fix(api): attribute v2 workspace keys to billing actor by TheodoreSpeaks · Pull Request #6376 · simstudioai/sim

TheodoreSpeaks · 2026-08-07T17:12:51Z

Summary

attribute v2 workspace-key requests, billing, quotas, and audits to the workspace billing actor
keep key creators as continuation owners while blocking personal-secret access from workspace keys
freeze billing attribution across multipart uploads, imports, and workflow execution

Type of Change

Bug fix

Testing

122 focused tests passed
whole-workspace type-check passed
lint, API validation, OpenAPI, boundaries, and all CI audits passed

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-08-07T17:12:57Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 7, 2026 5:32pm

cursor · 2026-08-07T17:13:01Z

PR Summary

High Risk
Changes authentication, authorization, billing attribution, and quota accounting across the entire v2 API surface; mis-attribution or permission bugs could affect billing, access control, or audit trails.

Overview
v2 workspace API keys are now split into a key creator (principal) and a workspace billing actor. Rate limits, usage gates, rollout (v2-api gate with org id), and billing snapshots use the frozen workspace payer; authorization and visibility use the creator’s workspace permission (invalidated if the creator leaves the workspace).

Across v2 routes, handlers distinguish who may act (principalUserId for table access, credentials, upload ownership, workflow auth) from who is attributed (userId / billing actor for writes, audits, execution, and file registration). Multipart uploads and table/knowledge imports store attribution in session metadata so completion does not re-resolve billing. Workspace keys cannot access personal secrets (PERSONAL_KEY_REQUIRED).

Infrastructure: authenticateV2ApiKey / checkV2RateLimit, keyId on auth, request context enriched with apiKeyId/apiKeyType for logs and audit metadata (overriding untrusted caller metadata).

^{Reviewed by Cursor Bugbot for commit 622ccb8. Bugbot is set up for automated code reviews on this repo. Configure here.}

greptile-apps · 2026-08-07T17:16:35Z

Greptile Summary

The PR separates workspace-key authorization from billing attribution, preserving the key creator as the authorization principal while using the workspace billing actor for quotas, audits, and persisted operations.

Freezes creator permission and billing attribution during v2 workspace-key admission.
Carries attribution snapshots through uploads, imports, and workflow execution.
Prevents workspace keys from accessing personal secrets.
Updates table, workflow, credential, and secret routes to authorize against the creator principal.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/app/api/v1/middleware.ts	Introduces the workspace-key principal/actor split and enforces the creator's effective workspace permission during authorization.
apps/sim/app/api/public-api-route-handler.ts	Applies organization-aware v2 gating and propagates API-key identity through request context.
apps/sim/app/api/v2/workflows/[id]/execute/route.ts	Authorizes workflow execution as the key creator while preserving the billing actor and attribution snapshot through execution.
apps/sim/app/api/v2/secrets/[name]/route.ts	Uses the creator for secret authorization, attributes workspace writes to the billing actor, and rejects personal-secret access from workspace keys.
apps/sim/app/api/v2/knowledge/[id]/documents/uploads/utils.ts	Restores multipart billing attribution from session metadata so completion retries retain the admission-time payer.
apps/sim/lib/table/orchestration/import-resource.ts	Carries frozen billing attribution through table-import orchestration.

Sequence Diagram

sequenceDiagram
  participant Client
  participant Auth as V2 API Authentication
  participant Authz as Workspace Authorization
  participant Billing as Billing and Quotas
  participant Operation as Route or Background Operation
  Client->>Auth: Request with workspace API key
  Auth->>Auth: Resolve key creator and current permission
  Auth->>Billing: Resolve workspace billing actor and payer snapshot
  Auth-->>Authz: Creator principal and frozen permission
  Auth-->>Operation: Billing actor and attribution snapshot
  Authz->>Authz: Enforce creator permission
  Billing->>Billing: Apply payer quota and billing status
  Operation->>Operation: Persist or execute with frozen attribution

_{Reviews (2): Last reviewed commit: "fix(api): preserve workspace key permiss..." | Re-trigger Greptile}

TheodoreSpeaks · 2026-08-07T17:33:37Z

@greptile

TheodoreSpeaks · 2026-08-07T17:33:44Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 622ccb8. Configure here.}

fix(api): attribute v2 workspace keys to billing actor

44636cb

greptile-apps Bot reviewed Aug 7, 2026

View reviewed changes

Comment thread apps/sim/app/api/v1/middleware.ts

Comment thread apps/sim/app/api/v2/files/uploads/[uploadId]/complete/route.ts

Comment thread apps/sim/app/api/public-api-route-handler.ts

cursor Bot reviewed Aug 7, 2026

View reviewed changes

Comment thread apps/sim/lib/table/orchestration/import-resource.ts

vercel Bot deployed to Preview August 7, 2026 17:18 View deployment

fix(api): preserve workspace key permissions

622ccb8

vercel Bot temporarily deployed to Preview August 7, 2026 17:32 Inactive

cursor Bot reviewed Aug 7, 2026

View reviewed changes

Navigation Menu

Uh oh!

fix(api): attribute v2 workspace keys to billing actor - #6376

fix(api): attribute v2 workspace keys to billing actor#6376
TheodoreSpeaks wants to merge 2 commits into
improvement/v2-platformsfrom
improvement/api-key-attribution

TheodoreSpeaks commented Aug 7, 2026

Uh oh!

vercel Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Aug 7, 2026 •

edited

Loading

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TheodoreSpeaks commented Aug 7, 2026

Uh oh!

TheodoreSpeaks commented Aug 7, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

TheodoreSpeaks commented Aug 7, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TheodoreSpeaks commented Aug 7, 2026

Uh oh!

TheodoreSpeaks commented Aug 7, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Aug 7, 2026 •

edited

Loading

cursor Bot commented Aug 7, 2026 •

edited

Loading

greptile-apps Bot commented Aug 7, 2026 •

edited

Loading