chore: import upstream snapshot with attribution

apps/sim/app/api/workflows/[id]/variables/route.test.ts

@@ -0,0 +1,361 @@
+/**
+ * Tests for workflow variables API route
+ * Tests the optimized permissions and caching system
+ *
+ * @vitest-environment node
+ */
+import {
+  auditMock,
+  hybridAuthMockFns,
+  workflowAuthzMockFns,
+  workflowsUtilsMock,
+} from '@sim/testing'
+import { NextRequest } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { getWorkflowVariablesContract } from '@/lib/api/contracts/workflows'
+
+vi.mock('@sim/audit', () => auditMock)
+
+vi.mock('@/lib/workflows/utils', () => workflowsUtilsMock)
+
+import { GET, POST } from '@/app/api/workflows/[id]/variables/route'
+
+describe('Workflow Variables API Route', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  describe('GET /api/workflows/[id]/variables', () => {
+    it('should return 401 when user is not authenticated', async () => {
+      hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: false,
+        error: 'Authentication required',
+      })
+
+      const req = new NextRequest('http://localhost:3000/api/workflows/workflow-123/variables')
+      const params = Promise.resolve({ id: 'workflow-123' })
+
+      const response = await GET(req, { params })
+
+      expect(response.status).toBe(401)
+      const data = await response.json()
+      expect(data.error).toBe('Unauthorized')
+    })
+
+    it('should return 404 when workflow does not exist', async () => {
+      hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: true,
+        userId: 'user-123',
+        authType: 'session',
+      })
+      workflowAuthzMockFns.mockAuthorizeWorkflowByWorkspacePermission.mockResolvedValueOnce({
+        allowed: false,
+        status: 404,
+        message: 'Workflow not found',
+        workflow: null,
+        workspacePermission: null,
+      })
+
+      const req = new NextRequest('http://localhost:3000/api/workflows/nonexistent/variables')
+      const params = Promise.resolve({ id: 'nonexistent' })
+
+      const response = await GET(req, { params })
+
+      expect(response.status).toBe(404)
+      const data = await response.json()
+      expect(data.error).toBe('Workflow not found')
+    })
+
+    it('should allow access when user has workspace permission', async () => {
+      const mockWorkflow = {
+        id: 'workflow-123',
+        userId: 'user-123',
+        workspaceId: 'workspace-456',
+        variables: {
+          'var-1': { id: 'var-1', name: 'test', type: 'string', value: 'hello' },
+        },
+      }
+
+      hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: true,
+        userId: 'user-123',
+        authType: 'session',
+      })
+      workflowAuthzMockFns.mockAuthorizeWorkflowByWorkspacePermission.mockResolvedValueOnce({
+        allowed: true,
+        status: 200,
+        workflow: mockWorkflow,
+        workspacePermission: 'admin',
+      })
+
+      const req = new NextRequest('http://localhost:3000/api/workflows/workflow-123/variables')
+      const params = Promise.resolve({ id: 'workflow-123' })
+
+      const response = await GET(req, { params })
+
+      expect(response.status).toBe(200)
+      const data = await response.json()
+      expect(data.data).toEqual({
+        'var-1': {
+          id: 'var-1',
+          name: 'test',
+          type: 'string',
+          value: 'hello',
+          workflowId: 'workflow-123',
+        },
+      })
+      const parsed = getWorkflowVariablesContract.response.schema.parse(data)
+      expect(parsed.data['var-1'].workflowId).toBe('workflow-123')
+    })
+
+    it('should allow access when user has workspace permissions', async () => {
+      const mockWorkflow = {
+        id: 'workflow-123',
+        userId: 'other-user',
+        workspaceId: 'workspace-456',
+        variables: {
+          'var-1': { id: 'var-1', name: 'test', type: 'string', value: 'hello' },
+        },
+      }
+
+      hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: true,
+        userId: 'user-123',
+        authType: 'session',
+      })
+      workflowAuthzMockFns.mockAuthorizeWorkflowByWorkspacePermission.mockResolvedValueOnce({
+        allowed: true,
+        status: 200,
+        workflow: mockWorkflow,
+        workspacePermission: 'read',
+      })
+
+      const req = new NextRequest('http://localhost:3000/api/workflows/workflow-123/variables')
+      const params = Promise.resolve({ id: 'workflow-123' })
+
+      const response = await GET(req, { params })
+
+      expect(response.status).toBe(200)
+      const data = await response.json()
+      // GET stamps `workflowId` from the path param on each variable.
