improvement(perf): drop a duplicate authorization, parallelize the credential reads, and trim the comments

Author: waleedlatif1

apps/sim/app/api/copilot/checkpoints/revert/route.ts

@@ -140,6 +140,8 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       workflowId: checkpoint.workflowId,
       userId,
       state: parsedState.data,
+      /** Already resolved above; re-deriving it would repeat 2-3 sequential reads. */
+      authorization,
     })
 
     if (!saveResult.success) {

apps/sim/app/api/workflows/[id]/state/route.ts

@@ -1,10 +1,7 @@
 import { db } from '@sim/db'
 import { workflow } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import {
-  authorizeWorkflowByWorkspacePermission,
-  WorkflowLockedError,
-} from '@sim/platform-authz/workflow'
+import { authorizeWorkflowByWorkspacePermission } from '@sim/platform-authz/workflow'
 import { toError } from '@sim/utils/errors'
 import { eq, sql } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
@@ -132,10 +129,6 @@ export const PUT = withRouteHandler(
 
       return NextResponse.json({ success: true, warnings: result.warnings }, { status: 200 })
     } catch (error: any) {
-      if (error instanceof WorkflowLockedError) {
-        return NextResponse.json({ error: error.message }, { status: error.status })
-      }
-
       const elapsed = Date.now() - startTime
       logger.error(
         `[${requestId}] Error saving workflow ${workflowId} state after ${elapsed}ms`,

apps/sim/app/workspace/[workspaceId]/prefetch.ts

@@ -93,38 +93,22 @@ async function seedWorkspaceList(
 }
 
 /**
- * How many files the layout is willing to inline into the document.
+ * How many files the layout is willing to inline into the document. Seeded on EVERY
+ * workspace route, so at ~500 bytes of JSON per file this budgets the entry at ~150 KB.
  *
- * The file list is seeded on EVERY workspace route (see the call site), so its cost is
- * paid per navigation into the app, not per visit to Files. At roughly 500 bytes of
- * serialized JSON per file, this budgets the entry at ~150 KB; a workspace with
- * thousands of files would otherwise push more than a megabyte of HTML ahead of first
- * paint on the logs, settings, and editor routes that never read it.
- *
- * A workspace above the budget seeds NOTHING rather than a prefix: the sidebar search
- * filters this list client-side and the Files browser renders it as the workspace's
- * files, so a truncated seed would silently hide files. Those workspaces fetch the
- * complete list from the route instead — which for a list that large is also the
- * cheaper first paint.
+ * A workspace above the budget seeds NOTHING rather than a prefix: the sidebar filters
+ * this list client-side, so a truncated seed would silently hide files.
  */
 export const WORKSPACE_FILE_SEED_MAX = 300
 
 /**
- * Seeds the workspace's file list, which the sidebar's search modal reads on EVERY
- * workspace route — so this query is registered by sidebar chrome before any page
- * renders. That ordering is why it has to be seeded HERE and not only by the Files
- * pages: `HydrationBoundary` hydrates a query the cache has already seen from a
- * `useEffect`, which never runs during SSR, so a page-level boundary can only ever hand
- * this entry to the client. Seeding it with the layout's own boundary — the first one to
- * render — is what lets the server paint the Files browser and the open file's header
- * populated instead of shipping a spinner and resolving it a beat later on the client.
- *
- * Seeded rather than prefetched so it can decline to create an entry at all when the
- * workspace exceeds {@link WORKSPACE_FILE_SEED_MAX}: `prefetchQuery` always creates one,
- * and a partial one would be read as the whole list.
+ * Seeds the workspace's file list, which sidebar chrome registers on EVERY workspace
+ * route. It must be seeded HERE, not by the Files pages: `HydrationBoundary` defers a
+ * query the cache has already seen to a `useEffect`, which SSR never runs.
  *
- * Parsed through the same response contract `GET /api/workspaces/[id]/files` validates
- * against, so a seeded entry is identical to what the client hook would cache.
+ * Seeded rather than prefetched so it can decline to create an entry at all above
+ * {@link WORKSPACE_FILE_SEED_MAX} — `prefetchQuery` always creates one, and a partial
+ * entry would be read as the whole list. Parsed through the route's response contract.
  */
 async function seedWorkspaceFiles(queryClient: QueryClient, workspaceId: string): Promise<void> {
   try {

