fix(api): align v2 permissions and resource behavior

Author: TheodoreSpeaks

apps/sim/app/api/v2/files/[fileId]/content/route.test.ts

@@ -115,7 +115,7 @@ describe('PUT /api/v2/files/[fileId]/content', () => {
 
     const response = await callPut('{not-json')
 
-    expect(response.status).toBe(404)
+    expect(response.status).toBe(403)
     expect(mocks.admit).toHaveBeenCalledWith(auth.principal, FILE_ID)
     expect(mocks.updateContent).not.toHaveBeenCalled()
   })

apps/sim/app/api/v2/files/[fileId]/content/route.ts

@@ -19,7 +19,7 @@ export const PUT = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: fileOperations.updateContent,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2FileErrorPolicies.concealResourceAuthorization,
+  errorPolicy: v2FileErrorPolicies.default,
   parseOptions: {
     invalidJsonResponse: () => v2Error('BAD_REQUEST', 'Request body must be valid JSON'),
     maxBodyBytes: MAX_WORKSPACE_FILE_INLINE_BODY_BYTES,

apps/sim/app/api/v2/files/[fileId]/metadata/route.test.ts

@@ -113,13 +113,13 @@ describe('GET /api/v2/files/[fileId]/metadata', () => {
     expect(mocks.readMetadata).not.toHaveBeenCalled()
   })
 
-  it('conceals an authorization failure as not found', async () => {
+  it('returns forbidden for an authorization failure', async () => {
     mocks.readMetadata.mockRejectedValue(new NoWorkspaceAccessError())
 
     const response = await callGet(`workspaceId=${WORKSPACE_ID}`)
 
-    expect(response.status).toBe(404)
-    expect((await response.json()).error.code).toBe('NOT_FOUND')
+    expect(response.status).toBe(403)
+    expect((await response.json()).error.code).toBe('FORBIDDEN')
   })
 
   it('returns the v2 metadata projection through the shared use case', async () => {

apps/sim/app/api/v2/files/[fileId]/metadata/route.ts

@@ -14,7 +14,7 @@ export const GET = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: fileOperations.readMetadata,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2FileErrorPolicies.concealResourceAuthorization,
+  errorPolicy: v2FileErrorPolicies.default,
   mapInput: ({ params, query }) => ({
     fileId: params.fileId,
     assertedWorkspaceId: query.workspaceId,

apps/sim/app/api/v2/files/[fileId]/route.test.ts

@@ -141,16 +141,16 @@ describe('v2 single-file routes', () => {
     })
   })
 
-  it('conceals download authorization failures', async () => {
+  it('returns forbidden for download authorization failures', async () => {
     mocks.download.mockRejectedValue(new NoWorkspaceAccessError())
 
     const response = await GET(
       new NextRequest(`http://localhost:3000/api/v2/files/${FILE_ID}?workspaceId=${WORKSPACE_ID}`),
       context
     )
 
-    expect(response.status).toBe(404)
-    expect((await response.json()).error.code).toBe('NOT_FOUND')
+    expect(response.status).toBe(403)
+    expect((await response.json()).error.code).toBe('FORBIDDEN')
   })
 
   it('renames through the shared use case and v2 presenter', async () => {
@@ -170,7 +170,7 @@ describe('v2 single-file routes', () => {
     })
   })
 
-  it('maps rename conflicts and conceals absent workspace access', async () => {
+  it('maps rename conflicts and returns forbidden for absent workspace access', async () => {
     mocks.rename.mockRejectedValueOnce(new OrchestrationError('conflict', 'Name exists'))
     const conflict = await PATCH(
       new NextRequest(`http://localhost:3000/api/v2/files/${FILE_ID}`, {
@@ -183,15 +183,15 @@ describe('v2 single-file routes', () => {
     expect(conflict.status).toBe(409)
 
     mocks.rename.mockRejectedValueOnce(new NoWorkspaceAccessError())
-    const concealed = await PATCH(
+    const forbidden = await PATCH(
       new NextRequest(`http://localhost:3000/api/v2/files/${FILE_ID}`, {
         method: 'PATCH',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ workspaceId: WORKSPACE_ID, name: 'renamed.csv' }),
       }),
       context
     )
-    expect(concealed.status).toBe(404)
+    expect(forbidden.status).toBe(403)
   })
 
