test(permission-groups): pin the governed subject end to end

Four seams, each mutation-verified against the fallback it replaces:
`insertDispatch` and `runWorkflowColumn` store and forward the subject
verbatim (an explicit null survives a non-null attribution); the enrichment cell
gates on the payload subject, so a workspace-key dispatch runs ungated and a
pre-0315-shaped payload — subject null, attribution intact — stays ungated
rather than reconstructing a gate from the payer; and `deleteUserAccount`
cancels the account's non-terminal dispatches ahead of the user delete.

The 0315 backfill itself is SQL and is covered by review, not by a test.

Author: waleedlatif1

apps/sim/background/enrichment-capability-subject.test.ts

@@ -0,0 +1,157 @@
+/**
+ * @vitest-environment node
+ */
+import { resetDbChainMock } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  getTableById: vi.fn(),
+  getRowById: vi.fn(),
+  updateRow: vi.fn(),
+  pickNextEligibleGroupForRow: vi.fn(),
+  stashCellContextForResume: vi.fn(),
+  writeWorkflowGroupState: vi.fn(async () => 'wrote'),
+  markWorkflowGroupPickedUp: vi.fn(async () => 'wrote'),
+  createWorkflowCellProgressWriter: vi.fn(),
+  buildCancelledExecution: vi.fn(),
+  classifyWorkflowCellTerminalResult: vi.fn(),
+  getEnrichment: vi.fn(),
+  runEnrichment: vi.fn(),
+  skippedEnrichmentDetail: vi.fn(() => ({})),
+  checkAttributedUsageLimits: vi.fn(async () => ({ isExceeded: false })),
+  loadTableRowSecretProvenance: vi.fn(async () => ({ scope: null, entries: [] })),
+}))
+
+vi.mock('@/lib/table/service', () => ({ getTableById: mocks.getTableById }))
+vi.mock('@/lib/table/rows/service', () => ({
+  getRowById: mocks.getRowById,
+  updateRow: mocks.updateRow,
+}))
+vi.mock('@/lib/table/cell-write', () => ({
+  writeWorkflowGroupState: mocks.writeWorkflowGroupState,
+  markWorkflowGroupPickedUp: mocks.markWorkflowGroupPickedUp,
+  createWorkflowCellProgressWriter: mocks.createWorkflowCellProgressWriter,
+  buildCancelledExecution: mocks.buildCancelledExecution,
+}))
+vi.mock('@/lib/table/workflow-cell-result', () => ({
+  classifyWorkflowCellTerminalResult: mocks.classifyWorkflowCellTerminalResult,
+}))
+vi.mock('@/enrichments/registry', () => ({ getEnrichment: mocks.getEnrichment }))
+vi.mock('@/enrichments/run', () => ({
+  runEnrichment: mocks.runEnrichment,
+  skippedEnrichmentDetail: mocks.skippedEnrichmentDetail,
+}))
+vi.mock('@/lib/billing/core/billing-attribution', () => ({
+  assertBillingAttributionSnapshot: vi.fn((value) => value),
+  checkAttributedUsageLimits: mocks.checkAttributedUsageLimits,
+  toBillingContext: vi.fn(() => ({})),
+}))
+vi.mock('@/lib/table/rows/secret-provenance', () => ({
+  createExactEmptyTableRowSecretProvenance: vi.fn(() => undefined),
+  createTableRowSecretProvenanceFromRegistry: vi.fn(() => undefined),
+  loadTableRowSecretProvenance: mocks.loadTableRowSecretProvenance,
+}))
+vi.mock('@/executor/utils/resolved-secret-trace-registry', () => ({
+  ResolvedSecretTraceRegistry: class {
+    async importCrossingProvenance() {}
+  },
+}))
+vi.mock('@/lib/table/events', () => ({ appendTableEvent: vi.fn() }))
+
+import { runRowCascadeLoop } from '@/background/workflow-column-execution'
+
+const GROUP = {
+  id: 'group-1',
+  type: 'enrichment' as const,
+  enrichmentId: 'company-lookup',
+  workflowId: '',
+  outputs: [{ columnName: 'col-out', blockId: '', path: '' }],
