[DO NOT MERGE] Org project view on the org routes: dev branch for Theo and Marcus

apps/sim/app/api/organizations/[id]/projects/route.ts

@@ -0,0 +1,25 @@
+import { listOrganizationProjectsContract } from '@/lib/api/contracts/projects'
+import {
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalPermissionGroupErrorPolicy } from '@/lib/api/server/routes/permission-groups'
+import {
+  listOrganizationProjects,
+  listOrganizationProjectsOperation,
+} from '@/lib/projects/application/organization-projects'
+
+export const GET = defineInternalJsonRoute({
+  contract: listOrganizationProjectsContract,
+  auth: internalSessionAuth,
+  operation: listOrganizationProjectsOperation,
+  rateLimit: internalRateLimits.none({
+    reason:
+      'Read-only organization settings inventory follows existing workspace inventory admission',
+  }),
+  errorPolicy: internalPermissionGroupErrorPolicy,
+  mapInput: ({ params }) => ({ organizationId: params.id }),
+  useCase: listOrganizationProjects,
+  present: (result) => result,
+})

apps/sim/app/api/projects/[id]/route.ts

@@ -0,0 +1,18 @@
+import { renameProjectContract } from '@/lib/api/contracts/projects'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { projectOperations, renameProject } from '@/lib/projects/application/projects'
+
+export const PATCH = defineInternalJsonRoute({
+  contract: renameProjectContract,
+  auth: internalSessionAuth,
+  operation: projectOperations.rename,
+  rateLimit: internalRateLimits.none({ reason: 'Admin renaming a project they administer' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ params, body }) => ({ projectId: params.id, name: body.name }),
+  useCase: renameProject,
+})

apps/sim/app/api/projects/route.ts

@@ -0,0 +1,18 @@
+import { listProjectsContract } from '@/lib/api/contracts/projects'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { listProjects, projectOperations } from '@/lib/projects/application/projects'
+
+export const GET = defineInternalJsonRoute({
+  contract: listProjectsContract,
+  auth: internalSessionAuth,
+  operation: projectOperations.list,
+  rateLimit: internalRateLimits.none({ reason: 'Read-only list of the caller’s own projects' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ query }) => query,
+  useCase: listProjects,
+})

apps/sim/app/api/v1/admin/organizations/[id]/data-retention/route.ts

@@ -9,7 +9,7 @@
  * `DATA_RETENTION_ENABLED` (or `ENTERPRISE_ENABLED`) when billing is off.
  *
  * Body: any subset of `logRetentionHours`, `softDeleteRetentionHours`,
- * `taskCleanupHours`, `fileVersionRetentionHours`, `piiRedaction`, `retentionOverrides`.
+ * `taskCleanupHours`, `fileVersionRetentionHours`, `piiRedaction`, `retentionOverrides`, `projectOverrides`.
  * Omitted keys keep their current value; `null` means "forever" for an hours field.
  *
  * Response: AdminSingleResponse<{ success, organizationId }>
@@ -85,6 +85,7 @@ export const PATCH = withRouteHandler(
         merged.piiRedaction = body.piiRedaction
       }
 
+      if (body.projectOverrides !== undefined) merged.projectOverrides = body.projectOverrides
       if (body.retentionOverrides !== undefined) {
         merged.retentionOverrides = body.retentionOverrides
       }
@@ -97,6 +98,7 @@ export const PATCH = withRouteHandler(
       const foreignTargetsReason = await getForeignWorkspaceTargetsReason({
         organizationId,
         retentionOverrides: body.retentionOverrides,
+        projectOverrides: body.projectOverrides,
         piiRedaction: body.piiRedaction,
       })
       if (foreignTargetsReason) {

