feat(auth): centralize delegated identity policy

[TheodoreSpeaks]

Summary

• add server-only scoped executor delegation headers and a fail-fast human-subject resolver
• require every delegated workspace operation to declare its allowed service identities and reject mismatches before resource loading
• preserve existing executor file-tool access while keeping other migrated domains Copilot-only
• repair the base branch OpenAPI snapshot for file metadata share state

Type of Change

• Improvement

Testing

• 49 focused Vitest tests
• Sim and @sim/auth typechecks
• lint, API validation, OpenAPI validation, and repository audit suite

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 8, 2026 11:57pm

[cursor]

PR Summary

High Risk
Changes authorization and delegation boundaries across workspace operations and executor-to-API calls; misconfigured delegatedServices or migration gaps could block legitimate executor file-tool access or widen delegation if mis-declared.

Overview
Centralizes which delegated service (copilot vs executor) may run each workspace operation, and tightens how the workflow executor and use cases resolve human subjects.

Delegated service allowlists — Workspace operations that admit delegated principals must now declare delegatedServices; defineWorkspaceOperation validates consistency at registration. requireAllowedWorkspacePrincipal rejects a mismatched serviceId with DelegatedServiceAuthorizationErrorbefore canonical context loading. Most domains stay Copilot-only; workspace file operations split so executor is limited to internal file-tool operations (read/write/move/share, etc.) while list/rename/delete and similar remain Copilot-only. Per-domain delegation policies no longer duplicate Copilot checks in isWithinScope—service identity is enforced on the operation.

Executor HTTP auth — Adds server-only buildExecutorDelegationHeaders (workflow-scoped internal delegation via generateInternalDelegationToken); legacy buildAuthHeaders stays for migration. Browser contexts cannot mint delegation headers.

Human subject resolution — requirePrincipalSubjectUserId in @sim/auth/principal replaces ad-hoc humanUserId helpers in skills/custom-tools and is used for file share updates; workspace API keys fail fast instead of inventing a user id.

OpenAPI — File metadata GET response schema switches to V2FileMetadataResponse (file + share state).

^{Reviewed by Cursor Bugbot for commit 5c9b105. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR centralizes delegated-service authorization in workspace operation policy, introduces server-only executor delegation headers and human-subject resolution, and preserves executor access to selected workspace-file operations.

• Adds typed, runtime-validated delegated-service allowlists to workspace operations.
• Rejects disallowed delegated services before resource loading and permission resolution.
• Keeps Copilot as the delegated identity for migrated domains while allowing executor access to internal file-tool operations.
• Adds a fail-fast principal helper for operations requiring a human subject.
• Updates the file metadata OpenAPI snapshot to include share state.

Confidence Score: 5/5

The PR appears safe to merge, with delegated-service checks consistently enforced before resource loading and no concrete changed-code failure identified.

The centralized authorization path preserves existing workspace permission and resource-scope checks, explicitly restricts each delegated service by operation, and the executor file-tool actions map to allowed underlying file operations.

Important Files Changed

Filename	Overview
apps/sim/lib/core/application/workspace-operation.ts	Adds typed delegated-service policies, validates policy consistency and duplicates, and freezes the resulting operation metadata.
apps/sim/lib/core/application/workspace-authorization.ts	Centralizes delegated-service allowlist enforcement before resource loading and existing delegation-scope and permission checks.
apps/sim/lib/workspace-files/application/operations.ts	Separates Copilot-only file operations from the subset also available to executor file tools.
apps/sim/executor/utils/http.ts	Adds a server-only helper for generating workflow-scoped executor delegation headers while retaining the legacy helper.
packages/auth/src/principal.ts	Adds a shared human-subject resolver that returns session, personal-key, or delegated user identity and rejects workspace API keys.
apps/sim/lib/workspace-files/application/share-workspace-file.ts	Uses the fail-fast human-subject resolver for file-share attribution.
apps/docs/openapi-v2-files-audit.json	Corrects the file metadata response snapshot to expose nullable public share state.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
Caller[Session, API key, or delegated service] --> Policy[Workspace operation policy]
Policy --> Kind{Principal kind allowed?}
Kind -->|No| RejectKind[Reject before resource loading]
Kind -->|Yes| Service{Delegated principal?}
Service -->|No| Load[Load canonical resource context]
Service -->|Yes| Allowlist{Service in delegatedServices?}
Allowlist -->|No| RejectService[Reject before resource loading]
Allowlist -->|Yes| Load
Load --> Scope[Validate delegation audience and resource scope]
Scope --> Permission[Resolve represented user's workspace permission]
Permission --> Execute[Execute operation]

Loading

_{Reviews (1): Last reviewed commit: "feat(auth): centralize delegated identit..." | Re-trigger Greptile}