fix(workflows): migrate Copilot application boundary

Author: TheodoreSpeaks

apps/sim/app/api/v2/workflows/[id]/deploy/route.test.ts

@@ -39,6 +39,7 @@ describe('/api/v2/workflows/[id]/deploy route definitions', () => {
         workflowId: 'workflow-1',
         name: undefined,
         description: undefined,
+        analytics: 'human',
       })
     )
 
@@ -78,21 +79,9 @@ describe('/api/v2/workflows/[id]/deploy route definitions', () => {
     expect(v2DeployWorkflowContract.response.schema.parse(body)).toEqual(body)
   })
 
-  it('keeps product analytics on the v2 adapter', async () => {
-    const result = { workflowId: 'workflow-1', workspaceId: 'workspace-1' }
-    await Reflect.get(
-      POST,
-      'onSuccess'
-    )({
-      principal: { kind: 'personal_api_key', userId: 'user-1', keyId: 'key-1' },
-      result,
-    })
-    expect(mocks.capture).toHaveBeenCalledWith(
-      'user-1',
-      'workflow_deployed',
-      { workflow_id: 'workflow-1', workspace_id: 'workspace-1' },
-      expect.objectContaining({ groups: { workspace: 'workspace-1' } })
-    )
+  it('defers deploy analytics to durable activation', () => {
+    expect(Reflect.get(POST, 'onSuccess')).toBeUndefined()
+    expect(mocks.capture).not.toHaveBeenCalled()
   })
 
   it('keeps undeploy on the authorized operation and declared response schema', () => {

apps/sim/app/api/v2/workflows/[id]/deploy/route.ts

@@ -30,6 +30,7 @@ export const POST = defineV2JsonRoute({
     name: body.name,
     description: body.description ?? undefined,
     requestId: generateRequestId(),
+    analytics: 'human' as const,
   }),
   useCase: deployWorkflow,
   present: (result) => ({
@@ -43,20 +44,6 @@ export const POST = defineV2JsonRoute({
       latestDeploymentAttempt: result.latestDeploymentAttempt ?? null,
     },
   }),
-  onSuccess: ({ principal, result }) => {
-    if (principal.kind !== 'personal_api_key') {
-      throw new Error('Admin deployment unexpectedly admitted a workspace API key')
-    }
-    captureServerEvent(
-      principal.userId,
-      'workflow_deployed',
-      { workflow_id: result.workflowId, workspace_id: result.workspaceId },
-      {
-        groups: { workspace: result.workspaceId },
-        setOnce: { first_workflow_deployed_at: new Date().toISOString() },
-      }
-    )
-  },
 })
 
 export const DELETE = defineV2JsonRoute({

apps/sim/app/api/v2/workflows/[id]/execute/route.test.ts

@@ -493,6 +493,9 @@ describe('POST /api/v2/workflows/[id]/execute', () => {
 
     const okRes = await callPublicExecute({ input: {} })
     expect(okRes.status).toBe(200)
+    expect(mockCheckPreAuthRate.mock.invocationCallOrder[0]).toBeLessThan(
+      dbChainMockFns.select.mock.invocationCallOrder[0]
+    )
     expect(mockAuthenticateV2ApiKey).not.toHaveBeenCalled()
     expect(mockCheckOperationRate).not.toHaveBeenCalled()
     expect(mockPreprocessExecution).toHaveBeenCalledWith(
@@ -506,6 +509,22 @@ describe('POST /api/v2/workflows/[id]/execute', () => {
     expect(asyncRes.status).toBe(400)
   })
 
