improvement(network): consolidate scoped request lifecycles

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/security.mdx

@@ -3,8 +3,6 @@ title: Security
 description: Manage organization session policies and view configured outbound IP addresses
 ---
 
-import { Callout } from 'fumadocs-ui/components/callout'
-
 Organization owners and admins open **Settings → Security** to manage session policies and view outbound IP addresses. [Single sign-on](/platform/enterprise/sso) remains a separate settings page for identity providers, verified domains, and provisioning.
 
 ## Session policies
@@ -17,18 +15,10 @@ See [Session policies](/platform/enterprise/session-policies) for limits, defaul
 
 ## Outbound IP addresses
 
-When an outbound gateway has been configured for your organization, this section lists the IPv4 addresses published by your deployment administrator. Use the copy button beside each address to copy it in `/32` format. Allowlist **every listed address** on the destination firewall.
-
-This section is read-only. Viewing or copying addresses does not provision a gateway or change routing. Contact Sim support for hosted deployments, or your deployment administrator for self-hosted installations, to arrange routing and confirm which connections it covers.
+Copy your organization's configured addresses in `/32` format and allowlist **every listed address** on the destination firewall. These addresses apply to supported HTTPS connections from Sim and its background workers.
 
-If dedicated IPs are not configured, the page says so. If settings cannot be loaded, use **Try again**. A paused-routing message means your administrator has blocked outbound routing.
-
-<Callout type="warn">
-  The listed addresses describe configured routing, not a successful connectivity test. Verify each required connection from both Sim and its background jobs before relying on the allowlist. Browser traffic and traffic originating inside external services do not use this gateway. The current mandatory-gateway mode also blocks unsupported transports, including remote sandbox creation and raw database connections; it does not silently send them through another network.
-</Callout>
+Contact Sim support or your deployment administrator to configure dedicated IPs and confirm connection coverage.
 
 ## Availability
 
 On Sim Cloud, Security settings require an Enterprise organization and an owner or admin role. On self-hosted deployments, the outbound IP section is available to organization administrators; session controls appear only when session policies are enabled. See [self-hosted enterprise configuration](/platform/enterprise/self-hosted).
-
-Existing links to the former **Session policies** and **Network** pages continue to open Security settings.

apps/docs/content/docs/search/gitlab.mdx

@@ -25,7 +25,7 @@ Use a self-managed GitLab instance reachable by Sim over HTTPS. The administrato
 
 The CSV path checks the token's identity and project access. It does not require administrator directory access or a custom admin role.
 
-If your GitLab instance restricts inbound traffic by source IP, coordinate the allowlist before connecting. When dedicated routing is configured, organization admins can copy its published addresses from [Settings → Security → Outbound IP addresses](/platform/enterprise/security#outbound-ip-addresses). Confirm access from both the application and background sync jobs; seeing the addresses in Settings does not verify connectivity.
+If your GitLab instance restricts access by source IP, allowlist the configured addresses from [Settings → Security → Outbound IP addresses](/platform/enterprise/security#outbound-ip-addresses). Confirm connectivity from Sim and its background sync jobs before the initial sync.
 
 <Callout type="warn">
   CSV files define access in Sim. Each mapped user listed for the selected project can read all of that source's indexed, non-confidential content. Sim does not infer that user's GitLab role or feature restrictions in this path. Include only users who should have that access, and replace the files whenever memberships or email mappings change.

apps/sim/app/api/cron/renew-subscriptions/route.test.ts

@@ -3,27 +3,55 @@
  *
  * @vitest-environment node
  */
+
+import { webhook } from '@sim/db/schema'
 import {
   authOAuthUtilsMock,
+  authOAuthUtilsMockFns,
   createMockRequest,
   dbChainMockFns,
+  queueTableRows,
   redisConfigMockFns,
   resetDbChainMock,
 } from '@sim/testing'
-import { sleep } from '@sim/utils/helpers'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockVerifyCronAuth } = vi.hoisted(() => ({
+const mocks = vi.hoisted(() => ({
   mockVerifyCronAuth: vi.fn().mockReturnValue(null),
+  detached: vi.fn<(label: string, work: () => Promise<unknown>) => void>(),
+  enabled: vi.fn(() => true),
+  workspace: vi.fn(),
+  route: vi.fn(async (organizationId: string | null | undefined) => ({ organizationId })),
+  fetch: vi.fn<typeof fetch>(),
+  credentialOwner: vi.fn(),
 }))
 
 vi.mock('@/lib/auth/internal', () => ({
-  verifyCronAuth: mockVerifyCronAuth,
+  verifyCronAuth: mocks.mockVerifyCronAuth,
 }))
 
 vi.mock('@/lib/oauth/credential-service', () => authOAuthUtilsMock)
+vi.mock('@/lib/core/utils/background', () => ({ runDetached: mocks.detached }))
+vi.mock('@/lib/core/network/config.server', () => ({
+  isOutboundRoutingEnabled: mocks.enabled,
+  resolveOutboundRoute: mocks.route,
+}))
+vi.mock('@/lib/workspaces/application/workspace-context', () => ({
+  loadActiveWorkspaceApplicationContext: mocks.workspace,
+}))
+vi.mock('@/lib/core/security/input-validation.server', () => ({ outboundFetch: mocks.fetch }))
+vi.mock('@/lib/webhooks/provider-subscription-utils', () => ({
+  getCredentialOwner: mocks.credentialOwner,
+  getNotificationUrl: () => 'https://example.com/api/webhooks/trigger/teams',
+}))
 
