fix(api): conceal cross-tenant resource denials on internal routes

The v2 routes rewrite DelegatedWorkspaceAuthorizationError,
NoWorkspaceAccessError, and WorkspaceApiKeyScopeAuthorizationError to a
404 so a caller with no reach into a workspace cannot confirm a
resource exists. The internal routes reach the same application use
cases and still answered 403, so the same probe worked from the other
surface. Same-workspace role denials stay 403 on both.

Author: waleedlatif1

apps/sim/app/api/table/[tableId]/exports/route.ts

@@ -1,10 +1,6 @@
 import { createTableExportResourceContract } from '@/lib/api/contracts/table-transfers'
-import {
-  defineInternalJsonRoute,
-  internalPlainOrchestrationErrorPolicy,
-  internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import { createTableExportUseCase } from '@/lib/table/application/exports'
 import { tableOperations } from '@/lib/table/application/operations'
 import { toV2TableExport } from '@/lib/table/orchestration/export-resource'
@@ -16,7 +12,7 @@ export const POST = defineInternalJsonRoute({
   rateLimit: internalRateLimits.none({
     reason: 'Existing authenticated table export creation has no request-rate policy',
   }),
-  errorPolicy: internalPlainOrchestrationErrorPolicy,
+  errorPolicy: internalTableErrorPolicies.concealTableAuthorization,
   mapInput: ({ params, body }) => ({
     tableId: params.tableId,
     workspaceId: body.workspaceId,

apps/sim/app/api/table/[tableId]/groups/route.test.ts

@@ -6,6 +6,7 @@ import { describe, expect, it, vi } from 'vitest'
 interface CapturedDefinition {
   contract: { method: string; path: string }
   auth: unknown
+  errorPolicy: unknown
   operation: { id: string }
   useCase: unknown
   mapInput(input: {
@@ -21,6 +22,7 @@ interface CapturedDefinition {
 
 const mocks = vi.hoisted(() => ({
   auth: { kind: 'session-or-executor' },
+  concealTableGroupAuthorization: { kind: 'conceal-table-group' },
   definitions: [] as CapturedDefinition[],
   useCases: {
     create: { operation: { id: 'tables.groups.create' } },
@@ -34,15 +36,17 @@ vi.mock('@/lib/api/server/routes', () => ({
     mocks.definitions.push(definition)
     return vi.fn()
   },
-  extendInternalErrorPolicy: vi.fn(() => ({ kind: 'table' })),
-  internalErrorResponse: vi.fn(),
-  internalPlainOrchestrationErrorPolicy: { kind: 'plain' },
   internalRateLimits: {
     none: ({ reason }: { reason: string }) => ({ kind: 'none', reason }),
   },
 }))
 
-vi.mock('@/lib/table/api', () => ({ internalTableSessionOrExecutorAuth: mocks.auth }))
+vi.mock('@/lib/table/api', () => ({
+  internalTableErrorPolicies: {
+    concealTableGroupAuthorization: mocks.concealTableGroupAuthorization,
+  },
+  internalTableSessionOrExecutorAuth: mocks.auth,
+}))
 
 vi.mock('@/lib/table/application/groups', () => ({
   createTableGroupUseCase: mocks.useCases.create,
@@ -77,6 +81,7 @@ describe('/api/table/[tableId]/groups', () => {
       expect(route.auth).toBe(mocks.auth)
       expect(route.useCase).toBe(useCase)
       expect(route.operation.id).toBe(useCase.operation.id)
+      expect(route.errorPolicy).toBe(mocks.concealTableGroupAuthorization)
     }
   })
 

apps/sim/app/api/table/[tableId]/groups/route.ts

@@ -3,30 +3,17 @@ import {
   deleteWorkflowGroupContract,
   updateWorkflowGroupContract,
 } from '@/lib/api/contracts/tables'
-import {
-  defineInternalJsonRoute,
-  extendInternalErrorPolicy,
-  internalErrorResponse,
-  internalPlainOrchestrationErrorPolicy,
-  internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import {
   createTableGroupUseCase,
   deleteTableGroupUseCase,
   updateTableGroupUseCase,
 } from '@/lib/table/application/groups'
 import { tableOperations } from '@/lib/table/application/operations'
-import { TableLockedError } from '@/lib/table/mutation-locks'
 import type { TableDefinition } from '@/lib/table/types'
 import { normalizeColumn } from '@/app/api/table/utils'
 
