fix(workflows): finish delegated application migration

Author: TheodoreSpeaks

apps/sim/app/api/v2/workflows/[id]/deploy/route.test.ts

@@ -9,6 +9,7 @@ const mocks = vi.hoisted(() => ({
 }))
 
 vi.mock('@/lib/api/server/routes', () => ({
+  createInternalSessionOrExecutorAuth: vi.fn(() => ({ kind: 'internal-workflow' })),
   defineV2JsonRoute: mocks.defineRoute,
   v2ApiKeyAuth: { kind: 'v2-api-key' },
   v2RateLimits: { publicApi: { kind: 'public-api' } },

apps/sim/app/api/v2/workflows/[id]/rollback/route.test.ts

@@ -8,6 +8,7 @@ const mocks = vi.hoisted(() => ({
 }))
 
 vi.mock('@/lib/api/server/routes', () => ({
+  createInternalSessionOrExecutorAuth: vi.fn(() => ({ kind: 'internal-workflow' })),
   defineV2JsonRoute: mocks.defineRoute,
   v2ApiKeyAuth: { kind: 'v2-api-key' },
   v2RateLimits: { publicApi: { kind: 'public-api' } },

apps/sim/app/api/workflows/[id]/deploy/route.ts

@@ -1,9 +1,5 @@
-import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
-import { db, workflow } from '@sim/db'
 import { createLogger } from '@sim/logger'
-import { assertWorkflowMutable, WorkflowLockedError } from '@sim/platform-authz/workflow'
 import { getErrorMessage } from '@sim/utils/errors'
-import { eq } from 'drizzle-orm'
 import type { NextRequest } from 'next/server'
 import { updatePublicApiContract } from '@/lib/api/contracts/deployments'
 import { parseRequest } from '@/lib/api/server'
@@ -12,18 +8,13 @@ import { asOrchestrationError, statusForOrchestrationError } from '@/lib/core/or
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { captureServerEvent } from '@/lib/posthog/server'
-import { deployWorkflow, undeployWorkflow } from '@/lib/workflows/application/deployments'
-import { getWorkflowDeploymentSummary } from '@/lib/workflows/orchestration'
-import { validateWorkflowPermissions } from '@/lib/workflows/utils'
 import {
-  checkNeedsRedeployment,
-  createErrorResponse,
-  createSuccessResponse,
-} from '@/app/api/workflows/utils'
-import {
-  PublicApiNotAllowedError,
-  validatePublicApiAllowed,
-} from '@/ee/access-control/utils/permission-check'
+  deployWorkflow,
+  readWorkflowDeploymentStatus,
+  undeployWorkflow,
+} from '@/lib/workflows/application/deployments'
+import { updateWorkflowPublicApi } from '@/lib/workflows/application/update-workflow-deployment-settings'
+import { createErrorResponse, createSuccessResponse } from '@/app/api/workflows/utils'
 
 const logger = createLogger('WorkflowDeployAPI')
 
@@ -37,14 +28,13 @@ export const GET = withRouteHandler(
     const { id } = await params
 
     try {
-      const { error, workflow: workflowData } = await validateWorkflowPermissions(
-        id,
-        requestId,
-        'read'
-      )
-      if (error) {
-        return createErrorResponse(error.message, error.status)
-      }
+      const principal = await internalSessionAuth.authenticate()
+      const result = await readWorkflowDeploymentStatus.execute({
+        principal,
+        input: { workflowId: id },
+        request,
+      })
+      const workflowData = result.workflow
 
       /**
        * A workflow is deployed only when an active version snapshot exists —
@@ -53,8 +43,7 @@ export const GET = withRouteHandler(
        * disagrees with the version table the workflow cannot actually serve
        * traffic, so reporting it as live would be untruthful.
        */
-      const deploymentSummary = await getWorkflowDeploymentSummary(id)
-      const isDeployed = deploymentSummary.activeDeployment !== null
+      const isDeployed = result.isDeployed
 
       if (!isDeployed) {
         logger.info(`[${requestId}] Workflow is not deployed: ${id}`)
@@ -64,18 +53,12 @@ export const GET = withRouteHandler(
           apiKey: null,
           needsRedeployment: false,
           isPublicApi: workflowData.isPublicApi ?? false,
-          activeDeployment: deploymentSummary.activeDeployment,
-          latestDeploymentAttempt: deploymentSummary.latestDeploymentAttempt,
-          warnings: deploymentSummary.warnings,
+          activeDeployment: result.activeDeployment,
+          latestDeploymentAttempt: result.latestDeploymentAttempt,
+          warnings: result.warnings,
         })
       }
 
