fix(auth): clarify workflow execution authorization

Author: TheodoreSpeaks

apps/sim/app/api/resume/[workflowId]/[executionId]/[contextId]/route.test.ts

@@ -106,27 +106,39 @@ function createPausedExecution(overrides: PausedExecutionOverrides = {}) {
     'billingAttribution' in overrides
       ? overrides.billingAttribution
       : structuredClone(PERSISTED_ATTRIBUTION)
+  const snapshotWorkflowId = overrides.snapshotWorkflowId ?? WORKFLOW_ID
+  const snapshotExecutionId = overrides.snapshotExecutionId ?? EXECUTION_ID
+  const snapshotActorUserId = overrides.snapshotActorUserId ?? PERSISTED_ACTOR_ID
 
   return {
     id: 'paused-execution-1',
     workflowId: overrides.workflowId ?? WORKFLOW_ID,
     executionId: overrides.executionId ?? EXECUTION_ID,
     executionSnapshot: {
       snapshot: JSON.stringify({
-        version: 1,
+        version: 2,
         metadata: {
           requestId: 'request-original',
-          workflowId: overrides.snapshotWorkflowId ?? WORKFLOW_ID,
-          executionId: overrides.snapshotExecutionId ?? EXECUTION_ID,
+          workflowId: snapshotWorkflowId,
+          executionId: snapshotExecutionId,
           workspaceId: overrides.snapshotWorkspaceId ?? WORKSPACE_ID,
-          userId: overrides.snapshotActorUserId ?? PERSISTED_ACTOR_ID,
+          userId: snapshotActorUserId,
           principal: {
-            version: 1,
+            version: 2,
             principal: {
               kind: 'session',
-              userId: overrides.snapshotActorUserId ?? PERSISTED_ACTOR_ID,
+              userId: snapshotActorUserId,
               sessionId: 'session-original',
             },
+            executionMetadata: {
+              executionId: snapshotExecutionId,
+              rootWorkflowId: snapshotWorkflowId,
+              currentWorkflow: {
+                workflowId: snapshotWorkflowId,
+                mode: 'deployment',
+                deploymentVersionId: 'deployment-version-1',
+              },
+            },
           },
           billingAttribution,
           triggerType: 'manual',

apps/sim/app/api/table/[tableId]/route.test.ts

@@ -4,6 +4,7 @@
 import { hybridAuthMockFns } from '@sim/testing'
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { createTestRuntimePrincipal } from '@/lib/auth/runtime-principal.test-support'
 
 const {
   mockCheckAccess,
@@ -15,6 +16,7 @@ const {
   mockFindActiveFolder,
   mockGetLimits,
   mockAuthenticate,
+  mockAuthenticateWithTransport,
   mockReadTable,
 } = vi.hoisted(() => ({
   mockCheckAccess: vi.fn(),
@@ -26,11 +28,15 @@ const {
   mockFindActiveFolder: vi.fn(),
   mockGetLimits: vi.fn(),
   mockAuthenticate: vi.fn(),
+  mockAuthenticateWithTransport: vi.fn(),
   mockReadTable: vi.fn(),
 }))
 
 vi.mock('@/lib/table/api', () => ({
-  internalTableSessionOrExecutorAuth: { authenticate: mockAuthenticate },
+  internalTableSessionOrExecutorAuth: {
+    authenticate: mockAuthenticate,
+    authenticateWithTransport: mockAuthenticateWithTransport,
+  },
   internalTableErrorPolicies: {
     concealTableAuthorization: { project: () => null },
   },
@@ -182,15 +188,16 @@ describe('PATCH /api/table/[tableId] folder moves', () => {
 describe('GET /api/table/[tableId] application adapter', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockAuthenticate.mockResolvedValue({
-      kind: 'delegated',
-      serviceId: 'executor',
-      subjectUserId: 'user-1',
-      workspaceId: 'workspace-canonical',
-      delegationId: 'delegation-1',
-      audience: 'sim:tables',
-      issuedAt: new Date('2026-01-01'),
-      expiresAt: new Date('2026-01-02'),
+    const principal = createTestRuntimePrincipal({
+      principal: { kind: 'session', userId: 'user-1', sessionId: 'session-1' },
+      executionId: 'execution-1',
+      rootWorkflowId: 'workflow-1',
+    })
+    mockAuthenticate.mockResolvedValue(principal)
+    mockAuthenticateWithTransport.mockResolvedValue({
+      principal,
+      transport: 'executor_jwt',
+      executionWorkspaceId: 'workspace-canonical',
     })
     mockReadTable.mockResolvedValue({
       table: {

