Merge branch 'pgx/p1' into feat/permission-groups-coverage

Author: waleedlatif1

apps/sim/app/api/workflows/[id]/executions/[executionId]/route.test.ts

@@ -0,0 +1,106 @@
+/**
+ * @vitest-environment node
+ *
+ * The internal run-detail door. `logs.cost` and `logs.trace_spans` withhold
+ * fields inside a run, and the shared read applies them — but only for the
+ * subject this route names. `auth.userId` is populated for every credential the
+ * route accepts, so naming it unconditionally would apply a workspace key
+ * creator's group to every caller of a shared credential, and the executor's
+ * actor's group to a delegation that carries no capabilities at all.
+ */
+import { NextRequest } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockValidateWorkflowAccess, mockGetStatus } = vi.hoisted(() => ({
+  mockValidateWorkflowAccess: vi.fn(),
+  mockGetStatus: vi.fn(),
+}))
+
+vi.mock('@/app/api/workflows/middleware', () => ({
+  validateWorkflowAccess: mockValidateWorkflowAccess,
+}))
+
+vi.mock('@/lib/workflows/executor/execution-status', () => ({
+  getWorkflowExecutionStatus: mockGetStatus,
+}))
+
+import { GET } from './route'
+
+const WORKFLOW_ID = 'b1f0c7e2-0000-4000-8000-00000000000a'
+const EXECUTION_ID = 'b1f0c7e2-0000-4000-8000-00000000000b'
+
+function request() {
+  return new NextRequest(`https://sim.test/api/workflows/${WORKFLOW_ID}/executions/${EXECUTION_ID}`)
+}
+
+function context() {
+  return { params: Promise.resolve({ id: WORKFLOW_ID, executionId: EXECUTION_ID }) }
+}
+
+function grantAccess(auth: Record<string, unknown>) {
+  mockValidateWorkflowAccess.mockResolvedValue({
+    workflow: { id: WORKFLOW_ID, workspaceId: 'workspace-1' },
+    auth,
+  })
+}
+
+describe('internal execution status route projection subject', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockGetStatus.mockResolvedValue({
+      executionId: EXECUTION_ID,
+      workflowId: WORKFLOW_ID,
+      status: 'completed',
+      trigger: 'api',
+      level: 'info',
+      startedAt: '2026-08-05T12:00:00.000Z',
+      endedAt: null,
+      totalDurationMs: null,
+      paused: null,
+      cost: null,
+      error: null,
+      finalOutput: null,
+      blockOutputs: null,
+    })
+  })
+
+  it('names the session user as the projection subject', async () => {
+    grantAccess({ success: true, userId: 'user-1', authType: 'session' })
+
+    const response = await GET(request(), context())
+
+    expect(response.status).toBe(200)
+    expect(mockGetStatus).toHaveBeenCalledWith(
+      expect.objectContaining({ workspaceId: 'workspace-1', viewerUserId: 'user-1' })
+    )
+  })
+
+  it('names the personal API key owner as the projection subject', async () => {
+    grantAccess({ success: true, userId: 'user-1', authType: 'api_key', apiKeyType: 'personal' })
+
+    await GET(request(), context())
+
+    expect(mockGetStatus).toHaveBeenCalledWith(expect.objectContaining({ viewerUserId: 'user-1' }))
+  })
+
+  it('names no subject for a workspace API key', async () => {
+    grantAccess({
+      success: true,
+      userId: 'key-creator-1',
+      authType: 'api_key',
+      apiKeyType: 'workspace',
+    })
+
+    await GET(request(), context())
+
+    expect(mockGetStatus).toHaveBeenCalledWith(expect.objectContaining({ viewerUserId: null }))
+  })
+
+  it('names no subject for an executor delegation', async () => {
+    grantAccess({ success: true, userId: 'run-actor-1', authType: 'internal_jwt' })
+
+    await GET(request(), context())
+
+    expect(mockGetStatus).toHaveBeenCalledWith(expect.objectContaining({ viewerUserId: null }))
+  })
+})

apps/sim/app/api/workflows/[id]/executions/[executionId]/route.ts

@@ -2,6 +2,7 @@ import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
 import { getWorkflowExecutionContract } from '@/lib/api/contracts/workflows'
 import { parseRequest } from '@/lib/api/server'
+import { type AuthResult, AuthType } from '@/lib/auth/hybrid'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import {
   FUNCTIONAL_OUTPUTS_UNAVAILABLE_MESSAGE,
@@ -11,6 +12,22 @@ import { getWorkflowExecutionStatus } from '@/lib/workflows/executor/execution-s
 import { validateWorkflowAccess } from '@/app/api/workflows/middleware'
 