   it('returns forbidden when the current workspace role cannot rename the file', async () => {

apps/sim/app/api/v2/files/[fileId]/route.ts

@@ -33,7 +33,7 @@ export const GET = defineV2BinaryRoute({
   auth: v2ApiKeyAuth,
   operation: fileOperations.download,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2FileErrorPolicies.concealResourceAuthorization,
+  errorPolicy: v2FileErrorPolicies.default,
   mapInput: ({ params, query }) => ({
     fileId: params.fileId,
     assertedWorkspaceId: query.workspaceId,
@@ -59,7 +59,7 @@ export const PATCH = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: fileOperations.rename,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2FileErrorPolicies.concealResourceAuthorization,
+  errorPolicy: v2FileErrorPolicies.default,
   mapInput: ({ params, body }) => ({
     fileId: params.fileId,
     assertedWorkspaceId: body.workspaceId,
@@ -81,7 +81,7 @@ export const DELETE = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: fileOperations.delete,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2FileErrorPolicies.concealResourceAuthorization,
+  errorPolicy: v2FileErrorPolicies.default,
   mapInput: ({ params, query }) => ({
     fileId: params.fileId,
     assertedWorkspaceId: query.workspaceId,

apps/sim/app/api/v2/files/[fileId]/share/route.ts

@@ -15,7 +15,7 @@ export const GET = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: fileOperations.readShare,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2FileErrorPolicies.concealResourceAuthorization,
+  errorPolicy: v2FileErrorPolicies.default,
   mapInput: ({ params, query }) => ({
     fileId: params.fileId,
     assertedWorkspaceId: query.workspaceId,
@@ -29,7 +29,7 @@ export const PUT = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: fileOperations.updateShare,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2FileErrorPolicies.concealResourceAuthorization,
+  errorPolicy: v2FileErrorPolicies.default,
   mapInput: ({ params, body }) => ({
     fileId: params.fileId,
     assertedWorkspaceId: body.workspaceId,

apps/sim/app/api/v2/files/uploads/utils.ts

@@ -39,17 +39,15 @@ function uploadStatus(status: string): V2UploadStatus {
 import type { Principal } from '@sim/auth/principal'
 import type { NextRequest, NextResponse } from 'next/server'
 import { authenticateV2ApiKey } from '@/lib/api/server/routes/v2-api-key-auth'
-import { v2CaughtOrchestrationError, v2Error } from '@/app/api/v2/lib/response'
+import { v2CaughtOrchestrationError } from '@/app/api/v2/lib/response'
 
 /** Re-authenticates the API key for each upload control leg. */
 export async function authenticateUploadPrincipal(request: NextRequest): Promise<Principal> {
   const auth = await authenticateV2ApiKey(request.headers.get('x-api-key'))
   return auth.principal
 }
 
-/** Resource-ID upload controls conceal authorization failures as absence. */
+/** Renders upload-control application failures without rewriting authorization status. */
 export function v2UploadControlError(error: unknown): NextResponse | null {
-  const response = v2CaughtOrchestrationError(error)
-  if (!response) return null
-  return response.status === 403 ? v2Error('NOT_FOUND', 'Upload session not found') : response
+  return v2CaughtOrchestrationError(error)
 }

apps/sim/app/api/v2/knowledge/[id]/documents/[documentId]/route.ts

@@ -33,7 +33,7 @@ export const GET = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: knowledgeOperations.readDocument,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2KnowledgeErrorPolicies.concealKnowledgeBaseAuthorization,
+  errorPolicy: v2KnowledgeErrorPolicies.default,
   mapInput: ({ params, query }) => ({
     knowledgeBaseId: params.id,
     documentId: params.documentId,

apps/sim/app/api/v2/knowledge/[id]/documents/route.ts

@@ -71,7 +71,7 @@ export const GET = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: knowledgeOperations.listDocuments,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2KnowledgeErrorPolicies.concealKnowledgeBaseAuthorization,
+  errorPolicy: v2KnowledgeErrorPolicies.default,
   mapInput: ({ params, query }) => {
     const decodedCursor = query.cursor ? decodeCursor<{ offset: number }>(query.cursor) : null
     if (