fix CI regressions after staging merge

Author: TheodoreSpeaks

apps/sim/app/api/chat/manage/[id]/route.test.ts

@@ -23,14 +23,16 @@ import {
 import { NextRequest } from 'next/server'
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockCheckChatAccess, mockValidateChatDeployAuth } = vi.hoisted(() => ({
-  mockCheckChatAccess: vi.fn(),
-  mockValidateChatDeployAuth: vi.fn(),
-}))
+const { mockCheckChatAccess, mockCheckNeedsRedeployment, mockValidateChatDeployAuth } = vi.hoisted(
+  () => ({
+    mockCheckChatAccess: vi.fn(),
+    mockCheckNeedsRedeployment: vi.fn(),
+    mockValidateChatDeployAuth: vi.fn(),
+  })
+)
 
 const mockCreateSuccessResponse = workflowsApiUtilsMockFns.mockCreateSuccessResponse
 const mockCreateErrorResponse = workflowsApiUtilsMockFns.mockCreateErrorResponse
-const mockCheckNeedsRedeployment = workflowsApiUtilsMockFns.mockCheckNeedsRedeployment
 const mockEncryptSecret = encryptionMockFns.mockEncryptSecret
 const mockPerformFullDeploy = workflowsOrchestrationMockFns.mockPerformFullDeploy
 const mockPerformChatUndeploy = workflowsOrchestrationMockFns.mockPerformChatUndeploy
@@ -56,6 +58,9 @@ vi.mock('@/ee/access-control/utils/permission-check', () => {
 })
 vi.mock('@/lib/workflows/persistence/utils', () => workflowsPersistenceUtilsMock)
 vi.mock('@/lib/workflows/orchestration', () => workflowsOrchestrationMock)
+vi.mock('@/lib/workflows/deployment-status', () => ({
+  checkNeedsRedeployment: mockCheckNeedsRedeployment,
+}))
 
 import { DELETE, GET, PATCH } from '@/app/api/chat/manage/[id]/route'
 import { ChatDeployAuthNotAllowedError } from '@/ee/access-control/utils/permission-check'

apps/sim/app/api/tools/file/manage/route.test.ts

@@ -54,6 +54,12 @@ vi.mock('@/lib/realtime/notify', () => ({
   notifyWorkspaceFilesChanged: vi.fn(async () => undefined),
 }))
 
+vi.mock('@/lib/public-shares/share-manager', () => ({
+  getShareForResource: vi.fn().mockResolvedValue(null),
+  getSharesForResources: vi.fn().mockResolvedValue(new Map()),
+  ShareValidationError: class ShareValidationError extends Error {},
+}))
+
 vi.mock('@sim/platform-authz/workspace', () => ({
   permissionSatisfies: (permission: string | null, required: string) =>
     permission === 'admin' ||
@@ -439,7 +445,9 @@ describe('POST /api/tools/file/manage content provenance', () => {
       'new.txt',
       'text/plain',
       {
+        exactName: false,
         folderId: null,
+        folderPath: undefined,
         secretProvenance: { status: 'unknown' },
       }
     )
@@ -619,7 +627,9 @@ describe('POST /api/tools/file/manage content provenance', () => {
       'child.txt',
       'text/plain',
       {
+        exactName: true,
         folderId: null,
+        folderPath: undefined,
         secretProvenance: { status: 'unknown' },
       }
     )

apps/sim/app/api/v1/knowledge/[id]/documents/route.test.ts

@@ -228,10 +228,17 @@ describe('v1 knowledge document upload route', () => {
     expect(mockResolveBillingAttribution).not.toHaveBeenCalled()
     expect(mockCheckAttributedUsageLimits).toHaveBeenCalledWith(SYSTEM_BILLING_ATTRIBUTION)
     expect(mockCreateSingleDocument).toHaveBeenCalledWith(
-      expect.any(Object),
+      {
+        filename: 'file.txt',
+        fileUrl: 'https://example.com/file.txt',
+        fileSize: 11,
+        mimeType: 'text/plain',
+      },
       'kb-1',
       'req-1',
-      'owner-after-transfer'
+      'owner-after-transfer',
+      undefined,
+      undefined
     )
     expect(mockProcessDocumentsWithQueue).toHaveBeenCalledWith(
       expect.any(Array),

apps/sim/app/api/v2/files/[fileId]/share/route.test.ts

@@ -157,14 +157,14 @@ describe('GET /api/v2/files/[fileId]/share', () => {
     expect(mocks.getShare).not.toHaveBeenCalled()
   })
 
-  it('conceals authorization failures as not found', async () => {
+  it('preserves generic authorization failures as forbidden', async () => {
     mocks.getShare.mockRejectedValueOnce(new OrchestrationError('forbidden', 'Access denied'))
 
     const response = await callGet()
     const body = await response.json()
 
-    expect(response.status).toBe(404)
-    expect(body.error.code).toBe('NOT_FOUND')
+    expect(response.status).toBe(403)
+    expect(body.error.code).toBe('FORBIDDEN')
     expect(mocks.getShare).toHaveBeenCalledWith({
       principal: PRINCIPAL,
       input: { fileId: FILE_ID, assertedWorkspaceId: WORKSPACE_ID },
@@ -251,13 +251,13 @@ describe('PUT /api/v2/files/[fileId]/share', () => {
     })
   })
 
-  it('conceals forbidden updates as not found', async () => {
+  it('preserves generic forbidden updates as forbidden', async () => {
     mocks.updateShare.mockRejectedValueOnce(new OrchestrationError('forbidden', 'Access denied'))
 
     const response = await callPut({ workspaceId: WORKSPACE_ID, isActive: true })
 
