improvement(api): harden application route boundaries

[TheodoreSpeaks]

Summary

• move audit authorization and queries behind transport-neutral application boundaries and consolidate canonical active-workspace loading
• preserve personal API-key policy denials while concealing only typed resource authorization failures across file, workflow, table, and knowledge routes
• directly test v2 admission ordering and failure behavior, share static route fixtures, and cap workflow/table folder materialization with typed limit failures
• replace shared wire-named sort/export aliases with neutral internal types without changing v1 or v2 envelopes

Type of Change

• Bug fix
• Improvement

Testing

• 41 focused Vitest files, 350 tests
• Sim and @sim/testing type-checks
• Biome on touched files and repository lint
• Strict API validation and full ship audit suite
• git diff --check

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 9, 2026 12:41am

[cursor]

PR Summary

Medium Risk
Touches authorization boundaries, v2 error mapping, and folder mutation limits across many API surfaces; behavior is heavily tested but misclassification of auth errors could change client-visible status codes.

Overview
This PR relocates enterprise audit authorization and query building from v1 API routes into lib/audit-logs, keeping v1 handlers as thin transport wrappers. Active workspace policy is loaded through a single canonical helper for workflow, table, and knowledge application contexts instead of per-domain DB joins.

For v2 JSON routes, typed workspace/resource authorization failures are concealed as 404 via createV2ResourceConcealmentPolicy, while denials like disabled personal API keys still return 403. Knowledge routes drop inline concealment policies in favor of shared knowledge route policies.

Folder materialization for workflows and tables is bounded with MAX_FOLDERS_PER_WORKSPACE and FolderCollectionLimitExceededError (payload_too_large) before oversized path indexes or inserts. v2 route tests reuse @sim/testing mocks (v2RouteMocks, rate-limit constants) and add direct coverage of defineV2JsonRoute admission, rate limiting, and short-circuit behavior.

Internal list/sort typing is aligned on ListSortOrder / LIST_SORT_ORDERS; workflow export uses neutral payload types rather than v1 wire aliases without changing envelopes.

^{Reviewed by Cursor Bugbot for commit e787cbb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR moves audit authorization and querying into application-layer boundaries, centralizes active resource/workspace resolution, and adds typed v2 authorization concealment and folder-materialization limits.

• Preserves personal API-key policy denials while concealing selected resource authorization failures.
• Adds shared v2 route fixtures and focused admission-ordering, context, concealment, and folder-cap tests.
• Replaces transport-oriented internal aliases while retaining existing API envelopes.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains in the eligible follow-up scope.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/api/server/routes/v2-resource-concealment.ts	Introduces typed, reusable concealment for selected resource authorization errors while preserving other policy failures.
apps/sim/lib/workflows/application/context.ts	Consolidates canonical active workflow, run, and workspace loading with workspace-containment checks.
apps/sim/lib/table/application/context.ts	Resolves active tables through their canonical workspace and rejects asserted workspace mismatches.
apps/sim/lib/knowledge/application/contexts.ts	Centralizes active knowledge-base and document context resolution with workspace binding.
apps/sim/lib/folders/queries.ts	Adds bounded folder materialization with limit-plus-one overflow detection and typed failures.
apps/sim/lib/folders/cascade.ts	Applies bounded folder loading before computing cascade descendants.
apps/sim/lib/audit-logs/authorization.ts	Moves enterprise audit authorization into a transport-neutral application module.
packages/testing/src/mocks/v2-route.mock.ts	Provides shared v2 authentication, gating, and rate-limit fixtures for route tests.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
Request[V1 or V2 request] --> Admission[Authentication and admission]
Admission --> Policy[Route error policy]
Admission --> UseCase[Application use case]
UseCase --> Context[Canonical active resource and workspace context]
Context --> Authorization[Workspace and resource authorization]
Authorization --> Query[Transport-neutral query or operation]
Authorization -->|Typed resource denial| Policy
Authorization -->|Personal API-key policy denial| Forbidden[403 Forbidden]
Policy -->|Concealed denial| NotFound[404 Not Found]
Query --> Response[Existing API envelope]

Loading

_{Reviews (3): Last reviewed commit: "fix(folders): reject creates at workspac..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e787cbb. Configure here.}