improvement(auth): unify resource-scoped human delegation

Author: mzxchandra

apps/sim/app/api/files/uploads/purposes.ts

@@ -1,4 +1,5 @@
 import type { Principal } from '@sim/auth/principal'
+import { isWorkspaceDelegation } from '@sim/auth/principal'
 import { db } from '@sim/db'
 import { workspace } from '@sim/db/schema'
 import { authorizeWorkflowByWorkspacePermission } from '@sim/platform-authz/workflow'
@@ -250,11 +251,6 @@ function requireSessionScope(value: string | null, label = 'scope'): string {
 
 async function principalUserId(principal: Principal, workspaceId?: string): Promise<string> {
   switch (principal.kind) {
-    case 'resource_delegated':
-      throw new UploadSessionError(
-        'forbidden',
-        'Resource delegation cannot create workspace uploads'
-      )
     case 'slack_app':
     case 'slack_installation':
       throw new UploadSessionError('forbidden', 'Slack installations cannot create uploads')
@@ -274,6 +270,11 @@ async function principalUserId(principal: Principal, workspaceId?: string): Prom
         return context.billedAccountUserId
       }
     case 'delegated':
+      if (!isWorkspaceDelegation(principal))
+        throw new UploadSessionError(
+          'forbidden',
+          'Resource delegation cannot create workspace uploads'
+        )
       if (
         principal.serviceId === 'copilot' &&
         principal.workspaceId === workspaceId &&

apps/sim/ee/access-requests/lib/application/operations.ts

@@ -1,11 +1,11 @@
-import type { DelegatedPrincipal, Principal } from '@sim/auth/principal'
+import type { Principal, WorkspaceDelegatedPrincipal } from '@sim/auth/principal'
 import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
 import { defineWorkspaceOperation } from '@/lib/core/application/workspace-operation'
 
 /** Chat acting for the requester joins the direct callers on the workspace routes only. */
 export type AccessRequestPrincipal =
   | Extract<Principal, { kind: 'session' | 'personal_api_key' | 'oauth_access_token' }>
-  | (DelegatedPrincipal & { serviceId: 'copilot' })
+  | (WorkspaceDelegatedPrincipal & { serviceId: 'copilot' })
 
 export const ACCESS_REQUEST_DELEGATION_AUDIENCE = 'sim:settings'
 

apps/sim/lib/api/server/routes/copilot-project-file-request.test.ts

@@ -48,7 +48,7 @@ describe('private v2 Project file authority', () => {
     )
     if (!principal) throw new Error('The admitted Project file request lost its principal')
     expect(principal).toMatchObject({
-      kind: 'resource_delegated',
+      kind: 'delegated',
       subjectUserId: 'actor',
       invocation: { kind: 'chat', chatId: 'private-chat' },
       scope: { kind: 'entity', entityType: 'project', entityId: 'project', fileId: 'file' },

apps/sim/lib/api/server/routes/copilot-request.ts

@@ -1,4 +1,4 @@
-import type { DelegatedPrincipal, ResourceDelegatedPrincipal } from '@sim/auth/principal'
+import type { ResourceScopedDelegation, WorkspaceDelegatedPrincipal } from '@sim/auth/principal'
 import { noteContentDeliveryOperation } from '@/lib/core/application'
 import { markCopilotWorkspaceInvocation } from '@/lib/core/application/copilot-workspace-invocation'
 import type { ApplicationOperation, OperationUseCase } from '@/lib/core/application/operation'
@@ -15,7 +15,7 @@ import {
 type CopilotResourceRequestGrant = (
   operation: ApplicationOperation,
   audience: string
-) => ResourceDelegatedPrincipal | undefined
+) => ResourceScopedDelegation | undefined
 
 type CopilotRequestInvocation =
   | { kind: 'resource'; grant: CopilotResourceRequestGrant }
@@ -71,7 +71,7 @@ export function copilotRequestPrincipal(
   request: Request,
   operation: ApplicationOperation,
   useCase?: CopilotRouteUseCase
-): DelegatedPrincipal | ResourceDelegatedPrincipal | undefined {
+): WorkspaceDelegatedPrincipal | ResourceScopedDelegation | undefined {
   const invocation = INVOCATIONS.get(request)
   if (!invocation) return undefined
   const audience = copilotRouteAudience(operation, useCase)