 const logger = createLogger('WorkflowExecutionStatusAPI')
+
+/**
+ * The user whose permission group governs this read, or `null` when none does.
+ *
+ * `auth.userId` is populated for every credential this route accepts, and for a
+ * workspace API key it is the key's *creator* — a bystander who may not be the
+ * caller — while an internal JWT is the executor, which carries a role but no
+ * capabilities. Keying on the presence of a user id would apply a group to both.
+ * `authType` and `apiKeyType` are the authoritative signals, the same pair
+ * `capabilityGovernedUserId` reads on the v1 surface.
+ */
+function capabilityGovernedUserId(auth: AuthResult | undefined): string | null {
+  if (!auth?.userId) return null
+  if (auth.authType === AuthType.SESSION) return auth.userId
+  return auth.authType === AuthType.API_KEY && auth.apiKeyType === 'personal' ? auth.userId : null
+}
 export const GET = withRouteHandler(
   async (
     request: NextRequest,
@@ -33,6 +50,8 @@ export const GET = withRouteHandler(
         executionId,
         includeOutput,
         selectedOutputs,
+        workspaceId: access.workflow.workspaceId,
+        viewerUserId: capabilityGovernedUserId(access.auth),
       })
     } catch (error) {
       if (error instanceof FunctionalOutputsUnavailableError) {

apps/sim/lib/copilot/chat/process-contents-log-projection.test.ts

@@ -0,0 +1,150 @@
+/**
+ * @vitest-environment node
+ *
+ * Copilot's `@log` mention context, projected for the chatting user.
+ *
+ * `logs.cost` and `logs.trace_spans` are PROJECTIONS, not gates, and Copilot is
+ * deliberately not exempt from them: it acts as the person, so a run inlined as
+ * mention context must be withheld exactly as the person's own log surfaces
+ * withhold it. This path resolved the run row directly with a role-only
+ * authorization and inlined the run total, every span's own cost, and the whole
+ * block overview — so a member withheld all three on `/api/logs/**` read them by
+ * typing `@` in chat.
+ *
+ * Kept in its own file because it mocks `config-scope.server`, which the sibling
+ * `process-contents.test.ts` deliberately leaves real so its integration-allowlist
+ * tests exercise `getUserPermissionConfig`.
+ */
+import {
+  dbChainMockFns,
+  permissionGroupScopeMock,
+  permissionGroupScopeMockFns,
+  resetPermissionGroupScopeMock,
+  workflowAuthzMockFns,
+} from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ChatContext } from '@/stores/panel'
+
+vi.mock('@/lib/permission-groups/config-scope.server', () => permissionGroupScopeMock)
+
+import { processContextsServer } from '@/lib/copilot/chat/process-contents'
+import { DEFAULT_PERMISSION_GROUP_CONFIG } from '@/lib/permission-groups/fields'
+
+function queueRun(): void {
+  dbChainMockFns.limit.mockResolvedValueOnce([
+    {
+      id: 'log-1',
+      workflowId: 'wf-1',
+      workspaceId: 'ws-1',
+      executionId: 'exec-1',
+      level: 'error',
+      trigger: 'manual',
+      startedAt: new Date('2026-01-01T00:00:00.000Z'),
+      endedAt: new Date('2026-01-01T00:00:01.000Z'),
+      totalDurationMs: 1000,
+      executionData: {
+        traceSpans: [
+          {
+            id: 'span-1',
+            blockId: 'block-1',
+            name: 'Agent 1',
+            type: 'agent',
+            status: 'failed',
+            duration: 500,
+            cost: { total: 0.04 },
+            children: [
+              { id: 'span-2', name: 'tool', type: 'tool', duration: 10, cost: { total: 0.01 } },
+            ],
+          },
+        ],
+      },
+      costTotal: '0.05',
+      workflowName: 'My Flow',
+    },
+  ])
+  workflowAuthzMockFns.mockAuthorizeWorkflowByWorkspacePermission.mockResolvedValueOnce({
+    allowed: true,
+    workflow: { workspaceId: 'ws-1' },
+  })
+}
+
+async function mentionSummary(userId?: string) {
+  const result = await processContextsServer(
+    [{ kind: 'logs', executionId: 'exec-1', label: 'My Flow' } as ChatContext],
+    userId as string,
+    'hello',
+    'ws-1'
+  )
+  expect(result).toHaveLength(1)
+  return JSON.parse(result[0].content)
+}
+
+describe('@log mention context projection', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetPermissionGroupScopeMock()
+  })
+
+  it('inlines spend whole for a member no group governs', async () => {
+    queueRun()
+
+    const summary = await mentionSummary('user-1')
+
+    expect(summary.cost).toEqual({ total: 0.05 })
+    expect(summary.overview[0].cost).toEqual({ total: 0.04 })
+    expect(summary.overview[0].children[0].cost).toEqual({ total: 0.01 })
+  })
+
+  it('withholds the run total and every span cost when the group hides spend', async () => {
+    permissionGroupScopeMockFns.mockResolvePermissionGroupConfig.mockResolvedValue({
+      ...DEFAULT_PERMISSION_GROUP_CONFIG,
+      hideCostInfo: true,
+    })
+    queueRun()
+
+    const summary = await mentionSummary('user-1')
+
+    expect(summary.cost).toBeUndefined()
+    expect(summary.overview).toHaveLength(1)
+    expect(summary.overview[0].name).toBe('Agent 1')
+    expect(summary.overview[0].cost).toBeUndefined()
+    expect(summary.overview[0].children[0].cost).toBeUndefined()
+  })
+
+  /**
+   * The overview is derived from `traceSpans`, which is on the withheld list the
+   * log-detail path strips outright — so it is withheld entirely rather than
+   * merely thinned. The run's identity, level and timings stay: these are
+   * projections, not gates.
+   */
+  it('withholds the whole block overview when the group hides trace spans', async () => {
+    permissionGroupScopeMockFns.mockResolvePermissionGroupConfig.mockResolvedValue({
+      ...DEFAULT_PERMISSION_GROUP_CONFIG,
+      hideTraceSpans: true,
+    })
+    queueRun()
+
+    const summary = await mentionSummary('user-1')
+
+    expect(summary.overview).toBeUndefined()
+    expect(summary.cost).toEqual({ total: 0.05 })
+    expect(summary.executionId).toBe('exec-1')
+    expect(JSON.stringify(summary)).not.toContain('Agent 1')
+  })
+
+  /** No subject, no group — never a bystander's. */
+  it('resolves no group when the mention carries no subject', async () => {
+    permissionGroupScopeMockFns.mockResolvePermissionGroupConfig.mockResolvedValue({
+      ...DEFAULT_PERMISSION_GROUP_CONFIG,
+      hideCostInfo: true,
+      hideTraceSpans: true,
+    })
+    queueRun()
+
+    const summary = await mentionSummary(undefined)
+
+    expect(summary.cost).toEqual({ total: 0.05 })
+    expect(summary.overview).toHaveLength(1)
+    expect(permissionGroupScopeMockFns.mockResolvePermissionGroupConfig).not.toHaveBeenCalled()
+  })
+})

