fix(api): conceal cross-tenant resource denials on internal routes

apps/sim/app/api/table/[tableId]/exports/route.ts

@@ -1,10 +1,6 @@
 import { createTableExportResourceContract } from '@/lib/api/contracts/table-transfers'
-import {
- defineInternalJsonRoute,
- internalOrchestrationErrorPolicy,
- internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import { createTableExportUseCase } from '@/lib/table/application/exports'
 import { tableOperations } from '@/lib/table/application/operations'
 import { toV2TableExport } from '@/lib/table/orchestration/export-resource'
@@ -16,7 +12,7 @@ export const POST = defineInternalJsonRoute({
  rateLimit: internalRateLimits.none({
  reason: 'Existing authenticated table export creation has no request-rate policy',
  }),
- errorPolicy: internalOrchestrationErrorPolicy,
+ errorPolicy: internalTableErrorPolicies.concealTableAuthorization,
  mapInput: ({ params, body }) => ({
  tableId: params.tableId,
  workspaceId: body.workspaceId,

apps/sim/app/api/table/[tableId]/groups/route.test.ts

@@ -6,6 +6,7 @@ import { describe, expect, it, vi } from 'vitest'
 interface CapturedDefinition {
  contract: { method: string; path: string }
  auth: unknown
+ errorPolicy: unknown
  operation: { id: string }
  useCase: unknown
  mapInput(input: {
@@ -21,6 +22,7 @@ interface CapturedDefinition {
 
 const mocks = vi.hoisted(() => ({
  auth: { kind: 'session-or-executor' },
+ concealTableGroupAuthorization: { kind: 'conceal-table-group' },
  definitions: [] as CapturedDefinition[],
  useCases: {
  create: { operation: { id: 'tables.groups.create' } },
@@ -34,15 +36,17 @@ vi.mock('@/lib/api/server/routes', () => ({
  mocks.definitions.push(definition)
  return vi.fn()
  },
- extendInternalErrorPolicy: vi.fn(() => ({ kind: 'table' })),
- internalErrorResponse: vi.fn(),
- internalOrchestrationErrorPolicy: { kind: 'plain' },
  internalRateLimits: {
  none: ({ reason }: { reason: string }) => ({ kind: 'none', reason }),
  },
 }))
 
-vi.mock('@/lib/table/api', () => ({ internalTableSessionOrExecutorAuth: mocks.auth }))
+vi.mock('@/lib/table/api', () => ({
+ internalTableErrorPolicies: {
+ concealTableGroupAuthorization: mocks.concealTableGroupAuthorization,
+ },
+ internalTableSessionOrExecutorAuth: mocks.auth,
+}))
 
 vi.mock('@/lib/table/application/groups', () => ({
  createTableGroupUseCase: mocks.useCases.create,
@@ -77,6 +81,7 @@ describe('/api/table/[tableId]/groups', () => {
  expect(route.auth).toBe(mocks.auth)
  expect(route.useCase).toBe(useCase)
  expect(route.operation.id).toBe(useCase.operation.id)
+ expect(route.errorPolicy).toBe(mocks.concealTableGroupAuthorization)
  }
  })
 

apps/sim/app/api/table/[tableId]/groups/route.ts

@@ -3,30 +3,17 @@ import {
  deleteWorkflowGroupContract,
  updateWorkflowGroupContract,
 } from '@/lib/api/contracts/tables'
-import {
- defineInternalJsonRoute,
- extendInternalErrorPolicy,
- internalErrorResponse,
- internalOrchestrationErrorPolicy,
- internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import {
  createTableGroupUseCase,
  deleteTableGroupUseCase,
  updateTableGroupUseCase,
 } from '@/lib/table/application/groups'
 import { tableOperations } from '@/lib/table/application/operations'
-import { TableLockedError } from '@/lib/table/mutation-locks'
 import type { TableDefinition } from '@/lib/table/types'
 import { normalizeColumn } from '@/app/api/table/utils'
 
-const errorPolicy = extendInternalErrorPolicy(internalOrchestrationErrorPolicy, (error) =>
- error instanceof TableLockedError
- ? internalErrorResponse(423, { error: error.message, lock: error.lock })
- : null
-)
-
 const rateLimit = internalRateLimits.none({
  reason: 'Existing authenticated table group mutations have no request-rate policy',
 })
@@ -47,7 +34,7 @@ export const POST = defineInternalJsonRoute({
  useCase: createTableGroupUseCase,
  auth: internalTableSessionOrExecutorAuth,
  rateLimit,
- errorPolicy,
+ errorPolicy: internalTableErrorPolicies.concealTableGroupAuthorization,
  mapInput: ({ params, body }) => ({
  tableId: params.tableId,
  ...body,
@@ -62,7 +49,7 @@ export const PATCH = defineInternalJsonRoute({
  useCase: updateTableGroupUseCase,
  auth: internalTableSessionOrExecutorAuth,
  rateLimit,
- errorPolicy,
+ errorPolicy: internalTableErrorPolicies.concealTableGroupAuthorization,
  mapInput: ({ params, body }) => ({ tableId: params.tableId, ...body }),
  present: ({ table }) => presentTable(table),
 })
@@ -73,7 +60,7 @@ export const DELETE = defineInternalJsonRoute({
  useCase: deleteTableGroupUseCase,
  auth: internalTableSessionOrExecutorAuth,
  rateLimit,
- errorPolicy,
+ errorPolicy: internalTableErrorPolicies.concealTableGroupAuthorization,
  mapInput: ({ params, body }) => ({ tableId: params.tableId, ...body }),
  present: ({ table }) => presentTable(table),
 })

