fix(execution): propagate run identity across dispatch paths and scope public runs to workspace secrets

Author: icecrasher321

apps/docs/content/docs/en/platform/credentials.mdx

@@ -124,8 +124,16 @@ When a workspace secret and a personal secret share the same key name, the **wor
 
 When a workflow runs, secrets resolve in this order:
 
-1. **Workspace secrets** are checked first
-2. **Personal secrets** are used as a fallback — from the user who triggered the run (manual) or the workflow owner (automated runs via API, webhook, or schedule)
+1. **Workspace secrets** are checked first, and always resolve against the identity running the workflow — the caller when one can be identified, otherwise the workspace's billing account. A run only sees the workspace secrets that identity is allowed to use.
+2. **Personal secrets** are used as a fallback, from whichever identity is running:
+
+| Run started by | Personal secrets come from |
+| --- | --- |
+| Clicking Run, or a personal API key | The person running it |
+| A workspace API key, schedule, or webhook | The workflow owner |
+| A public API URL with no authentication | Nobody — personal secrets do not resolve |
+
+The workflow owner is the fallback only where nobody can be identified but somebody in the workspace set the trigger up, since those workflows are usually built against the owner's own keys. A public URL can be called by anyone, so it never borrows a person's keys at all — put every secret such a workflow needs in **Workspace**.
 
 ## Best Practices
 
@@ -138,7 +146,7 @@ When a workflow runs, secrets resolve in this order:
   { question: "Are my secrets encrypted at rest?", answer: "Yes. Values saved under Secrets are encrypted before being stored in the database." },
   { question: "Can a saved secret still appear in a workflow result?", answer: "Yes. Functional workflow data is not rewritten, so the raw value can still reach downstream blocks and tools and can appear in workflow execution responses, streams, or callbacks if your workflow deliberately returns or prints it. Log-facing views and read APIs receive a protected copy after a successful {{KEY}} resolution. Before content is sent to a model, exact values from the run's authorized secret catalog are replaced with placeholders, but encoded or otherwise transformed values remain outside that protection." },
   { question: "What happens if both a workspace secret and a personal secret have the same key name?", answer: "Among secrets available to the execution actor, the workspace secret takes precedence and the personal secret is the fallback. An inaccessible workspace secret does not shadow an authorized personal value." },
-  { question: "Who determines which personal secret is used for automated runs?", answer: "For manual runs, the personal secrets of the user who clicked Run are used as fallback. For automated runs triggered by API, webhook, or schedule, the personal secrets of the workflow owner are used instead." },
+  { question: "Who determines which personal secret is used for automated runs?", answer: "Whoever is running it, when that can be identified. Clicking Run or calling with a personal API key uses that person's personal secrets. A workspace API key, schedule, or webhook has no identifiable caller, so it falls back to the workflow owner's — those triggers are set up inside the workspace and the workflow is usually built against the owner's own keys. A public API URL with no authentication can be called by anyone, so no personal secrets resolve at all — those workflows run on workspace secrets only." },
   { question: "Can I import secrets from a .env file?", answer: "Yes. Paste .env-style content (KEY=VALUE format) into any key or value field and the secrets will be auto-populated. The parser supports export KEY=VALUE, quoted values, and inline comments." },
   { question: "What happens if I delete a secret that is used in a workflow?", answer: "The workflow will fail at any block that references the deleted secret during execution because the value cannot be resolved. Update any references before deleting a secret." },
 ]} />

