Skip to content

Commit 9304304

Browse files
TheodoreSpeaksTheodoreSpeaks
committed
feat(auth): bind workflow authority to runtime principals
1 parent 04322e0 commit 9304304

183 files changed

Lines changed: 3519 additions & 4059 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎apps/sim/app/api/knowledge/[id]/connectors/[connectorId]/route.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,12 +48,12 @@ export const PATCH = defineInternalJsonRoute({
4848
reason: 'Preserve existing internal connector-update behavior',
4949
}),
5050
errorPolicy: internalKnowledgeErrorPolicies.connectors,
51-
mapInput: ({ params, body }, { principal, request }) => ({
51+
mapInput: ({ params, body }, { principal, request, authTransport }) => ({
5252
connectorId: params.connectorId,
5353
knowledgeBaseId: params.id,
5454
updates: body,
5555
resolveBillingAttribution: (workspaceId: string) =>
56-
resolveInternalKnowledgeBillingAttribution(request, principal, workspaceId),
56+
resolveInternalKnowledgeBillingAttribution(request, principal, workspaceId, authTransport),
5757
source: 'ui' as const,
5858
}),
5959
useCase: updateKnowledgeConnector,

‎apps/sim/app/api/knowledge/[id]/connectors/[connectorId]/sync/route.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,12 @@ export const POST = defineInternalJsonRoute({
1919
reason: 'Preserve existing internal connector-sync behavior',
2020
}),
2121
errorPolicy: internalKnowledgeErrorPolicies.connectors,
22-
mapInput: ({ params, query }, { principal, request }) => ({
22+
mapInput: ({ params, query }, { principal, request, authTransport }) => ({
2323
connectorId: params.connectorId,
2424
knowledgeBaseId: params.id,
2525
rehydrate: query.rehydrate,
2626
resolveBillingAttribution: (workspaceId: string) =>
27-
resolveInternalKnowledgeBillingAttribution(request, principal, workspaceId),
27+
resolveInternalKnowledgeBillingAttribution(request, principal, workspaceId, authTransport),
2828
source: 'ui' as const,
2929
}),
3030
useCase: syncKnowledgeConnector,

‎apps/sim/app/api/knowledge/[id]/connectors/route.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ export const POST = defineInternalJsonRoute({
4242
reason: 'Preserve existing internal connector-create behavior',
4343
}),
4444
errorPolicy: internalKnowledgeErrorPolicies.connectors,
45-
mapInput: ({ params, body }, { principal, request }) => ({
45+
mapInput: ({ params, body }, { principal, request, authTransport }) => ({
4646
knowledgeBaseId: params.id,
4747
connectorType: body.connectorType,
4848
credentialId: body.credentialId,
@@ -53,7 +53,7 @@ export const POST = defineInternalJsonRoute({
5353
credentialGroupId: body.credentialGroupId,
5454
credentialGroupOptionId: body.credentialGroupOptionId,
5555
resolveBillingAttribution: (workspaceId: string) =>
56-
resolveInternalKnowledgeBillingAttribution(request, principal, workspaceId),
56+
resolveInternalKnowledgeBillingAttribution(request, principal, workspaceId, authTransport),
5757
source: 'ui' as const,
5858
}),
5959
useCase: createKnowledgeConnector,

‎apps/sim/app/api/knowledge/[id]/documents/[documentId]/chunks/[chunkId]/route.ts‎