-import { GET } from './route'
+import {
+  resolveCurrentOutboundRoute,
+  runWithOutboundOrganization,
+} from '@/lib/core/network/context.server'
+import { GET } from '@/app/api/cron/renew-subscriptions/route'
+
+const NEW_EXPIRATION = '2030-01-04T00:00:00.000Z'
 
 function createRequest() {
   return createMockRequest(
@@ -34,24 +62,59 @@ function createRequest() {
   )
 }
 
-const flushMicrotasks = () => sleep(0)
+function expiringWebhook(id: string, workspaceId: string | null) {
+  return {
+    workspaceId,
+    webhook: {
+      id,
+      workflowId: `workflow-${id}`,
+      providerConfig: {
+        triggerId: 'microsoftteams_chat_subscription',
+        subscriptionExpiration: new Date(Date.now() + 60_000).toISOString(),
+        credentialId: 'shared-credential',
+        externalSubscriptionId: `subscription-${id}`,
+        chatId: 'chat-1',
+      },
+    },
+  }
+}
+
+async function runBackground() {
+  expect(mocks.detached).toHaveBeenCalledExactlyOnceWith(
+    'teams-subscription-renewal',
+    expect.any(Function)
+  )
+  await mocks.detached.mock.calls[0][1]()
+}
 
 describe('Teams subscription renewal route (fire-and-forget)', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()
     redisConfigMockFns.mockAcquireLock.mockResolvedValue(true)
     redisConfigMockFns.mockReleaseLock.mockResolvedValue(true)
-    mockVerifyCronAuth.mockReturnValue(null)
+    mocks.mockVerifyCronAuth.mockReturnValue(null)
+    mocks.enabled.mockReturnValue(true)
+    mocks.workspace.mockResolvedValue({ workspaceOrganizationId: 'org-1' })
+    mocks.credentialOwner.mockResolvedValue({ accountId: 'account-1', userId: 'credential-owner' })
+    authOAuthUtilsMockFns.mockRefreshAccessTokenIfNeeded.mockImplementation(async () => {
+      await resolveCurrentOutboundRoute()
+      return 'access-token'
+    })
+    mocks.fetch.mockImplementation(async () => {
+      await resolveCurrentOutboundRoute()
+      return Response.json({ expirationDateTime: NEW_EXPIRATION })
+    })
   })
 
   it('returns the auth error when cron auth fails', async () => {
-    mockVerifyCronAuth.mockReturnValueOnce(new Response(null, { status: 401 }) as never)
+    mocks.mockVerifyCronAuth.mockReturnValueOnce(new Response(null, { status: 401 }) as never)
 
     const response = await GET(createRequest())
 
     expect(response.status).toBe(401)
     expect(redisConfigMockFns.mockAcquireLock).not.toHaveBeenCalled()
+    expect(mocks.detached).not.toHaveBeenCalled()
   })
 
   it('acknowledges with 202 and renews in the background after acquiring the lock', async () => {
@@ -67,7 +130,8 @@ describe('Teams subscription renewal route (fire-and-forget)', () => {
       { reclaimOnFailure: true }
     )
 