apps/sim/executor/utils/provider-request.ts

@@ -11,32 +11,17 @@ interface ExecuteBlockProviderRequestInput {
   ctx: ExecutionContext
   providerId: string
   request: ProviderRequest
-  /**
-   * The fork the block's model input was projected through. Supplied to the
-   * provider runtime in place of the provenance envelope the HTTP boundary used
-   * to serialize and re-import.
-   */
+  /** Supplied in place of the provenance envelope the HTTP boundary serialized and re-imported. */
   resolvedSecretTraceRegistry: ResolvedSecretTraceRegistry | undefined
 }
 
 /**
- * Runs one non-streaming provider request for a block handler in-process.
- *
- * Replaces the executor's `POST /api/providers` round trip, which re-derived
- * everything it needed from claims the executor had itself just supplied. The
- * two admission checks the route owned are reproduced here so the outcome is
- * unchanged:
- *
- * - `checkInternalAuth` rejected a token carrying no user. The executor mints
- *   that token from `ctx.userId`, so the check reduces to requiring one.
- * - `checkWorkspaceAccess` rejected an execution subject who is no longer a
- *   member of the workspace being billed.
- *
- * The route's remaining work is either already done by the caller (the model
- * permission policy, via `validateModelProvider`; Vertex credential
- * authorization, via `resolveVertexCredential`) or lives inside
- * `executeProviderRequest` itself (BYOK key resolution, attachment provenance
- * filtering, cost policy).
+ * Runs one non-streaming provider request for a block handler in-process, replacing the
+ * executor's `POST /api/providers` round trip. The route's two admission checks are
+ * reproduced so the outcome is unchanged: an internal token with no user is rejected (the
+ * executor mints it from `ctx.userId`), and an execution subject who has left the billed
+ * workspace is rejected. The route's remaining work is already done by the caller or lives
+ * inside `executeProviderRequest`.
  */
 export async function executeBlockProviderRequest({
   ctx,
@@ -56,16 +41,10 @@ export async function executeBlockProviderRequest({
   }
 
   /**
-   * `executionContext` is deliberately not supplied: it is only inherited by
-   * model-emitted tool calls, and the route this replaces never carried one.
-   * Router and evaluator requests declare no tools, so passing the executor's
-   * context here would widen the trusted surface without changing any outcome.
-   *
-   * The whole runtime context is omitted when there is no registry, rather than
-   * passed carrying `undefined`. `executeProviderTool` reads a present context with
-   * an absent registry as "provenance was expected and is missing" and fails the
-   * call closed with no error text — unreachable while these blocks declare no
-   * tools, but a silent failure the day one does.
+   * No `executionContext`: it is only inherited by model-emitted tool calls, and the route
+   * this replaces never carried one. The whole context is omitted when there is no registry
+   * rather than passed carrying `undefined` — `executeProviderTool` reads that as missing
+   * provenance and fails the call closed with no error text.
    */
   const response = await executeProviderRequest(
     providerId,

apps/sim/hooks/queries/schedules.ts

@@ -249,10 +249,7 @@ export function useRedeployWorkflowSchedule() {
       const { workflowId, blockId } = data
       await Promise.all([
         queryClient.invalidateQueries({ queryKey: scheduleKeys.schedule(workflowId, blockId) }),
-        /**
-         * A redeploy recreates the schedule, so the id-keyed reads go stale too. They are
-         * a separate subtree from `schedule(workflowId, blockId)`, which does not cover them.
-         */
+        /** A redeploy recreates the schedule; the id-keyed reads are a separate subtree. */
         queryClient.invalidateQueries({ queryKey: scheduleKeys.byIds() }),
         queryClient.invalidateQueries({ queryKey: deploymentKeys.info(workflowId) }),
         queryClient.invalidateQueries({ queryKey: deploymentKeys.versions(workflowId) }),