-const errorPolicy = extendInternalErrorPolicy(internalPlainOrchestrationErrorPolicy, (error) =>
-  error instanceof TableLockedError
-    ? internalErrorResponse(423, { error: error.message, lock: error.lock })
-    : null
-)
-
 const rateLimit = internalRateLimits.none({
   reason: 'Existing authenticated table group mutations have no request-rate policy',
 })
@@ -47,7 +34,7 @@ export const POST = defineInternalJsonRoute({
   useCase: createTableGroupUseCase,
   auth: internalTableSessionOrExecutorAuth,
   rateLimit,
-  errorPolicy,
+  errorPolicy: internalTableErrorPolicies.concealTableGroupAuthorization,
   mapInput: ({ params, body }) => ({
     tableId: params.tableId,
     ...body,
@@ -62,7 +49,7 @@ export const PATCH = defineInternalJsonRoute({
   useCase: updateTableGroupUseCase,
   auth: internalTableSessionOrExecutorAuth,
   rateLimit,
-  errorPolicy,
+  errorPolicy: internalTableErrorPolicies.concealTableGroupAuthorization,
   mapInput: ({ params, body }) => ({ tableId: params.tableId, ...body }),
   present: ({ table }) => presentTable(table),
 })
@@ -73,7 +60,7 @@ export const DELETE = defineInternalJsonRoute({
   useCase: deleteTableGroupUseCase,
   auth: internalTableSessionOrExecutorAuth,
   rateLimit,
-  errorPolicy,
+  errorPolicy: internalTableErrorPolicies.concealTableGroupAuthorization,
   mapInput: ({ params, body }) => ({ tableId: params.tableId, ...body }),
   present: ({ table }) => presentTable(table),
 })

apps/sim/app/api/table/exports/[exportId]/download/route.ts

@@ -1,10 +1,6 @@
 import { downloadTableExportResourceContract } from '@/lib/api/contracts/table-transfers'
-import {
-  defineInternalJsonRoute,
-  internalPlainOrchestrationErrorPolicy,
-  internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import { downloadTableExportUseCase } from '@/lib/table/application/exports'
 import { tableOperations } from '@/lib/table/application/operations'
 
@@ -15,7 +11,7 @@ export const GET = defineInternalJsonRoute({
   rateLimit: internalRateLimits.none({
     reason: 'Existing authenticated table export download signing has no request-rate policy',
   }),
-  errorPolicy: internalPlainOrchestrationErrorPolicy,
+  errorPolicy: internalTableErrorPolicies.concealExportAuthorization,
   mapInput: ({ params, query }) => ({
     exportId: params.exportId,
     workspaceId: query.workspaceId,

apps/sim/app/api/table/exports/[exportId]/route.ts

@@ -2,12 +2,8 @@ import {
   cancelTableExportResourceContract,
   getTableExportResourceContract,
 } from '@/lib/api/contracts/table-transfers'
-import {
-  defineInternalJsonRoute,
-  internalPlainOrchestrationErrorPolicy,
-  internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import { cancelTableExportUseCase, readTableExportUseCase } from '@/lib/table/application/exports'
 import { tableOperations } from '@/lib/table/application/operations'
 import { toV2TableExport } from '@/lib/table/orchestration/export-resource'
@@ -21,7 +17,7 @@ export const GET = defineInternalJsonRoute({
   auth: internalTableSessionOrExecutorAuth,
   operation: tableOperations.readExport,
   rateLimit,
-  errorPolicy: internalPlainOrchestrationErrorPolicy,
+  errorPolicy: internalTableErrorPolicies.concealExportAuthorization,
   mapInput: ({ params, query }) => ({
     exportId: params.exportId,
     workspaceId: query.workspaceId,
@@ -35,7 +31,7 @@ export const DELETE = defineInternalJsonRoute({
   auth: internalTableSessionOrExecutorAuth,
   operation: tableOperations.cancelExport,
   rateLimit,
-  errorPolicy: internalPlainOrchestrationErrorPolicy,
+  errorPolicy: internalTableErrorPolicies.concealExportAuthorization,
   mapInput: ({ params, query }) => ({
     exportId: params.exportId,
     workspaceId: query.workspaceId,