apps/sim/lib/api/server/routes/internal-json-route.ts

@@ -1,10 +1,10 @@
 import {
-  type DelegatedPrincipal,
   describePrincipalAuth,
   type Principal,
   resolvePrincipalSubjectUserId,
   type SessionPrincipal,
   type WorkflowExecutionDelegatedPrincipal,
+  type WorkspaceDelegatedPrincipal,
 } from '@sim/auth/principal'
 import { setRequestAuth } from '@sim/logger'
 import type { NextRequest } from 'next/server'
@@ -66,7 +66,7 @@ interface InternalSessionOrExecutorAuthOptions {
   audience: string
   resourceScope?(
     params: Record<string, string | string[] | undefined>
-  ): DelegatedPrincipal['resourceScope']
+  ): WorkspaceDelegatedPrincipal['resourceScope']
 }
 
 export function createInternalSessionOrExecutorAuth(

apps/sim/lib/auth/internal-delegation.ts

@@ -1,6 +1,6 @@
 import type {
   BoundWorkflowExecutionDelegatedPrincipal,
-  DelegatedPrincipal,
+  WorkspaceDelegatedPrincipal,
 } from '@sim/auth/principal'
 import type { VerifiedInternalDelegation } from '@/lib/auth/internal'
 import { asOrchestrationError } from '@/lib/core/orchestration/types'
@@ -15,7 +15,7 @@ import {
 
 export interface BindInternalExecutorDelegationOptions {
   audience: string
-  resourceScope?: DelegatedPrincipal['resourceScope']
+  resourceScope?: WorkspaceDelegatedPrincipal['resourceScope']
   compatibilityActorUserId?: string
 }
 

apps/sim/lib/auth/realtime-file-delegation.ts

@@ -1,4 +1,4 @@
-import type { ResourceDelegatedPrincipal } from '@sim/auth/principal'
+import type { ResourceScopedDelegation } from '@sim/auth/principal'
 import { FILE_DOC_INTERNAL_HEADERS } from '@sim/realtime-protocol/file-doc'
 import { generateId } from '@sim/utils/id'
 import {
@@ -9,7 +9,7 @@ import { checkInternalApiKey } from '@/lib/mothership/request/http'
 import { PROJECT_FILE_DELEGATION_TTL_MS } from '@/lib/projects/files/application/operations'
 
 /** Internal relay requests carry the authenticated socket actor, bounded to exactly one Project file. */
-export const realtimeProjectFileAuth: InternalAuthPolicy<ResourceDelegatedPrincipal> = {
+export const realtimeProjectFileAuth: InternalAuthPolicy<ResourceScopedDelegation> = {
   async authenticate(request, params) {
     if (!checkInternalApiKey(request).success) throw new InternalUnauthenticatedError()
     const subjectUserId = request.headers.get(FILE_DOC_INTERNAL_HEADERS.userId)
@@ -28,7 +28,7 @@ export const realtimeProjectFileAuth: InternalAuthPolicy<ResourceDelegatedPrinci
     }
     const now = Date.now()
     return {
-      kind: 'resource_delegated',
+      kind: 'delegated',
       serviceId: 'realtime',
       subjectUserId,
       invocation: { kind: 'realtime', connectionId },

apps/sim/lib/auth/realtime-file-list-delegation.ts

@@ -1,4 +1,4 @@
-import type { ResourceDelegatedPrincipal } from '@sim/auth/principal'
+import type { ResourceScopedDelegation } from '@sim/auth/principal'
 import { FILE_DOC_INTERNAL_HEADERS } from '@sim/realtime-protocol/file-doc'
 import { generateId } from '@sim/utils/id'
 import {
@@ -9,7 +9,7 @@ import { checkInternalApiKey } from '@/lib/mothership/request/http'
 import { PROJECT_FILE_DELEGATION_TTL_MS } from '@/lib/projects/files/application/operations'
 
