fix(auth): project legacy knowledge audits

Author: TheodoreSpeaks

apps/sim/lib/core/application/authorized-workspace-use-case.ts

@@ -75,16 +75,17 @@ function isAuthorizationOptionsResolver<
   return typeof options === 'function'
 }
 
-function recordProjectedAuditEntries<O extends WorkspaceOperation>(
+export function recordProjectedUseCaseAuditEntries<O extends WorkspaceOperation>(
   operation: O,
-  context: WorkspaceAuthorizationContext,
-  attribution: PrincipalAuditAttribution,
+  workspaceId: string | null | undefined,
+  principal: PrincipalForOperation<O>,
   request: OrchestrationRequestContext | undefined,
   entries: readonly WorkspaceUseCaseAuditEntry[]
 ): void {
+  const attribution: PrincipalAuditAttribution = resolvePrincipalAuditAttribution(principal)
   for (const entry of entries) {
     recordAudit({
-      workspaceId: context.workspaceId,
+      workspaceId,
       actorId: attribution.actorId,
       actorName: attribution.actorName,
       action: entry.action,
@@ -135,11 +136,10 @@ export function defineAuthorizedWorkspaceUseCase<
       if (projectedAudit !== undefined) {
         const auditEntries = Array.isArray(projectedAudit) ? projectedAudit : [projectedAudit]
         if (auditEntries.length > 0) {
-          const auditAttribution = resolvePrincipalAuditAttribution(principal)
-          recordProjectedAuditEntries(
+          recordProjectedUseCaseAuditEntries(
             definition.operation,
-            context,
-            auditAttribution,
+            context.workspaceId,
+            principal,
             request,
             auditEntries
           )

apps/sim/lib/core/application/index.ts

@@ -3,6 +3,7 @@ export {
   type AuthorizedWorkspaceUseCaseDefinition,
   type AuthorizedWorkspaceUseCaseResultContext,
   defineAuthorizedWorkspaceUseCase,
+  recordProjectedUseCaseAuditEntries,
   type WorkspaceUseCaseAuditEntry,
 } from '@/lib/core/application/authorized-workspace-use-case'
 export type {

apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts

@@ -3,6 +3,7 @@ import {
   defineAuthorizedWorkspaceUseCase,
   type OperationUseCase,
   type PrincipalForOperation,
+  recordProjectedUseCaseAuditEntries,
   requireAllowedWorkspacePrincipal,
   type WorkspaceOperation,
   type WorkspaceUseCaseAuditEntry,
@@ -131,7 +132,21 @@ export function defineAuthorizedKnowledgeUseCase<
         }
         const executionContext = { principal, input, context, request }
         const result = await definition.execute(executionContext)
-        await definition.afterSuccess?.({ ...executionContext, result })
+        const resultContext = { ...executionContext, result }
+        const projectedAudit = definition.projectAudit?.(resultContext)
+        if (projectedAudit !== undefined) {
+          const auditEntries = Array.isArray(projectedAudit) ? projectedAudit : [projectedAudit]
+          if (auditEntries.length > 0) {
+            recordProjectedUseCaseAuditEntries(
+              definition.operation,
+              context.workspaceId,
+              principal,
+              request,
+              auditEntries
+            )
+          }
+        }
+        await definition.afterSuccess?.(resultContext)
         return result
       }
 

apps/sim/lib/knowledge/application/documents.test.ts

@@ -195,6 +195,37 @@ describe('knowledge document application use cases', () => {
     expect(mocks.recordAudit).not.toHaveBeenCalled()
   })
 
+  it('projects mutation audit entries for an owning legacy personal principal', async () => {
+    mocks.resolveDocument.mockResolvedValueOnce({
+      workspaceId: undefined,
+      legacyPersonalOwnerUserId: 'user-1',
+      knowledgeBaseId: 'legacy-knowledge',
+      knowledgeBase: { id: 'legacy-knowledge', name: 'Personal docs', userId: 'user-1' },
+      documentId: document.id,
+      document: { ...document, knowledgeBaseId: 'legacy-knowledge' },
+    })
+
+    await deleteKnowledgeDocument.execute({
+      principal: { kind: 'session', userId: 'user-1', sessionId: 'session-1' },
+      input: { knowledgeBaseId: 'legacy-knowledge', documentId: document.id, source: 'legacy' },
+    })
+
+    expect(mocks.resolvePermission).not.toHaveBeenCalled()
+    expect(mocks.recordAudit).toHaveBeenCalledWith(
+      expect.objectContaining({
+        workspaceId: undefined,
+        actorId: 'user-1',
+        action: 'document.deleted',
+        resourceId: document.id,
+        metadata: expect.objectContaining({
+          operation: 'knowledge.documents.delete',
+          knowledgeBaseId: 'legacy-knowledge',
+          actor: { kind: 'session', userId: 'user-1' },
+        }),
+      })
+    )
+  })
+
   it('conceals legacy personal documents from a non-owner', async () => {
     mocks.resolveKnowledgeBase.mockResolvedValueOnce({
       workspaceId: undefined,

apps/sim/lib/mcp/middleware.ts

@@ -24,7 +24,6 @@ export interface McpAuthContext {
   userEmail?: string | null
   authType?: AuthTypeValue
   workspaceId: string
-  canWrite: boolean
   requestId: string
   /**
    * The caller's resolved workspace permission, which satisfies but may exceed
@@ -203,7 +202,6 @@ async function validateMcpAuth(
         userEmail: auth.userEmail,
         authType: auth.authType,
         workspaceId,
-        canWrite: permissionSatisfies(userPermissions as PermissionType, 'write'),
         requestId,
         permission: userPermissions,
       },