+      expect(data.data).toEqual({
+        'var-1': {
+          id: 'var-1',
+          name: 'test',
+          type: 'string',
+          value: 'hello',
+          workflowId: 'workflow-123',
+        },
+      })
+    })
+
+    it('should deny access when user has no workspace permissions', async () => {
+      const mockWorkflow = {
+        id: 'workflow-123',
+        userId: 'other-user',
+        workspaceId: 'workspace-456',
+        variables: {},
+      }
+
+      hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: true,
+        userId: 'user-123',
+        authType: 'session',
+      })
+      workflowAuthzMockFns.mockAuthorizeWorkflowByWorkspacePermission.mockResolvedValueOnce({
+        allowed: false,
+        status: 403,
+        message: 'Unauthorized: Access denied to read this workflow',
+        workflow: mockWorkflow,
+        workspacePermission: null,
+      })
+
+      const req = new NextRequest('http://localhost:3000/api/workflows/workflow-123/variables')
+      const params = Promise.resolve({ id: 'workflow-123' })
+
+      const response = await GET(req, { params })
+
+      expect(response.status).toBe(403)
+      const data = await response.json()
+      expect(data.error).toBe('Unauthorized: Access denied to read this workflow')
+    })
+
+    it('should include proper cache headers', async () => {
+      const mockWorkflow = {
+        id: 'workflow-123',
+        userId: 'user-123',
+        workspaceId: 'workspace-456',
+        variables: {
+          'var-1': { id: 'var-1', name: 'test', type: 'string', value: 'hello' },
+        },
+      }
+
+      hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: true,
+        userId: 'user-123',
+        authType: 'session',
+      })
+      workflowAuthzMockFns.mockAuthorizeWorkflowByWorkspacePermission.mockResolvedValueOnce({
+        allowed: true,
+        status: 200,
+        workflow: mockWorkflow,
+        workspacePermission: 'admin',
+      })
+
+      const req = new NextRequest('http://localhost:3000/api/workflows/workflow-123/variables')
+      const params = Promise.resolve({ id: 'workflow-123' })
+
+      const response = await GET(req, { params })
+
+      expect(response.status).toBe(200)
+      expect(response.headers.get('Cache-Control')).toBe('max-age=30, stale-while-revalidate=300')
+      expect(response.headers.get('ETag')).toMatch(/^"variables-workflow-123-\d+"$/)
+    })
+  })
+
+  describe('POST /api/workflows/[id]/variables', () => {
+    it('should allow user with write permission to update variables', async () => {
+      const mockWorkflow = {
+        id: 'workflow-123',
+        userId: 'user-123',
+        workspaceId: 'workspace-456',
+        variables: {},
+      }
+
+      hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: true,
+        userId: 'user-123',
+        authType: 'session',
+      })
+      workflowAuthzMockFns.mockAuthorizeWorkflowByWorkspacePermission.mockResolvedValueOnce({
+        allowed: true,
+        status: 200,
+        workflow: mockWorkflow,
+        workspacePermission: 'write',
+      })
+
+      const variables = {
+        'var-1': {
+          id: 'var-1',
+          workflowId: 'workflow-123',
+          name: 'test',
+          type: 'string',
+          value: 'hello',
+        },
+      }
+
+      const req = new NextRequest('http://localhost:3000/api/workflows/workflow-123/variables', {
+        method: 'POST',
+        body: JSON.stringify({ variables }),
+      })
+      const params = Promise.resolve({ id: 'workflow-123' })
+
+      const response = await POST(req, { params })
+
+      expect(response.status).toBe(200)
+      const data = await response.json()
+      expect(data.success).toBe(true)
+    })
+
+    it('should deny access for users without permissions', async () => {
+      const mockWorkflow = {
+        id: 'workflow-123',
+        userId: 'other-user',
+        workspaceId: 'workspace-456',
+        variables: {},
+      }
+
+      hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: true,
+        userId: 'user-123',
+        authType: 'session',
+      })
+      workflowAuthzMockFns.mockAuthorizeWorkflowByWorkspacePermission.mockResolvedValueOnce({
+        allowed: false,
+        status: 403,
+        message: 'Unauthorized: Access denied to write this workflow',
+        workflow: mockWorkflow,
+        workspacePermission: null,
+      })
+
+      const variables = {
+        'var-1': {
+          id: 'var-1',
+          workflowId: 'workflow-123',
+          name: 'test',
+          type: 'string',
+          value: 'hello',
+        },
+      }
+
+      const req = new NextRequest('http://localhost:3000/api/workflows/workflow-123/variables', {
+        method: 'POST',
+        body: JSON.stringify({ variables }),