apps/sim/app/api/table/exports/[exportId]/download/route.ts

@@ -1,10 +1,6 @@
 import { downloadTableExportResourceContract } from '@/lib/api/contracts/table-transfers'
-import {
- defineInternalJsonRoute,
- internalOrchestrationErrorPolicy,
- internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import { downloadTableExportUseCase } from '@/lib/table/application/exports'
 import { tableOperations } from '@/lib/table/application/operations'
 
@@ -15,7 +11,7 @@ export const GET = defineInternalJsonRoute({
  rateLimit: internalRateLimits.none({
  reason: 'Existing authenticated table export download signing has no request-rate policy',
  }),
- errorPolicy: internalOrchestrationErrorPolicy,
+ errorPolicy: internalTableErrorPolicies.concealExportAuthorization,
  mapInput: ({ params, query }) => ({
  exportId: params.exportId,
  workspaceId: query.workspaceId,

apps/sim/app/api/table/exports/[exportId]/route.ts

@@ -2,12 +2,8 @@ import {
  cancelTableExportResourceContract,
  getTableExportResourceContract,
 } from '@/lib/api/contracts/table-transfers'
-import {
- defineInternalJsonRoute,
- internalOrchestrationErrorPolicy,
- internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import { cancelTableExportUseCase, readTableExportUseCase } from '@/lib/table/application/exports'
 import { tableOperations } from '@/lib/table/application/operations'
 import { toV2TableExport } from '@/lib/table/orchestration/export-resource'
@@ -21,7 +17,7 @@ export const GET = defineInternalJsonRoute({
  auth: internalTableSessionOrExecutorAuth,
  operation: tableOperations.readExport,
  rateLimit,
- errorPolicy: internalOrchestrationErrorPolicy,
+ errorPolicy: internalTableErrorPolicies.concealExportAuthorization,
  mapInput: ({ params, query }) => ({
  exportId: params.exportId,
  workspaceId: query.workspaceId,
@@ -35,7 +31,7 @@ export const DELETE = defineInternalJsonRoute({
  auth: internalTableSessionOrExecutorAuth,
  operation: tableOperations.cancelExport,
  rateLimit,
- errorPolicy: internalOrchestrationErrorPolicy,
+ errorPolicy: internalTableErrorPolicies.concealExportAuthorization,
  mapInput: ({ params, query }) => ({
  exportId: params.exportId,
  workspaceId: query.workspaceId,

apps/sim/app/api/table/imports/[importId]/complete/route.ts

@@ -1,10 +1,6 @@
 import { completeTableImportResourceContract } from '@/lib/api/contracts/table-transfers'
-import {
- defineInternalJsonRoute,
- internalOrchestrationErrorPolicy,
- internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import { completeTableImportUseCase } from '@/lib/table/application/imports'
 import { tableOperations } from '@/lib/table/application/operations'
 import { toV2TableImport } from '@/lib/table/orchestration/import-resource'
@@ -16,7 +12,7 @@ export const POST = defineInternalJsonRoute({
  rateLimit: internalRateLimits.none({
  reason: 'Existing authenticated table import completion has no request-rate policy',
  }),
- errorPolicy: internalOrchestrationErrorPolicy,
+ errorPolicy: internalTableErrorPolicies.concealImportAuthorization,
  mapInput: ({ params, query, headers }) => ({
  importId: params.importId,
  workspaceId: query.workspaceId,

apps/sim/app/api/table/imports/[importId]/parts/route.ts

@@ -1,10 +1,6 @@
 import { createTableImportPartUrlsContract } from '@/lib/api/contracts/table-transfers'
-import {
- defineInternalJsonRoute,
- internalOrchestrationErrorPolicy,
- internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import { createTableImportPartsUseCase } from '@/lib/table/application/imports'
 import { tableOperations } from '@/lib/table/application/operations'
 
