Merge remote-tracking branch 'origin/staging' into fix/release-audit-unique-1110

Author: waleedlatif1

.github/CI.md

@@ -4,13 +4,13 @@ The `changes` job runs Turborepo 2.9.14's `affectedTasks` query before installin
 
 A PR compares the checked-out GitHub merge commit with its first parent: the actual target revision tested by that merge. The PR event's base SHA can become stale when the target advances. Scoping requires a matching GitHub merge ref and SHA, exactly two merge parents, and a usable target parent; otherwise every check runs. This works with the existing depth-two checkout without fetching older ancestry. Main/staging pushes execute all checks; the parent `ci` workflow skips checks on `dev` pushes, while PRs targeting `dev` still run checks. A manual `checks` run executes all checks unless supplied a full base commit SHA to reproduce a scoped plan. Missing history, an empty diff, unknown files outside the workspace graph, root script/CI changes, or a planner error run every check. Missing selection outputs fail the aggregate gate. The gate also rejects an omitted dependency, any failed/cancelled job, and any skip that its explicit selection flag did not authorize.
 
-Dedicated docs verification uses the same planner, comparing pushes with their previous commit and PRs with the tested merge's first parent. Site acceptance follows `docs#build` and its transitive package dependencies. The app's docs-consumer task depends on server runtime and that docs build: backend-only changes run the platform consumer against the docs app, while site changes also run corpus and browser checks. Independent SDK and unit-only edits skip those production jobs. The required `docs HTTP` gate verifies explicit site/platform selections before accepting any skip.
+Dedicated docs verification uses the same planner, comparing pushes with their previous commit and PRs with the tested merge's first parent. Site acceptance follows `docs#build` and its transitive package dependencies. The app's docs-consumer task depends on server runtime and that docs build: backend-only changes run the platform consumer against the docs app, while site changes also run corpus and browser checks. Standalone package and unit-only edits skip those production jobs. The required `docs HTTP` gate verifies explicit site/platform selections before accepting any skip.
 
 Docs production builds run once and publish an artifact to isolated HTTP, corpus, Chromium, and WebKit jobs. Source checks keep their own checkout because generator verification mutates inputs. Content caches use separate lint/source/build namespaces; generation validates every restore, repairs missing declarations, and removes obsolete modules. The Next build cache keeps its supported incremental behavior. Content and Next caches have size limits, and Next cache files expire after seven days; successful content eviction happens after all consumers finish.
 
 | Change | Expensive checks selected |
 | --- | --- |
-| Independent SDK | That workspace's tests and type-check; no app build, services, or browsers |
+| Standalone package | That workspace's tests and type-check; no app build, services, or browsers |
 | App unit test | App test shards and test type check |
 | Integration test | Both provision paths; no HTTP/browser job merely for the test edit |
 | Workspace UI | Database integration, mobile, SEO and live Electron, plus app tests/build |

apps/docs/content/docs/search/gitlab.mdx

@@ -91,7 +91,7 @@ To rotate the PAT, supply its replacement in source settings. A blank token reta
 
 After an admin configures a source in **Non-admin token** mode, a job can [read its revision](/api-reference/organizations/getSearchSourcePermissions) and [replace both CSVs](/api-reference/organizations/replaceSearchSourcePermissions). Copy `SIM_ORG_ID` and `SIM_SOURCE_ID` from the source settings URL: `/o/<organizationId>/settings/integrations/sources/<sourceId>`. Set `SIM_BASE_URL` to your Sim origin (for hosted Sim, `https://www.sim.ai`).
 
-Store an organization admin's [personal Sim API key](/api-reference/authentication) as a [masked, protected GitLab CI variable](https://docs.gitlab.com/ci/variables/) named `SIM_API_KEY`. A personal key inherits its owner's access. This endpoint can only read the revision or replace both CSVs; it cannot change the GitLab PAT, host, or project.
+Store an organization admin's [personal Sim API key](/api-reference/authentication) with [**Full access**](/api-reference/authentication#key-access) as a [masked, protected GitLab CI variable](https://docs.gitlab.com/ci/variables/) named `SIM_API_KEY`. A personal key inherits its owner's access; a read-only key can read the revision but not replace the CSVs. This endpoint can only read the revision or replace both CSVs; it cannot change the GitLab PAT, host, or project.
 
