polling backoff; a schedule with no future runs returns `409` and an invalid cron expression returns `400`. A permission group that blocks webhook triggers returns `403` when enabling a polling, internal-event, or webhook trigger. Requesting the current state changes nothing.\n\nDisabling only stops Sim from accepting the trigger; nothing is removed at the provider. Deliveries to a disabled webhook receive `404`, and some providers disable their subscription after repeated failures, which requires a redeploy to restore.\n\nOAuth scope: `api:write`.",
+        "description": "Enable or disable one trigger of the live deployment without redeploying. Requires workspace write access. Enabling resets `failedCount`, schedules the next run, and clears any polling backoff; a schedule whose cron expression is invalid or has no future runs returns `400`. A permission group that blocks webhook triggers returns `403` when enabling a polling, internal-event, or webhook trigger. Disabling a completed schedule marks it disabled. A block with several live rows switches them together. Requesting the current state changes nothing.\n\nDisabling only stops Sim from accepting the trigger; nothing is removed at the provider. Deliveries to a disabled webhook receive `404`, and some providers disable their subscription after repeated failures, which requires a redeploy to restore.\n\nOAuth scope: `api:write`.",
         "x-sim-operation": "workflows.triggers.set_enabled",
         "x-oauth-scope": "api:write",
         "tags": ["Workflows"],

apps/sim/app/api/schedules/[id]/route.ts

@@ -10,12 +10,14 @@ import { parseRequest } from '@/lib/api/server'
 import {
   createInternalResourceConcealmentPolicy,
   defineInternalJsonRoute,
+  extendInternalErrorPolicy,
   internalErrorResponse,
   internalOrchestrationErrorPolicy,
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
 import { getSession } from '@/lib/auth'
+import { InsufficientWorkspacePermissionsError } from '@/lib/core/application'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { workflowOperations } from '@/lib/workflows/application/operations'
@@ -117,21 +119,30 @@ export const PUT = defineInternalJsonRoute({
   }),
   errorPolicy: createInternalResourceConcealmentPolicy({
     notFoundMessage: 'Schedule not found',
-    base: {
-      project: internalOrchestrationErrorPolicy.project,
-      unhandled: () => internalErrorResponse(500, { error: 'Failed to update schedule' }),
-    },
+    base: extendInternalErrorPolicy(
+      {
+        project: internalOrchestrationErrorPolicy.project,
+        unhandled: () => internalErrorResponse(500, { error: 'Failed to update schedule' }),
+      },
+      (error) =>
+        error instanceof InsufficientWorkspacePermissionsError
+          ? internalErrorResponse(403, {
+              error: 'Unauthorized: Access denied to write this workflow',
+            })
+          : null
+    ),
   }),
   parseOptions: {
     validationErrorResponse: () =>
       NextResponse.json({ error: 'Invalid request body' }, { status: 400 }),
   },
   mapInput: ({ params, body }) => ({
-    target: { kind: 'schedule_row' as const, scheduleId: params.id },
+    target: { kind: 'row' as const, table: 'schedule' as const, id: params.id },
     enabled: body.action === 'reactivate',
   }),
   useCase: setWorkflowTriggerEnabled,
-  present: ({ trigger, changed }, { input }) => {
+  present: ({ trigger, changes }, { input }) => {
+    const changed = changes.length > 0
     if (!input.enabled) {
       return {
         message: changed ? 'Schedule disabled successfully' : 'Schedule is already disabled',

apps/sim/app/api/webhooks/[id]/route.ts

@@ -19,11 +19,14 @@ import { parseRequest } from '@/lib/api/server'
 import {
   createInternalResourceConcealmentPolicy,
   defineInternalJsonRoute,
+  extendInternalErrorPolicy,
+  internalErrorResponse,
   internalOrchestrationErrorPolicy,
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
+import { InsufficientWorkspacePermissionsError } from '@/lib/core/application'
 import { PlatformEvents } from '@/lib/core/telemetry'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -110,10 +113,14 @@ export const PATCH = defineInternalJsonRoute({
   }),
   errorPolicy: createInternalResourceConcealmentPolicy({
     notFoundMessage: 'Webhook not found',
-    base: internalOrchestrationErrorPolicy,
+    base: extendInternalErrorPolicy(internalOrchestrationErrorPolicy, (error) =>
+      error instanceof InsufficientWorkspacePermissionsError
+        ? internalErrorResponse(403, { error: 'Access denied' })
+        : null
+    ),
   }),
   mapInput: ({ params, body }) => ({
-    target: { kind: 'webhook_row' as const, webhookId: params.id },
+    target: { kind: 'row' as const, table: 'webhook' as const, id: params.id },
     enabled: body.isActive,
   }),
   useCase: setWorkflowTriggerEnabled,

apps/sim/lib/api/contracts/v2/openapi/workflows.ts

@@ -949,7 +949,7 @@ const declaredRoutes = [
       applicationOperation: workflowOperations.setTriggerEnabled,
       operationId: 'updateWorkflowTrigger',
       summary: 'Update workflow trigger',
-      description: `Enable or disable one trigger of the live deployment without redeploying. Requires workspace write access. Enabling resets \`failedCount\`, schedules the next run, and clears any polling backoff; a schedule with no future runs returns \`409\` and an invalid cron expression returns \`400\`. A permission group that blocks webhook triggers returns \`403\` when enabling a polling, internal-event, or webhook trigger. Requesting the current state changes nothing.\n\nDisabling only stops Sim from accepting the trigger; nothing is removed at the provider. Deliveries to a disabled webhook receive \`404\`, and some providers disable their subscription after repeated failures, which requires a redeploy to restore.`,
+      description: `Enable or disable one trigger of the live deployment without redeploying. Requires workspace write access. Enabling resets \`failedCount\`, schedules the next run, and clears any polling backoff; a schedule whose cron expression is invalid or has no future runs returns \`400\`. A permission group that blocks webhook triggers returns \`403\` when enabling a polling, internal-event, or webhook trigger. Disabling a completed schedule marks it disabled. A block with several live rows switches them together. Requesting the current state changes nothing.\n\nDisabling only stops Sim from accepting the trigger; nothing is removed at the provider. Deliveries to a disabled webhook receive \`404\`, and some providers disable their subscription after repeated failures, which requires a redeploy to restore.`,
       errors: [...RESOURCE_MUTATION_ERRORS, 'PayloadTooLarge'],
       success: jsonSuccess('The trigger after the update.'),
     }),

apps/sim/lib/webhooks/polling/utils.ts

@@ -28,8 +28,8 @@ const POLL_TICK_TOLERANCE_MS = 10_000
 /** Ceiling on a source's own `Retry-After`, so a hostile feed cannot park a trigger for days. */
 const POLL_RETRY_AFTER_MAX_MS = 24 * 60 * 60_000
 
-const POLL_BACKOFF_UNTIL_KEY = 'pollBackoffUntil'
-const POLL_SOURCE_FAILURES_KEY = 'pollSourceFailures'
+export const POLL_BACKOFF_UNTIL_KEY = 'pollBackoffUntil'
+export const POLL_SOURCE_FAILURES_KEY = 'pollSourceFailures'
 
 /**
  * Whether a webhook is inside the backoff window {@link recordPollSourceFailure}