fix(workflows): lint only the JSON fields the operation sends, and lint deploys as the acting user

Author: waleedlatif1

apps/sim/lib/workflows/application/deployments.ts

@@ -1,5 +1,9 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
-import { resolvePrincipalAttribution, toPrincipalActor } from '@sim/auth/principal'
+import {
+  resolvePrincipalAttribution,
+  resolvePrincipalSubjectUserId,
+  toPrincipalActor,
+} from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import { assertWorkflowMutable, WorkflowLockedError } from '@sim/platform-authz/workflow'
 import { getErrorMessage } from '@sim/utils/errors'
@@ -108,7 +112,7 @@ async function requireMutableWorkflow(workflowId: string): Promise<void> {
 async function deployedVersionLintWarning(
   context: ActiveWorkflowApplicationContext,
   deploymentVersionId: string | undefined,
-  subjectUserId: string
+  subjectUserId: string | null
 ): Promise<string | undefined> {
   if (!deploymentVersionId) return undefined
   try {
@@ -156,7 +160,7 @@ export const deployWorkflow = defineAuthorizedWorkflowUseCase({
     const lintWarning = await deployedVersionLintWarning(
       context,
       result.deploymentVersionId,
-      attribution.attributedUserId
+      resolvePrincipalSubjectUserId(principal) ?? null
     )
     return {
       ...result,

apps/sim/lib/workflows/application/workflow-deployments.test.ts

@@ -341,7 +341,7 @@ describe('workflow deployment application use cases', () => {
       ],
     }
 
-    it('reports them as a deploy warning, linted as the deploying user', async () => {
+    it('reports them as a deploy warning, linted as the acting user', async () => {
       mockDeploy.mockResolvedValueOnce({
         success: true,
         version: 4,
@@ -350,17 +350,16 @@ describe('workflow deployment application use cases', () => {
           'Deployment activation completed, and post-activation notifications are queued.',
         ],
       })
-      mocks.buildWorkflowLintReport.mockResolvedValueOnce(unquotedRowJson)
+      mocks.buildWorkflowLintReport.mockImplementation(
+        async (_graph: unknown, scope: { subjectUserId: string | null }) =>
+          scope.subjectUserId === 'session-user' ? unquotedRowJson : cleanLint
+      )
 
       const result = await deployWorkflow.execute({
         principal: createSessionPrincipal({ userId: 'session-user' }),
         input: { workflowId: 'workflow-1', requestId: 'request-10' },
       })
 
-      expect(mocks.buildWorkflowLintReport).toHaveBeenCalledWith(
-        { blocks: {}, edges: [] },
-        expect.objectContaining({ workflowId: 'workflow-1', subjectUserId: 'session-user' })
-      )
       expect(result.warnings).toHaveLength(2)
       expect(result.warnings?.[1]).toContain('"Insert Order".data <start.order_id>')
     })

apps/sim/lib/workflows/editing/json-literal-refs.test.ts

@@ -31,7 +31,12 @@ const MOCK_BLOCKS = vi.hoisted(
         category: 'blocks',
         subBlocks: [
           { id: 'operation', type: 'dropdown' },
-          { id: 'data', type: 'code', language: 'json' },
+          {
+            id: 'data',
+            type: 'code',
+            language: 'json',
+            condition: { field: 'operation', value: ['insert_row', 'update_row'] },
+          },
           { id: 'rows', type: 'code', language: 'json' },
         ],
         outputs: {},
@@ -87,8 +92,12 @@ function graph(
   return { blocks } as Parameters<typeof collectUnquotedJsonStringReferences>[0]
 }
 
-function insertRow(data: unknown) {
-  return { type: 'table_v2', name: 'Insert Order', subBlocks: { data: { value: data } } }
+function insertRow(data: unknown, operation = 'insert_row') {
+  return {
+    type: 'table_v2',
+    name: 'Insert Order',
+    subBlocks: { operation: { value: operation }, data: { value: data } },
+  }
 }
 
 describe('collectUnquotedJsonStringReferences', () => {
@@ -196,4 +205,14 @@ describe('collectUnquotedJsonStringReferences', () => {
     )
     expect(findings).toHaveLength(0)
   })
+
+  it('ignores a JSON field the selected operation does not send', () => {
+    const findings = collectUnquotedJsonStringReferences(
+      graph({
+        start: START,
+        insert: insertRow('{"order_id": <start.order_id>}', 'get_schema'),
+      })
+    )
+    expect(findings).toHaveLength(0)
+  })
 })

apps/sim/lib/workflows/editing/lint.ts

@@ -798,8 +798,16 @@ export function collectUnquotedJsonStringReferences(
     const jsonFields = (block.type ? getBlock(block.type)?.subBlocks : undefined)?.filter(
       (subBlock) => subBlock.type === 'code' && subBlock.language === 'json'
     )
-    for (const { id: field } of jsonFields ?? []) {
-      const json = block.subBlocks?.[field]?.value
+    if (!jsonFields?.length) continue
+    /** Only what the serializer sends: a field the selected operation drops never runs. */
+    let params: Record<string, unknown>
+    try {
+      params = extractBlockParams(block as Parameters<typeof extractBlockParams>[0])
+    } catch {
+      continue
+    }
+    for (const field of new Set(jsonFields.map((subBlock) => subBlock.id))) {
+      const json = params[field]
       if (typeof json !== 'string') continue
       const unquoted = new Set<string>()
       for (const token of unquotedJsonReferenceTokens(json)) {