apps/sim/app/api/table/imports/[importId]/complete/route.ts

@@ -1,10 +1,6 @@
 import { completeTableImportResourceContract } from '@/lib/api/contracts/table-transfers'
-import {
-  defineInternalJsonRoute,
-  internalPlainOrchestrationErrorPolicy,
-  internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import { completeTableImportUseCase } from '@/lib/table/application/imports'
 import { tableOperations } from '@/lib/table/application/operations'
 import { toV2TableImport } from '@/lib/table/orchestration/import-resource'
@@ -16,7 +12,7 @@ export const POST = defineInternalJsonRoute({
   rateLimit: internalRateLimits.none({
     reason: 'Existing authenticated table import completion has no request-rate policy',
   }),
-  errorPolicy: internalPlainOrchestrationErrorPolicy,
+  errorPolicy: internalTableErrorPolicies.concealImportAuthorization,
   mapInput: ({ params, query, headers }) => ({
     importId: params.importId,
     workspaceId: query.workspaceId,

apps/sim/app/api/table/imports/[importId]/parts/route.ts

@@ -1,10 +1,6 @@
 import { createTableImportPartUrlsContract } from '@/lib/api/contracts/table-transfers'
-import {
-  defineInternalJsonRoute,
-  internalPlainOrchestrationErrorPolicy,
-  internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import { createTableImportPartsUseCase } from '@/lib/table/application/imports'
 import { tableOperations } from '@/lib/table/application/operations'
 
@@ -15,7 +11,7 @@ export const POST = defineInternalJsonRoute({
   rateLimit: internalRateLimits.none({
     reason: 'Existing authenticated table import part signing has no request-rate policy',
   }),
-  errorPolicy: internalPlainOrchestrationErrorPolicy,
+  errorPolicy: internalTableErrorPolicies.concealImportAuthorization,
   mapInput: ({ params, query, headers, body }) => ({
     importId: params.importId,
     workspaceId: query.workspaceId,

apps/sim/app/api/table/imports/[importId]/route.ts

@@ -2,12 +2,8 @@ import {
   cancelTableImportResourceContract,
   getTableImportResourceContract,
 } from '@/lib/api/contracts/table-transfers'
-import {
-  defineInternalJsonRoute,
-  internalPlainOrchestrationErrorPolicy,
-  internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import { cancelTableImportUseCase, readTableImportUseCase } from '@/lib/table/application/imports'
 import { tableOperations } from '@/lib/table/application/operations'
 import { toV2TableImport } from '@/lib/table/orchestration/import-resource'
@@ -21,7 +17,7 @@ export const GET = defineInternalJsonRoute({
   auth: internalTableSessionOrExecutorAuth,
   operation: tableOperations.readImport,
   rateLimit,
-  errorPolicy: internalPlainOrchestrationErrorPolicy,
+  errorPolicy: internalTableErrorPolicies.concealImportAuthorization,
   mapInput: ({ params, query }) => ({
     importId: params.importId,
     workspaceId: query.workspaceId,
@@ -35,7 +31,7 @@ export const DELETE = defineInternalJsonRoute({
   auth: internalTableSessionOrExecutorAuth,
   operation: tableOperations.cancelImport,
   rateLimit,
-  errorPolicy: internalPlainOrchestrationErrorPolicy,
+  errorPolicy: internalTableErrorPolicies.concealImportAuthorization,
   mapInput: ({ params, query, headers }) => ({
     importId: params.importId,
     workspaceId: query.workspaceId,

