fix(mcp): keep public workflow MCP servers admin-only

Third instance of the same class, found by Cursor Bugbot. A public
workflow MCP server skips authentication entirely on the serve path
(api/mcp/serve/[serverId] returns early when isPublic), so anyone with
the URL can invoke every workflow published on it — the same
unauthenticated exposure already kept admin-only for the public workflow
API and public chats. create_server and update_server had moved to write
with no secondary gate on the transition to public.

Renames the helper to canExposePublicly and moves it to
lib/deployments/public-exposure: it now governs four surfaces (workflow
public API via its operation, chat REST, chat copilot, MCP servers), so a
chat-specific name and home no longer described it.

Adds a behavioral test for the MCP path, verified to fail when the gate
is removed. Also drops a cross-surface test added in this round that
grepped source text — it passed with the gate deleted, which makes it
worse than no test.

Author: mzxchandra

apps/sim/app/api/chat/manage/[id]/route.test.ts

@@ -25,12 +25,12 @@ import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vites
 
 const {
   mockCheckChatAccess,
-  mockCanSetPublicChatAuth,
+  mockCanExposePublicly,
   mockCheckNeedsRedeployment,
   mockValidateChatDeployAuth,
 } = vi.hoisted(() => ({
   mockCheckChatAccess: vi.fn(),
-  mockCanSetPublicChatAuth: vi.fn(),
+  mockCanExposePublicly: vi.fn(),
   mockCheckNeedsRedeployment: vi.fn(),
   mockValidateChatDeployAuth: vi.fn(),
 }))
@@ -51,8 +51,8 @@ vi.mock('@/lib/core/security/encryption', () => encryptionMock)
 vi.mock('@/app/api/chat/utils', () => ({
   checkChatAccess: mockCheckChatAccess,
 }))
-vi.mock('@/lib/chat/permissions', () => ({
-  canSetPublicChatAuth: mockCanSetPublicChatAuth,
+vi.mock('@/lib/deployments/public-exposure', () => ({
+  canExposePublicly: mockCanExposePublicly,
 }))
 
 vi.mock('@/ee/access-control/utils/permission-check', () => {
@@ -88,7 +88,7 @@ describe('Chat Edit API Route', () => {
     vi.clearAllMocks()
     // Existing chat suites deploy with authType public; default to admin so they
     // keep testing what they were written to test.
-    mockCanSetPublicChatAuth.mockResolvedValue(true)
+    mockCanExposePublicly.mockResolvedValue(true)
     resetDbChainMock()
     mockPerformChatUndeploy.mockResolvedValue({ success: true })
 

apps/sim/app/api/chat/manage/[id]/route.ts

@@ -8,11 +8,11 @@ import type { NextRequest } from 'next/server'
 import { chatIdParamsSchema, updateChatContract } from '@/lib/api/contracts/chats'
 import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { canSetPublicChatAuth } from '@/lib/chat/permissions'
 import { isDev } from '@/lib/core/config/env-flags'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import { getEmailDomain } from '@/lib/core/utils/urls'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { canExposePublicly } from '@/lib/deployments/public-exposure'
 import { checkNeedsRedeployment } from '@/lib/workflows/deployment-status'
 import {
   getWorkflowDeploymentSummary,
@@ -130,10 +130,7 @@ export const PATCH = withRouteHandler(
       if (authType && authType !== existingChatRecord.authType && chatWorkspaceId) {
         // Only the transition *to* public is admin-gated. Leaving an already-public
         // chat as-is, or moving it off public, does not increase exposure.
-        if (
-          authType === 'public' &&
-          !(await canSetPublicChatAuth(session.user.id, chatWorkspaceId))
-        ) {
+        if (authType === 'public' && !(await canExposePublicly(session.user.id, chatWorkspaceId))) {
           return createErrorResponse('Only admins can make a chat public', 403)
         }
 

apps/sim/app/api/chat/route.test.ts

@@ -18,11 +18,11 @@ import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
   mockCheckWorkflowAccessForChatCreation,
-  mockCanSetPublicChatAuth,
+  mockCanExposePublicly,
   mockValidateChatDeployAuth,
 } = vi.hoisted(() => ({
   mockCheckWorkflowAccessForChatCreation: vi.fn(),
-  mockCanSetPublicChatAuth: vi.fn(),
+  mockCanExposePublicly: vi.fn(),
   mockValidateChatDeployAuth: vi.fn(),
 }))
 
