fix(api): refine resource authorization boundaries

Author: TheodoreSpeaks

apps/sim/app/api/v2/custom-tools/[id]/route.test.ts

@@ -3,6 +3,10 @@
  */
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  InsufficientWorkspacePermissionsError,
+  NoWorkspaceAccessError,
+} from '@/lib/core/application'
 
 const { mocks, MockV2ApiKeyUnauthenticatedError } = vi.hoisted(() => {
   class MockV2ApiKeyUnauthenticatedError extends Error {}
@@ -160,4 +164,15 @@ describe('/api/v2/custom-tools/[id]', () => {
     expect(response.status).toBe(401)
     expect(mocks.update).not.toHaveBeenCalled()
   })
+
+  it('conceals cross-tenant access while preserving same-workspace role denials', async () => {
+    mocks.get.mockRejectedValueOnce(new NoWorkspaceAccessError())
+    expect((await GET(request('GET'), context)).status).toBe(404)
+
+    mocks.update.mockRejectedValueOnce(new InsufficientWorkspacePermissionsError())
+    expect(
+      (await PATCH(request('PATCH', { workspaceId: WORKSPACE_ID, code: 'return 2' }), context))
+        .status
+    ).toBe(403)
+  })
 })

apps/sim/app/api/v2/custom-tools/[id]/route.ts

@@ -4,9 +4,9 @@ import {
   v2UpdateCustomToolContract,
 } from '@/lib/api/contracts/v2/custom-tools'
 import {
+  createV2ResourceConcealmentPolicy,
   defineV2JsonRoute,
   v2ApiKeyAuth,
-  v2OrchestrationErrorPolicy,
   v2RateLimits,
 } from '@/lib/api/server/routes'
 import { customToolOperations } from '@/lib/custom-tools/application/operations'
@@ -20,13 +20,17 @@ import { toV2CustomTool } from '@/app/api/v2/custom-tools/utils'
 export const dynamic = 'force-dynamic'
 export const revalidate = 0
 
+const customToolResourceErrorPolicy = createV2ResourceConcealmentPolicy({
+  notFoundMessage: 'Custom tool not found',
+})
+
 /** GET /api/v2/custom-tools/[id] — Fetch a single custom tool. */
 export const GET = defineV2JsonRoute({
   contract: v2GetCustomToolContract,
   operation: customToolOperations.read,
   auth: v2ApiKeyAuth,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2OrchestrationErrorPolicy,
+  errorPolicy: customToolResourceErrorPolicy,
   mapInput: ({ params, query }) => ({ workspaceId: query.workspaceId, toolId: params.id }),
   useCase: getWorkspaceCustomToolUseCase,
   present: ({ tool }) => ({ data: { customTool: toV2CustomTool(tool) } }),
@@ -38,7 +42,7 @@ export const PATCH = defineV2JsonRoute({
   operation: customToolOperations.update,
   auth: v2ApiKeyAuth,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2OrchestrationErrorPolicy,
+  errorPolicy: customToolResourceErrorPolicy,
   mapInput: ({ params, body }) => ({
     ...body,
     toolId: params.id,
@@ -54,7 +58,7 @@ export const DELETE = defineV2JsonRoute({
   operation: customToolOperations.delete,
   auth: v2ApiKeyAuth,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2OrchestrationErrorPolicy,
+  errorPolicy: customToolResourceErrorPolicy,
   mapInput: ({ params, query }) => ({
     workspaceId: query.workspaceId,
     toolId: params.id,

apps/sim/app/api/v2/files/[fileId]/content/route.test.ts

@@ -115,7 +115,7 @@ describe('PUT /api/v2/files/[fileId]/content', () => {
 
     const response = await callPut('{not-json')
 
-    expect(response.status).toBe(403)
+    expect(response.status).toBe(404)
     expect(mocks.admit).toHaveBeenCalledWith(auth.principal, FILE_ID)
     expect(mocks.updateContent).not.toHaveBeenCalled()
   })

apps/sim/app/api/v2/files/[fileId]/content/route.ts

@@ -19,7 +19,7 @@ export const PUT = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: fileOperations.updateContent,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2FileErrorPolicies.default,
+  errorPolicy: v2FileErrorPolicies.concealResourceAuthorization,
   parseOptions: {
     invalidJsonResponse: () => v2Error('BAD_REQUEST', 'Request body must be valid JSON'),
     maxBodyBytes: MAX_WORKSPACE_FILE_INLINE_BODY_BYTES,

apps/sim/app/api/v2/files/[fileId]/metadata/route.test.ts

@@ -113,13 +113,13 @@ describe('GET /api/v2/files/[fileId]/metadata', () => {
     expect(mocks.readMetadata).not.toHaveBeenCalled()
   })
 
-  it('returns forbidden for an authorization failure', async () => {
+  it('conceals cross-workspace authorization as not found', async () => {
     mocks.readMetadata.mockRejectedValue(new NoWorkspaceAccessError())
 
     const response = await callGet(`workspaceId=${WORKSPACE_ID}`)
 