 This example runs on a schedule against a protected branch. Replace `./ci/export-gitlab-permissions` with your existing export command. It must write a fresh, complete `users.csv` and `project-permissions.csv` and exit nonzero if it cannot finish.
 

apps/sim/app/(landing)/components/navbar/components/nav-menu-chip/constants.ts

@@ -128,14 +128,14 @@ export const RESOURCES_MENU: NavMenu = {
       items: [
         {
           title: 'Docs',
-          description: 'Guides, SDKs, and API reference',
+          description: 'Guides, CLI, and API reference',
           href: 'https://docs.sim.ai',
           external: true,
           preview: {
             kind: 'docs',
             eyebrow: 'Documentation',
             title: 'Build with Sim',
-            details: ['Quickstart', 'SDKs', 'API reference'],
+            details: ['Quickstart', 'CLI', 'API reference'],
           },
         },
         {

apps/sim/app/api/cli/auth/poll/route.ts

@@ -3,6 +3,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { pollCliAuthContract } from '@/lib/api/contracts'
 import { parseRequest } from '@/lib/api/server'
 import {
+  apiKeyCreationErrorStatus,
   performCreatePersonalApiKey,
   performCreateWorkspaceApiKey,
 } from '@/lib/api-key/orchestration'
@@ -83,7 +84,7 @@ async function mintForGrant(
   if (!result.success || !result.key) {
     return {
       ok: false,
-      status: result.errorCode === 'conflict' ? 409 : 500,
+      status: apiKeyCreationErrorStatus(result.errorCode),
       message: result.error ?? 'Failed to generate API key',
     }
   }

apps/sim/app/api/resume/[workflowId]/[executionId]/[contextId]/route.ts

@@ -160,7 +160,7 @@ export const GET = withRouteHandler(
     }
   ) => {
     const { workflowId: requestedWorkflowId } = await context.params
-    const access = await validateWorkflowAccess(request, requestedWorkflowId, false)
+    const access = await validateWorkflowAccess(request, requestedWorkflowId)
     if (access.error) {
       return NextResponse.json({ error: access.error.message }, { status: access.error.status })
     }

apps/sim/app/api/v2/workspaces/[workspaceId]/members/[userId]/route.ts

@@ -1,9 +1,11 @@
+import { isUserCredentialPrincipal } from '@sim/auth/principal'
 import {
   v2RemoveWorkspaceMemberContract,
   v2UpdateWorkspaceMemberContract,
 } from '@/lib/api/contracts/v2/workspaces'
 import { defineV2JsonRoute, v2ApiKeyAuth, v2RateLimits } from '@/lib/api/server/routes'
 import { presentWorkspaceMember } from '@/lib/api/server/workspace-presenters'
+import { captureServerEvent } from '@/lib/posthog/server'
 import { v2WorkspaceErrorPolicies } from '@/lib/workspaces/api/route-policies'
 import { updateWorkspaceMember } from '@/lib/workspaces/application/manage-permissions'
 import {
@@ -22,6 +24,17 @@ export const PATCH = defineV2JsonRoute({
   mapInput: ({ params, body }) => ({ ...params, ...body }),
   useCase: updateWorkspaceMember,
   present: ({ member }) => ({ data: presentWorkspaceMember(member) }),
+  onSuccess: ({ principal, input, result }) => {
+    if (!isUserCredentialPrincipal(principal)) return
+    for (const change of result.changes) {
+      captureServerEvent(
+        principal.userId,
+        'workspace_member_role_changed',
+        { workspace_id: input.workspaceId, new_role: change.newRole },
+        { groups: { workspace: input.workspaceId } }
+      )
+    }
+  },
 })
 