@@ -15,7 +11,7 @@ export const POST = defineInternalJsonRoute({
  rateLimit: internalRateLimits.none({
  reason: 'Existing authenticated table import part signing has no request-rate policy',
  }),
- errorPolicy: internalOrchestrationErrorPolicy,
+ errorPolicy: internalTableErrorPolicies.concealImportAuthorization,
  mapInput: ({ params, query, headers, body }) => ({
  importId: params.importId,
  workspaceId: query.workspaceId,

apps/sim/app/api/table/imports/[importId]/route.ts

@@ -2,12 +2,8 @@ import {
  cancelTableImportResourceContract,
  getTableImportResourceContract,
 } from '@/lib/api/contracts/table-transfers'
-import {
- defineInternalJsonRoute,
- internalOrchestrationErrorPolicy,
- internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import { cancelTableImportUseCase, readTableImportUseCase } from '@/lib/table/application/imports'
 import { tableOperations } from '@/lib/table/application/operations'
 import { toV2TableImport } from '@/lib/table/orchestration/import-resource'
@@ -21,7 +17,7 @@ export const GET = defineInternalJsonRoute({
  auth: internalTableSessionOrExecutorAuth,
  operation: tableOperations.readImport,
  rateLimit,
- errorPolicy: internalOrchestrationErrorPolicy,
+ errorPolicy: internalTableErrorPolicies.concealImportAuthorization,
  mapInput: ({ params, query }) => ({
  importId: params.importId,
  workspaceId: query.workspaceId,
@@ -35,7 +31,7 @@ export const DELETE = defineInternalJsonRoute({
  auth: internalTableSessionOrExecutorAuth,
  operation: tableOperations.cancelImport,
  rateLimit,
- errorPolicy: internalOrchestrationErrorPolicy,
+ errorPolicy: internalTableErrorPolicies.concealImportAuthorization,
  mapInput: ({ params, query, headers }) => ({
  importId: params.importId,
  workspaceId: query.workspaceId,

apps/sim/app/api/table/imports/route.ts

@@ -1,10 +1,6 @@
 import { createTableImportResourceContract } from '@/lib/api/contracts/table-transfers'
-import {
- defineInternalJsonRoute,
- internalOrchestrationErrorPolicy,
- internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import { createTableImportUseCase } from '@/lib/table/application/imports'
 import { tableOperations } from '@/lib/table/application/operations'
 import { toV2CreateTableImport } from '@/lib/table/orchestration/import-resource'
@@ -16,7 +12,7 @@ export const POST = defineInternalJsonRoute({
  rateLimit: internalRateLimits.none({
  reason: 'Existing authenticated table import creation has no request-rate policy',
  }),
- errorPolicy: internalOrchestrationErrorPolicy,
+ errorPolicy: internalTableErrorPolicies.concealTableAuthorization,
  mapInput: ({ body }) => ({ body }),
  useCase: createTableImportUseCase,
  present: ({ import: created }) => ({ data: toV2CreateTableImport(created) }),

apps/sim/app/api/table/table-transfer-routes.test.ts

@@ -10,13 +10,19 @@ interface CapturedDefinition {
  response: { status?: number }
  }
  auth: unknown
+ errorPolicy: unknown
  operation: { id: string }
  useCase: unknown
 }
 
 const mocks = vi.hoisted(() => ({
  auth: { kind: 'session-or-executor' },
  definitions: [] as CapturedDefinition[],
+ errorPolicies: {
+ concealTableAuthorization: { kind: 'conceal-table' },
+ concealImportAuthorization: { kind: 'conceal-import' },
+ concealExportAuthorization: { kind: 'conceal-export' },
+ },
  useCases: {
  cancelExport: { operation: { id: 'tables.exports.cancel' } },
  cancelImport: { operation: { id: 'tables.imports.cancel' } },
@@ -41,7 +47,10 @@ vi.mock('@/lib/api/server/routes', () => ({
  },
 }))
 
-vi.mock('@/lib/table/api', () => ({ internalTableSessionOrExecutorAuth: mocks.auth }))
+vi.mock('@/lib/table/api', () => ({
+ internalTableErrorPolicies: mocks.errorPolicies,
+ internalTableSessionOrExecutorAuth: mocks.auth,
+}))
 
 vi.mock('@/lib/table/application/imports', () => ({
  cancelTableImportUseCase: mocks.useCases.cancelImport,
@@ -106,6 +115,36 @@ describe('internal table transfer routes', () => {
  }
  })
 