Lines changed: 39 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,11 @@ import {
55
getKnowledgeChunkContract,
66
updateKnowledgeChunkContract,
77
} from '@/lib/api/contracts/knowledge'
8-
import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
8+
import {
9+
defineInternalJsonRoute,
10+
type InternalAuthTransport,
11+
internalRateLimits,
12+
} from '@/lib/api/server/routes'
913
import { OrchestrationError } from '@/lib/core/orchestration/types'
1014
import {
1115
internalKnowledgeAuthType,
@@ -32,13 +36,19 @@ function resolveContentProvenance(
3236
principal: Principal,
3337
payload: unknown,
3438
workspaceId: string | undefined,
35-
includeContent: boolean
39+
includeContent: boolean,
40+
authTransport: InternalAuthTransport | undefined
3641
) {
3742
const resolved = resolveKnowledgeWriteSecretProvenance({
3843
headers: request.headers,
3944
payload,
40-
authType: internalKnowledgeAuthType(principal),
41-
userId: internalKnowledgeProvenanceUserId(request.headers, principal, workspaceId),
45+
authType: internalKnowledgeAuthType(authTransport),
46+
userId: internalKnowledgeProvenanceUserId(
47+
request.headers,
48+
principal,
49+
workspaceId,
50+
authTransport
51+
),
4252
...(workspaceId ? { workspaceId } : {}),
4353
selectionKeys: includeContent ? ['chunk-content'] : [],
4454
})
@@ -61,11 +71,16 @@ export const GET = defineInternalJsonRoute({
6171
}),
6272
useCase: readKnowledgeChunk,
6373
present: ({ chunk }) => ({ success: true as const, data: toInternalKnowledgeChunk(chunk) }),
64-
finalizeResponse: ({ request, principal, result, body }) =>
74+
finalizeResponse: ({ request, principal, result, body, authTransport }) =>
6575
finalizeKnowledgePersistedResponse({
6676
headers: request.headers,
67-
authType: internalKnowledgeAuthType(principal),
68-
userId: internalKnowledgeProvenanceUserId(request.headers, principal, result.workspaceId),
77+
authType: internalKnowledgeAuthType(authTransport),
78+
userId: internalKnowledgeProvenanceUserId(
79+
request.headers,
80+
principal,
81+
result.workspaceId,
82+
authTransport
83+
),
6984
workspaceId: result.workspaceId,
7085
body,
7186
chunks: [
@@ -87,22 +102,34 @@ export const PUT = defineInternalJsonRoute({
87102
reason: 'Preserve existing internal chunk-update behavior',
88103
}),
89104
errorPolicy: internalKnowledgeErrorPolicies.chunks,
90-
mapInput: ({ params, body }, { principal, request }) => ({
105+
mapInput: ({ params, body }, { principal, request, authTransport }) => ({
91106
knowledgeBaseId: params.id,
92107
documentId: params.documentId,
93108
chunkId: params.chunkId,
94109
content: body.content,
95110
enabled: body.enabled,
96111
resolveContentProvenance: ({ workspaceId }: { workspaceId?: string }) =>
97-
resolveContentProvenance(request, principal, body, workspaceId, body.content !== undefined),
112+
resolveContentProvenance(
113+
request,
114+
principal,
115+
body,
116+
workspaceId,
117+
body.content !== undefined,
118+
authTransport
119+
),
98120
}),
99121
useCase: updateKnowledgeChunk,
100122
present: ({ chunk }) => ({ success: true as const, data: toInternalKnowledgeChunk(chunk) }),
101-
finalizeResponse: ({ request, principal, result, body }) =>
123+
finalizeResponse: ({ request, principal, result, body, authTransport }) =>
102124
finalizeKnowledgePersistedResponse({
103125
headers: request.headers,
104-
authType: internalKnowledgeAuthType(principal),
105-
userId: internalKnowledgeProvenanceUserId(request.headers, principal, result.workspaceId),
126+
authType: internalKnowledgeAuthType(authTransport),
127+
userId: internalKnowledgeProvenanceUserId(
128+
request.headers,
129+
principal,
130+
result.workspaceId,
131+
authTransport
132+
),
106133
workspaceId: result.workspaceId,
107134
body,
108135
chunks: [

