fix(auth): preserve runtime authority across resumed operations

Author: TheodoreSpeaks

apps/sim/executor/handlers/credential-group/credential-group-handler.test.ts

@@ -190,6 +190,7 @@ describe('CredentialGroupBlockHandler', () => {
       principal,
       input: {
         credentialGroupId: 'group-1',
+        assertedWorkspaceId: 'workspace-1',
         email: 'person@example.com',
         mcpServerId: 'mcp-server-1',
         limit: 25,

apps/sim/executor/handlers/credential-group/credential-group-handler.ts

@@ -140,6 +140,7 @@ export class CredentialGroupBlockHandler implements BlockHandler {
           principal,
           input: {
             credentialGroupId: credentialGroupId!,
+            assertedWorkspaceId: executionWorkspaceId,
             limit: parseLimit(inputs.limit),
             cursor: parseOptionalString(inputs.cursor, 'Cursor'),
             email: parseOptionalString(inputs.email, 'Email'),

apps/sim/lib/auth/internal.test.ts

@@ -74,6 +74,20 @@ describe('internal executor delegation claims', () => {
       name: 'workspace API key',
       principal: { kind: 'workspace_api_key', workspaceId: 'workspace-1', keyId: 'key-1' },
     },
+    ...(['copilot', 'realtime'] as const).map((serviceId) => ({
+      name: `${serviceId} delegation`,
+      principal: {
+        kind: 'delegated' as const,
+        serviceId,
+        subjectUserId: 'delegated-user',
+        workspaceId: 'workspace-1',
+        delegationId: 'delegation-1',
+        audience: 'workflow-execution',
+        issuedAt: new Date(),
+        expiresAt: new Date(Date.now() + 60_000),
+      },
+      expectedSubject: 'delegated-user',
+    })),
     {
       name: 'schedule',
       principal: {

apps/sim/lib/core/application/workspace-operation.test.ts

@@ -1,10 +1,45 @@
 /**
  * @vitest-environment node
  */
-import { describe, expect, it } from 'vitest'
-import { defineWorkspaceOperation } from '@/lib/core/application/workspace-operation'
+import type { BoundWorkflowExecutionPrincipal, SessionPrincipal } from '@sim/auth/principal'
+import { describe, expect, expectTypeOf, it } from 'vitest'
+import {
+  defineWorkspaceOperation,
+  type PrincipalForOperation,
+} from '@/lib/core/application/workspace-operation'
 import { CREDENTIAL_GROUP_CREDENTIAL_USE_ACTION } from '@/lib/resource-policies/registry'
 
+describe('defineWorkspaceOperation workflow execution policy', () => {
+  it('infers bound runtime principals for a workflow-only operation', () => {
+    const operation = defineWorkspaceOperation({
+      id: 'test.workflow_only',
+      minimumRole: 'read',
+      workspaceApiKey: 'deny',
+      principalKinds: [],
+      workflowExecution: 'allow',
+      capability: 'none',
+    })
+
+    expect(operation.workflowExecution).toBe('allow')
+    expectTypeOf<
+      PrincipalForOperation<typeof operation>
+    >().toEqualTypeOf<BoundWorkflowExecutionPrincipal>()
+  })
+
+  it('does not widen an operation that omits workflow execution', () => {
+    const operation = defineWorkspaceOperation({
+      id: 'test.session_only',
+      minimumRole: 'read',
+      workspaceApiKey: 'deny',
+      principalKinds: ['session'],
+      capability: 'none',
+    })
+
+    expect(operation.workflowExecution).toBeUndefined()
+    expectTypeOf<PrincipalForOperation<typeof operation>>().toEqualTypeOf<SessionPrincipal>()
+  })
+})
+
 describe('defineWorkspaceOperation delegated service policy', () => {
   it('preserves and freezes an explicit delegated service allowlist', () => {
     const operation = defineWorkspaceOperation({

apps/sim/lib/core/application/workspace-operation.ts

@@ -33,7 +33,7 @@ type DelegatedPrincipalForOperation<
   : never
 
 type WorkflowExecutionPrincipalForOperation<O extends { readonly workflowExecution?: 'allow' }> =
-  O['workflowExecution'] extends 'allow' ? BoundWorkflowExecutionPrincipal : never
+  Extract<O['workflowExecution'], 'allow'> extends never ? never : BoundWorkflowExecutionPrincipal
 
 export type PrincipalForOperation<
   O extends {

apps/sim/lib/credential-groups/application/list-mcp-connections.test.ts

@@ -63,7 +63,7 @@ const workspaceContext = {
   allowPersonalApiKeys: true,
   billedAccountUserId: 'billing-owner-1',
 }
-const input = { credentialGroupId: 'group-1', limit: 50 }
+const input = { credentialGroupId: 'group-1', assertedWorkspaceId: 'workspace-1', limit: 50 }
 
 function executorPrincipal(
   principal?: WorkflowExecutionPrincipal
@@ -157,6 +157,18 @@ describe('listCredentialGroupMcpConnections', () => {
     })
   })
 