-    await flushMicrotasks()
+    expect(dbChainMockFns.select).not.toHaveBeenCalled()
+    await runBackground()
     expect(dbChainMockFns.select).toHaveBeenCalled()
     expect(redisConfigMockFns.mockReleaseLock).toHaveBeenCalledWith(
       'teams-subscription-renewal-lock',
@@ -84,5 +148,120 @@ describe('Teams subscription renewal route (fire-and-forget)', () => {
     const data = await response.json()
     expect(data).toMatchObject({ status: 'skip' })
     expect(dbChainMockFns.select).not.toHaveBeenCalled()
+    expect(mocks.detached).not.toHaveBeenCalled()
+  })
+
+  it('scopes refresh and Graph calls by each canonical workspace, not the credential owner', async () => {
+    queueTableRows(webhook, [
+      expiringWebhook('first', 'workspace-1'),
+      expiringWebhook('second', 'workspace-2'),
+    ])
+    mocks.workspace
+      .mockResolvedValueOnce({ workspaceOrganizationId: 'org-1' })
+      .mockResolvedValueOnce({ workspaceOrganizationId: null })
+
+    await GET(createRequest())
+    await runWithOutboundOrganization('caller-org', runBackground)
+
+    expect(mocks.workspace.mock.calls).toEqual([['workspace-1'], ['workspace-2']])
+    expect(mocks.route.mock.calls).toEqual([['org-1'], ['org-1'], [null], [null]])
+    expect(mocks.fetch.mock.calls.map(([url, init]) => [url, init?.method])).toEqual([
+      ['https://graph.microsoft.com/v1.0/subscriptions/subscription-first', 'PATCH'],
+      ['https://graph.microsoft.com/v1.0/subscriptions/subscription-second', 'PATCH'],
+    ])
+    expect(dbChainMockFns.set).toHaveBeenCalledTimes(2)
+    expect(await resolveCurrentOutboundRoute()).toEqual({ organizationId: undefined })
   })
+
+  it.each([404, 410])(
+    'recreates an expired subscription through the same scope after Graph returns %s',
+    async (status) => {
+      queueTableRows(webhook, [expiringWebhook('expired', 'workspace-1')])
+      mocks.fetch
+        .mockImplementationOnce(async () => {
+          await resolveCurrentOutboundRoute()
+          return Response.json({ error: { message: 'Subscription expired' } }, { status })
+        })
+        .mockImplementationOnce(async () => {
+          await resolveCurrentOutboundRoute()
+          return Response.json({ id: 'replacement', expirationDateTime: NEW_EXPIRATION })
+        })
+
+      await GET(createRequest())
+      await runBackground()
+
+      expect(mocks.route.mock.calls).toEqual([['org-1'], ['org-1'], ['org-1']])
+      expect(mocks.fetch).toHaveBeenLastCalledWith(
+        'https://graph.microsoft.com/v1.0/subscriptions',
+        expect.objectContaining({ method: 'POST' })
+      )
+      expect(dbChainMockFns.set).toHaveBeenCalledExactlyOnceWith({
+        providerConfig: expect.objectContaining({
+          externalSubscriptionId: 'replacement',
+          subscriptionExpiration: NEW_EXPIRATION,
+        }),
+        updatedAt: expect.any(Date),
+      })
+    }
+  )
+
+  it.each([null, 'removed-workspace'])(
+    'skips unresolved workspace %s without provider calls and renews the next webhook',
+    async (workspaceId) => {
+      queueTableRows(webhook, [
+        expiringWebhook('unresolved', workspaceId),
+        expiringWebhook('valid', 'workspace-1'),
+      ])
+      mocks.workspace.mockImplementation(async (id: string) =>
+        id === 'workspace-1' ? { workspaceOrganizationId: 'org-1' } : null
+      )
+
+      await GET(createRequest())
+      await runBackground()
+
+      expect(authOAuthUtilsMockFns.mockRefreshAccessTokenIfNeeded).toHaveBeenCalledOnce()
+      expect(mocks.fetch).toHaveBeenCalledExactlyOnceWith(
+        'https://graph.microsoft.com/v1.0/subscriptions/subscription-valid',
+        expect.objectContaining({ method: 'PATCH' })
+      )
+      expect(dbChainMockFns.set).toHaveBeenCalledOnce()
+      expect(redisConfigMockFns.mockReleaseLock).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('continues after a routed provider failure and releases the lock', async () => {
+    queueTableRows(webhook, [
+      expiringWebhook('failed', 'workspace-1'),
+      expiringWebhook('valid', 'workspace-2'),
+    ])
+    mocks.workspace
+      .mockResolvedValueOnce({ workspaceOrganizationId: 'org-1' })
+      .mockResolvedValueOnce({ workspaceOrganizationId: 'org-2' })
+    mocks.fetch.mockImplementationOnce(async () => {
+      await resolveCurrentOutboundRoute()
+      throw new Error('Gateway unavailable')
+    })
+
+    await GET(createRequest())
+    await runBackground()
+
+    expect(mocks.route.mock.calls).toEqual([['org-1'], ['org-1'], ['org-2'], ['org-2']])
+    expect(dbChainMockFns.set).toHaveBeenCalledOnce()
+    expect(redisConfigMockFns.mockReleaseLock).toHaveBeenCalledOnce()
+  })
+
+  it.each(['workspace-1', null])(
+    'renews legacy workspace %s without an extra lookup when routing is unconfigured',
+    async (workspaceId) => {
+      mocks.enabled.mockReturnValue(false)
+      queueTableRows(webhook, [expiringWebhook('default', workspaceId)])
+
+      await GET(createRequest())
+      await runBackground()
+
+      expect(mocks.workspace).not.toHaveBeenCalled()
+      expect(mocks.fetch).toHaveBeenCalledOnce()
+      expect(dbChainMockFns.set).toHaveBeenCalledOnce()
+    }
+  )
 })