@@ -36,8 +36,8 @@ vi.mock('@/app/api/chat/utils', () => ({
   checkWorkflowAccessForChatCreation: mockCheckWorkflowAccessForChatCreation,
 }))
 
-vi.mock('@/lib/chat/permissions', () => ({
-  canSetPublicChatAuth: mockCanSetPublicChatAuth,
+vi.mock('@/lib/deployments/public-exposure', () => ({
+  canExposePublicly: mockCanExposePublicly,
 }))
 
 vi.mock('@/ee/access-control/utils/permission-check', () => {
@@ -64,7 +64,7 @@ describe('Chat API Route', () => {
     vi.clearAllMocks()
     // Existing chat suites deploy with authType public; default to admin so they
     // keep testing what they were written to test.
-    mockCanSetPublicChatAuth.mockResolvedValue(true)
+    mockCanExposePublicly.mockResolvedValue(true)
     setEnv({ NODE_ENV: 'development', NEXT_PUBLIC_APP_URL: 'http://localhost:3000' })
 
     mockCreateSuccessResponse.mockImplementation((data) => {
@@ -274,7 +274,7 @@ describe('Chat API Route', () => {
         workflow: { userId: 'user-id', workspaceId: 'workspace-1', isDeployed: true },
       })
       // Write access is enough to deploy a chat, but not to make one public.
-      mockCanSetPublicChatAuth.mockResolvedValue(false)
+      mockCanExposePublicly.mockResolvedValue(false)
 
       const response = await POST(
         new NextRequest('http://localhost:3000/api/chat', {
@@ -290,7 +290,7 @@ describe('Chat API Route', () => {
       )
 
       expect(response.status).toBe(403)
-      expect(mockCanSetPublicChatAuth).toHaveBeenCalledWith('user-id', 'workspace-1')
+      expect(mockCanExposePublicly).toHaveBeenCalledWith('user-id', 'workspace-1')
     })
 
     it('lets a non-admin deploy a password-protected chat', async () => {
@@ -303,7 +303,7 @@ describe('Chat API Route', () => {
         hasAccess: true,
         workflow: { userId: 'user-id', workspaceId: 'workspace-1', isDeployed: true },
       })
-      mockCanSetPublicChatAuth.mockResolvedValue(false)
+      mockCanExposePublicly.mockResolvedValue(false)
 
       const response = await POST(
         new NextRequest('http://localhost:3000/api/chat', {

apps/sim/app/api/chat/route.ts

@@ -7,8 +7,8 @@ import type { NextRequest } from 'next/server'
 import { createChatContract } from '@/lib/api/contracts/chats'
 import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { canSetPublicChatAuth } from '@/lib/chat/permissions'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { canExposePublicly } from '@/lib/deployments/public-exposure'
 import { performChatDeploy } from '@/lib/workflows/orchestration'
 import { checkWorkflowAccessForChatCreation } from '@/app/api/chat/utils'
 import { createErrorResponse, createSuccessResponse } from '@/app/api/workflows/utils'
@@ -116,7 +116,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     if (workflowRecord.workspaceId) {
       if (
         authType === 'public' &&
-        !(await canSetPublicChatAuth(session.user.id, workflowRecord.workspaceId))
+        !(await canExposePublicly(session.user.id, workflowRecord.workspaceId))
       ) {
         return createErrorResponse('Only admins can deploy a public chat', 403)
       }

apps/sim/lib/chat/permissions.ts

@@ -13,7 +13,7 @@ vi.mock('@/lib/workspaces/permissions/utils', () => ({
 }))
 
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { canSetPublicChatAuth } from '@/lib/chat/permissions'
+import { canExposePublicly } from '@/lib/deployments/public-exposure'
 import { checkWorkflowAccessForChatCreation } from '@/app/api/chat/utils'
 
