fix(workspace-sync): preserve activity attribution and update boundary tests

Author: icecrasher321

apps/docs/lib/openapi-download.test.ts

@@ -33,8 +33,9 @@ describe('OpenAPI download', () => {
     const tags = document.tags as Array<{ name: string }>
 
     expect(document.openapi).toBe('3.1.0')
-    expect(Object.keys(paths)).toHaveLength(133)
+    expect(Object.keys(paths)).toHaveLength(152)
     expect(tags.map((tag) => tag.name)).toEqual([
+      'Workspace Sync',
       'Workflows',
       'Workflow Runs',
       'Logs',

apps/docs/openapi-v2-workflows.json

@@ -15727,7 +15727,7 @@
                 "type": "null"
               }
             ],
-            "description": "Opaque continuation cursor, or null when the result is complete."
+            "description": "Opaque cursor for the next page. Send it back as `cursor`; null means there is nothing further to fetch. Never construct one yourself."
           },
           "truncated": {
             "type": "boolean",

apps/sim/app/api/workspaces/[id]/fork/excluded-workflows/route.test.ts

@@ -11,13 +11,29 @@ import {
 } from '@sim/testing'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockAssertWorkspaceAdminAccess, mockCaptureServerEvent } = vi.hoisted(() => ({
-  mockAssertWorkspaceAdminAccess: vi.fn(),
-  mockCaptureServerEvent: vi.fn(),
-}))
+const { mockAuthorizeWorkspaceOperation, mockCaptureServerEvent, mockAssertForkingEnabled } =
+  vi.hoisted(() => ({
+    mockAuthorizeWorkspaceOperation: vi.fn(),
+    mockCaptureServerEvent: vi.fn(),
+    mockAssertForkingEnabled: vi.fn(),
+  }))
 
 vi.mock('@/ee/workspace-forking/lib/lineage/authz', () => ({
-  assertWorkspaceAdminAccess: mockAssertWorkspaceAdminAccess,
+  assertForkingEnabled: mockAssertForkingEnabled,
+  ForkError: class extends Error {},
+}))
+
+vi.mock('@/lib/core/application/workspace-authorization', () => ({
+  authorizeWorkspaceOperation: mockAuthorizeWorkspaceOperation,
+  requireAllowedWorkspacePrincipal: vi.fn(),
+}))
+vi.mock('@/lib/workspaces/permissions/utils', () => ({
+  getWorkspaceWithOwner: vi.fn(async (id: string) => ({
+    id,
+    name: 'My Workspace',
+    organizationId: null,
+    allowPersonalApiKeys: true,
+  })),
 }))
 
 vi.mock('@sim/audit', () => auditMock)
@@ -42,8 +58,8 @@ describe('fork excluded-workflows route', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()
-    mockGetSession.mockResolvedValue({ user: { id: ADMIN_ID } })
-    mockAssertWorkspaceAdminAccess.mockResolvedValue({ id: WORKSPACE_ID, name: 'My Workspace' })
+    mockGetSession.mockResolvedValue({ user: { id: ADMIN_ID }, session: { id: 'session-1' } })
+    mockAuthorizeWorkspaceOperation.mockResolvedValue(undefined)
     mockUpdateReturning([])
   })
 
@@ -60,7 +76,7 @@ describe('fork excluded-workflows route', () => {
     )
 
     expect(res.status).toBe(401)
-    expect(mockAssertWorkspaceAdminAccess).not.toHaveBeenCalled()
+    expect(mockAuthorizeWorkspaceOperation).not.toHaveBeenCalled()
   })
 
   it('rejects an empty workflowIds batch', async () => {
@@ -81,7 +97,16 @@ describe('fork excluded-workflows route', () => {
       routeContext
     )
 
-    expect(mockAssertWorkspaceAdminAccess).toHaveBeenCalledWith(WORKSPACE_ID, ADMIN_ID)
+    expect(mockAuthorizeWorkspaceOperation).toHaveBeenCalledWith(
+      expect.objectContaining({ kind: 'session', userId: ADMIN_ID }),
+      expect.objectContaining({ id: 'workspaces.fork.exclusions', minimumRole: 'admin' }),
+      expect.objectContaining({ workspaceId: WORKSPACE_ID }),
+      {}
+    )
+    expect(mockAssertForkingEnabled).toHaveBeenCalledWith(null)
+    expect(mockAssertForkingEnabled.mock.invocationCallOrder[0]).toBeLessThan(
+      dbChainMockFns.update.mock.invocationCallOrder[0]
+    )
   })
 
