Skip to content

Commit 8b6796e

Browse files
icecrasher321icecrasher321
committed
correct degree of access control
1 parent 895eec3 commit 8b6796e

File tree

23 files changed

+60
-74
lines changed

23 files changed

+60
-74
lines changed

‎apps/sim/app/api/a2a/agents/[agentId]/route.ts‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import { eq } from 'drizzle-orm'
55
import { type NextRequest, NextResponse } from 'next/server'
66
import { generateAgentCard, generateSkillsFromWorkflow } from '@/lib/a2a/agent-card'
77
import type { AgentCapabilities, AgentSkill } from '@/lib/a2a/types'
8-
import { checkHybridAuth } from '@/lib/auth/hybrid'
8+
import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
99
import { getRedisClient } from '@/lib/core/config/redis'
1010
import { loadWorkflowFromNormalizedTables } from '@/lib/workflows/persistence/utils'
1111
import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
@@ -40,7 +40,7 @@ export async function GET(request: NextRequest, { params }: { params: Promise<Ro
4040
}
4141

4242
if (!agent.agent.isPublished) {
43-
const auth = await checkHybridAuth(request, { requireWorkflowId: false })
43+
const auth = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
4444
if (!auth.success) {
4545
return NextResponse.json({ error: 'Agent not published' }, { status: 404 })
4646
}
@@ -81,7 +81,7 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<Ro
8181
const { agentId } = await params
8282

8383
try {
84-
const auth = await checkHybridAuth(request, { requireWorkflowId: false })
84+
const auth = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
8585
if (!auth.success || !auth.userId) {
8686
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
8787
}
@@ -151,7 +151,7 @@ export async function DELETE(request: NextRequest, { params }: { params: Promise
151151
const { agentId } = await params
152152

153153
try {
154-
const auth = await checkHybridAuth(request, { requireWorkflowId: false })
154+
const auth = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
155155
if (!auth.success || !auth.userId) {
156156
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
157157
}
@@ -189,7 +189,7 @@ export async function POST(request: NextRequest, { params }: { params: Promise<R
189189
const { agentId } = await params
190190

191191
try {
192-
const auth = await checkHybridAuth(request, { requireWorkflowId: false })
192+
const auth = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
193193
if (!auth.success || !auth.userId) {
194194
logger.warn('A2A agent publish auth failed:', { error: auth.error, hasUserId: !!auth.userId })
195195
return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })

‎apps/sim/app/api/a2a/agents/route.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import { v4 as uuidv4 } from 'uuid'
1313
import { generateSkillsFromWorkflow } from '@/lib/a2a/agent-card'
1414
import { A2A_DEFAULT_CAPABILITIES } from '@/lib/a2a/constants'
1515
import { sanitizeAgentName } from '@/lib/a2a/utils'
16-
import { checkHybridAuth } from '@/lib/auth/hybrid'
16+
import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
1717
import { loadWorkflowFromNormalizedTables } from '@/lib/workflows/persistence/utils'
1818
import { hasValidStartBlockInState } from '@/lib/workflows/triggers/trigger-utils'
1919
import { getWorkspaceById } from '@/lib/workspaces/permissions/utils'
@@ -27,7 +27,7 @@ export const dynamic = 'force-dynamic'
2727
*/
2828
export async function GET(request: NextRequest) {
2929
try {
30-
const auth = await checkHybridAuth(request, { requireWorkflowId: false })
30+
const auth = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
3131
if (!auth.success || !auth.userId) {
3232
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
3333
}
@@ -87,7 +87,7 @@ export async function GET(request: NextRequest) {
8787
*/
8888
export async function POST(request: NextRequest) {
8989
try {
90-
const auth = await checkHybridAuth(request, { requireWorkflowId: false })
90+
const auth = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
9191
if (!auth.success || !auth.userId) {
9292
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
9393
}

‎apps/sim/app/api/auth/oauth/credentials/route.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import { and, eq } from 'drizzle-orm'
55
import { jwtDecode } from 'jwt-decode'
66
import { type NextRequest, NextResponse } from 'next/server'
77
import { z } from 'zod'
8-
import { checkHybridAuth } from '@/lib/auth/hybrid'
8+
import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
99
import { generateRequestId } from '@/lib/core/utils/request'
1010
import { evaluateScopeCoverage, type OAuthProvider, parseProvider } from '@/lib/oauth'
1111
import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
@@ -81,7 +81,7 @@ export async function GET(request: NextRequest) {
8181
const { provider: providerParam, workflowId, credentialId } = parseResult.data
8282