apps/sim/hooks/queries/tables.ts

@@ -837,10 +837,6 @@ function withOptimisticAutoFireExec(groups: WorkflowGroup[], row: TableRow): Tab
  * shared parent, and handing this updater a `find` entry — a flat
  * {@link TableFindResult}, not pages — throws on `old.pages` inside `onMutate`, so
  * the whole cell edit would reject before reaching the server.
- *
- * A consequence worth knowing: an open search-results view is therefore left to its
- * own refetch rather than patched here, since it holds a different shape. Patching
- * it too would need its own updater keyed on {@link tableKeys.find}.
  */
 function patchCachedRows(
   queryClient: ReturnType<typeof useQueryClient>,

apps/sim/hooks/queries/utils/invalidate-usage.ts

@@ -9,10 +9,9 @@ import { workspaceUsageKeys } from '@/hooks/queries/utils/workspace-usage-keys'
 const USAGE_SETTLE_DELAY_MS = 1000
 
 /**
- * Invalidates the workspace credit/usage reads after anything that moves the balance —
- * a run that spends credits, a top-up, a plan change, or a usage-limit edit. Both
- * families are keyed per workspace but derive from the same billing account, so the
- * family prefixes (not a single workspace's key) are what has to be refetched.
+ * Invalidates the workspace credit/usage reads after anything that moves the balance.
+ * Both families are keyed per workspace but derive from one billing account, so the
+ * family prefixes are what must refetch.
  */
 export function invalidateWorkspaceUsage(queryClient: QueryClient) {
   return Promise.all([
@@ -23,9 +22,7 @@ export function invalidateWorkspaceUsage(queryClient: QueryClient) {
 
 /**
  * Refreshes the billing reads a run touches, after {@link USAGE_SETTLE_DELAY_MS}.
- *
- * Shared by the surfaces that spend credits — workflow execution and wand generation —
- * so the delay and the key set stay in one place.
+ * Shared by workflow execution and wand generation.
  */
 export function scheduleUsageRefresh(queryClient: QueryClient) {
   setTimeout(() => {

apps/sim/hooks/queries/utils/subscription-keys.ts

@@ -1,9 +1,6 @@
 /**
- * React Query key factory for subscription and billing reads.
- *
- * Lives in this standalone module — like {@link file://./workspace-usage-keys.ts} — so
- * the shared billing invalidations can reference it without importing the hook module
- * that consumes those invalidations, which would close an import cycle between the two.
+ * React Query key factory for subscription and billing reads. Standalone so the shared
+ * billing invalidations can use it without closing an import cycle through the hook module.
  */
 export const subscriptionKeys = {
   all: ['subscription'] as const,

apps/sim/hooks/queries/utils/table-keys.ts

@@ -26,12 +26,9 @@ export const tableKeys = {
     [...tableKeys.all, 'export-jobs', workspaceId ?? ''] as const,
   rowsRoot: (tableId: string) => [...tableKeys.detail(tableId), 'rows'] as const,
   /**
-   * Prefix covering only the paged row lists.
-   *
-   * `rowsRoot` is a shared parent — `find` hangs off it holding an entirely different
-   * shape — so anything walking the cache to update or snapshot row pages must start
-   * here instead. Reaching for `rowsRoot` and subtracting the siblings is a denylist
-   * that rots the moment another subtree is added.
+   * Prefix covering only the paged row lists. `rowsRoot` is a shared parent — `find`
+   * hangs off it holding a different shape — so anything walking the cache for row
+   * pages must start here.
    */
   infiniteRowsRoot: (tableId: string) => [...tableKeys.rowsRoot(tableId), 'infinite'] as const,
   infiniteRows: (tableId: string, paramsKey: string) =>

apps/sim/hooks/queries/utils/workspace-usage-keys.ts

@@ -1,8 +1,6 @@
 /**
- * React Query key factory for the per-workspace credit and usage-gate reads.
- *
- * Standalone for the same reason as {@link file://./subscription-keys.ts}: the shared
- * billing invalidations need these keys without importing the hooks that call them.
+ * React Query key factory for the per-workspace credit and usage-gate reads. Standalone
+ * for the same import-cycle reason as {@link file://./subscription-keys.ts}.
  */
 export const workspaceUsageKeys = {
   all: ['workspace-usage'] as const,