apps/sim/app/api/table/route.test.ts

@@ -4,16 +4,21 @@
 
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { createTestRuntimePrincipal } from '@/lib/auth/runtime-principal.test-support'
 
 const mocks = vi.hoisted(() => ({
   authenticate: vi.fn(),
+  authenticateWithTransport: vi.fn(),
   createTable: vi.fn(),
   listTables: vi.fn(),
   capture: vi.fn(),
 }))
 
 vi.mock('@/lib/table/api', () => ({
-  internalTableSessionOrExecutorAuth: { authenticate: mocks.authenticate },
+  internalTableSessionOrExecutorAuth: {
+    authenticate: mocks.authenticate,
+    authenticateWithTransport: mocks.authenticateWithTransport,
+  },
 }))
 
 vi.mock('@/lib/table/application/tables', () => ({
@@ -47,46 +52,51 @@ const TABLE = {
 }
 
 function sessionPrincipal() {
-  mocks.authenticate.mockResolvedValue({
+  const principal = {
     kind: 'session',
     userId: 'user-1',
     sessionId: 'session-1',
-  })
+  } as const
+  mocks.authenticate.mockResolvedValue(principal)
+  mocks.authenticateWithTransport.mockResolvedValue({ principal, transport: 'session' })
 }
 
 function executorPrincipal() {
-  mocks.authenticate.mockResolvedValue({
-    kind: 'delegated',
-    serviceId: 'executor',
-    subjectUserId: 'user-1',
-    workspaceId: 'workspace-canonical',
-    delegationId: 'delegation-1',
-    audience: 'sim:tables',
-    issuedAt: new Date('2026-01-01'),
-    expiresAt: new Date('2026-01-02'),
+  const principal = createTestRuntimePrincipal({
+    principal: { kind: 'session', userId: 'user-1', sessionId: 'session-1' },
+    executionId: 'execution-1',
+    rootWorkflowId: 'parent-workflow',
+  })
+  mocks.authenticate.mockResolvedValue(principal)
+  mocks.authenticateWithTransport.mockResolvedValue({
+    principal,
+    transport: 'executor_jwt',
+    executionWorkspaceId: 'workspace-canonical',
   })
 }
 
 function actorlessExecutorPrincipal() {
-  mocks.authenticate.mockResolvedValue({
-    kind: 'delegated',
-    serviceId: 'executor',
-    workspaceId: 'workspace-canonical',
-    delegationId: 'delegation-1',
-    audience: 'sim:tables',
-    issuedAt: new Date('2026-01-01'),
-    expiresAt: new Date('2026-01-02'),
-    delegationContext: {
-      kind: 'workflow_execution',
+  const principal = createTestRuntimePrincipal({
+    principal: {
+      kind: 'system',
+      serviceId: 'schedule',
+      workspaceId: 'workspace-canonical',
       workflowId: 'parent-workflow',
-      principal: {
-        kind: 'system',
-        serviceId: 'internal',
-        workspaceId: 'workspace-canonical',
-        workflowId: 'parent-workflow',
-      },
+    },
+    executionId: 'execution-1',
+    rootWorkflowId: 'parent-workflow',
+    currentWorkflow: {
+      workflowId: 'parent-workflow',
+      mode: 'deployment',
+      deploymentVersionId: 'deployment-version-1',
     },
   })
+  mocks.authenticate.mockResolvedValue(principal)
+  mocks.authenticateWithTransport.mockResolvedValue({
+    principal,
+    transport: 'executor_jwt',
+    executionWorkspaceId: 'workspace-canonical',
+  })
 }
 
 function post(body: unknown) {
@@ -149,8 +159,8 @@ describe('/api/table application adapter', () => {
     expect(response.status).toBe(200)
     expect(mocks.createTable.mock.calls[0][0]).toMatchObject({
       principal: {
-        kind: 'delegated',
-        serviceId: 'executor',
+        kind: 'system',
+        serviceId: 'schedule',
         workspaceId: 'workspace-canonical',
       },
       input: { workspaceId: 'workspace-canonical' },