 /** DELETE /api/v2/workspaces/[workspaceId]/members/[userId] — Remove a member, or leave. */
@@ -40,4 +53,13 @@ export const DELETE = defineV2JsonRoute({
       organizationMembershipRemoved: result.organizationRemoval,
     },
   }),
+  onSuccess: ({ principal, input, result }) => {
+    if (!isUserCredentialPrincipal(principal)) return
+    captureServerEvent(
+      principal.userId,
+      'workspace_member_removed',
+      { workspace_id: input.workspaceId, is_self_removal: result.selfRemoval },
+      { groups: { workspace: input.workspaceId } }
+    )
+  },
 })

apps/sim/app/api/workflows/[id]/executions/[executionId]/route.ts

@@ -23,7 +23,7 @@ export const GET = withRouteHandler(
     const { id: workflowId, executionId } = parsed.data.params
     const { includeOutput, selectedOutputs } = parsed.data.query
 
-    const access = await validateWorkflowAccess(request, workflowId, false)
+    const access = await validateWorkflowAccess(request, workflowId)
     if (access.error) {
       return NextResponse.json({ error: access.error.message }, { status: access.error.status })
     }

apps/sim/app/api/workflows/[id]/paused/route.ts

@@ -14,7 +14,7 @@ export const GET = withRouteHandler(
     if (!parsed.success) return parsed.response
     const { id: workflowId } = parsed.data.params
 
-    const access = await validateWorkflowAccess(request, workflowId, false)
+    const access = await validateWorkflowAccess(request, workflowId)
     if (access.error) {
       return NextResponse.json({ error: access.error.message }, { status: access.error.status })
     }

apps/sim/app/api/workflows/middleware.test.ts

@@ -1,6 +1,6 @@
 /**
  * Tests for workflow access middleware — focused on the workspace-scoped
- * API key boundary check in the `requireDeployment=false` branch.
+ * API key boundary check.
  */
 
 import {
@@ -13,10 +13,6 @@ import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@/lib/workflows/utils', () => workflowsUtilsMock)
-vi.mock('@/lib/api-key/service', () => ({
-  authenticateApiKeyFromHeader: vi.fn(),
-  updateApiKeyLastUsed: vi.fn(),
-}))
 
 import { WORKSPACE_KEY_SCOPE_DENIED } from '@/lib/api-key/policy-messages'
 import { validateWorkflowAccess } from '@/app/api/workflows/middleware'
@@ -25,7 +21,7 @@ function makeRequest() {
   return new NextRequest(new URL('https://example.com/api/workflows/wf-1'))
 }
 
-describe('validateWorkflowAccess (requireDeployment=false)', () => {
+describe('validateWorkflowAccess', () => {
   beforeEach(() => {
     workflowsUtilsMockFns.mockGetWorkflowById.mockResolvedValue({
       id: 'wf-1',
@@ -48,7 +44,7 @@ describe('validateWorkflowAccess (requireDeployment=false)', () => {
       workspaceId: 'ws-B',
     })
 
-    const result = await validateWorkflowAccess(makeRequest(), 'wf-1', false)
+    const result = await validateWorkflowAccess(makeRequest(), 'wf-1')
 
     expect(result.error).toEqual({
       message: WORKSPACE_KEY_SCOPE_DENIED,
@@ -70,7 +66,7 @@ describe('validateWorkflowAccess (requireDeployment=false)', () => {
       message: 'Access denied',
     })
 
-    const result = await validateWorkflowAccess(makeRequest(), 'wf-1', false)
+    const result = await validateWorkflowAccess(makeRequest(), 'wf-1')
 
     expect(result.error).toEqual({ message: 'Access denied', status: 403 })
   })

apps/sim/app/api/workflows/middleware.ts

@@ -2,11 +2,6 @@ import { createLogger } from '@sim/logger'
 import { authorizeWorkflowByWorkspacePermission } from '@sim/platform-authz/workflow'
 import type { NextRequest } from 'next/server'
 import { WORKSPACE_KEY_SCOPE_DENIED } from '@/lib/api-key/policy-messages'
-import {
-  type ApiKeyAuthResult,
-  authenticateApiKeyFromHeader,
-  updateApiKeyLastUsed,
-} from '@/lib/api-key/service'
 import { type AuthResult, checkHybridAuth } from '@/lib/auth/hybrid'
 import { getWorkflowById } from '@/lib/workflows/utils'
 