+  it('conceals groups outside the execution workspace even when the user has access', async () => {
+    mocks.resolvePermission.mockResolvedValue('admin')
+    mocks.loadGroup.mockResolvedValue({ ...groupContext, workspaceId: 'workspace-2' })
+
+    await expect(
+      listCredentialGroupMcpConnections.execute({ principal: executorPrincipal(), input })
+    ).rejects.toMatchObject({ code: 'not_found' })
+    expect(mocks.loadWorkspace).not.toHaveBeenCalled()
+    expect(mocks.resolvePermission).not.toHaveBeenCalled()
+    expect(mocks.listMcpConnections).not.toHaveBeenCalled()
+  })
+
   it('rejects invalid filters before querying MCP connections', async () => {
     await expect(
       listCredentialGroupMcpConnections.execute({

apps/sim/lib/credential-groups/application/list-mcp-connections.ts

@@ -15,6 +15,7 @@ import {
 
 export interface ListCredentialGroupMcpConnectionsInput {
   credentialGroupId: string
+  assertedWorkspaceId: string
   limit: number
   cursor?: string
   email?: string
@@ -31,7 +32,7 @@ export interface ListCredentialGroupMcpConnectionsResult {
 export const listCredentialGroupMcpConnections = defineAuthorizedWorkspaceUseCase({
   operation: credentialGroupOperations.listMcpConnections,
   resolveContext: ({ input }: { input: ListCredentialGroupMcpConnectionsInput }) =>
-    resolveCredentialGroupContext(input.credentialGroupId),
+    resolveCredentialGroupContext(input.credentialGroupId, input.assertedWorkspaceId),
   authorizationOptions: {},
   execute: async ({ input, context }): Promise<ListCredentialGroupMcpConnectionsResult> => {
     if (

apps/sim/lib/logs/api/route-policies.test.ts

@@ -56,19 +56,23 @@ describe('internal logs route authentication', () => {
     })
   })
 
-  it('keeps workflow-scoped executor tokens unscoped to one execution', async () => {
+  it('preserves the canonical workspace separately from the signed execution identity', async () => {
     const token = await generateInternalDelegationToken({
       principal: createTestRuntimePrincipal(),
     })
 
-    const principal = await internalLogsSessionOrExecutorAuth.authenticate(
+    const admission = await internalLogsSessionOrExecutorAuth.authenticateWithTransport(
       new NextRequest('http://localhost/api/logs/log-1', {
         headers: { authorization: `Bearer ${token}` },
       }),
       { id: 'log-1' }
     )
 
-    expect(principal.executionMetadata.executionId).toBe('execution-1')
+    expect(admission).toMatchObject({
+      transport: 'executor_jwt',
+      executionWorkspaceId: 'canonical-workspace',
+      principal: { executionMetadata: { executionId: 'execution-1' } },
+    })
   })
 
   it('rejects an executor delegation without canonical workflow execution context', async () => {

apps/sim/lib/uploads/upload-session/service.test.ts

@@ -1,7 +1,11 @@
 /**
  * @vitest-environment node
  */
-import { type Principal, serializePrincipal } from '@sim/auth/principal'
+import {
+  type Principal,
+  serializePrincipal,
+  type WorkflowExecutionPrincipal,
+} from '@sim/auth/principal'
 import { sha256Hex } from '@sim/security/hash'
 import { dbChainMockFns, queueTableRows, resetDbChainMock, schemaMock } from '@sim/testing'
 import { eq, inArray, isNull } from 'drizzle-orm'
@@ -550,6 +554,119 @@ describe('upload sessions', () => {
     ).toThrow('Upload session not found')
   })
 