apps/sim/app/api/table/table-tool-auth.test.ts

@@ -5,7 +5,7 @@
  * things have to line up for that to work:
  *
  *  1. the tool must declare an in-process operation, and
- *  2. the operation's policy must admit the `executor` delegated service.
+ *  2. the operation's policy must admit a runtime workflow principal.
  */
 import { describe, expect, it } from 'vitest'
 import { tableOperations } from '@/lib/table/application/operations'
@@ -29,10 +29,9 @@ describe('executor access to the migrated table row routes', () => {
   })
 
   it.each(EXECUTOR_ROW_TOOLS)(
-    '%s runs under an operation that admits the executor',
+    '%s runs under an operation that admits workflow execution',
     (_name, _tool, operation) => {
-      expect(operation.delegatedServices).toContain('executor')
-      expect(operation.principalKinds).toContain('delegated')
+      expect(operation.workflowExecution).toBe('allow')
     }
   )
 })

apps/sim/app/api/workflows/[id]/deployed/route.test.ts

@@ -4,16 +4,17 @@
 import { authMockFns } from '@sim/testing'
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { createTestRuntimePrincipal } from '@/lib/auth/runtime-principal.test-support'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 
 const {
   InvalidDelegationTokenError,
-  mockBindExecutorDelegation,
+  mockBindExecutorDelegationAdmission,
   mockReadWorkflowDefinition,
   mockVerifyDelegationToken,
 } = vi.hoisted(() => ({
   InvalidDelegationTokenError: class InvalidDelegationTokenError extends Error {},
-  mockBindExecutorDelegation: vi.fn(),
+  mockBindExecutorDelegationAdmission: vi.fn(),
   mockReadWorkflowDefinition: vi.fn(),
   mockVerifyDelegationToken: vi.fn(),
 }))
@@ -24,7 +25,7 @@ vi.mock('@/lib/auth/internal', () => ({
 }))
 
 vi.mock('@/lib/auth/internal-delegation', () => ({
-  bindInternalExecutorDelegation: mockBindExecutorDelegation,
+  bindInternalExecutorDelegationAdmission: mockBindExecutorDelegationAdmission,
   InvalidInternalDelegationBindingError: class InvalidInternalDelegationBindingError extends Error {},
 }))
 
@@ -34,7 +35,8 @@ vi.mock('@/lib/workflows/application/read-workflow-definition', () => {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     principalKinds: ['session', 'personal_api_key', 'workspace_api_key', 'delegated'],
-    delegatedServices: ['copilot', 'executor'],
+    delegatedServices: ['copilot'],
+    workflowExecution: 'allow',
   } as const
   return {
     readWorkflowDefinition: { operation, execute: mockReadWorkflowDefinition },
@@ -57,21 +59,11 @@ const SESSION = {
   session: { id: 'session-123' },
 }
 
-const EXECUTOR_PRINCIPAL = {
-  kind: 'delegated' as const,
-  serviceId: 'executor' as const,
-  subjectUserId: 'user-123',
-  workspaceId: 'workspace-456',
-  delegationId: 'delegation-123',
-  audience: 'sim:workflows',
-  issuedAt: new Date('2026-08-08T00:00:00.000Z'),
-  expiresAt: new Date('2999-08-08T00:00:00.000Z'),
-  delegationContext: {
-    kind: 'workflow_execution' as const,
-    workflowId: 'origin-workflow',
-    executionId: 'origin-run',
-  },
-}
+const EXECUTOR_PRINCIPAL = createTestRuntimePrincipal({
+  principal: { kind: 'session', userId: 'user-123', sessionId: 'session-123' },
+  rootWorkflowId: 'origin-workflow',
+  executionId: 'origin-run',
+})
 