8383
// Authenticate requester (supports session, API key, internal JWT)
84-
const authResult = await checkHybridAuth(request)
84+
const authResult = await checkSessionOrInternalAuth(request)
8585
if (!authResult.success || !authResult.userId) {
8686
logger.warn(`[${requestId}] Unauthenticated credentials request rejected`)
8787
return NextResponse.json({ error: 'User not authenticated' }, { status: 401 })

‎apps/sim/app/api/auth/oauth/token/route.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ import { createLogger } from '@sim/logger'
22
import { type NextRequest, NextResponse } from 'next/server'
33
import { z } from 'zod'
44
import { authorizeCredentialUse } from '@/lib/auth/credential-access'
5-
import { checkHybridAuth } from '@/lib/auth/hybrid'
5+
import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
66
import { generateRequestId } from '@/lib/core/utils/request'
77
import { getCredential, getOAuthToken, refreshTokenIfNeeded } from '@/app/api/auth/oauth/utils'
88

@@ -71,7 +71,7 @@ export async function POST(request: NextRequest) {
7171
providerId,
7272
})
7373

74-
const auth = await checkHybridAuth(request, { requireWorkflowId: false })
74+
const auth = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
7575
if (!auth.success || auth.authType !== 'session' || !auth.userId) {
7676
logger.warn(`[${requestId}] Unauthorized request for credentialAccountUserId path`, {
7777
success: auth.success,
@@ -187,7 +187,7 @@ export async function GET(request: NextRequest) {
187187
const { credentialId } = parseResult.data
188188

189189
// For GET requests, we only support session-based authentication
190-
const auth = await checkHybridAuth(request, { requireWorkflowId: false })
190+
const auth = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
191191
if (!auth.success || auth.authType !== 'session' || !auth.userId) {
192192
return NextResponse.json({ error: 'User not authenticated' }, { status: 401 })
193193
}

‎apps/sim/app/api/files/delete/route.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
import { createLogger } from '@sim/logger'
22
import type { NextRequest } from 'next/server'
33
import { NextResponse } from 'next/server'
4-
import { checkHybridAuth } from '@/lib/auth/hybrid'
4+
import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
55
import type { StorageContext } from '@/lib/uploads/config'
66
import { deleteFile, hasCloudStorage } from '@/lib/uploads/core/storage-service'
77
import { extractStorageKey, inferContextFromKey } from '@/lib/uploads/utils/file-utils'
@@ -24,7 +24,7 @@ const logger = createLogger('FilesDeleteAPI')
2424
*/
2525
export async function POST(request: NextRequest) {
2626
try {
27-
const authResult = await checkHybridAuth(request, { requireWorkflowId: false })
27+
const authResult = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
2828

2929
if (!authResult.success || !authResult.userId) {
3030
logger.warn('Unauthorized file delete request', {

‎apps/sim/app/api/files/download/route.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import { createLogger } from '@sim/logger'
22
import { type NextRequest, NextResponse } from 'next/server'
3-
import { checkHybridAuth } from '@/lib/auth/hybrid'
3+
import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
44
import type { StorageContext } from '@/lib/uploads/config'
55
import { hasCloudStorage } from '@/lib/uploads/core/storage-service'
66
import { verifyFileAccess } from '@/app/api/files/authorization'
@@ -12,7 +12,7 @@ export const dynamic = 'force-dynamic'
1212

1313
export async function POST(request: NextRequest) {
1414
try {
15-
const authResult = await checkHybridAuth(request, { requireWorkflowId: false })
15+
const authResult = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
1616

1717
if (!authResult.success || !authResult.userId) {
1818
logger.warn('Unauthorized download URL request', {

‎apps/sim/app/api/files/parse/route.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import path from 'path'
55
import { createLogger } from '@sim/logger'
66
import binaryExtensionsList from 'binary-extensions'
77
import { type NextRequest, NextResponse } from 'next/server'
8-
import { checkHybridAuth } from '@/lib/auth/hybrid'
8+
import { checkInternalAuth } from '@/lib/auth/hybrid'
99
import {
1010
secureFetchWithPinnedIP,
1111
validateUrlWithDNS,
@@ -66,7 +66,7 @@ export async function POST(request: NextRequest) {
6666
const startTime = Date.now()
6767

6868
try {
69-
const authResult = await checkHybridAuth(request, { requireWorkflowId: true })
69+
const authResult = await checkInternalAuth(request, { requireWorkflowId: true })
7070

