fix(v2): parse a bound list filter once, so the scope matches the query

The logs list fingerprinted `workflowIds`, `triggers`, and `folderPaths`
through unorderedScopePart, which trims each member, then split the same raw
values itself with `.split(',').filter(Boolean)`, which does not. So
`?workflowIds=A,B` and `?workflowIds=A, B` produced one fingerprint and two
different result sets: the second selects on a member with a leading space
that matches no row. A cursor minted under one was accepted under the other,
which is the exact failure the filter binding exists to refuse.

Extracts parseUnorderedList as the single parse. unorderedScopePart now
derives from it, and the route passes the array to the query and the joined
form to the scope, so the members fingerprinted are by construction the
members filtered on. Also drops three inline splits.

Reported by Greptile.

Author: waleedlatif1

apps/sim/app/api/v2/logs/route.ts

@@ -6,6 +6,7 @@ import {
 } from '@/lib/api/contracts/v2/logs'
 import {
   cursorScopeKey,
+  parseUnorderedList,
   UNREADABLE_CURSOR_MESSAGE,
   unorderedScopePart,
 } from '@/lib/api/cursor-binding'
@@ -76,8 +77,8 @@ export const GET = defineV2JsonRoute({
     return {
       workspaceId: query.workspaceId,
       filters: {
-        workflowIds: query.workflowIds?.split(',').filter(Boolean),
-        triggers: query.triggers?.split(',').filter(Boolean),
+        workflowIds: parseUnorderedList(query.workflowIds),
+        triggers: parseUnorderedList(query.triggers),
         level: query.level,
         startDate: query.startDate ? new Date(query.startDate) : undefined,
         endDate: query.endDate ? new Date(query.endDate) : undefined,
@@ -90,7 +91,7 @@ export const GET = defineV2JsonRoute({
         cursor: decodedCursor ?? undefined,
         order: query.order,
       },
-      folderPaths: query.folderPaths?.split(',').filter(Boolean),
+      folderPaths: parseUnorderedList(query.folderPaths),
       limit: query.limit,
       includeFullDetails:
         query.details === 'full' || query.includeFinalOutput || query.includeTraceSpans,

apps/sim/lib/api/cursor-binding.test.ts

@@ -2,7 +2,7 @@
  * @vitest-environment node
  */
 import { describe, expect, it } from 'vitest'
-import { cursorScopeKey, unorderedScopePart } from '@/lib/api/cursor-binding'
+import { cursorScopeKey, parseUnorderedList, unorderedScopePart } from '@/lib/api/cursor-binding'
 import {
   cursorSortKey,
   decodeOffsetCursor,
@@ -207,6 +207,18 @@ describe('unordered filter scope parts', () => {
     expect(unorderedScopePart('B,A,B')).toBe('A,B')
   })
 
+  /**
+   * The scope and the query must read one parse. When the scope trimmed members
+   * and the route split the raw value itself, `A,B` and `A, B` shared a
+   * fingerprint while selecting different rows — a cursor accepted across a
+   * change that moved the sequence, which is the failure the binding prevents.
+   */
+  it('parses the members it fingerprints', () => {
+    expect(parseUnorderedList('A, B')).toEqual(['A', 'B'])
+    expect(parseUnorderedList('A,B')).toEqual(parseUnorderedList('A, B'))
+    expect(unorderedScopePart('A, B')).toBe(parseUnorderedList('A, B')?.join(','))
+  })
+
   it('still separates genuinely different sets', () => {
     expect(cursorScopeKey({ workflowIds: unorderedScopePart('A,B') })).not.toBe(
       cursorScopeKey({ workflowIds: unorderedScopePart('A,C') })

apps/sim/lib/api/cursor-binding.ts

@@ -63,20 +63,35 @@ export type CursorScopePart =
  * {@link canonicalJson} already sorts object keys, so this only has to normalize
  * the list. Members are de-duplicated as well as sorted: the filters compile to
  * `inArray`, which is set membership, so `A,A,B` selects exactly what `A,B` does
- * and must not bind to a different page. Empty members are dropped because the
- * parsers drop them too.
+ * and must not bind to a different page.
+ *
+ * Derived from {@link parseUnorderedList} rather than parsing again, so the
+ * members this fingerprints are exactly the members the query filters on. A
+ * route that canonicalized here and split the raw value itself would give
+ * `A,B` and `A, B` one fingerprint and two different result sets.
  */
 export function unorderedScopePart(raw: string | undefined): string | undefined {
+  const members = parseUnorderedList(raw)
+  return members && members.length > 0 ? members.join(',') : undefined
+}
+
+/**
+ * The members of a comma-separated filter, trimmed, de-duplicated, and sorted.
+ *
+ * The one parse for both halves of a bound list filter: pass the array to the
+ * query and {@link unorderedScopePart} to the cursor scope. Callers must not
+ * re-split the raw value for one half — that is what lets the two drift.
+ */
+export function parseUnorderedList(raw: string | undefined): string[] | undefined {
   if (raw === undefined) return undefined
-  const members = [
+  return [
     ...new Set(
       raw
         .split(',')
         .map((member) => member.trim())
         .filter((member) => member.length > 0)
     ),
   ].sort()
-  return members.length > 0 ? members.join(',') : undefined
 }
 
 /**