+  it('rejects anonymous abuse before looking up the workflow', async () => {
+    mockCheckPreAuthRate.mockResolvedValueOnce({
+      allowed: false,
+      remaining: 0,
+      resetAt: new Date('2026-08-08T05:00:00Z'),
+      retryAfterMs: 10_000,
+    })
+
+    const response = await callPublicExecute({ input: {} })
+
+    expect(response.status).toBe(429)
+    expect(dbChainMockFns.select).not.toHaveBeenCalled()
+    expect(mockValidatePublicApiAllowed).not.toHaveBeenCalled()
+    expect(mockAuthenticateV2ApiKey).not.toHaveBeenCalled()
+  })
+
   it('401s non-public workflows without a key', async () => {
     dbChainMockFns.limit.mockResolvedValueOnce([
       { isPublicApi: false, isDeployed: true, userId: 'owner-1', workspaceId: 'workspace-1' },

apps/sim/app/api/v2/workflows/[id]/execute/route.ts

@@ -11,7 +11,7 @@ import {
 } from '@/lib/api/contracts/v2/workflows'
 import { parseRequest } from '@/lib/api/server'
 import {
-  admitV2Request,
+  admitOptionalV2Request,
   V2RouteInfrastructureError,
   v2ApiKeyAuth,
   v2RateLimits,
@@ -112,14 +112,15 @@ export const POST = withRouteHandler(
     let isPublicApiAccess = false
     let apiKeyPrincipal: V2ApiKeyPrincipal | undefined
 
-    if (req.headers.has('x-api-key')) {
-      const admission = await admitV2Request(
-        req,
-        workflowOperations.execute,
-        v2ApiKeyAuth,
-        v2RateLimits.publicApi
-      )
-      if (!admission.success) return admission.response
+    const admission = await admitOptionalV2Request(
+      req,
+      workflowOperations.execute,
+      v2ApiKeyAuth,
+      v2RateLimits.publicApi
+    )
+    if (!admission.success) return admission.response
+
+    if (admission.auth) {
       apiKeyPrincipal = admission.auth.principal
       userId = admission.auth.rolloutUserId
     } else {

apps/sim/app/api/v2/workflows/[id]/rollback/route.test.ts

@@ -5,7 +5,6 @@ import { describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
   defineRoute: vi.fn((definition) => definition),
-  capture: vi.fn(),
 }))
 
 vi.mock('@/lib/api/server/routes', () => ({
@@ -14,7 +13,6 @@ vi.mock('@/lib/api/server/routes', () => ({
   v2RateLimits: { publicApi: { kind: 'public-api' } },
   v2OrchestrationErrorPolicy: { kind: 'orchestration-errors' },
 }))
-vi.mock('@/lib/posthog/server', () => ({ captureServerEvent: mocks.capture }))
 
 import { v2RollbackWorkflowContract } from '@/lib/api/contracts/v2/workflows'
 import { v2WorkflowErrorPolicies } from '@/lib/workflows/api'
@@ -36,6 +34,7 @@ describe('/api/v2/workflows/[id]/rollback route definition', () => {
         workflowId: 'workflow-1',
         version: undefined,
         transition: 'rollback',
+        analytics: 'human',
       })
     )
 
@@ -75,19 +74,7 @@ describe('/api/v2/workflows/[id]/rollback route definition', () => {
     expect(v2RollbackWorkflowContract.response.schema.parse(body)).toEqual(body)
   })
 
-  it('keeps activation analytics on the v2 adapter', async () => {
-    await Reflect.get(
-      POST,
-      'onSuccess'
-    )({
-      principal: { kind: 'personal_api_key', userId: 'user-1', keyId: 'key-1' },
-      result: { workflowId: 'workflow-1', workspaceId: 'workspace-1', version: 1 },
-    })
-    expect(mocks.capture).toHaveBeenCalledWith(
-      'user-1',
-      'deployment_version_activated',
-      { workflow_id: 'workflow-1', workspace_id: 'workspace-1', version: 1 },
-      { groups: { workspace: 'workspace-1' } }
-    )
+  it('defers activation analytics to durable activation', () => {
+    expect(Reflect.get(POST, 'onSuccess')).toBeUndefined()
   })
 })