apps/sim/app/api/table/imports/route.ts

@@ -1,10 +1,6 @@
 import { createTableImportResourceContract } from '@/lib/api/contracts/table-transfers'
-import {
-  defineInternalJsonRoute,
-  internalPlainOrchestrationErrorPolicy,
-  internalRateLimits,
-} from '@/lib/api/server/routes'
-import { internalTableSessionOrExecutorAuth } from '@/lib/table/api'
+import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import { internalTableErrorPolicies, internalTableSessionOrExecutorAuth } from '@/lib/table/api'
 import { createTableImportUseCase } from '@/lib/table/application/imports'
 import { tableOperations } from '@/lib/table/application/operations'
 import { toV2CreateTableImport } from '@/lib/table/orchestration/import-resource'
@@ -16,7 +12,7 @@ export const POST = defineInternalJsonRoute({
   rateLimit: internalRateLimits.none({
     reason: 'Existing authenticated table import creation has no request-rate policy',
   }),
-  errorPolicy: internalPlainOrchestrationErrorPolicy,
+  errorPolicy: internalTableErrorPolicies.concealTableAuthorization,
   mapInput: ({ body }) => ({ body }),
   useCase: createTableImportUseCase,
   present: ({ import: created }) => ({ data: toV2CreateTableImport(created) }),

apps/sim/app/api/table/table-transfer-routes.test.ts

@@ -10,13 +10,19 @@ interface CapturedDefinition {
     response: { status?: number }
   }
   auth: unknown
+  errorPolicy: unknown
   operation: { id: string }
   useCase: unknown
 }
 
 const mocks = vi.hoisted(() => ({
   auth: { kind: 'session-or-executor' },
   definitions: [] as CapturedDefinition[],
+  errorPolicies: {
+    concealTableAuthorization: { kind: 'conceal-table' },
+    concealImportAuthorization: { kind: 'conceal-import' },
+    concealExportAuthorization: { kind: 'conceal-export' },
+  },
   useCases: {
     cancelExport: { operation: { id: 'tables.exports.cancel' } },
     cancelImport: { operation: { id: 'tables.imports.cancel' } },
@@ -41,7 +47,10 @@ vi.mock('@/lib/api/server/routes', () => ({
   },
 }))
 
-vi.mock('@/lib/table/api', () => ({ internalTableSessionOrExecutorAuth: mocks.auth }))
+vi.mock('@/lib/table/api', () => ({
+  internalTableErrorPolicies: mocks.errorPolicies,
+  internalTableSessionOrExecutorAuth: mocks.auth,
+}))
 
 vi.mock('@/lib/table/application/imports', () => ({
   cancelTableImportUseCase: mocks.useCases.cancelImport,
@@ -106,6 +115,36 @@ describe('internal table transfer routes', () => {
     }
   })
 
+  it('conceals cross-tenant authorization on every table transfer control leg', () => {
+    const expected = [
+      ['POST', '/api/table/imports', mocks.errorPolicies.concealTableAuthorization],
+      ['GET', '/api/table/imports/[importId]', mocks.errorPolicies.concealImportAuthorization],
+      ['DELETE', '/api/table/imports/[importId]', mocks.errorPolicies.concealImportAuthorization],
+      [
+        'POST',
+        '/api/table/imports/[importId]/parts',
+        mocks.errorPolicies.concealImportAuthorization,
+      ],
+      [
+        'POST',
+        '/api/table/imports/[importId]/complete',
+        mocks.errorPolicies.concealImportAuthorization,
+      ],
+      ['POST', '/api/table/[tableId]/exports', mocks.errorPolicies.concealTableAuthorization],
+      ['GET', '/api/table/exports/[exportId]', mocks.errorPolicies.concealExportAuthorization],
+      ['DELETE', '/api/table/exports/[exportId]', mocks.errorPolicies.concealExportAuthorization],
+      [
+        'GET',
+        '/api/table/exports/[exportId]/download',
+        mocks.errorPolicies.concealExportAuthorization,
+      ],
+    ] as const
+
+    for (const [method, path, errorPolicy] of expected) {
+      expect(definition(method, path).errorPolicy).toBe(errorPolicy)
+    }
+  })
+
   it('preserves the create response statuses', () => {
     expect(definition('POST', '/api/table/imports').contract.response.status).toBe(201)
     expect(definition('POST', '/api/table/[tableId]/exports').contract.response.status).toBe(201)