apps/sim/app/api/workflows/[id]/execute/route.ts

@@ -385,6 +385,8 @@ type AsyncExecutionParams = {
   executionId: string
   copilotToolCallId?: string
   callChain?: string[]
+  enforceCredentialAccess?: boolean
+  isPublicApiAccess?: boolean
   executionTimeoutMs: number
   trustedInitialResolvedSecretTraceProvenance?: ResolvedSecretTraceProvenanceV1
 }
@@ -1245,6 +1247,8 @@ async function handleExecutePost(
         executionId,
         copilotToolCallId,
         callChain,
+        enforceCredentialAccess: useAuthenticatedUserAsActor,
+        isPublicApiAccess,
         executionTimeoutMs: preprocessResult.executionTimeout.async,
         trustedInitialResolvedSecretTraceProvenance,
       })
@@ -1628,7 +1632,13 @@ async function handleExecutePost(
       const streamVariables = cachedWorkflowData?.variables ?? (workflow as any).variables
       const streamWorkflow = {
         id: workflow.id,
-        userId: actorUserId,
+        /**
+         * The owner, not the actor: `executeWorkflow` reads this one field to set
+         * `workflowUserId`, which is the personal-environment fallback for runs with
+         * no identifiable caller. Passing the actor here made the streaming path
+         * resolve the actor where the JSON path resolves the owner.
+         */
+        userId: workflow.userId,
         workspaceId,
         isDeployed: workflow.isDeployed,
         variables: streamVariables,

apps/sim/background/workflow-execution.ts

@@ -76,6 +76,14 @@ export type WorkflowExecutionPayload = {
   executionTimeoutMs?: number
   /** Authenticated input provenance validated by the workflow execution boundary. */
   trustedInitialResolvedSecretTraceProvenance?: ResolvedSecretTraceProvenanceV1
+  /**
+   * Identity decisions the enqueuing surface already made. They must ride the
+   * payload because the worker has no request to re-derive them from, and a
+   * queued run that dropped them would resolve its personal variables as the
+   * workflow owner while still authorizing workspace variables as the actor.
+   */
+  enforceCredentialAccess?: boolean
+  isPublicApiAccess?: boolean
 }
 
 /**
@@ -193,6 +201,8 @@ export async function executeWorkflowJob(
           useDraftState: false,
           startTime: new Date().toISOString(),
           isClientSession: false,
+          enforceCredentialAccess: payload.enforceCredentialAccess ?? false,
+          isPublicApiAccess: payload.isPublicApiAccess ?? false,
           callChain: payload.callChain,
           correlation,
           executionMode: payload.executionMode ?? 'async',

apps/sim/executor/execution/snapshot-serializer.ts

@@ -273,6 +273,13 @@ export function serializePauseSnapshot(
     useDraftState,
     startTime: metadataFromContext?.startTime ?? new Date().toISOString(),
     isClientSession: metadataFromContext?.isClientSession,
+    /**
+     * Both identity flags survive pause/resume. Dropping them would silently
+     * re-resolve a resumed run's personal variables as the workflow owner even
+     * though the original run authorized as its caller.
+     */
+    enforceCredentialAccess: metadataFromContext?.enforceCredentialAccess,
+    isPublicApiAccess: metadataFromContext?.isPublicApiAccess,
     executionMode: metadataFromContext?.executionMode,
     /** Preserve deployed-chat thinking gate across HITL pause/resume. */
     includeThinking: metadataFromContext?.includeThinking === true ? true : undefined,

apps/sim/lib/environment/utils.test.ts

@@ -142,10 +142,16 @@ describe('getExecutionEnvironment', () => {
 
   it('resolves each slice against its own identity', async () => {
     grantAdminTo('actor-1')
-    queueTableRows(environment, [{ variables: { PERSONAL_KEY: 'personal-cipher' } }])
-    queueTableRows(workspaceEnvironment, [{ variables: { WORKSPACE_KEY: 'workspace-cipher' } }])
+    /**
+     * Queued rows are FIFO per table, and the actor resolves first: its access was
+     * already decided, so it skips the `checkWorkspaceAccess` await the personal
+     * resolution still performs. Only the actor is a workspace admin, so the owner's
+     * own workspace slice resolves empty and could not be the one that lands.
+     */
     queueTableRows(environment, [{ variables: { ACTOR_ONLY: 'actor-cipher' } }])
     queueTableRows(workspaceEnvironment, [{ variables: { WORKSPACE_KEY: 'workspace-cipher' } }])
+    queueTableRows(environment, [{ variables: { PERSONAL_KEY: 'personal-cipher' } }])
+    queueTableRows(workspaceEnvironment, [{ variables: { WORKSPACE_KEY: 'workspace-cipher' } }])
 
     const snapshot = await getExecutionEnvironment('owner-1', 'actor-1', 'workspace-1')
 
