chore(cleanup): cascade-remove use cases, helpers, and mocks orphaned by deleted Copilot commands

Author: waleedlatif1

apps/sim/app/api/v1/middleware.ts

@@ -40,7 +40,7 @@ const rateLimiter = new RateLimiter()
  * `defineV2JsonRoute` and rate-limited through `v2RateLimits`. Add a member only
  * when a route actually passes it to `checkRateLimit` / `authenticateRequest`.
  */
-export type ApiEndpoint =
+type ApiEndpoint =
   | 'logs'
   | 'logs-detail'
   | 'workflows'
@@ -84,7 +84,7 @@ export interface RateLimitResult {
   error?: string
 }
 
-export interface AuthorizedRequest {
+interface AuthorizedRequest {
   requestId: string
   userId: string
   rateLimit: RateLimitResult

apps/sim/lib/api/server/routes/internal-request.ts

@@ -25,7 +25,6 @@ class TestLockedError extends HttpError {
 vi.mock('@/lib/api/server/routes/v2-api-key-auth', () => v2ApiKeyAuthModuleMock)
 vi.mock('@/lib/core/rate-limiter', () => v2RateLimiterModuleMock)
 
-import { markInternalRequest } from '@/lib/api/server/routes/internal-request'
 import type { V2ApiKeyAuthContext } from '@/lib/api/server/routes/v2-api-key-auth'
 import {
   admitOptionalV2Request,
@@ -207,21 +206,6 @@ describe('defineV2JsonRoute', () => {
     expect(response.headers.get('Cache-Control')).toBe('private, no-store')
   })
 
-  it('authenticates but never rate-limits a request the server marked as its own', async () => {
-    // The embedded CLI and the agent-cli engines dispatch to these handlers in-process;
-    // the IP bucket and the per-key limits exist for callers on the wire, and a chat
-    // turn's tool calls all land on one key (dev 2026-09-03: grep hit the limit).
-    const internal = request()
-    markInternalRequest(internal)
-
-    const response = await createHandler()(internal)
-
-    expect(response.status).toBe(201)
-    expect(v2RouteMocks.authenticate).toHaveBeenCalledTimes(1)
-    expect(v2RouteMocks.preauthRate).not.toHaveBeenCalled()
-    expect(v2RouteMocks.operationRate).not.toHaveBeenCalled()
-  })
-
   it('fails closed before authentication when the IP bucket cannot admit the request', async () => {
     v2RouteMocks.preauthRate.mockResolvedValueOnce({
       allowed: false,

apps/sim/lib/api/server/routes/v2-json-route.test.ts

@@ -9,7 +9,6 @@ import {
   methodMatchesContract,
   requireJsonRouteDefinition,
 } from '@/lib/api/server/routes/definition'
-import { isInternalRequest } from '@/lib/api/server/routes/internal-request'
 import type {
   JsonApiRouteContract,
   JsonNextRouteHandler,
@@ -358,12 +357,7 @@ async function admitAuthenticatedV2Request(
     throw error
   }
 
-  // The server's own requests (embedded CLI, agent-cli engines) are authenticated like
-  // any other but never rate limited: the buckets exist for callers on the wire, and a
-  // chat turn's tool calls all land on one key. See `internal-request.ts`.
-  const limited = isInternalRequest(request)
-    ? null
-    : await rateLimitPolicy.enforce(request, auth, operation)
+  const limited = await rateLimitPolicy.enforce(request, auth, operation)
   return limited ? { success: false, response: limited } : { success: true, auth }
 }
 
@@ -397,7 +391,7 @@ async function admitRateLimitedV2Request(
     setRequestAuth(describePrincipalAuth(principal))
     return { success: true, auth: { principal } }
   }
-  const preAuthResponse = isInternalRequest(request) ? null : await enforceV2PreAuthIpLimit(request)
+  const preAuthResponse = await enforceV2PreAuthIpLimit(request)
   if (preAuthResponse) return { success: false, response: preAuthResponse }
   return admitAuthenticatedV2Request(request, operation, authPolicy, rateLimitPolicy)
 }
@@ -437,7 +431,7 @@ export async function admitOptionalV2Request(
 ): Promise<{ success: true; auth?: V2AdmissionAuth } | { success: false; response: NextResponse }> {
   if (isCopilotRequest(request))
     return admitRateLimitedV2Request(request, operation, authPolicy, rateLimitPolicy, useCase)
-  const preAuthResponse = isInternalRequest(request) ? null : await enforceV2PreAuthIpLimit(request)
+  const preAuthResponse = await enforceV2PreAuthIpLimit(request)
   if (preAuthResponse) return { success: false, response: preAuthResponse }
   if (!hasV2Credential(request.headers)) return { success: true }
   return admitAuthenticatedV2Request(request, operation, authPolicy, rateLimitPolicy)

apps/sim/lib/api/server/routes/v2-json-route.ts

@@ -220,15 +220,15 @@ export async function ensureUserStatsExists(userId: string): Promise<void> {
     .onConflictDoNothing({ target: userStats.userId })
 }
 