 /** The relay attests the socket actor and connection, bounded to observing one Project collection. */
-export const realtimeProjectFileListAuth: InternalAuthPolicy<ResourceDelegatedPrincipal> = {
+export const realtimeProjectFileListAuth: InternalAuthPolicy<ResourceScopedDelegation> = {
   async authenticate(request, params) {
     if (!checkInternalApiKey(request).success) throw new InternalUnauthenticatedError()
     const subjectUserId = request.headers.get(FILE_DOC_INTERNAL_HEADERS.userId)
@@ -25,7 +25,7 @@ export const realtimeProjectFileListAuth: InternalAuthPolicy<ResourceDelegatedPr
     }
     const now = Date.now()
     return {
-      kind: 'resource_delegated',
+      kind: 'delegated',
       serviceId: 'realtime',
       subjectUserId,
       invocation: { kind: 'realtime', connectionId },

apps/sim/lib/core/application/audit-source.ts

@@ -1,4 +1,4 @@
-import type { Principal } from '@sim/auth/principal'
+import { type Principal, toPrincipalActor } from '@sim/auth/principal'
 
 /**
  * The surface a semantic audit row attributes a change to.
@@ -13,5 +13,6 @@ import type { Principal } from '@sim/auth/principal'
  * names its own credential class, which is already what `actor` records.
  */
 export function principalAuditSource(principal: Principal): string {
-  return principal.kind === 'delegated' ? principal.serviceId : principal.kind
+  const actor = toPrincipalActor(principal)
+  return actor.kind === 'delegated' ? actor.serviceId : actor.kind
 }

apps/sim/lib/core/application/authorized-workspace-use-case.test.ts

@@ -1,7 +1,7 @@
 import type {
-  DelegatedPrincipal,
   SessionPrincipal,
   WorkspaceApiKeyPrincipal,
+  WorkspaceDelegatedPrincipal,
 } from '@sim/auth/principal'
 import {
   createPersonalApiKeyPrincipal,
@@ -317,15 +317,15 @@ describe('defineAuthorizedWorkspaceUseCase', () => {
 
   it('resolves domain-specific delegation options against canonical context', async () => {
     const scopeCheck = vi.fn(
-      (principal: DelegatedPrincipal, context: TestContext) =>
+      (principal: WorkspaceDelegatedPrincipal, context: TestContext) =>
         principal.resourceScope?.fileId === context.canonicalResourceId
     )
     const useCase = defineAuthorizedWorkspaceUseCase({
       operation: delegatedOperation,
-      resolveContext: async (_args: { principal: DelegatedPrincipal; input: TestInput }) =>
+      resolveContext: async (_args: { principal: WorkspaceDelegatedPrincipal; input: TestInput }) =>
         canonicalContext,
       authorizationOptions: ({ principal }) => {
-        expectTypeOf(principal).toMatchTypeOf<DelegatedPrincipal>()
+        expectTypeOf(principal).toMatchTypeOf<WorkspaceDelegatedPrincipal>()
         expectTypeOf(principal.serviceId).toEqualTypeOf<'executor'>()
         return {
           delegation: {
@@ -335,12 +335,12 @@ describe('defineAuthorizedWorkspaceUseCase', () => {
         }
       },
       async execute({ principal }) {
-        expectTypeOf(principal).toMatchTypeOf<DelegatedPrincipal>()
+        expectTypeOf(principal).toMatchTypeOf<WorkspaceDelegatedPrincipal>()
         expectTypeOf(principal.serviceId).toEqualTypeOf<'executor'>()
         return { ok: true as const }
       },
     })
-    const principal: DelegatedPrincipal = {
+    const principal: WorkspaceDelegatedPrincipal = {
       kind: 'delegated',
       serviceId: 'executor',
       subjectUserId: 'user-1',
@@ -367,7 +367,8 @@ describe('defineAuthorizedWorkspaceUseCase', () => {
 
   it('rejects a disallowed delegated service before canonical loading', async () => {
     const resolveContext = vi.fn(
-      async (_args: { principal: DelegatedPrincipal; input: TestInput }) => canonicalContext
+      async (_args: { principal: WorkspaceDelegatedPrincipal; input: TestInput }) =>
+        canonicalContext
     )
     const useCase = defineAuthorizedWorkspaceUseCase({
       operation: delegatedOperation,