fix(data-retention): reject enabled stage with no entity types; empty = off everywhere

Author: TheodoreSpeaks

apps/sim/lib/api/contracts/data-retention.test.ts

@@ -106,6 +106,32 @@ describe('piiRedactionRuleSchema', () => {
     expect(result.success).toBe(false)
   })
 
+  it('rejects an enabled stage with no entity types (redact-all is not expressible)', () => {
+    const result = piiRedactionRuleSchema.safeParse({
+      id: 'r-1',
+      workspaceId: null,
+      stages: {
+        input: stage(true, []),
+        blockOutputs: stage(false, []),
+        logs: stage(false, []),
+      },
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('accepts a disabled stage with no entity types (off)', () => {
+    const result = piiRedactionRuleSchema.safeParse({
+      id: 'r-1',
+      workspaceId: null,
+      stages: {
+        input: stage(false, []),
+        blockOutputs: stage(false, []),
+        logs: stage(true, ['PERSON']),
+      },
+    })
+    expect(result.success).toBe(true)
+  })
+
   it('rejects an unsupported stage language', () => {
     const result = piiRedactionRuleSchema.safeParse({
       id: 'r-1',

apps/sim/lib/api/contracts/primitives.ts

@@ -113,14 +113,24 @@ export const userFileSchema = z
   })
   .passthrough()
 
-/** Per-stage redaction policy: which entity types to mask, in which language. */
-export const piiStagePolicySchema = z.object({
-  enabled: z.boolean(),
-  /** Presidio entity types to mask. Empty (or disabled) = redact nothing. */
-  entityTypes: z.array(z.string().min(1, 'Entity type cannot be empty')).max(100),
-  /** Language whose Presidio recognizers apply; defaults to English. */
-  language: z.enum(PII_LANGUAGE_CODES).optional(),
-})
+/**
+ * Per-stage redaction policy: which entity types to mask, in which language. An
+ * enabled stage must name at least one entity type — "redact all" is not an
+ * expressible policy, so `enabled: true` with an empty list (which would resolve
+ * to off and silently skip masking) is rejected at the boundary.
+ */
+export const piiStagePolicySchema = z
+  .object({
+    enabled: z.boolean(),
+    /** Presidio entity types to mask. Disabled stages may be empty. */
+    entityTypes: z.array(z.string().min(1, 'Entity type cannot be empty')).max(100),
+    /** Language whose Presidio recognizers apply; defaults to English. */
+    language: z.enum(PII_LANGUAGE_CODES).optional(),
+  })
+  .refine((stage) => !stage.enabled || stage.entityTypes.length > 0, {
+    message: 'An enabled redaction stage must select at least one entity type.',
+    path: ['entityTypes'],
+  })
 
 export type PiiStagePolicy = z.output<typeof piiStagePolicySchema>
 

apps/sim/lib/billing/retention.test.ts

@@ -108,7 +108,7 @@ describe('resolveEffectivePiiRedaction', () => {
       })
     })
 
-    it('keeps an enabled stage active (redact all) when it has no entity types, and disables a disabled stage', () => {
+    it('disables a stage that is enabled but has no entity types (empty = off)', () => {
       const result = resolveEffectivePiiRedaction({
         orgSettings: settings([
           {
@@ -123,9 +123,7 @@ describe('resolveEffectivePiiRedaction', () => {
         ]),
         workspaceId: 'ws-1',
       })
-      // enabled + empty entityTypes = redact ALL detected PII (not disabled).
-      expect(result.input).toEqual({ enabled: true, entityTypes: [], language: 'en' })
-      // disabled stage stays off regardless of its entity types.
+      expect(result.input).toEqual(DISABLED)
       expect(result.blockOutputs).toEqual(DISABLED)
       expect(result.logs).toEqual({ enabled: true, entityTypes: ['PERSON'], language: 'en' })
     })

apps/sim/lib/billing/retention.ts

@@ -38,17 +38,18 @@ function sanitizeEntityTypes(value: unknown): string[] {
 }
 
 /**
- * Expand a stored stage policy into its effective form. A disabled stage redacts
- * nothing. An ENABLED stage with no entity types redacts ALL detected PII — the
- * masking layer omits `entities` from the Presidio request — so it stays active;
- * treating enabled-but-empty as disabled would let an explicit "redact all" save
- * silently skip masking (fail-open).
+ * Expand a stored stage policy into its effective form. A stage redacts nothing
+ * unless it is enabled AND names at least one entity type. "Redact all" is not an
+ * expressible policy (the checkbox UI has no such control, and the contract
+ * rejects enabled-with-no-types), so an empty entity list always means "off" —
+ * consistent across the UI, the contract, and the masking layer.
  */
 function toEffectiveStage(policy: PiiStagePolicy | undefined): EffectivePiiStage {
-  if (!policy?.enabled) return DISABLED_STAGE
+  const types = sanitizeEntityTypes(policy?.entityTypes)
+  if (!policy?.enabled || types.length === 0) return DISABLED_STAGE
   return {
     enabled: true,
-    entityTypes: sanitizeEntityTypes(policy.entityTypes),
+    entityTypes: types,
     language: coercePiiLanguage(policy.language) ?? DEFAULT_PII_LANGUAGE,
   }
 }
@@ -60,10 +61,9 @@ function toEffectiveStage(policy: PiiStagePolicy | undefined): EffectivePiiStage
  * selection is whole-rule; the selected rule is then expanded into three stages.
  *
  * Back-compat: a legacy rule with no `stages` is treated exactly as it was before
- * — logs-only, masking its flat `entityTypes` (input/blockOutputs disabled); an
- * empty flat `entityTypes` redacts nothing (the workspace-exemption shape). For
- * per-stage rules an enabled stage with no entity types redacts ALL detected PII
- * (see {@link toEffectiveStage}). Defensive about the loosely-typed JSON column.
+ * — logs-only, masking its flat `entityTypes` (input/blockOutputs disabled). A
+ * resolved stage with no entity types redacts nothing (an empty list is the
+ * workspace-exemption / off shape). Defensive about the loosely-typed JSON column.
  */
 export function resolveEffectivePiiRedaction(params: {
   orgSettings: DataRetentionSettings | null | undefined