 /**
@@ -90,17 +90,17 @@ describe('public chat auth is admin-only', () => {
 
   it('allows an admin', async () => {
     mockGetUserEntityPermissions.mockResolvedValue('admin')
-    await expect(canSetPublicChatAuth('user-1', 'ws-1')).resolves.toBe(true)
+    await expect(canExposePublicly('user-1', 'ws-1')).resolves.toBe(true)
     expect(mockGetUserEntityPermissions).toHaveBeenCalledWith('user-1', 'workspace', 'ws-1')
   })
 
   it.each(['write', 'read'] as const)('refuses a %s member', async (permission) => {
     mockGetUserEntityPermissions.mockResolvedValue(permission)
-    await expect(canSetPublicChatAuth('user-1', 'ws-1')).resolves.toBe(false)
+    await expect(canExposePublicly('user-1', 'ws-1')).resolves.toBe(false)
   })
 
   it('refuses a member with no permission on the workspace', async () => {
     mockGetUserEntityPermissions.mockResolvedValue(null)
-    await expect(canSetPublicChatAuth('user-1', 'ws-1')).resolves.toBe(false)
+    await expect(canExposePublicly('user-1', 'ws-1')).resolves.toBe(false)
   })
 })

…m/app/api/chat/utils.permissions.test.ts …/lib/deployments/public-exposure.test.tsapps/sim/app/api/chat/utils.permissions.test.ts renamed to apps/sim/lib/deployments/public-exposure.test.ts apps/sim/app/api/chat/utils.permissions.test.ts renamed to apps/sim/lib/deployments/public-exposure.test.ts

@@ -0,0 +1,24 @@
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+
+/**
+ * Whether the actor may expose a deployment to unauthenticated callers.
+ *
+ * Deploying is a `write` capability, but making a deployment *public* is not:
+ * a public workflow API, a public chat, and a public workflow MCP server all
+ * skip authentication entirely, so anyone holding the URL can invoke the
+ * workflow and everything it references. That is a different risk class from
+ * shipping a version, and it stays admin-only.
+ *
+ * Lives here rather than beside any one surface because four paths can set it —
+ * the workflow public-API route, the REST chat create and update routes, the
+ * copilot chat use case, and the workflow MCP server create/update use cases —
+ * and a rule duplicated per callsite is a rule that drifts. Two of those paths
+ * default to public, so a missing check silently reopens the boundary.
+ *
+ * Callers gate only the *transition to* public. Turning exposure off, or
+ * leaving it unchanged, stays `write`: neither increases exposure.
+ */
+export async function canExposePublicly(userId: string, workspaceId: string): Promise<boolean> {
+  const permission = await getUserEntityPermissions(userId, 'workspace', workspaceId)
+  return permission === 'admin'
+}