+ it('conceals cross-tenant authorization on every table transfer control leg', () => {
+ const expected = [
+ ['POST', '/api/table/imports', mocks.errorPolicies.concealTableAuthorization],
+ ['GET', '/api/table/imports/[importId]', mocks.errorPolicies.concealImportAuthorization],
+ ['DELETE', '/api/table/imports/[importId]', mocks.errorPolicies.concealImportAuthorization],
+ [
+ 'POST',
+ '/api/table/imports/[importId]/parts',
+ mocks.errorPolicies.concealImportAuthorization,
+ ],
+ [
+ 'POST',
+ '/api/table/imports/[importId]/complete',
+ mocks.errorPolicies.concealImportAuthorization,
+ ],
+ ['POST', '/api/table/[tableId]/exports', mocks.errorPolicies.concealTableAuthorization],
+ ['GET', '/api/table/exports/[exportId]', mocks.errorPolicies.concealExportAuthorization],
+ ['DELETE', '/api/table/exports/[exportId]', mocks.errorPolicies.concealExportAuthorization],
+ [
+ 'GET',
+ '/api/table/exports/[exportId]/download',
+ mocks.errorPolicies.concealExportAuthorization,
+ ],
+ ] as const
+
+ for (const [method, path, errorPolicy] of expected) {
+ expect(definition(method, path).errorPolicy).toBe(errorPolicy)
+ }
+ })
+
  it('preserves the create response statuses', () => {
  expect(definition('POST', '/api/table/imports').contract.response.status).toBe(201)
  expect(definition('POST', '/api/table/[tableId]/exports').contract.response.status).toBe(201)

apps/sim/app/api/v2/workflows/[id]/deploy/route.test.ts

@@ -9,6 +9,8 @@ const mocks = vi.hoisted(() => ({
 }))
 
 vi.mock('@/lib/api/server/routes', () => ({
+ createInternalResourceConcealmentPolicy: vi.fn(() => ({ kind: 'conceal-internal-resource' })),
+ internalOrchestrationErrorPolicy: { kind: 'internal-plain' },
  createInternalSessionOrExecutorAuth: vi.fn(() => ({ kind: 'internal-workflow' })),
  createV2ResourceConcealmentPolicy: vi.fn(() => ({ kind: 'conceal-resource' })),
  defineV2JsonRoute: mocks.defineRoute,

apps/sim/app/api/v2/workflows/[id]/export/route.test.ts

@@ -6,6 +6,8 @@ import { describe, expect, it, vi } from 'vitest'
 const mocks = vi.hoisted(() => ({ defineRoute: vi.fn((definition) => definition) }))
 
 vi.mock('@/lib/api/server/routes', () => ({
+ createInternalResourceConcealmentPolicy: vi.fn(() => ({ kind: 'conceal-internal-resource' })),
+ internalOrchestrationErrorPolicy: { kind: 'internal-plain' },
  createInternalSessionOrExecutorAuth: vi.fn(() => ({ authenticate: vi.fn() })),
  createV2ResourceConcealmentPolicy: vi.fn(() => ({ kind: 'conceal-resource' })),
  defineV2JsonRoute: mocks.defineRoute,

apps/sim/app/api/v2/workflows/[id]/rollback/route.test.ts

@@ -8,6 +8,8 @@ const mocks = vi.hoisted(() => ({
 }))
 
 vi.mock('@/lib/api/server/routes', () => ({
+ createInternalResourceConcealmentPolicy: vi.fn(() => ({ kind: 'conceal-internal-resource' })),
+ internalOrchestrationErrorPolicy: { kind: 'internal-plain' },
  createInternalSessionOrExecutorAuth: vi.fn(() => ({ kind: 'internal-workflow' })),
  createV2ResourceConcealmentPolicy: vi.fn(() => ({ kind: 'conceal-resource' })),
  defineV2JsonRoute: mocks.defineRoute,

apps/sim/app/api/v2/workflows/[id]/runs/[runId]/resume/route.test.ts

@@ -34,6 +34,8 @@ vi.mock('@/lib/api/server/routes', () => {
  }
  return {
  admitV2Request: mocks.admit,
+ createInternalResourceConcealmentPolicy: vi.fn(() => ({ project: () => null })),
+ internalOrchestrationErrorPolicy: { project: () => null },
  createInternalSessionOrExecutorAuth: vi.fn(() => ({ authenticate: vi.fn() })),
  createV2ResourceConcealmentPolicy: vi.fn(
  ({ render }: { render?: (error: unknown) => Response | null }) => ({

apps/sim/app/api/v2/workflows/folders/route.test.ts

@@ -6,6 +6,8 @@ import { describe, expect, it, vi } from 'vitest'
 const mocks = vi.hoisted(() => ({ defineRoute: vi.fn((definition) => definition) }))
 
 vi.mock('@/lib/api/server/routes', () => ({
+ createInternalResourceConcealmentPolicy: vi.fn(() => ({ kind: 'conceal-internal-resource' })),
+ internalOrchestrationErrorPolicy: { kind: 'internal-plain' },
  createInternalSessionOrExecutorAuth: vi.fn(() => ({ authenticate: vi.fn() })),
  createV2ResourceConcealmentPolicy: vi.fn(() => ({ kind: 'conceal-resource' })),
  defineV2JsonRoute: mocks.defineRoute,