+  inputMappings: [{ columnName: 'col-in', inputName: 'domain' }],
+}
+
+const TABLE = {
+  id: 'table-1',
+  workspaceId: 'workspace-1',
+  schema: { columns: [{ id: 'col-in', name: 'Domain', type: 'string' }], workflowGroups: [GROUP] },
+}
+
+function payload(capabilityGovernedUserId: string | null, triggeredByUserId?: string) {
+  return {
+    tableId: 'table-1',
+    tableName: 'Table',
+    rowId: 'row-1',
+    groupId: 'group-1',
+    workflowId: '',
+    workspaceId: 'workspace-1',
+    executionId: 'exec-1',
+    capabilityGovernedUserId,
+    ...(triggeredByUserId ? { triggeredByUserId } : {}),
+    billingAttribution: {
+      /** The meter's subject: the payer a workspace-key run attributes to. */
+      actorUserId: triggeredByUserId ?? 'billing-owner',
+      workspaceId: 'workspace-1',
+      organizationId: null,
+      billedAccountUserId: 'billing-owner',
+      billingEntity: { type: 'user' as const, id: 'billing-owner' },
+      billingPeriod: { start: '2026-07-01T00:00:00.000Z', end: '2026-08-01T00:00:00.000Z' },
+      payerSubscription: null,
+    },
+  }
+}
+
+/** The `userId` the cell handed the enrichment run — the per-tool gate subject. */
+function gatedUserId(): unknown {
+  expect(mocks.runEnrichment).toHaveBeenCalledTimes(1)
+  return (mocks.runEnrichment.mock.calls[0][2] as { userId?: unknown }).userId
+}
+
+describe('enrichment cell capability subject', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+    mocks.getTableById.mockResolvedValue(TABLE)
+    mocks.getRowById.mockResolvedValue({
+      id: 'row-1',
+      data: { 'col-in': 'example.com' },
+      executions: {},
+      updatedAt: new Date('2026-08-01T00:00:00.000Z'),
+    })
+    mocks.checkAttributedUsageLimits.mockResolvedValue({ isExceeded: false })
+    mocks.markWorkflowGroupPickedUp.mockResolvedValue('wrote')
+    mocks.writeWorkflowGroupState.mockResolvedValue('wrote')
+    mocks.pickNextEligibleGroupForRow.mockResolvedValue(null)
+    mocks.getEnrichment.mockReturnValue({
+      id: 'company-lookup',
+      inputs: [{ id: 'domain', required: true }],
+      providers: [],
+    })
+    mocks.runEnrichment.mockResolvedValue({ result: {}, cost: 0, detail: {} })
+  })
+
+  /**
+   * A workspace-key write is actorless: nobody's permission group governs it,
+   * and the billing owner beside it on the payload is a bystander. Handing that
+   * bystander to the enrichment would run their tool denylist against a request
+   * they never made.
+   */
+  it('runs a workspace-key dispatch ungated even though the payload names a payer', async () => {
+    await runRowCascadeLoop(payload(null, 'billing-owner') as never)
+    expect(gatedUserId()).toBeNull()
+  })
+
+  it('governs a session-triggered dispatch by the acting person', async () => {
+    await runRowCascadeLoop(payload('acting-user', 'acting-user') as never)
+    expect(gatedUserId()).toBe('acting-user')
+  })
+
+  /**
+   * The shape a pre-0315 dispatch row has after the column is added: no governed
+   * subject, attribution intact. New code reads that as actorless, which is why
+   * the migration backfills the legacy subject onto non-terminal old rows rather
+   * than letting the reader reconstruct it here.
+   */
+  it('does not fall back to the attribution when the governed subject is absent', async () => {
+    await runRowCascadeLoop(payload(null, 'legacy-trigger-user') as never)
+    expect(gatedUserId()).toBeNull()
+  })
+})