   it('updates the batch, reports the transition count, and records one audit entry', async () => {

apps/sim/app/api/workspaces/[id]/fork/lineage/route.test.ts

@@ -3,23 +3,25 @@
  */
 import { authMockFns, createMockRequest } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
 
 const {
-  mockAssertWorkspaceAdminAccess,
+  mockAuthorizeWorkspaceOperation,
   mockGetForkParent,
   mockGetForkChildren,
   mockGetUndoableRunForTarget,
   mockGetEffectiveWorkspacePermission,
 } = vi.hoisted(() => ({
-  mockAssertWorkspaceAdminAccess: vi.fn(),
+  mockAuthorizeWorkspaceOperation: vi.fn(),
   mockGetForkParent: vi.fn(),
   mockGetForkChildren: vi.fn(),
   mockGetUndoableRunForTarget: vi.fn(),
   mockGetEffectiveWorkspacePermission: vi.fn(),
 }))
 
 vi.mock('@/ee/workspace-forking/lib/lineage/authz', () => ({
-  assertWorkspaceAdminAccess: mockAssertWorkspaceAdminAccess,
+  assertForkingEnabled: vi.fn(),
+  ForkError: class extends Error {},
 }))
 
 vi.mock('@/ee/workspace-forking/lib/lineage/lineage', () => ({
@@ -31,7 +33,17 @@ vi.mock('@/ee/workspace-forking/lib/promote/promote-run-store', () => ({
   getUndoableRunForTarget: mockGetUndoableRunForTarget,
 }))
 
+vi.mock('@/lib/core/application/workspace-authorization', () => ({
+  authorizeWorkspaceOperation: mockAuthorizeWorkspaceOperation,
+  requireAllowedWorkspacePrincipal: vi.fn(),
+}))
+
 vi.mock('@/lib/workspaces/permissions/utils', () => ({
+  getWorkspaceWithOwner: vi.fn(async (id: string) => ({
+    id,
+    organizationId: null,
+    allowPersonalApiKeys: true,
+  })),
   getEffectiveWorkspacePermission: mockGetEffectiveWorkspacePermission,
 }))
 
@@ -55,8 +67,8 @@ const childNode = (id: string, name: string) => ({
 describe('fork lineage route', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockGetSession.mockResolvedValue({ user: { id: VIEWER_ID } })
-    mockAssertWorkspaceAdminAccess.mockResolvedValue({ id: WORKSPACE_ID })
+    mockGetSession.mockResolvedValue({ user: { id: VIEWER_ID }, session: { id: 'session-1' } })
+    mockAuthorizeWorkspaceOperation.mockResolvedValue(undefined)
     mockGetForkParent.mockResolvedValue(null)
     mockGetForkChildren.mockResolvedValue([])
     mockGetUndoableRunForTarget.mockResolvedValue(null)
@@ -69,13 +81,34 @@ describe('fork lineage route', () => {
     const res = await GET(createMockRequest('GET'), routeContext)
 
     expect(res.status).toBe(401)
-    expect(mockAssertWorkspaceAdminAccess).not.toHaveBeenCalled()
+    expect(mockAuthorizeWorkspaceOperation).not.toHaveBeenCalled()
   })
 
   it('requires admin on the current workspace before loading lineage', async () => {
     await GET(createMockRequest('GET'), routeContext)
 
-    expect(mockAssertWorkspaceAdminAccess).toHaveBeenCalledWith(WORKSPACE_ID, VIEWER_ID)
+    expect(mockAuthorizeWorkspaceOperation).toHaveBeenCalledWith(
+      expect.objectContaining({ kind: 'session', userId: VIEWER_ID }),
+      expect.objectContaining({ id: 'workspaces.fork.discover', minimumRole: 'admin' }),
+      expect.objectContaining({ workspaceId: WORKSPACE_ID }),
+      {}
+    )
+    expect(mockAuthorizeWorkspaceOperation.mock.invocationCallOrder[0]).toBeLessThan(
+      mockGetForkParent.mock.invocationCallOrder[0]
+    )
+  })
+
+  it('does not read lineage when current workspace authorization is refused', async () => {
+    mockAuthorizeWorkspaceOperation.mockRejectedValue(
+      new OrchestrationError('forbidden', 'Admin access required')
+    )
+
+    const response = await GET(createMockRequest('GET'), routeContext)
+
+    expect(response.status).toBe(403)
+    expect(mockGetForkParent).not.toHaveBeenCalled()
+    expect(mockGetForkChildren).not.toHaveBeenCalled()
+    expect(mockGetUndoableRunForTarget).not.toHaveBeenCalled()
   })
 
