improvement(tables): centralize v2 application operations

[TheodoreSpeaks]

Summary

• migrate the complete v2 tables API to shared Principal-authorized semantic operations and declarative routes
• harden canonical workspace scope, authoritative mutations, bounded rows/runs/imports/exports, and trusted Copilot delegation
• add focused route, application, manager, transfer, memory, audit, and alias coverage

Type of Change

• Improvement

Testing

• 328 focused table tests passed
• Sim and auth type checks passed
• Biome, strict API validation, memory checks, and the full pre-ship audit suite passed

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 8, 2026 6:36pm

[cursor]

PR Summary

High Risk
Large refactor across core table read/write, runs, exports, and auth boundaries; behavior regressions in workspace scoping, predicates, locks, or partial composite updates would affect all public API consumers.

Overview
The v2 tables public API is refactored so routes are thin defineV2JsonRoute handlers instead of bespoke withPublicApiRouteHandler wiring. Auth, rate limits, rollout gates, and error envelopes stay on the route layer; workspace-scoped table use cases (tableOperations + execute on rows, columns, groups, runs, exports, tables, etc.) own authorization, predicate translation, locks, and side effects like row-change signals.

Coverage in this diff includes table detail (GET/PATCH/DELETE), columns, groups, query/list/find/row CRUD, column and row enrichment runs, cancel-runs, and exports create/status/download. Routes mostly mapInput → useCase → present, with shared v2TableRowsErrorPolicy / v2TableErrorPolicies and normalizeColumn now typed with explicit required and unique.

Tests mock authenticateV2ApiKey, rate limiting, gates, and application execute paths and assert delegation inputs and response shapes (including composite PATCH applied, bulk delete reporting, and admission-time 400s) rather than re-testing orchestration internals in every route file.

^{Reviewed by Cursor Bugbot for commit 1a6ad87. Bugbot is set up for automated code reviews on this repo. Configure here.}

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile-apps

[greptile-apps]

Greptile Summary

The PR migrates the v2 tables API to centralized, Principal-authorized application operations while retaining authoritative workspace and resource checks.

• Replaces route-local table logic with declarative JSON routes, operation policies, and shared use cases.
• Centralizes table, row, column, group, view, run, import, export, and folder authorization and orchestration.
• Adds bounded transfer and execution behavior, trusted Copilot delegation, audit attribution, and focused regression coverage.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/table/application/authorized-table-use-case.ts	Introduces the shared authorization wrapper that resolves canonical table context before executing semantic operations.
apps/sim/lib/table/application/authorization.ts	Defines table delegation and Principal authorization policy for the centralized application layer.
apps/sim/lib/table/application/operations.ts	Declares table operation identities and consistently separates read access from mutation access.
apps/sim/lib/table/application/groups.ts	Centralizes group mutations while preserving authoritative workflow-to-table workspace containment checks.
apps/sim/lib/api/server/routes/v2-json-route.ts	Supports centralized route presentation and preserves private, non-cacheable JSON responses.
apps/sim/lib/table/application/rows.ts	Consolidates authorized row operations, validation, bounded selection, and mutation behavior.
apps/sim/lib/table/application/imports.ts	Centralizes import lifecycle operations and their workspace-authorized resource handling.
apps/sim/lib/table/application/exports.ts	Centralizes export creation, status, cancellation, and download authorization.
apps/sim/lib/copilot/auth/table-delegation.ts	Adds scoped Principal delegation for trusted Copilot table operations.
packages/auth/src/principal.ts	Extends shared Principal modeling used by the centralized table authorization flow.

Sequence Diagram

sequenceDiagram
  participant Client as API Client
  participant Route as Declarative v2 Route
  participant Auth as API-key Authentication
  participant Policy as Operation Authorization
  participant UseCase as Table Application Use Case
  participant Store as Table Services / Storage

  Client->>Route: v2 table request
  Route->>Auth: authenticate request
  Auth-->>Route: Principal
  Route->>Policy: authorize operation and resolve context
  Policy->>Store: load authoritative table/workspace
  Store-->>Policy: canonical context
  Policy-->>UseCase: authorized Principal and context
  UseCase->>Store: execute semantic operation
  Store-->>UseCase: authoritative result
  UseCase-->>Route: application result
  Route-->>Client: validated v2 response

Loading

_{Reviews (3): Last reviewed commit: "Merge remote-tracking branch 'origin/imp..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile-apps

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 910f133. Configure here.}

[TheodoreSpeaks]

@greptile-apps

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1a6ad87. Configure here.}