apps/sim/background/workflow-column-execution.test.ts

@@ -283,6 +283,8 @@ describe('table workflow usage-limit clear', () => {
       data: {},
       workspaceId: 'workspace-1',
       executionsPatch: { 'group-1': null },
+      /** Clearing a pre-stamp writes no values, so no acting person governs it. */
+      capabilityGovernedUserId: null,
       cancellationGuard: { groupId: 'group-1', executionId: 'execution-1' },
     })
   })

apps/sim/lib/table/cell-write.test.ts

@@ -157,6 +157,8 @@ describe('writeWorkflowGroupState', () => {
         workspaceId: TABLE.workspaceId,
         executionsPatch: { [GROUP.id]: RUNNING_STATE },
         cancellationGuard: { groupId: GROUP.id, executionId: CONTEXT.executionId },
+        /** A cell result carries no acting person down to the write layer. */
+        capabilityGovernedUserId: null,
         secretProvenance,
       },
       TABLE,

apps/sim/lib/table/dispatch-governed-subject.test.ts

@@ -0,0 +1,94 @@
+/**
+ * @vitest-environment node
+ */
+import { dbChainMockFns, resetDbChainMock } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/lib/table/events', () => ({
+  appendTableEvent: vi.fn(),
+}))
+vi.mock('@/lib/table/service', () => ({
+  getTableById: vi.fn(),
+}))
+
+import { insertDispatch } from '@/lib/table/dispatcher'
+
+const BASE = {
+  tableId: 'table-1',
+  workspaceId: 'workspace-1',
+  requestId: 'req-1',
+  mode: 'all' as const,
+  scope: { groupIds: ['group-1'] },
+  isManualRun: true,
+}
+
+/** The values `insertDispatch` handed to the single `db.insert(...).values(...)`. */
+function insertedRow(): Record<string, unknown> {
+  expect(dbChainMockFns.values).toHaveBeenCalledTimes(1)
+  return dbChainMockFns.values.mock.calls[0][0] as Record<string, unknown>
+}
+
+describe('insertDispatch governed subject', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+  })
+
+  /**
+   * The bug this replaces: an optional field defaulting to `triggeredByUserId`
+   * meant a workspace-key auto-dispatch stored the workspace billed account as
+   * its gate subject — a bystander whose tool denylist would then run against
+   * a request nobody meant to govern.
+   */
+  it('stores null for an actorless run even when the attribution names a user', async () => {
+    await insertDispatch({
+      ...BASE,
+      triggeredByUserId: 'billing-owner',
+      capabilityGovernedUserId: null,
+    })
+    const row = insertedRow()
+    expect(row.triggeredByUserId).toBe('billing-owner')
+    expect(row.capabilityGovernedUserId).toBeNull()
+  })
+
+  it('stores the acting person for a session-triggered run', async () => {
+    await insertDispatch({
+      ...BASE,
+      triggeredByUserId: 'user-1',
+      capabilityGovernedUserId: 'user-1',
+    })
+    const row = insertedRow()
+    expect(row.capabilityGovernedUserId).toBe('user-1')
+  })
+
+  /**
+   * The two fields are independent: a delegated run can be metered to the payer
+   * while staying governed by the person who asked for it.
+   */
+  it('keeps the gate subject independent of the meter subject', async () => {
+    await insertDispatch({
+      ...BASE,
+      triggeredByUserId: 'billing-owner',
+      capabilityGovernedUserId: 'requesting-user',
+    })
+    const row = insertedRow()
+    expect(row.triggeredByUserId).toBe('billing-owner')
+    expect(row.capabilityGovernedUserId).toBe('requesting-user')
+  })
+
+  /**
+   * A row written before the column existed reads `capability_governed_user_id`
+   * as NULL with `triggered_by_user_id` still set. Under the new semantics that
+   * shape means "actorless, ungated" — which is why the 0315 migration
+   * backfills the legacy subject onto non-terminal pre-migration rows rather
+   * than letting them fall through to it.
+   */
+  it('never reconstructs the gate subject from the attribution', async () => {
+    await insertDispatch({
+      ...BASE,
+      triggeredByUserId: 'user-1',
+      capabilityGovernedUserId: null,
+    })
+    expect(insertedRow().capabilityGovernedUserId).toBeNull()
+  })
+})

