fix(mothership): restore workspace API key dispatch

Author: Sg312

apps/sim/lib/mothership/tool-executor/register-handlers.ts

@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import {
   CancelWorkflowRun,
+  GenerateApiKey,
   RunBlock,
   RunFromBlock,
   RunWorkflow,
@@ -13,6 +14,7 @@ import { executeRunCode } from '../tools/handlers/run-code'
 import { executeSimCli } from '../tools/handlers/sim-cli'
 import {
   executeCancelWorkflowRun,
+  executeGenerateApiKey,
   executeRunBlock,
   executeRunFromBlock,
   executeRunWorkflow,
@@ -50,6 +52,7 @@ function h(fn: (params: any, context: any) => Promise<any>): ToolHandler {
 function buildHandlerMap(): Record<string, ToolHandler> {
   return {
     [CancelWorkflowRun.id]: h(executeCancelWorkflowRun),
+    [GenerateApiKey.id]: h(executeGenerateApiKey),
     [RunWorkflow.id]: h(executeRunWorkflow),
     [RunWorkflowUntilBlock.id]: h(executeRunWorkflowUntilBlock),
     [RunFromBlock.id]: h(executeRunFromBlock),

apps/sim/lib/mothership/tools/handlers/workflow/mutations.test.ts

@@ -4,6 +4,8 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { WorkflowRunAlreadyTerminalError } from '@/lib/execution/workflow-run-already-terminal-error'
 import type { ExecutionContext } from '@/lib/mothership/request/types'
+import { executeTool } from '@/lib/mothership/tool-executor/executor'
+import { ensureHandlersRegistered } from '@/lib/mothership/tool-executor/register-handlers'
 import type { CancelWorkflowRunParams } from '@/lib/mothership/tools/handlers/param-types'
 
 const { mocks } = vi.hoisted(() => ({
@@ -51,10 +53,16 @@ vi.mock('@/lib/core/telemetry', () => ({
   PlatformEvents: { apiKeyGenerated: vi.fn() },
 }))
 
+vi.mock('@/lib/mothership/tools/handlers/function-execute', () => ({
+  executeFunctionExecute: vi.fn(),
+}))
+vi.mock('@/lib/mothership/tools/handlers/run-code', () => ({ executeRunCode: vi.fn() }))
+vi.mock('@/lib/mothership/tools/handlers/sim-cli', () => ({ executeSimCli: vi.fn() }))
+vi.mock('@/lib/mothership/tools/server/router', () => ({ getRegisteredServerToolNames: () => [] }))
+
 import {
   executeCancelWorkflowRun,
   executeCreateWorkflow,
-  executeGenerateApiKey,
   executeMoveWorkflow,
   executeRunBlock,
   executeRunFromBlock,
@@ -448,18 +456,35 @@ describe('workflow mutation Copilot adapters', () => {
       key: { id: 'key-1', name: 'Copilot key', key: 'secret-key' },
     })
 
-    const result = await executeGenerateApiKey({ name: ' Copilot key ' }, context)
+    ensureHandlersRegistered()
+    const result = await executeTool(
+      'generate_api_key',
+      { name: ' Copilot key ' },
+      { ...context, userPermission: 'admin' }
+    )
 
     expect(result.success).toBe(true)
     expect(mocks.apiKey).toHaveBeenCalledWith(
-      context,
+      expect.objectContaining({ userId: context.userId, workspaceId: context.workspaceId }),
       expect.objectContaining({
         operation: expect.objectContaining({ id: 'api_keys.copilot.create' }),
       }),
       { workspaceId: 'workspace-1', name: 'Copilot key' }
     )
   })
 
+  it('refuses API-key creation before calling the handler when the actor lacks admin access', async () => {
+    ensureHandlersRegistered()
+    const result = await executeTool(
+      'generate_api_key',
+      { name: 'Copilot key' },
+      { ...context, userPermission: 'write' }
+    )
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('requires admin access')
+    expect(mocks.apiKey).not.toHaveBeenCalled()
+  })
+
   it('logs the full unknown run failure but returns a generic model-visible error', async () => {
     mocks.executeWorkflowUseCase.mockRejectedValueOnce(new Error('postgres password=secret'))