   it('marks accessible and inaccessible nodes via the canonical permission resolver', async () => {

apps/sim/app/api/workspaces/[id]/fork/promote/route.test.ts

@@ -8,11 +8,13 @@
  *
  * @vitest-environment node
  */
+import { user } from '@sim/db/schema'
 import { auditMock, authMockFns, createMockRequest, type MockUser } from '@sim/testing'
+import { queueTableRows, resetDbChainMock } from '@sim/testing/mocks/database.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { FolderCollectionFullError } from '@/lib/folders/errors'
 
-const { mockLogger, mockPromoteFork, mockAssertCanPromote } = vi.hoisted(() => ({
+const { mockLogger, mockPromoteFork, mockAuthorizeWorkspaceOperation } = vi.hoisted(() => ({
   mockLogger: {
     info: vi.fn(),
     warn: vi.fn(),
@@ -23,7 +25,7 @@ const { mockLogger, mockPromoteFork, mockAssertCanPromote } = vi.hoisted(() => (
     child: vi.fn(),
   },
   mockPromoteFork: vi.fn(),
-  mockAssertCanPromote: vi.fn(),
+  mockAuthorizeWorkspaceOperation: vi.fn(),
 }))
 
 vi.mock('@sim/audit', () => auditMock)
@@ -34,7 +36,27 @@ vi.mock('@sim/logger', () => ({
 }))
 vi.mock('@/ee/workspace-forking/lib/promote/promote', () => ({ promoteFork: mockPromoteFork }))
 vi.mock('@/ee/workspace-forking/lib/lineage/authz', () => ({
-  assertCanPromote: mockAssertCanPromote,
+  assertForkingEnabled: vi.fn(),
+  ForkError: class extends Error {},
+}))
+
+vi.mock('@/lib/core/application/workspace-authorization', () => ({
+  authorizeWorkspaceOperation: mockAuthorizeWorkspaceOperation,
+  requireAllowedWorkspacePrincipal: vi.fn(),
+}))
+vi.mock('@/lib/workspaces/permissions/utils', () => ({
+  getWorkspaceWithOwner: vi.fn(async (id: string) => ({
+    id,
+    name: id === 'ws-child' ? 'Child' : 'Parent',
+    organizationId: null,
+    allowPersonalApiKeys: true,
+  })),
+}))
+vi.mock('@/ee/workspace-forking/lib/lineage/lineage', () => ({
+  resolveForkEdge: vi.fn(async () => ({
+    childWorkspaceId: 'ws-child',
+    parentWorkspaceId: 'ws-parent',
+  })),
 }))
 
 import { POST } from '@/app/api/workspaces/[id]/fork/promote/route'
@@ -58,19 +80,15 @@ function promoteRequest() {
 describe('POST /api/workspaces/[id]/fork/promote', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    authMockFns.mockGetSession.mockResolvedValue({ user: TEST_USER })
-    mockAssertCanPromote.mockResolvedValue({
-      edge: { childWorkspaceId: WORKSPACE_ID },
-      sourceWorkspaceId: WORKSPACE_ID,
-      targetWorkspaceId: 'ws-parent',
-      source: { name: 'Child' },
-      target: { name: 'Parent' },
-    })
+    authMockFns.mockGetSession.mockResolvedValue({ user: TEST_USER, session: { id: 'session-1' } })
+    resetDbChainMock()
+    queueTableRows(user, [{ name: TEST_USER.name }])
+    mockAuthorizeWorkspaceOperation.mockResolvedValue(undefined)
   })
 