apps/sim/lib/table/run-column-governed-subject.test.ts

@@ -0,0 +1,86 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  getTableById: vi.fn(),
+  insertDispatch: vi.fn(async () => 'tdsp_1'),
+  readDispatch: vi.fn(async () => null),
+  cancelDispatchById: vi.fn(),
+  bulkClearWorkflowGroupCells: vi.fn(async () => false),
+  runDispatcherToCompletion: vi.fn(),
+  resolveTableDispatchConcurrency: vi.fn(async () => 5),
+}))
+
+vi.mock('@/lib/table/service', () => ({ getTableById: mocks.getTableById }))
+vi.mock('@/lib/table/dispatcher', () => ({
+  bulkClearWorkflowGroupCells: mocks.bulkClearWorkflowGroupCells,
+  cancelDispatchById: mocks.cancelDispatchById,
+  insertDispatch: mocks.insertDispatch,
+  readDispatch: mocks.readDispatch,
+  runDispatcherToCompletion: mocks.runDispatcherToCompletion,
+}))
+vi.mock('@/lib/table/dispatch-concurrency', () => ({
+  resolveTableDispatchConcurrency: mocks.resolveTableDispatchConcurrency,
+}))
+
+import { runWorkflowColumn } from '@/lib/table/workflow-columns'
+
+const TABLE = {
+  id: 'table-1',
+  workspaceId: 'workspace-1',
+  schema: { columns: [], workflowGroups: [{ id: 'group-1', outputs: [] }] },
+}
+
+const BASE = {
+  tableId: 'table-1',
+  workspaceId: 'workspace-1',
+  groupIds: ['group-1'],
+  mode: 'new' as const,
+  isManualRun: false,
+  requestId: 'req-1',
+}
+
+/** The dispatch row `runWorkflowColumn` asked the dispatcher to insert. */
+function inserted(): Record<string, unknown> {
+  expect(mocks.insertDispatch).toHaveBeenCalledTimes(1)
+  return mocks.insertDispatch.mock.calls[0][0] as Record<string, unknown>
+}
+
+describe('runWorkflowColumn governed subject', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.getTableById.mockResolvedValue(TABLE)
+    mocks.insertDispatch.mockResolvedValue('tdsp_1')
+    mocks.readDispatch.mockResolvedValue(null)
+    mocks.bulkClearWorkflowGroupCells.mockResolvedValue(false)
+    mocks.resolveTableDispatchConcurrency.mockResolvedValue(5)
+  })
+
+  /**
+   * The row-write auto-fire case: a workspace API key wrote the row, so the
+   * attribution names the workspace billed account. Forwarding that as the gate
+   * subject — which an optional field with a fallback did — puts a bystander's
+   * tool denylist on a run nobody governs.
+   */
+  it('forwards an explicit null past a non-null attribution', async () => {
+    await runWorkflowColumn({
+      ...BASE,
+      triggeredByUserId: 'billing-owner',
+      capabilityGovernedUserId: null,
+    })
+    const row = inserted()
+    expect(row.triggeredByUserId).toBe('billing-owner')
+    expect(row.capabilityGovernedUserId).toBeNull()
+  })
+
+  it('forwards the acting person for a session-initiated run', async () => {
+    await runWorkflowColumn({
+      ...BASE,
+      triggeredByUserId: 'user-1',
+      capabilityGovernedUserId: 'user-1',
+    })
+    expect(inserted().capabilityGovernedUserId).toBe('user-1')
+  })
+})