apps/sim/app/api/workspaces/[id]/dashboard/route.ts

@@ -0,0 +1,19 @@
+import { readWorkspaceDashboardContract } from '@/lib/api/contracts/dashboards'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { readWorkspaceDashboard } from '@/lib/dashboards/application/dashboards'
+import { dashboardOperations } from '@/lib/dashboards/application/operations'
+
+export const GET = defineInternalJsonRoute({
+  contract: readWorkspaceDashboardContract,
+  auth: internalSessionAuth,
+  operation: dashboardOperations.read,
+  rateLimit: internalRateLimits.user({ bucketName: 'dashboards' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ params }) => ({ workspaceId: params.id }),
+  useCase: readWorkspaceDashboard,
+})

apps/sim/app/api/workspaces/[id]/fork/mapping/route.ts

@@ -1,4 +1,5 @@
 import {
+  createForkSecretMappingContract,
   getForkMappingContract,
   updateForkMappingContract,
 } from '@/lib/api/contracts/workspace-fork'
@@ -8,6 +9,7 @@ import {
   internalSessionAuth,
 } from '@/lib/api/server/routes'
 import { internalForkErrorPolicy } from '@/ee/workspace-forking/api/route-policies'
+import { createWorkspaceForkSecretMapping } from '@/ee/workspace-forking/application/create-secret-mapping'
 import { getWorkspaceForkMappingDetails } from '@/ee/workspace-forking/application/mapping-details'
 import { forkOperations } from '@/ee/workspace-forking/application/operations'
 import { updateWorkspaceForkMappings } from '@/ee/workspace-forking/application/recovery-and-mappings'
@@ -38,3 +40,14 @@ export const PUT = defineInternalJsonRoute({
   useCase: updateWorkspaceForkMappings,
   present: (result) => ({ success: true as const, ...result }),
 })
+
+export const POST = defineInternalJsonRoute({
+  contract: createForkSecretMappingContract,
+  auth: internalSessionAuth,
+  operation: forkOperations.createSecretMapping,
+  rateLimit: internalRateLimits.none({ reason: 'Preserve existing internal fork request policy' }),
+  errorPolicy: internalForkErrorPolicy,
+  mapInput: ({ params, body }) => ({ workspaceId: params.id, ...body }),
+  useCase: createWorkspaceForkSecretMapping,
+  present: ({ name }) => ({ name }),
+})