-    expect(response.status).toBe(403)
-    expect((await response.json()).error.code).toBe('FORBIDDEN')
+    expect(response.status).toBe(404)
+    expect((await response.json()).error.code).toBe('NOT_FOUND')
   })
 
   it('returns the v2 metadata projection through the shared use case', async () => {

apps/sim/app/api/v2/files/[fileId]/metadata/route.ts

@@ -14,7 +14,7 @@ export const GET = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: fileOperations.readMetadata,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2FileErrorPolicies.default,
+  errorPolicy: v2FileErrorPolicies.concealResourceAuthorization,
   mapInput: ({ params, query }) => ({
     fileId: params.fileId,
     assertedWorkspaceId: query.workspaceId,

apps/sim/app/api/v2/files/[fileId]/route.test.ts

@@ -141,16 +141,16 @@ describe('v2 single-file routes', () => {
     })
   })
 
-  it('returns forbidden for download authorization failures', async () => {
+  it('conceals cross-workspace download authorization', async () => {
     mocks.download.mockRejectedValue(new NoWorkspaceAccessError())
 
     const response = await GET(
       new NextRequest(`http://localhost:3000/api/v2/files/${FILE_ID}?workspaceId=${WORKSPACE_ID}`),
       context
     )
 
-    expect(response.status).toBe(403)
-    expect((await response.json()).error.code).toBe('FORBIDDEN')
+    expect(response.status).toBe(404)
+    expect((await response.json()).error.code).toBe('NOT_FOUND')
   })
 
   it('renames through the shared use case and v2 presenter', async () => {
@@ -170,7 +170,7 @@ describe('v2 single-file routes', () => {
     })
   })
 
-  it('maps rename conflicts and returns forbidden for absent workspace access', async () => {
+  it('maps rename conflicts and conceals absent workspace access', async () => {
     mocks.rename.mockRejectedValueOnce(new OrchestrationError('conflict', 'Name exists'))
     const conflict = await PATCH(
       new NextRequest(`http://localhost:3000/api/v2/files/${FILE_ID}`, {
@@ -183,15 +183,15 @@ describe('v2 single-file routes', () => {
     expect(conflict.status).toBe(409)
 
     mocks.rename.mockRejectedValueOnce(new NoWorkspaceAccessError())
-    const forbidden = await PATCH(
+    const concealed = await PATCH(
       new NextRequest(`http://localhost:3000/api/v2/files/${FILE_ID}`, {
         method: 'PATCH',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ workspaceId: WORKSPACE_ID, name: 'renamed.csv' }),
       }),
       context
     )
-    expect(forbidden.status).toBe(403)
+    expect(concealed.status).toBe(404)
   })
 
   it('returns forbidden when the current workspace role cannot rename the file', async () => {

apps/sim/app/api/v2/files/[fileId]/route.ts

@@ -33,7 +33,7 @@ export const GET = defineV2BinaryRoute({
   auth: v2ApiKeyAuth,
   operation: fileOperations.download,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2FileErrorPolicies.default,
+  errorPolicy: v2FileErrorPolicies.concealResourceAuthorization,
   mapInput: ({ params, query }) => ({
     fileId: params.fileId,
     assertedWorkspaceId: query.workspaceId,
@@ -59,7 +59,7 @@ export const PATCH = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: fileOperations.rename,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2FileErrorPolicies.default,
+  errorPolicy: v2FileErrorPolicies.concealResourceAuthorization,
   mapInput: ({ params, body }) => ({
     fileId: params.fileId,
     assertedWorkspaceId: body.workspaceId,
@@ -81,7 +81,7 @@ export const DELETE = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: fileOperations.delete,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2FileErrorPolicies.default,
+  errorPolicy: v2FileErrorPolicies.concealResourceAuthorization,
   mapInput: ({ params, query }) => ({
     fileId: params.fileId,
     assertedWorkspaceId: query.workspaceId,

apps/sim/app/api/v2/files/[fileId]/share/route.ts

@@ -15,7 +15,7 @@ export const GET = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: fileOperations.readShare,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2FileErrorPolicies.default,
+  errorPolicy: v2FileErrorPolicies.concealResourceAuthorization,
   mapInput: ({ params, query }) => ({
     fileId: params.fileId,
     assertedWorkspaceId: query.workspaceId,
@@ -29,7 +29,7 @@ export const PUT = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: fileOperations.updateShare,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2FileErrorPolicies.default,
+  errorPolicy: v2FileErrorPolicies.concealResourceAuthorization,
   mapInput: ({ params, body }) => ({
     fileId: params.fileId,
     assertedWorkspaceId: body.workspaceId,

apps/sim/app/api/v2/files/uploads/utils.ts

@@ -38,16 +38,20 @@ function uploadStatus(status: string): V2UploadStatus {
 
 import type { Principal } from '@sim/auth/principal'
 import type { NextRequest, NextResponse } from 'next/server'
+import { createV2ResourceConcealmentPolicy } from '@/lib/api/server/routes'
 import { authenticateV2ApiKey } from '@/lib/api/server/routes/v2-api-key-auth'
-import { v2CaughtOrchestrationError } from '@/app/api/v2/lib/response'
+
+const uploadControlErrorPolicy = createV2ResourceConcealmentPolicy({
+  notFoundMessage: 'Upload session not found',
+})
 
 /** Re-authenticates the API key for each upload control leg. */
 export async function authenticateUploadPrincipal(request: NextRequest): Promise<Principal> {
   const auth = await authenticateV2ApiKey(request.headers.get('x-api-key'))
   return auth.principal
 }
 
-/** Renders upload-control application failures without rewriting authorization status. */
+/** Conceals cross-tenant upload-session authorization while preserving same-workspace denials. */
 export function v2UploadControlError(error: unknown): NextResponse | null {
-  return v2CaughtOrchestrationError(error)
+  return uploadControlErrorPolicy.render(error)
 }