   /**
-   * The sync's Activity row is recorded by the use case, not here, so the route's job is to
-   * hand it the one thing only the route knows: the display name of the edge's other side.
+   * The shared application use case resolves the other side's name and the actor attribution
+   * before the manager records the sync activity.
    */
   it('names the other side of the edge for promoteFork to record the sync', async () => {
     mockPromoteFork.mockResolvedValue({
@@ -80,6 +98,7 @@ describe('POST /api/workspaces/[id]/fork/promote', () => {
       archived: 0,
       redeployed: 1,
       deployFailed: 0,
+      deployWarnings: [],
       unmappedRequired: [],
       blockers: [],
       blocked: null,

apps/sim/app/api/workspaces/[id]/fork/route.test.ts

@@ -8,11 +8,13 @@
  *
  * @vitest-environment node
  */
+import { user } from '@sim/db/schema'
 import { auditMock, authMockFns, createMockRequest, type MockUser } from '@sim/testing'
+import { queueTableRows, resetDbChainMock } from '@sim/testing/mocks/database.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { FolderCollectionFullError } from '@/lib/folders/errors'
 
-const { mockLogger, mockCreateFork, mockAssertCanFork } = vi.hoisted(() => ({
+const { mockLogger, mockCreateFork, mockAuthorizeWorkspaceOperation } = vi.hoisted(() => ({
   mockLogger: {
     info: vi.fn(),
     warn: vi.fn(),
@@ -23,7 +25,7 @@ const { mockLogger, mockCreateFork, mockAssertCanFork } = vi.hoisted(() => ({
     child: vi.fn(),
   },
   mockCreateFork: vi.fn(),
-  mockAssertCanFork: vi.fn(),
+  mockAuthorizeWorkspaceOperation: vi.fn(),
 }))
 
 vi.mock('@sim/audit', () => auditMock)
@@ -33,7 +35,25 @@ vi.mock('@sim/logger', () => ({
   getRequestContext: () => undefined,
 }))
 vi.mock('@/ee/workspace-forking/lib/create-fork', () => ({ createFork: mockCreateFork }))
-vi.mock('@/ee/workspace-forking/lib/lineage/authz', () => ({ assertCanFork: mockAssertCanFork }))
+vi.mock('@/ee/workspace-forking/lib/lineage/authz', () => ({
+  assertForkingEnabled: vi.fn(),
+  ForkError: class extends Error {},
+}))
+vi.mock('@/lib/core/application/workspace-authorization', () => ({
+  authorizeWorkspaceOperation: mockAuthorizeWorkspaceOperation,
+  requireAllowedWorkspacePrincipal: vi.fn(),
+}))
+vi.mock('@/lib/workspaces/permissions/utils', () => ({
+  getWorkspaceWithOwner: vi.fn(async (id: string) => ({
+    id,
+    name: 'Source',
+    organizationId: null,
+    allowPersonalApiKeys: true,
+  })),
+}))
+vi.mock('@/lib/workspaces/policy', () => ({
+  getWorkspaceCreationPolicy: vi.fn(async () => ({ canCreate: true })),
+}))
 
 import { POST } from '@/app/api/workspaces/[id]/fork/route'
 
@@ -56,11 +76,10 @@ function forkRequest() {
 describe('POST /api/workspaces/[id]/fork', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    authMockFns.mockGetSession.mockResolvedValue({ user: TEST_USER })
-    mockAssertCanFork.mockResolvedValue({
-      source: { id: SOURCE_WORKSPACE_ID, name: 'Source' },
-      policy: {},
-    })
+    authMockFns.mockGetSession.mockResolvedValue({ user: TEST_USER, session: { id: 'session-1' } })
+    resetDbChainMock()
+    queueTableRows(user, [{ name: TEST_USER.name }])
+    mockAuthorizeWorkspaceOperation.mockResolvedValue(undefined)
   })
 
   it('renders a full-folder-tree refusal as an actionable 409', async () => {
@@ -100,12 +119,25 @@ describe('POST /api/workspaces/[id]/fork', () => {
 
   it('still returns the created fork when the copy succeeds', async () => {
     mockCreateFork.mockResolvedValue({
-      workspace: { id: 'ws-child', name: 'Child' },
+      workspace: {
+        id: 'ws-child',
+        name: 'Child',
+        ownerId: TEST_USER.id,
+        organizationId: null,
+        workspaceMode: 'personal',
+      },
       workflowsCopied: 2,
     })
 
     const response = await POST(forkRequest(), routeContext)
 
     expect(response.status).toBe(201)
+    expect(mockCreateFork).toHaveBeenCalledWith(
+      expect.objectContaining({
+        source: expect.objectContaining({ id: SOURCE_WORKSPACE_ID }),
+        userId: TEST_USER.id,
+        actorName: TEST_USER.name,
+      })
+    )
   })
 })