@@ -20,8 +15,7 @@ export interface ValidationResult {
 
 export async function validateWorkflowAccess(
   request: NextRequest,
-  workflowId: string,
-  requireDeployment = true
+  workflowId: string
 ): Promise<ValidationResult> {
   try {
     const workflow = await getWorkflowById(workflowId)
@@ -44,95 +38,40 @@ export async function validateWorkflowAccess(
       }
     }
 
-    if (!requireDeployment) {
-      const auth = await checkHybridAuth(request, { requireWorkflowId: false })
-      if (!auth.success || !auth.userId) {
-        return {
-          error: {
-            message: auth.error || 'Unauthorized',
-            status: 401,
-          },
-        }
-      }
-
-      if (auth.apiKeyType === 'workspace' && auth.workspaceId !== workflow.workspaceId) {
-        return {
-          error: {
-            message: WORKSPACE_KEY_SCOPE_DENIED,
-            status: 403,
-          },
-        }
-      }
-
-      const authorization = await authorizeWorkflowByWorkspacePermission({
-        workflowId,
-        userId: auth.userId,
-        action: 'read',
-      })
-      if (!authorization.allowed) {
-        return {
-          error: {
-            message: authorization.message || 'Access denied',
-            status: authorization.status,
-          },
-        }
+    const auth = await checkHybridAuth(request, { requireWorkflowId: false })
+    if (!auth.success || !auth.userId) {
+      return {
+        error: {
+          message: auth.error || 'Unauthorized',
+          status: 401,
+        },
       }
-
-      return { workflow, auth }
     }
 
-    if (requireDeployment) {
-      if (!workflow.isDeployed) {
-        return {
-          error: {
-            message: 'Workflow is not deployed',
-            status: 403,
-          },
-        }
-      }
-
-      let apiKeyHeader = null
-      for (const [key, value] of request.headers.entries()) {
-        if (key.toLowerCase() === 'x-api-key' && value) {
-          apiKeyHeader = value
-          break
-        }
-      }
-
-      if (!apiKeyHeader) {
-        return {
-          error: {
-            message: 'Unauthorized: API key required',
-            status: 401,
-          },
-        }
-      }
-
-      let validResult: ApiKeyAuthResult | null = null
-
-      const workspaceResult = await authenticateApiKeyFromHeader(apiKeyHeader, {
-        workspaceId: workflow.workspaceId as string,
-        keyTypes: ['workspace', 'personal'],
-      })
-
-      if (workspaceResult.success) {
-        validResult = workspaceResult
-      }
-
-      if (!validResult) {
-        return {
-          error: {
-            message: 'Unauthorized: Invalid API key',
-            status: 401,
-          },
-        }
+    if (auth.apiKeyType === 'workspace' && auth.workspaceId !== workflow.workspaceId) {
+      return {
+        error: {
+          message: WORKSPACE_KEY_SCOPE_DENIED,
+          status: 403,
+        },
       }
+    }
 
-      if (validResult.keyId) {
-        updateApiKeyLastUsed(validResult.keyId)
+    const authorization = await authorizeWorkflowByWorkspacePermission({
+      workflowId,
+      userId: auth.userId,
+      action: 'read',
+    })
+    if (!authorization.allowed) {
+      return {
+        error: {
+          message: authorization.message || 'Access denied',
+          status: authorization.status,
+        },
       }
     }
-    return { workflow }
+
+    return { workflow, auth }
   } catch (error) {
     logger.error('Validation error:', { error })
     return {