+      })
+      const params = Promise.resolve({ id: 'workflow-123' })
+
+      const response = await POST(req, { params })
+
+      expect(response.status).toBe(403)
+      const data = await response.json()
+      expect(data.error).toBe('Unauthorized: Access denied to write this workflow')
+    })
+
+    it('should validate request data schema', async () => {
+      const mockWorkflow = {
+        id: 'workflow-123',
+        userId: 'user-123',
+        workspaceId: 'workspace-456',
+        variables: {},
+      }
+
+      hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: true,
+        userId: 'user-123',
+        authType: 'session',
+      })
+      workflowAuthzMockFns.mockAuthorizeWorkflowByWorkspacePermission.mockResolvedValueOnce({
+        allowed: true,
+        status: 200,
+        workflow: mockWorkflow,
+        workspacePermission: 'write',
+      })
+
+      const invalidData = { variables: [{ name: 'test' }] }
+
+      const req = new NextRequest('http://localhost:3000/api/workflows/workflow-123/variables', {
+        method: 'POST',
+        body: JSON.stringify(invalidData),
+      })
+      const params = Promise.resolve({ id: 'workflow-123' })
+
+      const response = await POST(req, { params })
+
+      expect(response.status).toBe(400)
+      const data = await response.json()
+      expect(data.error).toBe('Validation error')
+    })
+  })
+
+  describe('Error handling', () => {
+    it('should handle database errors gracefully', async () => {
+      hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: true,
+        userId: 'user-123',
+        authType: 'session',
+      })
+      workflowAuthzMockFns.mockAuthorizeWorkflowByWorkspacePermission.mockRejectedValueOnce(
+        new Error('Database connection failed')
+      )
+
+      const req = new NextRequest('http://localhost:3000/api/workflows/workflow-123/variables')
+      const params = Promise.resolve({ id: 'workflow-123' })
+
+      const response = await GET(req, { params })
+
+      expect(response.status).toBe(500)
+      const data = await response.json()
+      expect(data.error).toBe('Database connection failed')
+    })
+  })
+})

apps/sim/app/api/workflows/[id]/variables/route.ts

@@ -0,0 +1,176 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { db } from '@sim/db'
+import { workflow } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import {
+  assertWorkflowMutable,
+  authorizeWorkflowByWorkspacePermission,
+  WorkflowLockedError,
+} from '@sim/platform-authz/workflow'
+import { getErrorMessage } from '@sim/utils/errors'
+import { eq } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import { workflowVariablesContract } from '@/lib/api/contracts/workflows'
+import { parseRequest } from '@/lib/api/server'
+import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import type { Variable } from '@/stores/variables/types'
+
+const logger = createLogger('WorkflowVariablesAPI')
+
+export const POST = withRouteHandler(
+  async (req: NextRequest, context: { params: Promise<{ id: string }> }) => {
+    const requestId = generateRequestId()
+    const workflowId = (await context.params).id
+
+    try {
+      const auth = await checkSessionOrInternalAuth(req, { requireWorkflowId: false })
+      if (!auth.success || !auth.userId) {
+        logger.warn(`[${requestId}] Unauthorized workflow variables update attempt`)
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+      const userId = auth.userId
+
+      const authorization = await authorizeWorkflowByWorkspacePermission({
+        workflowId,
+        userId,
+        action: 'write',
+      })
+      const workflowData = authorization.workflow
+
+      if (!workflowData) {
+        logger.warn(`[${requestId}] Workflow not found: ${workflowId}`)
+        return NextResponse.json({ error: 'Workflow not found' }, { status: 404 })
+      }
+      const isAuthorized = authorization.allowed
+
+      if (!isAuthorized) {
+        logger.warn(
+          `[${requestId}] User ${userId} attempted to update variables for workflow ${workflowId} without permission`
+        )
+        return NextResponse.json(
+          { error: authorization.message || 'Access denied' },
+          { status: authorization.status || 403 }
+        )
+      }
+
+      await assertWorkflowMutable(workflowId)
+
+      const parsed = await parseRequest(workflowVariablesContract, req, context)
+      if (!parsed.success) return parsed.response
+      const { variables } = parsed.data.body
+      // Note: prior versions cross-checked that each variable's `workflowId`
+      // equalled the path param. The write contract does not carry `workflowId`
+      // per variable (the path param is the source of truth), so the check
+      // is unreachable and was removed.