-    expect(response.status).toBe(404)
-    expect((await response.json()).error.code).toBe('NOT_FOUND')
+    expect(response.status).toBe(403)
+    expect((await response.json()).error.code).toBe('FORBIDDEN')
   })
 
   it('returns the rate-limit response when denied', async () => {

apps/sim/app/api/v2/tables/[tableId]/groups/route.test.ts

@@ -143,16 +143,16 @@ describe('/api/v2/tables/[tableId]/groups', () => {
     })
   })
 
-  it('conceals denied table access on group mutations', async () => {
+  it('preserves generic denied table access on group mutations as forbidden', async () => {
     mocks.update.mockRejectedValueOnce(new OrchestrationError('forbidden', 'Forbidden'))
 
     const response = await PATCH(
       writeRequest('PATCH', { workspaceId: WORKSPACE_ID, groupId: 'group-1', name: 'Renamed' }),
       context
     )
 
-    expect(response.status).toBe(404)
-    expect((await response.json()).error.message).toBe('Table not found')
+    expect(response.status).toBe(403)
+    expect((await response.json()).error.message).toBe('Forbidden')
   })
 
   it('returns authoritative surviving columns after deletion', async () => {

apps/sim/app/api/v2/tables/[tableId]/rows/[rowId]/route.test.ts

@@ -153,12 +153,12 @@ describe('/api/v2/tables/[tableId]/rows/[rowId]', () => {
     )
   })
 
-  it('conceals a forbidden canonical lookup as not found', async () => {
+  it('preserves a generic forbidden canonical lookup as forbidden', async () => {
     mocks.readRow.mockRejectedValue(new OrchestrationError('forbidden', 'Forbidden'))
 
     const response = await GET(request('GET'), CONTEXT)
 
-    expect(response.status).toBe(404)
-    expect((await response.json()).error.code).toBe('NOT_FOUND')
+    expect(response.status).toBe(403)
+    expect((await response.json()).error.code).toBe('FORBIDDEN')
   })
 })

apps/sim/app/api/v2/workflows/[id]/export/route.test.ts

@@ -6,6 +6,8 @@ import { describe, expect, it, vi } from 'vitest'
 const mocks = vi.hoisted(() => ({ defineRoute: vi.fn((definition) => definition) }))
 
 vi.mock('@/lib/api/server/routes', () => ({
+  createInternalSessionOrExecutorAuth: vi.fn(() => ({ authenticate: vi.fn() })),
+  createV2ResourceConcealmentPolicy: vi.fn((options) => options),
   defineV2JsonRoute: mocks.defineRoute,
   v2ApiKeyAuth: { kind: 'v2-api-key' },
   v2RateLimits: { publicApi: { kind: 'public-api' } },

apps/sim/app/api/v2/workflows/[id]/runs/[runId]/resume/route.test.ts

@@ -11,12 +11,35 @@ const mocks = vi.hoisted(() => ({
 
 vi.mock('@/lib/api/server/routes', () => {
   class V2RouteInfrastructureError extends Error {}
+  const renderOrchestrationError = (error: unknown) => {
+    const candidate = error as { code?: string; message?: string; name?: string }
+    if (candidate.code === 'not_found') {
+      return Response.json(
+        { error: { code: 'NOT_FOUND', message: candidate.message ?? 'Not found' } },
+        { status: 404 }
+      )
+    }
+    if (candidate.name === 'PersonalApiKeysDisabledError') {
+      return Response.json(
+        {
+          error: {
+            code: 'FORBIDDEN',
+            message: candidate.message ?? 'Personal API keys are not allowed for this workspace',
+          },
+        },
+        { status: 403 }
+      )
+    }
+    return null
+  }
   return {
     admitV2Request: mocks.admit,
+    createInternalSessionOrExecutorAuth: vi.fn(() => ({ authenticate: vi.fn() })),
+    createV2ResourceConcealmentPolicy: vi.fn(() => ({ render: renderOrchestrationError })),
     V2RouteInfrastructureError,
     v2ApiKeyAuth: { kind: 'v2-api-key' },
     v2RateLimits: { publicApi: { kind: 'public-api' } },
-    v2OrchestrationErrorPolicy: { render: () => null },
+    v2OrchestrationErrorPolicy: { render: renderOrchestrationError },
   }
 })
 

apps/sim/app/api/v2/workflows/folders/route.test.ts

@@ -6,6 +6,8 @@ import { describe, expect, it, vi } from 'vitest'
 const mocks = vi.hoisted(() => ({ defineRoute: vi.fn((definition) => definition) }))
 
 vi.mock('@/lib/api/server/routes', () => ({
+  createInternalSessionOrExecutorAuth: vi.fn(() => ({ authenticate: vi.fn() })),
+  createV2ResourceConcealmentPolicy: vi.fn((options) => options),
   defineV2JsonRoute: mocks.defineRoute,
   v2ApiKeyAuth: { kind: 'v2-api-key' },
   v2RateLimits: { publicApi: { kind: 'public-api' } },

apps/sim/app/api/v2/workflows/import/route.test.ts

@@ -6,6 +6,8 @@ import { describe, expect, it, vi } from 'vitest'
 const mocks = vi.hoisted(() => ({ defineRoute: vi.fn((definition) => definition) }))
 
 vi.mock('@/lib/api/server/routes', () => ({
+  createInternalSessionOrExecutorAuth: vi.fn(() => ({ authenticate: vi.fn() })),
+  createV2ResourceConcealmentPolicy: vi.fn((options) => options),
   defineV2JsonRoute: mocks.defineRoute,
   v2ApiKeyAuth: { kind: 'v2-api-key' },
   v2RateLimits: { publicApi: { kind: 'public-api' } },