 function createRequest(bearerToken?: string) {
   return new NextRequest('http://localhost:3000/api/workflows/workflow-123/deployed', {
@@ -94,12 +86,18 @@ describe('GET /api/workflows/[id]/deployed', () => {
     vi.clearAllMocks()
     authMockFns.mockGetSession.mockResolvedValue(SESSION)
     mockReadWorkflowDefinition.mockResolvedValue(readResult())
-    mockVerifyDelegationToken.mockResolvedValue({
-      subjectUserId: 'user-123',
-      workflowId: 'origin-workflow',
-      executionId: 'origin-run',
+    const delegation = {
+      serviceId: 'executor' as const,
+      principal: EXECUTOR_PRINCIPAL,
+      delegationId: 'delegation-123',
+      issuedAt: new Date('2026-08-08T00:00:00.000Z'),
+      expiresAt: new Date('2999-08-08T00:00:00.000Z'),
+    }
+    mockVerifyDelegationToken.mockResolvedValue(delegation)
+    mockBindExecutorDelegationAdmission.mockResolvedValue({
+      principal: EXECUTOR_PRINCIPAL,
+      workspaceId: 'workspace-456',
     })
-    mockBindExecutorDelegation.mockResolvedValue(EXECUTOR_PRINCIPAL)
   })
 
   it('passes the authenticated session principal through the application use case', async () => {
@@ -119,9 +117,8 @@ describe('GET /api/workflows/[id]/deployed', () => {
     const response = await GET(createRequest('signed-token'), routeParams())
 
     expect(response.status).toBe(200)
-    expect(mockBindExecutorDelegation).toHaveBeenCalledWith(
-      expect.objectContaining({ workflowId: 'origin-workflow', executionId: 'origin-run' }),
-      { audience: 'sim:workflows', resourceScope: undefined }
+    expect(mockBindExecutorDelegationAdmission).toHaveBeenCalledWith(
+      expect.objectContaining({ principal: EXECUTOR_PRINCIPAL })
     )
     expect(mockReadWorkflowDefinition).toHaveBeenCalledWith(
       expect.objectContaining({

apps/sim/executor/handlers/credential-group/credential-group-handler.test.ts

@@ -87,7 +87,7 @@ describe('CredentialGroupBlockHandler', () => {
     )
   })
 
-  it('lists credentials with an optional email selector', async () => {
+  it('keeps the selected group on application input instead of principal metadata', async () => {
     mocks.listCredentials.mockResolvedValue({
       credentials: [],
       count: 0,

apps/sim/lib/credential-groups/application/authorization.ts

@@ -6,10 +6,7 @@ import {
   type WorkflowExecutionAuthority,
   type WorkflowExecutionPrincipal,
 } from '@sim/auth/principal'
-import type {
-  WorkspaceAuthorizationContext,
-  WorkspaceDelegationPolicy,
-} from '@/lib/core/application'
+import type { WorkspaceAuthorizationContext } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   credentialGroupWorkflowAccessPolicyCodec,
@@ -28,8 +25,6 @@ import {
 import type { ResourcePolicyBindingFor } from '@/lib/resource-policies/registry'
 import { requireResourcePolicy } from '@/lib/resource-policies/repository'
 
-export const CREDENTIAL_GROUP_DELEGATION_AUDIENCE = 'sim:credential-groups'
-
 export interface CredentialGroupAuthorizationContext extends WorkspaceAuthorizationContext {
   credentialGroupId: string
 }
@@ -160,17 +155,3 @@ export async function requireCredentialGroupCredentialAccess(
     throw new OrchestrationError('forbidden', 'Credential Group credential access denied')
   }
 }
-
-export const credentialGroupDelegationPolicy = {
-  audience: CREDENTIAL_GROUP_DELEGATION_AUDIENCE,
-  isWithinScope: (
-    principal: Extract<Principal, { kind: 'delegated' }>,
-    context: CredentialGroupApplicationContext
-  ) => principal.resourceScope?.credentialGroupId === context.credentialGroupId,
-} satisfies WorkspaceDelegationPolicy<CredentialGroupApplicationContext>
-
-export const credentialGroupWorkspaceDelegationPolicy = {
-  audience: CREDENTIAL_GROUP_DELEGATION_AUDIENCE,
-  isWithinScope: (principal: Extract<Principal, { kind: 'delegated' }>) =>
-    principal.resourceScope?.credentialGroupId === undefined,
-} satisfies WorkspaceDelegationPolicy<WorkspaceAuthorizationContext>