+
+      // Variables are already in Record format - use directly
+      // The frontend is the source of truth for what variables should exist
+      await db
+        .update(workflow)
+        .set({
+          variables,
+          updatedAt: new Date(),
+        })
+        .where(eq(workflow.id, workflowId))
+
+      recordAudit({
+        workspaceId: workflowData.workspaceId ?? null,
+        actorId: userId,
+        actorName: auth.userName,
+        actorEmail: auth.userEmail,
+        action: AuditAction.WORKFLOW_VARIABLES_UPDATED,
+        resourceType: AuditResourceType.WORKFLOW,
+        resourceId: workflowId,
+        resourceName: workflowData.name ?? undefined,
+        description: `Updated workflow variables`,
+        metadata: {
+          variableCount: Object.keys(variables).length,
+          variableNames: Object.values(variables).map((v) => v.name),
+          workflowName: workflowData.name ?? undefined,
+        },
+        request: req,
+      })
+
+      return NextResponse.json({ success: true })
+    } catch (error) {
+      if (error instanceof WorkflowLockedError) {
+        return NextResponse.json({ error: error.message }, { status: error.status })
+      }
+
+      logger.error(`[${requestId}] Error updating workflow variables`, error)
+      return NextResponse.json({ error: 'Failed to update workflow variables' }, { status: 500 })
+    }
+  }
+)
+
+export const GET = withRouteHandler(
+  async (req: NextRequest, { params }: { params: Promise<{ id: string }> }) => {
+    const requestId = generateRequestId()
+    const workflowId = (await params).id
+
+    try {
+      const auth = await checkSessionOrInternalAuth(req, { requireWorkflowId: false })
+      if (!auth.success || !auth.userId) {
+        logger.warn(`[${requestId}] Unauthorized workflow variables access attempt`)
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+      const userId = auth.userId
+
+      const authorization = await authorizeWorkflowByWorkspacePermission({
+        workflowId,
+        userId,
+        action: 'read',
+      })
+      const workflowData = authorization.workflow
+
+      if (!workflowData) {
+        logger.warn(`[${requestId}] Workflow not found: ${workflowId}`)
+        return NextResponse.json({ error: 'Workflow not found' }, { status: 404 })
+      }
+      const isAuthorized = authorization.allowed
+
+      if (!isAuthorized) {
+        logger.warn(
+          `[${requestId}] User ${userId} attempted to access variables for workflow ${workflowId} without permission`
+        )
+        return NextResponse.json(
+          { error: authorization.message || 'Access denied' },
+          { status: authorization.status || 403 }
+        )
+      }
+
+      // Return variables if they exist. Stamp `workflowId` from the path
+      // param on each entry so the global client-side variables store can
+      // filter by workflow; the read contract requires this stamped field.
+      const persistedVariables =
+        (workflowData.variables as Record<string, Record<string, unknown>>) || {}
+      const variables: Record<string, Variable> = {}
+      for (const [variableId, variable] of Object.entries(persistedVariables)) {
+        if (variable && typeof variable === 'object') {
+          variables[variableId] = { ...variable, workflowId } as Variable
+        }
+      }
+
+      // Add cache headers to prevent frequent reloading
+      const variableHash = JSON.stringify(variables).length
+      const headers = new Headers({
+        'Cache-Control': 'max-age=30, stale-while-revalidate=300', // Cache for 30 seconds, stale for 5 min
+        ETag: `"variables-${workflowId}-${variableHash}"`,
+      })
+
+      return NextResponse.json(
+        { data: variables },
+        {
+          status: 200,
+          headers,
+        }
+      )
+    } catch (error) {
+      logger.error(`[${requestId}] Workflow variables fetch error`, error)
+      const errorMessage = getErrorMessage(error, 'Unknown error')
+      return NextResponse.json({ error: errorMessage }, { status: 500 })
+    }
+  }
+)