-export interface ResolvedUserUsageData {
+interface ResolvedUserUsageData {
   usage: UsageData
   subscription: HighestPrioritySubscription
   /** The personal balance from the same user-stats row used to calculate usage. */
   personalCreditBalance: number
 }
 
 /** Resolves comprehensive usage and the subscription that determined its billing scope. */
-export async function getResolvedUserUsageData(
+async function getResolvedUserUsageData(
   userId: string,
   executor: DbClient = db
 ): Promise<ResolvedUserUsageData> {

apps/sim/lib/billing/core/account-billing-snapshot.test.ts

@@ -72,7 +72,7 @@ function getS3EndpointSources(
   return [origin, `${url.protocol}//*.${url.host}`]
 }
 
-export interface CSPDirectives {
+interface CSPDirectives {
   'default-src'?: string[]
   'script-src'?: string[]
   'style-src'?: string[]
@@ -208,7 +208,7 @@ const STATIC_FRAME_SRC = [
 ] as const
 
 // Build-time CSP directives (for next.config.ts)
-export const buildTimeCSPDirectives: CSPDirectives = {
+const buildTimeCSPDirectives: CSPDirectives = {
   'default-src': ["'self'"],
   'script-src': [...STATIC_SCRIPT_SRC],
   'style-src': ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com'],

apps/sim/lib/billing/core/account-billing-snapshot.ts

@@ -1,31 +1,10 @@
 import { getWorkspaceOwnerSubscriptionAccess } from '@/lib/billing/core/workspace-access'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import type { CredentialGroupApplicationContext } from '@/lib/credential-groups/application/authorization'
-import {
-  isCredentialGroupsAvailable,
-  resolveCredentialGroupsAvailability,
-} from '@/lib/credential-groups/availability'
-import {
-  loadCredentialGroupCredentialListContext,
-  loadWorkspaceAccountsCredentialListContext,
-} from '@/lib/credential-groups/credentials'
+import { isCredentialGroupsAvailable } from '@/lib/credential-groups/availability'
+import { loadCredentialGroupCredentialListContext } from '@/lib/credential-groups/credentials'
 import { loadActiveWorkspaceApplicationContext } from '@/lib/workspaces/application/workspace-context'
 
-export async function requireCredentialGroupsAvailable(workspaceId: string): Promise<void> {
-  const ownerBilling = await getWorkspaceOwnerSubscriptionAccess(workspaceId)
-  const availability = await resolveCredentialGroupsAvailability({
-    organizationId: ownerBilling.organizationId,
-    ownerBilling,
-  })
-  if (!availability.available) {
-    const message =
-      availability.reason === 'enterprise_plan_required'
-        ? 'Credential Groups are not available. Enterprise plan required.'
-        : 'Credential Groups are not available'
-    throw new OrchestrationError('forbidden', message)
-  }
-}
-
 export async function requireCredentialGroupSettingsAvailable(workspaceId: string): Promise<void> {
   const ownerBilling = await getWorkspaceOwnerSubscriptionAccess(workspaceId)
   if (
@@ -52,15 +31,6 @@ export async function resolveCredentialGroupContext(
   return { ...(await resolveCredentialGroupWorkspaceContext(group.workspaceId)), ...group }
 }
 
-export async function resolveWorkspaceAccountsContext(
-  workspaceId: string
-): Promise<CredentialGroupApplicationContext> {
-  const workspace = await resolveCredentialGroupWorkspaceContext(workspaceId)
-  const group = await loadWorkspaceAccountsCredentialListContext(workspaceId)
-  if (!group) throw new OrchestrationError('not_found', 'Connected accounts are not configured')
-  return { ...workspace, ...group }
-}
-
 export async function resolveCredentialGroupSettingsContext(
   credentialGroupId: string,
   assertedWorkspaceId: string

apps/sim/lib/billing/core/usage.ts

@@ -191,13 +191,6 @@ export async function loadCredentialGroupCredentialListContext(
   return loadCredentialGroupContext(eq(credentialGroup.id, credentialGroupId))
 }
 
-/** Loads the workspace's single accounts container without decrypting provider settings. */
-export async function loadWorkspaceAccountsCredentialListContext(
-  workspaceId: string
-): Promise<CredentialGroupCredentialListContext | null> {
-  return loadCredentialGroupContext(eq(credentialGroup.workspaceId, workspaceId))
-}
-
 async function loadCredentialGroupContext(
   scope: SQL
 ): Promise<CredentialGroupCredentialListContext | null> {