apps/sim/app/api/v2/workflows/[id]/rollback/route.ts

@@ -1,7 +1,6 @@
 import { v2RollbackWorkflowContract } from '@/lib/api/contracts/v2/workflows'
 import { defineV2JsonRoute, v2ApiKeyAuth, v2RateLimits } from '@/lib/api/server/routes'
 import { generateRequestId } from '@/lib/core/utils/request'
-import { captureServerEvent } from '@/lib/posthog/server'
 import { v2WorkflowErrorPolicies } from '@/lib/workflows/api'
 import { activateWorkflowVersion } from '@/lib/workflows/application/deployments'
 import { workflowOperations } from '@/lib/workflows/application/operations'
@@ -27,6 +26,7 @@ export const POST = defineV2JsonRoute({
     version: body.version,
     transition: 'rollback' as const,
     requestId: generateRequestId(),
+    analytics: 'human' as const,
   }),
   useCase: activateWorkflowVersion,
   present: (result) => ({
@@ -40,19 +40,4 @@ export const POST = defineV2JsonRoute({
       latestDeploymentAttempt: result.latestDeploymentAttempt ?? null,
     },
   }),
-  onSuccess: ({ principal, result }) => {
-    if (principal.kind !== 'personal_api_key') {
-      throw new Error('Admin activation unexpectedly admitted a workspace API key')
-    }
-    captureServerEvent(
-      principal.userId,
-      'deployment_version_activated',
-      {
-        workflow_id: result.workflowId,
-        workspace_id: result.workspaceId,
-        version: result.version,
-      },
-      { groups: { workspace: result.workspaceId } }
-    )
-  },
 })

apps/sim/app/api/workflows/[id]/deploy/route.ts

@@ -110,7 +110,7 @@ export const POST = withRouteHandler(
       const principal = await internalSessionAuth.authenticate()
       const result = await deployWorkflow.execute({
         principal,
-        input: { workflowId: id, requestId },
+        input: { workflowId: id, requestId, analytics: 'human' },
         request,
       })
 
@@ -120,16 +120,6 @@ export const POST = withRouteHandler(
         `[${requestId}] Workflow deployment ${attemptActivated ? 'activated' : 'accepted for preparation'}: ${id}`
       )
 
-      captureServerEvent(
-        principal.userId,
-        'workflow_deployed',
-        { workflow_id: result.workflowId, workspace_id: result.workspaceId },
-        {
-          groups: { workspace: result.workspaceId },
-          setOnce: { first_workflow_deployed_at: new Date().toISOString() },
-        }
-      )
-
       return createSuccessResponse({
         apiKey: 'Workspace API keys',
         isDeployed,

apps/sim/app/api/workflows/[id]/deployments/[version]/route.ts

@@ -8,7 +8,6 @@ import { InternalUnauthenticatedError, internalSessionAuth } from '@/lib/api/ser
 import { asOrchestrationError, statusForOrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { captureServerEvent } from '@/lib/posthog/server'
 import { activateWorkflowVersion } from '@/lib/workflows/application/deployments'
 import { readWorkflowVersion } from '@/lib/workflows/application/read-workflow-version'
 import { updateDeploymentVersionMetadata } from '@/lib/workflows/persistence/utils'
@@ -85,7 +84,13 @@ export const PATCH = withRouteHandler(
       if (isActive) {
         const activateResult = await activateWorkflowVersion.execute({
           principal,
-          input: { workflowId: id, version: versionNum, transition: 'activate', requestId },
+          input: {
+            workflowId: id,
+            version: versionNum,
+            transition: 'activate',
+            requestId,
+            analytics: 'human',
+          },
           request,
         })
 
@@ -124,17 +129,6 @@ export const PATCH = withRouteHandler(
           }
         }
 