‎apps/sim/app/api/knowledge/[id]/documents/[documentId]/chunks/route.ts‎

Lines changed: 26 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,11 @@ import {
55
createKnowledgeChunkContract,
66
listKnowledgeChunksContract,
77
} from '@/lib/api/contracts/knowledge'
8-
import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
8+
import {
9+
defineInternalJsonRoute,
10+
type InternalAuthTransport,
11+
internalRateLimits,
12+
} from '@/lib/api/server/routes'
913
import { OrchestrationError } from '@/lib/core/orchestration/types'
1014
import {
1115
internalKnowledgeAuthType,
@@ -33,13 +37,19 @@ function resolveContentProvenance(
3337
principal: Principal,
3438
payload: unknown,
3539
workspaceId: string | undefined,
36-
includeContent: boolean
40+
includeContent: boolean,
41+
authTransport: InternalAuthTransport | undefined
3742
) {
3843
const resolved = resolveKnowledgeWriteSecretProvenance({
3944
headers: request.headers,
4045
payload,
41-
authType: internalKnowledgeAuthType(principal),
42-
userId: internalKnowledgeProvenanceUserId(request.headers, principal, workspaceId),
46+
authType: internalKnowledgeAuthType(authTransport),
47+
userId: internalKnowledgeProvenanceUserId(
48+
request.headers,
49+
principal,
50+
workspaceId,
51+
authTransport
52+
),
4353
...(workspaceId ? { workspaceId } : {}),
4454
selectionKeys: includeContent ? ['chunk-content'] : [],
4555
})
@@ -66,11 +76,16 @@ export const GET = defineInternalJsonRoute({
6676
data: chunks.map(toInternalKnowledgeChunk),
6777
pagination,
6878
}),
69-
finalizeResponse: ({ request, principal, result, body }) =>
79+
finalizeResponse: ({ request, principal, result, body, authTransport }) =>
7080
finalizeKnowledgePersistedResponse({
7181
headers: request.headers,
72-
authType: internalKnowledgeAuthType(principal),
73-
userId: internalKnowledgeProvenanceUserId(request.headers, principal, result.workspaceId),
82+
authType: internalKnowledgeAuthType(authTransport),
83+
userId: internalKnowledgeProvenanceUserId(
84+
request.headers,
85+
principal,
86+
result.workspaceId,
87+
authTransport
88+
),
7489
workspaceId: result.workspaceId,
7590
body,
7691
chunks: result.chunks.map((chunk) => ({
@@ -90,20 +105,20 @@ export const POST = defineInternalJsonRoute({
90105
reason: 'Preserve existing internal chunk-create behavior',
91106
}),
92107
errorPolicy: internalKnowledgeErrorPolicies.chunks,
93-
mapInput: ({ params, body }, { principal, request }) => ({
108+
mapInput: ({ params, body }, { principal, request, authTransport }) => ({
94109
knowledgeBaseId: params.id,
95110
documentId: params.documentId,
96111
content: body.content,
97112
enabled: body.enabled,
98113
resolveContentProvenance: ({ workspaceId }: { workspaceId?: string }) =>
99-
resolveContentProvenance(request, principal, body, workspaceId, true),
114+
resolveContentProvenance(request, principal, body, workspaceId, true, authTransport),
100115
}),
101116
useCase: createKnowledgeChunk,
102117
present: ({ chunk }) => ({ success: true as const, data: toInternalKnowledgeChunk(chunk) }),
103-
finalizeResponse: ({ request, principal, result, body }) =>
118+
finalizeResponse: ({ request, principal, result, body, authTransport }) =>
104119
finalizeKnowledgeProvenanceResponse({
105120
headers: request.headers,
106-
authType: internalKnowledgeAuthType(principal),
121+
authType: internalKnowledgeAuthType(authTransport),
107122
userId: result.userId,
108123
workspaceId: result.workspaceId,
109124
body,

‎apps/sim/app/api/knowledge/[id]/documents/[documentId]/route.ts‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,16 @@ export const GET = defineInternalJsonRoute({
4141
success: true as const,
4242
data: toInternalKnowledgeDocument(document),
4343
}),
44-
finalizeResponse: ({ request, principal, result, body }) =>
44+
finalizeResponse: ({ request, principal, result, body, authTransport }) =>
4545
finalizeKnowledgePersistedResponse({
4646
headers: request.headers,
47-
authType: internalKnowledgeAuthType(principal),
48-
userId: internalKnowledgeProvenanceUserId(request.headers, principal, result.workspaceId),
47+
authType: internalKnowledgeAuthType(authTransport),
48+
userId: internalKnowledgeProvenanceUserId(
49+
request.headers,
50+
principal,
51+
result.workspaceId,
52+
authTransport
53+
),
4954
workspaceId: result.workspaceId,
5055
body,
5156
documents: [
@@ -66,7 +71,7 @@ export const PUT = defineInternalJsonRoute({
6671
reason: 'Preserve existing internal document-update behavior',
6772
}),
6873
errorPolicy: internalKnowledgeErrorPolicies.documents,
69-
mapInput: ({ params, body }, { principal, request }) => {
74+
mapInput: ({ params, body }, { principal, request, authTransport }) => {
7075
const { markFailedDueToTimeout, retryProcessing, ...updates } = body
7176
return {
7277
knowledgeBaseId: params.id,
@@ -75,7 +80,7 @@ export const PUT = defineInternalJsonRoute({
7580
markFailedDueToTimeout,
7681
retryProcessing,
7782
resolveBillingAttribution: (workspaceId: string) =>
78-
resolveInternalKnowledgeBillingAttribution(request, principal, workspaceId),
83+
resolveInternalKnowledgeBillingAttribution(request, principal, workspaceId, authTransport),
7984
source: 'ui',
8085
}
8186
},