-      const attemptStatus = deploymentSummary.latestDeploymentAttempt?.status
-      const needsRedeployment =
-        attemptStatus === 'preparing' || attemptStatus === 'activating'
-          ? false
-          : await checkNeedsRedeployment(id)
-
       logger.info(`[${requestId}] Successfully retrieved deployment info: ${id}`)
 
       const responseApiKeyInfo = workflowData.workspaceId
@@ -85,14 +68,24 @@ export const GET = withRouteHandler(
       return createSuccessResponse({
         apiKey: responseApiKeyInfo,
         isDeployed,
-        deployedAt: deploymentSummary.activeDeployment?.deployedAt ?? workflowData.deployedAt,
-        needsRedeployment,
+        deployedAt: result.activeDeployment?.deployedAt ?? workflowData.deployedAt,
+        needsRedeployment: result.needsRedeployment,
         isPublicApi: workflowData.isPublicApi ?? false,
-        activeDeployment: deploymentSummary.activeDeployment,
-        latestDeploymentAttempt: deploymentSummary.latestDeploymentAttempt,
-        warnings: deploymentSummary.warnings,
+        activeDeployment: result.activeDeployment,
+        latestDeploymentAttempt: result.latestDeploymentAttempt,
+        warnings: result.warnings,
       })
     } catch (error: unknown) {
+      if (error instanceof InternalUnauthenticatedError) {
+        return createErrorResponse(error.message, 401)
+      }
+      const orchestrationError = asOrchestrationError(error)
+      if (orchestrationError) {
+        return createErrorResponse(
+          orchestrationError.message,
+          statusForOrchestrationError(orchestrationError.code)
+        )
+      }
       logger.error(`[${requestId}] Error fetching deployment info: ${id}`, {
         error: getErrorMessage(error, 'Unknown error'),
       })
@@ -152,6 +145,7 @@ export const PATCH = withRouteHandler(
     const requestId = generateRequestId()
 
     try {
+      const principal = await internalSessionAuth.authenticate()
       const parsed = await parseRequest(updatePublicApiContract, request, context, {
         validationErrorResponse: () =>
           createErrorResponse('Invalid request body: isPublicApi must be a boolean', 400),
@@ -161,56 +155,32 @@ export const PATCH = withRouteHandler(
       const { id } = parsed.data.params
       const { isPublicApi } = parsed.data.body
 
-      const {
-        error,
-        session,
-        workflow: workflowData,
-      } = await validateWorkflowPermissions(id, requestId, 'admin')
-      if (error) {
-        return createErrorResponse(error.message, error.status)
-      }
-      await assertWorkflowMutable(id)
-
-      if (isPublicApi) {
-        try {
-          await validatePublicApiAllowed(session?.user?.id, workflowData?.workspaceId ?? undefined)
-        } catch (err) {
-          if (err instanceof PublicApiNotAllowedError) {
-            return createErrorResponse('Public API access is disabled', 403)
-          }
-          throw err
-        }
-      }
-
-      await db.update(workflow).set({ isPublicApi }).where(eq(workflow.id, id))
-
-      logger.info(`[${requestId}] Updated isPublicApi for workflow ${id} to ${isPublicApi}`)
-
-      const wsId = workflowData?.workspaceId
-
-      recordAudit({
-        workspaceId: wsId ?? null,
-        actorId: session!.user.id,
-        action: AuditAction.WORKFLOW_PUBLIC_API_TOGGLED,
-        resourceType: AuditResourceType.WORKFLOW,
-        resourceId: id,
-        resourceName: workflowData?.name ?? undefined,
-        description: `${isPublicApi ? 'Enabled' : 'Disabled'} public API for workflow "${workflowData?.name ?? id}"`,
-        metadata: { isPublicApi },
+      const result = await updateWorkflowPublicApi.execute({
+        principal,
+        input: { workflowId: id, isPublicApi },
         request,
       })
 
+      logger.info(`[${requestId}] Updated isPublicApi for workflow ${id} to ${isPublicApi}`)
+
       captureServerEvent(
-        session!.user.id,
+        principal.userId,
         'workflow_public_api_toggled',
-        { workflow_id: id, workspace_id: wsId ?? '', is_public: isPublicApi },
-        wsId ? { groups: { workspace: wsId } } : undefined
+        { workflow_id: id, workspace_id: result.workspaceId, is_public: isPublicApi },
+        { groups: { workspace: result.workspaceId } }
       )
 
       return createSuccessResponse({ isPublicApi })
     } catch (error: unknown) {
-      if (error instanceof WorkflowLockedError) {
-        return createErrorResponse(error.message, error.status)
+      if (error instanceof InternalUnauthenticatedError) {
+        return createErrorResponse(error.message, 401)
+      }
+      const orchestrationError = asOrchestrationError(error)
+      if (orchestrationError) {
+        return createErrorResponse(
+          orchestrationError.message,
+          statusForOrchestrationError(orchestrationError.code)
+        )
       }
       logger.error(`[${requestId}] Error updating deployment settings`, {
         error: getErrorMessage(error, 'Unknown error'),