apps/sim/lib/copilot/chat/process-contents.ts

@@ -32,6 +32,11 @@ import { EnvCapabilityConfigurationError } from '@/lib/core/config/env-capabilit
 import { getAllowedIntegrationsFromEnv } from '@/lib/core/config/env-flags'
 import { isIntegrationDeploymentAvailableForVisibility } from '@/lib/integrations/availability.server'
 import { readKnowledgeBase } from '@/lib/knowledge/application/knowledge-bases'
+import {
+  projectCostTotal,
+  projectExecutionData,
+  resolveLogFieldProjection,
+} from '@/lib/logs/log-projection'
 import { toOverview } from '@/lib/logs/log-views'
 import type { TraceSpan } from '@/lib/logs/types'
 import { mcpService } from '@/lib/mcp/service'
@@ -753,11 +758,35 @@ async function processExecutionLogFromDb(
       }
     }
 
+    /**
+     * Copilot is deliberately not exempt: it acts as the person, so the run it
+     * inlines is withheld exactly as the person's own log surfaces withhold it.
+     * `userId` here is the chatting user — both callers of
+     * `processContextsServer` pass the request's authenticated subject, and this
+     * is session context rather than an executor delegation — so it is the right
+     * subject for the projection, and an absent one reads whole.
+     *
+     * `logs.trace_spans` withholds the overview entirely rather than merely
+     * thinning it: the tree is derived from `traceSpans`, which is on the
+     * withheld list that the log-detail route strips outright.
+     * `logs.cost` blanks the run total AND every span's own `cost`, through the
+     * shared projector — a viewer who can sum the spans has been withheld
+     * nothing.
+     *
+     * permission-group-enforced: logs.trace_spans
+     * permission-group-enforced: logs.cost
+     */
+    const projection = await resolveLogFieldProjection(userId, log.workspaceId)
+
     const { materializeExecutionData } = await import('@/lib/logs/execution/trace-store')
-    const executionData = (await materializeExecutionData(
+    const materialized = (await materializeExecutionData(
       log.executionData as Record<string, unknown> | null,
       { workspaceId: log.workspaceId, workflowId: log.workflowId, executionId: log.executionId }
-    )) as { traceSpans?: TraceSpan[] } | undefined
+    )) as Record<string, unknown> | null | undefined
+    const executionData = projectExecutionData(materialized ?? null, projection) as
+      | { traceSpans?: TraceSpan[] }
+      | null
+      | undefined
     const overview = executionData?.traceSpans?.length
       ? toOverview(executionData.traceSpans)
       : undefined
@@ -772,7 +801,7 @@ async function processExecutionLogFromDb(
       endedAt: log.endedAt?.toISOString?.() || (log.endedAt ? String(log.endedAt) : null),
       totalDurationMs: log.totalDurationMs ?? null,
       workflowName: log.workflowName || '',
-      cost: log.costTotal != null ? { total: Number(log.costTotal) } : undefined,
+      cost: projectCostTotal(log.costTotal, projection) ?? undefined,
       overview,
       note: `For a block's input/output/error, or to grep the trace, call ${QueryLogs.id} with executionId: '${log.executionId}' — view: 'full' (scope with blockId or blockName), or pattern to grep.`,
     }