apps/sim/app/api/workspaces/[id]/fork/workflow-diff/route.test.ts

@@ -0,0 +1,181 @@
+/**
+ * @vitest-environment node
+ */
+import { authMockFns, createMockRequest } from '@sim/testing'
+import { createRouteContext } from '@sim/testing/helpers/http'
+import { permissionsMock, permissionsMockFns } from '@sim/testing/mocks/permissions.mock'
+import {
+  workspaceAuthorizationMock,
+  workspaceAuthorizationMockFns,
+} from '@sim/testing/mocks/workspace-authorization.mock'
+import { workspaceForkingAuthzMock } from '@sim/testing/mocks/workspace-forking-authz.mock'
+import {
+  workspaceForkingLineageMock,
+  workspaceForkingLineageMockFns,
+} from '@sim/testing/mocks/workspace-forking-lineage.mock'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+
+const mocks = vi.hoisted(() => ({
+  loadSourceDeployedWorkflow: vi.fn(),
+  loadTargetDraftState: vi.fn(),
+  loadForkBlockMap: vi.fn(),
+  resolveForkPlanItem: vi.fn(),
+}))
+
+vi.mock('@/lib/core/application/workspace-authorization', () => workspaceAuthorizationMock)
+vi.mock('@/lib/workspaces/permissions/utils', () => permissionsMock)
+vi.mock('@/ee/workspace-forking/lib/lineage/authz', () => workspaceForkingAuthzMock)
+vi.mock('@/ee/workspace-forking/lib/lineage/lineage', () => workspaceForkingLineageMock)
+vi.mock('@/ee/workspace-forking/lib/copy/deploy-bridge', () => ({
+  loadSourceDeployedWorkflow: mocks.loadSourceDeployedWorkflow,
+  loadTargetDraftState: mocks.loadTargetDraftState,
+}))
+vi.mock('@/ee/workspace-forking/lib/mapping/block-map-store', () => ({
+  loadForkBlockMap: mocks.loadForkBlockMap,
+}))
+vi.mock('@/ee/workspace-forking/lib/promote/promote-plan', () => ({
+  resolveForkPlanItem: mocks.resolveForkPlanItem,
+}))
+
+import { GET } from '@/app/api/workspaces/[id]/fork/workflow-diff/route'
+
+const { mockAuthorizeWorkspaceOperation } = workspaceAuthorizationMockFns
+const mockGetSession = authMockFns.mockGetSession
+permissionsMockFns.mockGetWorkspaceWithOwner.mockImplementation(async (id: string) => ({
+  id,
+  name: id,
+  organizationId: null,
+  allowPersonalApiKeys: true,
+}))
+
+const WORKSPACE_ID = 'child'
+const routeContext = createRouteContext({ id: WORKSPACE_ID })
+const BASE_URL = `http://localhost/api/workspaces/${WORKSPACE_ID}/fork/workflow-diff`
+
+const emptyState = { blocks: {}, edges: [], loops: {}, parallels: {}, variables: {} }
+
+function request(query: Record<string, string>) {
+  const url = `${BASE_URL}?${new URLSearchParams(query).toString()}`
+  return createMockRequest('GET', undefined, undefined, url)
+}
+
+describe('fork workflow-diff route', () => {
+  beforeEach(() => {
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' }, session: { id: 'session-1' } })
+    mockAuthorizeWorkspaceOperation.mockResolvedValue(undefined)
+    workspaceForkingLineageMockFns.mockResolveForkEdge.mockResolvedValue({
+      parentWorkspaceId: 'parent',
+      childWorkspaceId: 'child',
+    })
+    mocks.loadForkBlockMap.mockResolvedValue({ parentToChild: new Map(), childToParent: new Map() })
+    mocks.loadSourceDeployedWorkflow.mockImplementation(async (_ws: string, id: string) =>
+      id === 'wf-src' ? { summary: { id, name: 'Support Agent' }, state: emptyState } : null
+    )
+    mocks.resolveForkPlanItem.mockResolvedValue({
+      sourceWorkflowId: 'wf-src',
+      targetWorkflowId: 'wf-tgt',
+      targetName: null,
+      mode: 'create',
+      sourceMeta: { name: 'Support Agent' },
+    })
+  })
+
+  it('does not read any state when workspace authorization is refused', async () => {
+    mockAuthorizeWorkspaceOperation.mockRejectedValue(
+      new OrchestrationError('forbidden', 'Admin access required')
+    )
+
+    const response = await GET(
+      request({ otherWorkspaceId: 'parent', direction: 'push', sourceWorkflowId: 'wf-src' }),
+      routeContext
+    )
+
+    expect(response.status).toBe(403)
+  })
+
+  it('rejects a request without the source workflow id', async () => {
+    const response = await GET(
+      request({ otherWorkspaceId: 'parent', direction: 'push' }),
+      routeContext
+    )
+
+    expect(response.status).toBe(400)
+  })
+
+  it('rejects workspaces that are not a direct fork edge without reading state', async () => {
+    workspaceForkingLineageMockFns.mockResolveForkEdge.mockResolvedValue(null)
+
+    const response = await GET(
+      request({ otherWorkspaceId: 'parent', direction: 'push', sourceWorkflowId: 'wf-src' }),
+      routeContext
+    )
+
+    expect(response.status).toBe(400)
+  })
+
+  it('maps a workflow outside the sync plan to 404', async () => {
+    const response = await GET(
+      request({ otherWorkspaceId: 'parent', direction: 'push', sourceWorkflowId: 'foreign' }),
+      routeContext
+    )
+
+    expect(response.status).toBe(404)
+  })
+
+  it('returns the before and after states with their labels', async () => {
+    const response = await GET(
+      request({ otherWorkspaceId: 'parent', direction: 'push', sourceWorkflowId: 'wf-src' }),
+      routeContext
+    )
+
+    expect(response.status).toBe(200)
+    await expect(response.json()).resolves.toEqual({
+      targetWorkflowId: null,
+      before: null,
+      after: emptyState,
+      beforeLabel: 'Support Agent (current)',
+      afterLabel: 'Support Agent (deployed)',
+    })
+  })
+  it('maps a workflow whose target is excluded from sync to 404', async () => {
+    mocks.resolveForkPlanItem.mockResolvedValue(null)
+
+    const response = await GET(
+      request({ otherWorkspaceId: 'parent', direction: 'push', sourceWorkflowId: 'wf-src' }),
+      routeContext
+    )
+
+    expect(response.status).toBe(404)
+  })
+
+  it('returns the target draft as before when the sync replaces a workflow', async () => {
+    const targetState = {
+      ...emptyState,
+      blocks: {},
+    }
+    mocks.resolveForkPlanItem.mockResolvedValue({
+      sourceWorkflowId: 'wf-src',
+      targetWorkflowId: 'wf-tgt',
+      targetName: 'Support Agent prod',
+      mode: 'replace',
+      sourceMeta: { name: 'Support Agent' },
+    })
+    /* Only the replaced target in the target workspace has a draft; any other read is a 404. */
+    mocks.loadTargetDraftState.mockImplementation(async (id: string, workspaceId: string) =>
+      id === 'wf-tgt' && workspaceId === 'parent' ? targetState : null
+    )
+
+    const response = await GET(
+      request({ otherWorkspaceId: 'parent', direction: 'push', sourceWorkflowId: 'wf-src' }),
+      routeContext
+    )
+
+    expect(response.status).toBe(200)
+    await expect(response.json()).resolves.toMatchObject({
+      targetWorkflowId: 'wf-tgt',
+      before: targetState,
+      beforeLabel: 'Support Agent prod (current)',
+    })
+  })
+})

