fix(tables): restore scoped copilot imports

Author: TheodoreSpeaks

apps/sim/lib/copilot/application/execute-table-use-case.test.ts

@@ -42,12 +42,29 @@ describe('executeCopilotTableUseCase', () => {
         audience: 'sim:tables',
         issuedAt: new Date('2026-01-01T00:00:00Z'),
         expiresAt: new Date('2026-01-01T00:05:00Z'),
-        resourceScope: { chatId: 'chat-1', executionId: 'execution-1' },
+        resourceScope: {
+          chatId: 'chat-1',
+          executionId: 'execution-1',
+          tableId: 'table-1',
+        },
       },
       input: { tableId: 'table-1', workspaceId: 'workspace-1' },
     })
   })
 
+  it('fails fast when a table-scoped input has no valid table id', () => {
+    const execute = vi.fn()
+
+    expect(() =>
+      executeCopilotTableUseCase(
+        trustedContext,
+        { operation: tableOperations.read, execute },
+        { tableId: '', workspaceId: 'workspace-1' }
+      )
+    ).toThrow('invalid table ID')
+    expect(execute).not.toHaveBeenCalled()
+  })
+
   it('rejects untrusted Copilot context before application execution', () => {
     const execute = vi.fn()
 

apps/sim/lib/copilot/application/execute-table-use-case.ts

@@ -2,7 +2,18 @@ import { createCopilotWorkspaceUseCaseExecutor } from '@/lib/copilot/application
 import { TABLE_DELEGATION_AUDIENCE } from '@/lib/table/application/authorization'
 import { tableOperations } from '@/lib/table/application/operations'
 
+function tableResourceScope(input: unknown): { tableId: string } | undefined {
+  if (!input || typeof input !== 'object' || !('tableId' in input)) return undefined
+  const tableId = input.tableId
+  if (tableId === undefined) return undefined
+  if (typeof tableId !== 'string' || tableId.length === 0) {
+    throw new Error('Copilot table application input has an invalid table ID')
+  }
+  return { tableId }
+}
+
 export const executeCopilotTableUseCase = createCopilotWorkspaceUseCaseExecutor({
   audience: TABLE_DELEGATION_AUDIENCE,
   operations: tableOperations,
+  resourceScope: tableResourceScope,
 })

apps/sim/lib/copilot/application/execute-workspace-use-case.test.ts

@@ -97,4 +97,32 @@ describe('Copilot workspace application delegation', () => {
       )
     ).toThrow('Unregistered Copilot workspace operation')
   })
+
+  it('merges a domain-defined resource scope into the trusted principal', async () => {
+    const execute = vi.fn().mockResolvedValue({ ok: true })
+    const executeCopilotUseCase = createCopilotWorkspaceUseCaseExecutor({
+      audience: 'sim:skills',
+      operations: { update: operation },
+      resourceScope: () => ({ chatId: 'untrusted-chat', tableId: 'table-1' }),
+    })
+
+    await executeCopilotUseCase(
+      {
+        userId: 'user-1',
+        workspaceId: 'workspace-1',
+        chatId: 'chat-1',
+        toolCallId: 'call-1',
+        copilotToolExecution: true,
+      },
+      { operation, execute },
+      { workspaceId: 'workspace-1' }
+    )
+
+    expect(execute).toHaveBeenCalledWith({
+      principal: expect.objectContaining({
+        resourceScope: { chatId: 'chat-1', tableId: 'table-1' },
+      }),
+      input: { workspaceId: 'workspace-1' },
+    })
+  })
 })

apps/sim/lib/copilot/application/execute-workspace-use-case.ts

@@ -1,3 +1,4 @@
+import type { DelegatedPrincipal } from '@sim/auth/principal'
 import {
   type CopilotWorkspaceDelegationContext,
   createCopilotWorkspacePrincipal,
@@ -7,6 +8,7 @@ import type { OperationUseCase, WorkspaceOperation } from '@/lib/core/applicatio
 interface CopilotWorkspaceUseCaseExecutorOptions<O extends WorkspaceOperation> {
   audience: string
   operations: Readonly<Record<string, O>>
+  resourceScope?(input: unknown): DelegatedPrincipal['resourceScope']
 }
 
 /** Binds a domain registry to the trusted Copilot workspace execution runtime. */
@@ -27,7 +29,10 @@ export function createCopilotWorkspaceUseCaseExecutor<O extends WorkspaceOperati
     }
 
     return useCase.execute({
-      principal: createCopilotWorkspacePrincipal(context, { audience: options.audience }),
+      principal: createCopilotWorkspacePrincipal(context, {
+        audience: options.audience,
+        resourceScope: options.resourceScope?.(input),
+      }),
       input,
     })
   }

apps/sim/lib/copilot/auth/workspace-application-delegation.ts

@@ -13,6 +13,7 @@ export interface CopilotWorkspaceDelegationContext {
 
 interface CreateCopilotWorkspacePrincipalOptions {
   audience: string
+  resourceScope?: DelegatedPrincipal['resourceScope']
 }
 
