improvement(api): migrate policy-sensitive v2 reads

[TheodoreSpeaks]

Summary

• migrate audit logs, billing, credentials, logs, and workspace reads to shared Principal-backed application use cases
• declare v2 routes with shared auth, semantic operation, rate, error, and contract policies while preserving surface envelopes
• add focused principal, policy, concealment, audit, route, and compatibility coverage

Type of Change

• Improvement

Testing

• 17 focused test files / 66 tests
• Sim and @sim/auth type checks
• repo lint, API validation, block registry, and all ship audits

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 8, 2026 11:33am

[cursor]

PR Summary

High Risk
Refactors authorization, billing attribution, audit scope, and credential/log exposure across internal and v2 surfaces; regressions could leak data, widen scope, or change error semantics despite preserved envelopes.

Overview
Moves audit logs, billing, credentials, logs, and workspace read paths off inline route handlers onto shared defineInternalJsonRoute / defineV2JsonRoute wiring (auth, semantic operations, rate limits, error policies) backed by new application use cases with Principal-based authorization.

Internal GET /api/audit-logs now shares listAuditLogs with v2 while keeping its internal JSON envelope. v2 routes delegate to domain execute helpers (listAuditLogs, getBillingStatus, listWorkspaceCredentials, getPublicLog, etc.) instead of duplicating resolveWorkspaceAccess, query builders, and billing filters in each handler. v2BillingWorkspaceFilter is removed; workspace pinning and ledger attribution live in authorized-billing-read-use-case.

Credentials add listWorkspacePrincipalCredentials so workspace API keys see shared connection metadata without encrypted fields or creator membership. Logs resolve run scope via getPublicWorkflowLogScope before loading protected content; detail routes use v2LogErrorPolicies.concealDetailAuthorization to map forbidden access to not found. Audit logs enforce org-admin principals and reject workspace keys at the operation layer.

^{Reviewed by Cursor Bugbot for commit a6eba68. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR migrates policy-sensitive v2 reads and the internal audit-log read to shared Principal-backed application use cases while preserving their public response envelopes.

• Declares authentication, operation, rate-limit, error, and contract policies through shared route builders.
• Centralizes authorization and concealment logic for audit logs, billing, credentials, logs, and workspace reads.
• Adds focused route, policy, principal, compatibility, and application-use-case coverage.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/app/api/audit-logs/route.ts	Migrates the internal audit-log endpoint to the declarative route builder and shared authorized list operation while retaining its existing envelope.
apps/sim/app/api/v2/audit-logs/route.ts	Moves v2 audit-log listing behind shared API-key authentication, rate limiting, operation metadata, and Principal-aware authorization.
apps/sim/lib/audit-logs/application/authorized-audit-log-use-case.ts	Centralizes audit-log principal restrictions and organization authorization for list and detail reads.
apps/sim/lib/billing/application/authorized-billing-read-use-case.ts	Centralizes billing-read scope resolution and workspace authorization for both billing endpoints.
apps/sim/lib/credentials/application/list-workspace-credentials.ts	Moves credential visibility and workspace access enforcement into a Principal-backed application use case.
apps/sim/lib/logs/api/route-policies.ts	Defines shared route policies used by the migrated public log endpoints.
apps/sim/lib/workspaces/application/workspace-context.ts	Establishes shared Principal-aware workspace context and concealment behavior for public workspace reads.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Request[API request] --> Builder[Internal or v2 JSON route builder]
  Builder --> Wrapper[withRouteHandler lifecycle]
  Wrapper --> Auth[Authenticate Principal]
  Auth --> Policy[Rate and operation policies]
  Policy --> Contract[Parse route contract]
  Contract --> UseCase[Principal-backed application use case]
  UseCase --> Authorization[Workspace or organization authorization]
  Authorization --> Read[Domain read]
  Read --> Presenter[Preserve route response envelope]

Loading

_{Reviews (2): Last reviewed commit: "improvement(api): migrate policy-sensiti..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a6eba68. Configure here.}