-        captureServerEvent(
-          principal.userId,
-          'deployment_version_activated',
-          {
-            workflow_id: activateResult.workflowId,
-            workspace_id: activateResult.workspaceId,
-            version: versionNum,
-          },
-          { groups: { workspace: activateResult.workspaceId } }
-        )
-
         return createSuccessResponse({
           success: true,
           deployedAt: activateResult.deployedAt ?? null,

apps/sim/lib/api/server/routes/index.ts

@@ -15,6 +15,7 @@ export {
 } from '@/lib/api/server/routes/internal-json-route'
 export { defineV2BinaryRoute } from '@/lib/api/server/routes/v2-binary-route'
 export {
+  admitOptionalV2Request,
   admitV2Request,
   defineV2JsonRoute,
   type V2ErrorPolicy,

apps/sim/lib/api/server/routes/v2-json-route.ts

@@ -110,27 +110,26 @@ export const v2OrchestrationErrorPolicy = {
   },
 } satisfies V2ErrorPolicy
 
-export async function admitV2Request(
-  request: NextRequest,
-  operation: ApplicationOperation,
-  authPolicy: typeof v2ApiKeyAuth,
-  rateLimitPolicy: V2RateLimitPolicy
-): Promise<
-  { success: true; auth: V2ApiKeyAuthContext } | { success: false; response: NextResponse }
-> {
+async function enforceV2PreAuthIpLimit(request: NextRequest): Promise<NextResponse | null> {
   const ip = getClientIp(request)
   const abuseLimit = await rateLimiter.checkRateLimitDirect(
     `v2:preauth:ip:${ip}`,
     V2_PREAUTH_IP_LIMIT,
     { failClosed: true }
   )
-  if (!abuseLimit.allowed) {
-    return {
-      success: false,
-      response: v2RateLimitError({ ...abuseLimit, limit: V2_PREAUTH_IP_LIMIT.maxTokens }),
-    }
-  }
+  return abuseLimit.allowed
+    ? null
+    : v2RateLimitError({ ...abuseLimit, limit: V2_PREAUTH_IP_LIMIT.maxTokens })
+}
 
+async function admitAuthenticatedV2Request(
+  request: NextRequest,
+  operation: ApplicationOperation,
+  authPolicy: typeof v2ApiKeyAuth,
+  rateLimitPolicy: V2RateLimitPolicy
+): Promise<
+  { success: true; auth: V2ApiKeyAuthContext } | { success: false; response: NextResponse }
+> {
   let auth: V2ApiKeyAuthContext
   try {
     auth = await authPolicy.authenticate(request)
@@ -153,6 +152,33 @@ export async function admitV2Request(
   return limited ? { success: false, response: limited } : { success: true, auth }
 }
 
+export async function admitV2Request(
+  request: NextRequest,
+  operation: ApplicationOperation,
+  authPolicy: typeof v2ApiKeyAuth,
+  rateLimitPolicy: V2RateLimitPolicy
+): Promise<
+  { success: true; auth: V2ApiKeyAuthContext } | { success: false; response: NextResponse }
+> {
+  const preAuthResponse = await enforceV2PreAuthIpLimit(request)
+  if (preAuthResponse) return { success: false, response: preAuthResponse }
+  return admitAuthenticatedV2Request(request, operation, authPolicy, rateLimitPolicy)
+}
+
+export async function admitOptionalV2Request(
+  request: NextRequest,
+  operation: ApplicationOperation,
+  authPolicy: typeof v2ApiKeyAuth,
+  rateLimitPolicy: V2RateLimitPolicy
+): Promise<
+  { success: true; auth?: V2ApiKeyAuthContext } | { success: false; response: NextResponse }
+> {
+  const preAuthResponse = await enforceV2PreAuthIpLimit(request)
+  if (preAuthResponse) return { success: false, response: preAuthResponse }
+  if (!request.headers.has('x-api-key')) return { success: true }
+  return admitAuthenticatedV2Request(request, operation, authPolicy, rateLimitPolicy)
+}
+
 interface V2JsonRouteOptions<C extends JsonApiRouteContract, O extends ApplicationOperation, I, R>
   extends JsonRouteDefinition<C, O, I, R> {
   auth: typeof v2ApiKeyAuth