+  it.each<WorkflowExecutionPrincipal>([
+    { kind: 'workspace_api_key', workspaceId: WORKSPACE_ID, keyId: 'workspace-key' },
+    {
+      kind: 'system',
+      serviceId: 'schedule',
+      workspaceId: WORKSPACE_ID,
+      workflowId: 'workflow-1',
+    },
+    {
+      kind: 'system',
+      serviceId: 'webhook',
+      workspaceId: WORKSPACE_ID,
+      workflowId: 'workflow-1',
+      webhookId: 'webhook-1',
+      provider: 'generic',
+    },
+    {
+      kind: 'system',
+      serviceId: 'webhook',
+      workspaceId: WORKSPACE_ID,
+      workflowId: 'workflow-1',
+      webhookId: 'slack-webhook',
+      provider: 'slack',
+      subject: { kind: 'external_user', provider: 'slack', tenantId: 'T123', subjectId: 'U123' },
+    },
+    {
+      kind: 'system',
+      serviceId: 'chat',
+      workspaceId: WORKSPACE_ID,
+      workflowId: 'workflow-1',
+      subject: { kind: 'authenticated_email', email: 'person@example.com' },
+    },
+  ])(
+    'binds and validates table-import uploads without inventing a Sim user: $kind $serviceId',
+    async (actor) => {
+      const principal = createTestRuntimePrincipal({ principal: actor })
+      dbChainMockFns.returning.mockResolvedValueOnce([uploadRow({ purpose: 'table_import' })])
+
+      await createUploadSession({
+        id: 'upload-1',
+        workspaceId: WORKSPACE_ID,
+        userId: 'billing-attribution-only',
+        principal,
+        purpose: 'table_import',
+        fileName: 'data.csv',
+        contentType: 'text/csv',
+        fileSize: 4,
+      })
+
+      const authBinding = dbChainMockFns.values.mock.calls[0][0].metadata.authBinding
+      expect(authBinding).toEqual({
+        version: 2,
+        workspaceId: WORKSPACE_ID,
+        principal: serializePrincipal(principal, 2),
+      })
+      expect(authBinding.principal.principal).toEqual(actor)
+      expect(JSON.stringify(authBinding)).not.toContain('billing-attribution-only')
+      const session = sessionRecord({ purpose: 'table_import', metadata: { authBinding } })
+      expect(() => assertUploadSessionAuthBinding(session, principal)).not.toThrow()
+      expect(() =>
+        createUploadSessionAuthBinding(principal, 'other-workspace', { workflowExecution: 'allow' })
+      ).toThrow('Workflow execution cannot create this upload')
+      expect(() =>
+        assertUploadSessionAuthBinding(
+          session,
+          createTestRuntimePrincipal({ principal: actor, executionId: 'other-execution' })
+        )
+      ).toThrow('Upload session not found')
+    }
+  )
+
+  it.each([
+    { workspaceId: WORKSPACE_ID, audience: 'uploads' },
+    { workspaceId: 'other-workspace', audience: 'uploads' },
+    { workspaceId: WORKSPACE_ID, audience: 'other-audience' },
+  ])(
+    'rejects legacy executor bindings instead of accepting a different delegated identity: %j',
+    (scope) => {
+      const principal = createTestRuntimePrincipal({
+        principal: {
+          kind: 'delegated',
+          serviceId: 'copilot',
+          subjectUserId: 'user-1',
+          ...scope,
+          delegationId: 'copilot-1',
+          issuedAt: new Date(),
+          expiresAt: new Date(Date.now() + 60_000),
+        },
+      })
+      const session = sessionRecord({
+        purpose: 'table_import',
+        metadata: {
+          authBinding: {
+            version: 1,
+            workspaceId: WORKSPACE_ID,
+            principal: {
+              kind: 'delegated',
+              serviceId: 'executor',
+              subjectUserId: 'user-1',
+              audience: 'uploads',
+              workflowId: 'workflow-1',
+              executionId: 'execution-1',
+            },
+          },
+        },
+      })
+
+      expect(() => assertUploadSessionAuthBinding(session, principal)).toThrow(
+        'Upload session not found'
+      )
+    }
+  )
+
   it('compares persisted executor bindings independently of JSON object key order', () => {
     const session = sessionRecord({
       purpose: 'table_import',

apps/sim/lib/uploads/upload-session/service.ts

@@ -3,8 +3,6 @@ import {
   type Principal,
   parsePrincipal,
   requirePrincipalExecutionMetadata,
-  requirePrincipalSubjectUserId,
-  resolvePrincipalSubject,
   type SerializedPrincipalV2,
   serializePrincipal,
 } from '@sim/auth/principal'
@@ -167,7 +165,7 @@ function isExecutorWorkflowExecutionPrincipal(
   } catch {
     return false
   }
-  return resolvePrincipalSubject(principal)?.kind === 'sim_user'
+  return true
 }
 
 interface CreateUploadSessionBaseParams {
@@ -509,6 +507,8 @@ export function assertUploadSessionAuthBinding(
     return
   }
   const bound = candidate.principal
+  /** Version-1 executor bindings cannot prove the canonical runtime principal identity. */
+  if (bound.kind === 'delegated') throw uploadNotFound()
   const matches =
     bound.kind === principal.kind &&
     (bound.kind === 'session'
@@ -519,15 +519,9 @@ export function assertUploadSessionAuthBinding(
         ? principal.kind === 'personal_api_key' &&
           bound.userId === principal.userId &&
           bound.keyId === principal.keyId
-        : bound.kind === 'workspace_api_key'
-          ? principal.kind === 'workspace_api_key' &&
-            bound.workspaceId === principal.workspaceId &&
-            bound.keyId === principal.keyId
-          : isExecutorWorkflowExecutionPrincipal(principal) &&
-            resolvePrincipalSubject(principal)?.kind === 'sim_user' &&
-            requirePrincipalSubjectUserId(principal) === bound.subjectUserId &&
-            principal.executionMetadata.rootWorkflowId === bound.workflowId &&
-            principal.executionMetadata.executionId === bound.executionId)
+        : principal.kind === 'workspace_api_key' &&
+          bound.workspaceId === principal.workspaceId &&
+          bound.keyId === principal.keyId)
   if (!matches) throw uploadNotFound()
 }