7171
if (!authResult.success) {
7272
logger.warn('Unauthorized file parse request', {

‎apps/sim/app/api/files/serve/[...path]/route.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ import { readFile } from 'fs/promises'
22
import { createLogger } from '@sim/logger'
33
import type { NextRequest } from 'next/server'
44
import { NextResponse } from 'next/server'
5-
import { checkHybridAuth } from '@/lib/auth/hybrid'
5+
import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
66
import { CopilotFiles, isUsingCloudStorage } from '@/lib/uploads'
77
import type { StorageContext } from '@/lib/uploads/config'
88
import { downloadFile } from '@/lib/uploads/core/storage-service'
@@ -49,7 +49,7 @@ export async function GET(
4949
return await handleLocalFilePublic(fullPath)
5050
}
5151

52-
const authResult = await checkHybridAuth(request, { requireWorkflowId: false })
52+
const authResult = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
5353

5454
if (!authResult.success || !authResult.userId) {
5555
logger.warn('Unauthorized file access attempt', {

‎apps/sim/app/api/knowledge/[id]/tag-definitions/route.ts‎

Lines changed: 3 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ import { randomUUID } from 'crypto'
22
import { createLogger } from '@sim/logger'
33
import { type NextRequest, NextResponse } from 'next/server'
44
import { z } from 'zod'
5-
import { checkHybridAuth } from '@/lib/auth/hybrid'
5+
import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
66
import { SUPPORTED_FIELD_TYPES } from '@/lib/knowledge/constants'
77
import { createTagDefinition, getTagDefinitions } from '@/lib/knowledge/tags/service'
88
import { checkKnowledgeBaseAccess } from '@/app/api/knowledge/utils'
@@ -19,19 +19,11 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ id:
1919
try {
2020
logger.info(`[${requestId}] Getting tag definitions for knowledge base ${knowledgeBaseId}`)
2121

22-
const auth = await checkHybridAuth(req, { requireWorkflowId: false })
22+
const auth = await checkSessionOrInternalAuth(req)
2323
if (!auth.success) {
2424
return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
2525
}
2626

27-
// Only allow session and internal JWT auth (not API key)
28-
if (auth.authType === 'api_key') {
29-
return NextResponse.json(
30-
{ error: 'API key auth not supported for this endpoint' },
31-
{ status: 401 }
32-
)
33-
}
34-
3527
// For session auth, verify KB access. Internal JWT is trusted.
3628
if (auth.authType === 'session' && auth.userId) {
3729
const accessCheck = await checkKnowledgeBaseAccess(knowledgeBaseId, auth.userId)
@@ -64,19 +56,11 @@ export async function POST(req: NextRequest, { params }: { params: Promise<{ id:
6456
try {
6557
logger.info(`[${requestId}] Creating tag definition for knowledge base ${knowledgeBaseId}`)
6658

67-
const auth = await checkHybridAuth(req, { requireWorkflowId: false })
59+
const auth = await checkSessionOrInternalAuth(req)
6860
if (!auth.success) {
6961
return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
7062
}
7163

72-
// Only allow session and internal JWT auth (not API key)
73-
if (auth.authType === 'api_key') {
74-
return NextResponse.json(
75-
{ error: 'API key auth not supported for this endpoint' },
76-
{ status: 401 }
77-
)
78-
}
79-
8064
// For session auth, verify KB access. Internal JWT is trusted.
8165
if (auth.authType === 'session' && auth.userId) {
8266
const accessCheck = await checkKnowledgeBaseAccess(knowledgeBaseId, auth.userId)

‎apps/sim/app/api/logs/execution/[executionId]/route.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import {
88
import { createLogger } from '@sim/logger'
99
import { and, eq, inArray } from 'drizzle-orm'
1010
import { type NextRequest, NextResponse } from 'next/server'
11-
import { checkHybridAuth } from '@/lib/auth/hybrid'
11+
import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
1212
import { generateRequestId } from '@/lib/core/utils/request'
1313
import type { TraceSpan, WorkflowExecutionLog } from '@/lib/logs/types'
1414

@@ -23,7 +23,7 @@ export async function GET(
2323
try {
2424
const { executionId } = await params
2525

26-
const authResult = await checkHybridAuth(request, { requireWorkflowId: false })
26+
const authResult = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
2727
if (!authResult.success || !authResult.userId) {
2828
logger.warn(`[${requestId}] Unauthorized execution data access attempt for: ${executionId}`)
2929
return NextResponse.json(

0 commit comments

Comments
 (0)