 /** Creates a delegated principal exclusively from server-authored Copilot execution context. */
@@ -39,6 +40,7 @@ export function createCopilotWorkspacePrincipal(
     issuedAt,
     expiresAt: new Date(issuedAt.getTime() + COPILOT_WORKSPACE_DELEGATION_TTL_MS),
     resourceScope: {
+      ...options.resourceScope,
       ...(context.chatId ? { chatId: context.chatId } : {}),
       ...(context.executionId ? { executionId: context.executionId } : {}),
     },

apps/sim/lib/copilot/tools/server/table/user-table.ts

@@ -834,6 +834,7 @@ export const userTableServerTool: BaseServerTool<UserTableArgs, UserTableResult>
             columns,
             headerToColumn,
             rows,
+            assertNotAborted,
           })
           if (result.kind !== 'inline') {
             throw new Error('Inline table import returned a background result')
@@ -921,6 +922,7 @@ export const userTableServerTool: BaseServerTool<UserTableArgs, UserTableResult>
             sourceFile: record,
             mode,
             mapping: rawMapping,
+            assertNotAborted,
             loadRows: async () => {
               const { content } = await resolveWorkspaceFileRecordOrThrow(
                 fileReference,

apps/sim/lib/table/application/authorization.test.ts

@@ -122,7 +122,7 @@ describe('table operation authorization', () => {
     )
   })
 
-  it('rejects wrong-audience, expired, cross-workspace, and wrong-table delegations before lookup', async () => {
+  it('rejects wrong-audience, expired, cross-workspace, unscoped, and wrong-table delegations before lookup', async () => {
     const base = {
       kind: 'delegated' as const,
       serviceId: 'copilot' as const,
@@ -150,6 +150,10 @@ describe('table operation authorization', () => {
       expiresAt: new Date(Date.now() + 60_000),
       resourceScope: { tableId: 'table-1' },
     })
+    await expectForbidden({
+      ...base,
+      expiresAt: new Date(Date.now() + 60_000),
+    })
     await expectForbidden({
       ...base,
       expiresAt: new Date(Date.now() + 60_000),

apps/sim/lib/table/application/authorization.ts

@@ -24,10 +24,7 @@ export const tableDelegationPolicy: WorkspaceDelegationPolicy<TableAuthorization
     principal: Extract<Principal, { kind: 'delegated' }>,
     context: TableAuthorizationContext
   ) {
-    return (
-      principal.resourceScope?.tableId === undefined ||
-      principal.resourceScope.tableId === context.tableId
-    )
+    return context.tableId === undefined || principal.resourceScope?.tableId === context.tableId
   },
 }
 

apps/sim/lib/table/application/workspace-file-imports.test.ts

@@ -16,6 +16,8 @@ const mocks = vi.hoisted(() => ({
   resolvePermission: vi.fn(),
   resolveWorkspaceContext: vi.fn(),
   signal: vi.fn(),
+  validateMapping: vi.fn(),
+  CsvImportValidationError: class extends Error {},
 }))
 
 vi.mock('@sim/audit', () => ({
@@ -39,14 +41,11 @@ vi.mock('@/lib/table', () => ({
   batchInsertRows: mocks.batchInsert,
   buildAutoMapping: vi.fn(() => ({ name: 'name' })),
   coerceRowsForTable: (rows: unknown[]) => rows,
+  CsvImportValidationError: mocks.CsvImportValidationError,
   CSV_MAX_BATCH_SIZE: 1000,
   getWorkspaceTableLimits: vi.fn(() => ({ maxRowsPerTable: 100, maxTables: 5 })),
   replaceTableRows: vi.fn(),
-  validateMapping: vi.fn(() => ({
-    effectiveMap: new Map([['name', 'name']]),
-    mappedHeaders: ['name'],
-    skippedHeaders: [],
-  })),
+  validateMapping: mocks.validateMapping,
 }))
 vi.mock('@/lib/table/application/context', () => ({
   resolveActiveTableContext: mocks.resolveTableContext,
@@ -94,6 +93,7 @@ const principal = {
   audience: 'sim:tables',
   issuedAt: new Date('2026-08-01T00:00:00.000Z'),
   expiresAt: new Date('2099-08-01T00:00:00.000Z'),
+  resourceScope: { tableId: 'table-1' },
 }
 const input = {
   kind: 'inline' as const,
@@ -136,6 +136,11 @@ describe('Copilot workspace-file table creation', () => {
     mocks.batchInsert.mockResolvedValue([{ id: 'row-1' }])
     mocks.markJob.mockResolvedValue(true)
     mocks.releaseJob.mockResolvedValue(true)
+    mocks.validateMapping.mockReturnValue({
+      effectiveMap: new Map([['name', 'name']]),
+      mappedHeaders: ['name'],
+      skippedHeaders: [],
+    })
   })
 
   it('owns table creation, row insertion, audit, and shared effects', async () => {
@@ -201,6 +206,53 @@ describe('Copilot workspace-file table creation', () => {
     expect(events).toEqual(['claim', 'load', 'mutate', 'release'])
   })
 