apps/sim/app/api/workspaces/[id]/fork/workflow-diff/route.ts

@@ -0,0 +1,20 @@
+import { getForkWorkflowDiffContract } from '@/lib/api/contracts/workspace-fork'
+import {
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalForkErrorPolicy } from '@/ee/workspace-forking/api/route-policies'
+import { forkOperations } from '@/ee/workspace-forking/application/operations'
+import { getWorkspaceSyncWorkflowDiff } from '@/ee/workspace-forking/application/sync-workflow-diff'
+
+export const GET = defineInternalJsonRoute({
+  contract: getForkWorkflowDiffContract,
+  auth: internalSessionAuth,
+  operation: forkOperations.syncPreview,
+  rateLimit: internalRateLimits.user({ bucketName: 'workspace-fork-workflow-diff' }),
+  errorPolicy: internalForkErrorPolicy,
+  mapInput: ({ params, query }) => ({ workspaceId: params.id, ...query }),
+  useCase: getWorkspaceSyncWorkflowDiff,
+  present: (result) => result,
+})

apps/sim/app/api/workspaces/[id]/settings-navigation/route.ts

@@ -0,0 +1,24 @@
+import { getWorkspaceSettingsNavigationContract } from '@/lib/api/contracts/workspace-settings'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import {
+  readWorkspaceSettingsNavigation,
+  readWorkspaceSettingsNavigationOperation,
+} from '@/lib/settings/application/workspace-navigation'
+
+export const GET = defineInternalJsonRoute({
+  contract: getWorkspaceSettingsNavigationContract,
+  auth: internalSessionAuth,
+  operation: readWorkspaceSettingsNavigationOperation,
+  rateLimit: internalRateLimits.none({
+    reason: 'Read-only settings navigation, matching existing settings-page admission',
+  }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ params }) => ({ workspaceId: params.id }),
+  useCase: readWorkspaceSettingsNavigation,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
+})