‎apps/sim/app/api/knowledge/[id]/documents/route.ts‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,11 +56,16 @@ export const GET = defineInternalJsonRoute({
5656
pagination,
5757
},
5858
}),
59-
finalizeResponse: ({ request, principal, result, body }) =>
59+
finalizeResponse: ({ request, principal, result, body, authTransport }) =>
6060
finalizeKnowledgePersistedResponse({
6161
headers: request.headers,
62-
authType: internalKnowledgeAuthType(principal),
63-
userId: internalKnowledgeProvenanceUserId(request.headers, principal, result.workspaceId),
62+
authType: internalKnowledgeAuthType(authTransport),
63+
userId: internalKnowledgeProvenanceUserId(
64+
request.headers,
65+
principal,
66+
result.workspaceId,
67+
authTransport
68+
),
6469
workspaceId: result.workspaceId,
6570
body,
6671
documents: result.documents.map((document) => ({

‎apps/sim/app/api/logs/[id]/route.ts‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import {
44
internalErrorResponse,
55
internalOrchestrationErrorPolicy,
66
internalRateLimits,
7+
resolveInternalAuthWorkspaceId,
78
} from '@/lib/api/server/routes'
89
import { internalLogsSessionOrExecutorAuth } from '@/lib/logs/api/route-policies'
910
import { logOperations } from '@/lib/logs/application/operations'
@@ -20,8 +21,12 @@ export const GET = defineInternalJsonRoute({
2021
operation: logOperations.readDetail,
2122
rateLimit: internalRateLimits.none({ reason: 'Preserve existing internal log detail behavior' }),
2223
errorPolicy,
23-
mapInput: ({ params, query }, { principal, request }) => ({
24-
workspaceId: principal.kind === 'delegated' ? principal.workspaceId : query.workspaceId,
24+
mapInput: ({ params, query }, { request, authTransport, executionWorkspaceId }) => ({
25+
workspaceId: resolveInternalAuthWorkspaceId(
26+
authTransport,
27+
executionWorkspaceId,
28+
query.workspaceId
29+
),
2530
lookupColumn: 'id' as const,
2631
lookupValue: params.id,
2732
signal: request.signal,

‎apps/sim/app/api/logs/by-execution/[executionId]/route.ts‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import {
44
internalErrorResponse,
55
internalOrchestrationErrorPolicy,
66
internalRateLimits,
7+
resolveInternalAuthWorkspaceId,
78
} from '@/lib/api/server/routes'
89
import { internalLogsSessionOrExecutorAuth } from '@/lib/logs/api/route-policies'
910
import { logOperations } from '@/lib/logs/application/operations'
@@ -20,8 +21,12 @@ export const GET = defineInternalJsonRoute({
2021
operation: logOperations.readDetail,
2122
rateLimit: internalRateLimits.none({ reason: 'Preserve existing execution log detail behavior' }),
2223
errorPolicy,
23-
mapInput: ({ params, query }, { principal, request }) => ({
24-
workspaceId: principal.kind === 'delegated' ? principal.workspaceId : query.workspaceId,
24+
mapInput: ({ params, query }, { request, authTransport, executionWorkspaceId }) => ({
25+
workspaceId: resolveInternalAuthWorkspaceId(
26+
authTransport,
27+
executionWorkspaceId,
28+
query.workspaceId
29+
),
2530
lookupColumn: 'executionId' as const,
2631
lookupValue: params.executionId,
2732
signal: request.signal,

‎apps/sim/app/api/logs/route.ts‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import {
44
internalErrorResponse,
55
internalOrchestrationErrorPolicy,
66
internalRateLimits,
7+
resolveInternalAuthWorkspaceId,
78
} from '@/lib/api/server/routes'
89
import { internalLogsSessionOrExecutorAuth } from '@/lib/logs/api/route-policies'
910
import { listLogsUseCase } from '@/lib/logs/application/list-logs'
@@ -20,9 +21,13 @@ export const GET = defineInternalJsonRoute({
2021
operation: logOperations.list,
2122
rateLimit: internalRateLimits.none({ reason: 'Preserve existing internal logs list behavior' }),
2223
errorPolicy,
23-
mapInput: ({ query }, { principal, request }) => ({
24+
mapInput: ({ query }, { request, authTransport, executionWorkspaceId }) => ({
2425
...query,
25-
workspaceId: principal.kind === 'delegated' ? principal.workspaceId : query.workspaceId,
26+
workspaceId: resolveInternalAuthWorkspaceId(
27+
authTransport,
28+
executionWorkspaceId,
29+
query.workspaceId
30+
),
2631
signal: request.signal,
2732
}),
2833
useCase: listLogsUseCase,

0 commit comments

Comments
 (0)