+  it('checks for a user stop after loading and before every inline insert batch', async () => {
+    const assertNotAborted = vi.fn()
+
+    await importWorkspaceFileIntoTable.execute({
+      principal,
+      input: {
+        kind: 'inline',
+        tableId: 'table-1',
+        assertedWorkspaceId: 'workspace-1',
+        sourceFile: input.sourceFile,
+        mode: 'append',
+        assertNotAborted,
+        loadRows: async () => ({
+          headers: ['name'],
+          rows: Array.from({ length: 1001 }, (_, index) => ({ name: `Person ${index}` })),
+        }),
+      },
+    })
+
+    expect(assertNotAborted).toHaveBeenCalledTimes(3)
+    expect(mocks.batchInsert).toHaveBeenCalledTimes(2)
+  })
+
+  it('classifies mapping failures before mutation so Copilot can correct them', async () => {
+    mocks.validateMapping.mockImplementationOnce(() => {
+      throw new mocks.CsvImportValidationError('Mapping references an unknown column')
+    })
+
+    await expect(
+      importWorkspaceFileIntoTable.execute({
+        principal,
+        input: {
+          kind: 'inline',
+          tableId: 'table-1',
+          assertedWorkspaceId: 'workspace-1',
+          sourceFile: input.sourceFile,
+          mode: 'append',
+          loadRows: async () => ({ headers: ['name'], rows: [{ name: 'Ada' }] }),
+        },
+      })
+    ).rejects.toMatchObject({
+      code: 'validation',
+      message: 'Mapping references an unknown column',
+    })
+    expect(mocks.batchInsert).not.toHaveBeenCalled()
+  })
+
   it('rolls back and propagates unknown insertion failures without audit or effects', async () => {
     const failure = new Error('database unavailable')
     mocks.batchInsert.mockRejectedValueOnce(failure)

apps/sim/lib/table/application/workspace-file-imports.ts

@@ -12,6 +12,7 @@ import {
   type ColumnDefinition,
   CSV_MAX_BATCH_SIZE,
   type CsvHeaderMapping,
+  CsvImportValidationError,
   coerceRowsForTable,
   getWorkspaceTableLimits,
   type RowData,
@@ -60,6 +61,7 @@ export type CreateTableFromWorkspaceFileInput = CreateTableFromWorkspaceFileBase
         columns: ColumnDefinition[]
         headerToColumn: Map<string, string>
         rows: Record<string, unknown>[]
+        assertNotAborted?: () => void
       }
   )
 
@@ -94,6 +96,7 @@ export type ImportWorkspaceFileInput = ImportWorkspaceFileBaseInput &
     | {
         kind: 'inline'
         loadRows: () => Promise<{ headers: string[]; rows: Record<string, unknown>[] }>
+        assertNotAborted?: () => void
       }
   )
 
@@ -148,9 +151,11 @@ async function batchInsertAll(params: {
   rows: RowData[]
   workspaceId: string
   userId: string
+  assertNotAborted?: () => void
 }): Promise<number> {
   let inserted = 0
   for (let index = 0; index < params.rows.length; index += CSV_MAX_BATCH_SIZE) {
+    params.assertNotAborted?.()
     const batch = params.rows.slice(index, index + CSV_MAX_BATCH_SIZE)
     const result = await batchInsertRows(
       {
@@ -303,6 +308,7 @@ export const createTableFromWorkspaceFile = defineAuthorizedTableUseCase({
         rows: coerceRowsForTable(rows, table.schema, input.headerToColumn),
         workspaceId: context.workspaceId,
         userId,
+        assertNotAborted: input.assertNotAborted,
       })
       return {
         kind: input.kind,
@@ -391,15 +397,22 @@ export const importWorkspaceFileIntoTable = defineAuthorizedTableUseCase({
       throw new OrchestrationError('conflict', 'A job is already in progress for this table')
     return withReleasedTableJobClaim(context.table.id, context.workspaceId, jobId, async () => {
       const { headers, rows: sourceRows } = await input.loadRows()
+      input.assertNotAborted?.()
       if (sourceRows.length === 0) {
         return { kind: 'empty', table: context.table, mode: input.mode }
       }
       const mapping = input.mapping ?? buildAutoMapping(headers, context.table.schema)
-      const validation = validateMapping({
-        csvHeaders: headers,
-        mapping,
-        tableSchema: context.table.schema,
-      })
+      let validation: ReturnType<typeof validateMapping>
+      try {
+        validation = validateMapping({
+          csvHeaders: headers,
+          mapping,
+          tableSchema: context.table.schema,
+        })
+      } catch (error) {
+        if (!(error instanceof CsvImportValidationError)) throw error
+        throw new OrchestrationError('validation', error.message)
+      }
       if (validation.mappedHeaders.length === 0) {
         throw new OrchestrationError(
           'validation',
@@ -435,6 +448,7 @@ export const importWorkspaceFileIntoTable = defineAuthorizedTableUseCase({
         rows,
         workspaceId: context.workspaceId,
         userId,
+        assertNotAborted: input.assertNotAborted,
       })
       return {
         kind: input.kind,