apps/sim/lib/deployments/public-exposure.ts

@@ -0,0 +1,129 @@
+/**
+ * @vitest-environment node
+ */
+import type { Principal } from '@sim/auth/principal'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mocks } = vi.hoisted(() => ({
+  mocks: {
+    canExposePublicly: vi.fn(),
+    resolvePermission: vi.fn(),
+    createServer: vi.fn(),
+    updateServer: vi.fn(),
+    loadWorkspace: vi.fn(),
+    audit: vi.fn(),
+  },
+}))
+
+vi.mock('@sim/audit', () => ({
+  AuditAction: { MCP_SERVER_ADDED: 'mcp.added', MCP_SERVER_UPDATED: 'mcp.updated' },
+  AuditResourceType: { MCP_SERVER: 'mcp_server' },
+  recordAudit: mocks.audit,
+}))
+
+vi.mock('@sim/platform-authz/workspace', () => ({
+  permissionSatisfies: (actual: string | null, required: string) => {
+    const rank = { read: 1, write: 2, admin: 3 } as const
+    return (
+      actual !== null && rank[actual as keyof typeof rank] >= rank[required as keyof typeof rank]
+    )
+  },
+  resolveEffectiveWorkspacePermission: mocks.resolvePermission,
+}))
+
+// The delegation policy revalidates the copilot grant against live state; this
+// test is about the public-exposure gate, not that plumbing.
+vi.mock('@/lib/mcp/application/authorization', () => ({
+  MCP_SERVER_DELEGATION_AUDIENCE: 'sim:mcp-servers',
+  mcpServerDelegationPolicy: { audience: 'sim:mcp-servers', isWithinScope: () => true },
+}))
+
+vi.mock('@/lib/deployments/public-exposure', () => ({
+  canExposePublicly: mocks.canExposePublicly,
+}))
+
+vi.mock('@/lib/mcp/orchestration', () => ({
+  performCreateWorkflowMcpServer: mocks.createServer,
+  performCreateWorkflowMcpTool: vi.fn(),
+  performDeleteWorkflowMcpServer: vi.fn(),
+  performDeleteWorkflowMcpTool: vi.fn(),
+  performUpdateWorkflowMcpServer: mocks.updateServer,
+  performUpdateWorkflowMcpTool: vi.fn(),
+}))
+
+vi.mock('@/lib/workspaces/application/workspace-context', () => ({
+  loadActiveWorkspaceApplicationContext: mocks.loadWorkspace,
+}))
+
+vi.mock('@/lib/mcp/pubsub', () => ({ mcpPubSub: undefined }))
+
+import { createWorkflowMcpDeploymentServer } from '@/lib/mcp/application/workflow-deployments'
+
+// This operation only accepts delegated copilot principals.
+const WRITE_PRINCIPAL: Principal = {
+  kind: 'delegated',
+  serviceId: 'copilot',
+  subjectUserId: 'editor-1',
+  workspaceId: 'workspace-1',
+  delegationId: 'copilot-1',
+  audience: 'sim:mcp-servers',
+  issuedAt: new Date('2026-08-08T00:00:00Z'),
+  expiresAt: new Date('2999-08-08T00:00:00Z'),
+}
+
+/**
+ * A public workflow MCP server skips authentication on the serve path, so
+ * anyone with the URL can invoke every workflow published on it. Creating the
+ * server is `write`; making it public is admin-only.
+ */
+describe('workflow MCP server public exposure is admin-only', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.resolvePermission.mockResolvedValue('write')
+    mocks.loadWorkspace.mockResolvedValue({
+      workspaceId: 'workspace-1',
+      billedAccountUserId: 'billing-1',
+    })
+    mocks.createServer.mockResolvedValue({
+      success: true,
+      server: { id: 'srv-1', name: 'srv', isPublic: true },
+      addedTools: [],
+    })
+  })
+
+  it('rejects a write member creating a public server', async () => {
+    mocks.canExposePublicly.mockResolvedValue(false)
+
+    await expect(
+      createWorkflowMcpDeploymentServer.execute({
+        principal: WRITE_PRINCIPAL,
+        input: { workspaceId: 'workspace-1', name: 'srv', isPublic: true },
+      })
+    ).rejects.toMatchObject({ code: 'forbidden' })
+
+    expect(mocks.createServer).not.toHaveBeenCalled()
+  })
+
+  it('allows a write member creating a private server', async () => {
+    mocks.canExposePublicly.mockResolvedValue(false)
+
+    await createWorkflowMcpDeploymentServer.execute({
+      principal: WRITE_PRINCIPAL,
+      input: { workspaceId: 'workspace-1', name: 'srv', isPublic: false },
+    })
+
+    expect(mocks.createServer).toHaveBeenCalled()
+    expect(mocks.canExposePublicly).not.toHaveBeenCalled()
+  })
+
+  it('allows an admin creating a public server', async () => {
+    mocks.canExposePublicly.mockResolvedValue(true)
+
+    await createWorkflowMcpDeploymentServer.execute({
+      principal: WRITE_PRINCIPAL,
+      input: { workspaceId: 'workspace-1', name: 'srv', isPublic: true },
+    })
+
+    expect(mocks.createServer).toHaveBeenCalledWith(expect.objectContaining({ isPublic: true }))
+  })
+})