@@ -165,6 +171,18 @@ describe('getExecutionEnvironment', () => {
     expect(snapshot.workspaceDecrypted).toEqual({ WORKSPACE_KEY: 'plain:workspace-cipher' })
   })
 
+  it('drops the personal slice entirely when no personal identity is supplied', async () => {
+    grantAdminTo('billing-account')
+    queueTableRows(environment, [{ variables: { PERSONAL_KEY: 'personal-cipher' } }])
+    queueTableRows(workspaceEnvironment, [{ variables: { WORKSPACE_KEY: 'workspace-cipher' } }])
+
+    const snapshot = await getExecutionEnvironment(undefined, 'billing-account', 'workspace-1')
+
+    expect(snapshot.personalDecrypted).toEqual({})
+    expect(snapshot.personalEncrypted).toEqual({})
+    expect(snapshot.workspaceDecrypted).toEqual({ WORKSPACE_KEY: 'plain:workspace-cipher' })
+  })
+
   it('falls back to the personal identity when the actor cannot reach the workspace', async () => {
     mockCheckWorkspaceAccess.mockImplementation(async (_workspaceId: string, userId: string) => ({
       exists: true,

apps/sim/lib/environment/utils.ts

@@ -293,41 +293,63 @@ export async function getPersonalAndWorkspaceEnv(
  * workflow is routinely authored against its owner's personal keys and would
  * otherwise lose them the moment anyone else triggered it.
  *
+ * An undefined `personalUserId` means no personal namespace belongs in this run at
+ * all, which is how an anonymous public-API call resolves: workspace variables only.
+ *
  * A run whose two identities coincide, which is every interactive run, resolves
  * exactly as before through a single query.
  *
- * When the actor cannot reach the workspace at all, the personal identity is
+ * When the actor has no access to the workspace at all, the personal identity is
  * reused for both slices and the fault is reported rather than raised.
  * `workspace.billedAccountUserId` is a stored column rather than a derivation,
  * so an organization ownership transfer can leave it pointing at a user with no
  * remaining access; failing here would take down every background execution in
  * that workspace for a misconfiguration the run itself did not cause. The error
  * line is what makes that state visible while it is repaired.
+ *
+ * That fallback is gated on the access decision alone, never on a failed query.
+ * Widening to a `catch` would let a transient database fault silently promote the
+ * run to the owner's broader secret selection, which is the opposite of what an
+ * infrastructure error should do — those propagate and fail the run.
  */
 export async function getExecutionEnvironment(
-  personalUserId: string,
+  personalUserId: string | undefined,
   workspaceUserId: string,
   workspaceId?: string
 ): Promise<EnvironmentResolutionSnapshot> {
+  if (personalUserId === undefined) {
+    const workspaceOnly = await getPersonalAndWorkspaceEnv(workspaceUserId, workspaceId)
+    return {
+      ...workspaceOnly,
+      personalEncrypted: {},
+      personalDecrypted: {},
+      personalOwners: {},
+      conflicts: [],
+      decryptionFailures: workspaceOnly.decryptionFailures.filter(
+        (key) => key in workspaceOnly.workspaceEncrypted
+      ),
+    }
+  }
+
   if (!workspaceId || workspaceUserId === personalUserId) {
     return getPersonalAndWorkspaceEnv(personalUserId, workspaceId)
   }
 
+  const actorAccess = await checkWorkspaceAccess(workspaceId, workspaceUserId)
+  if (!actorAccess.hasAccess) {
+    logger.error('Execution actor cannot reach the workspace; falling back to the owner', {
+      personalUserId,
+      workspaceUserId,
+      workspaceId,
+    })
+    return getPersonalAndWorkspaceEnv(personalUserId, workspaceId)
+  }
+
   const [personal, actor] = await Promise.all([
     getPersonalAndWorkspaceEnv(personalUserId, workspaceId),
-    getPersonalAndWorkspaceEnv(workspaceUserId, workspaceId).catch((error) => {
-      logger.error('Execution actor cannot reach the workspace; falling back to the owner', {
-        personalUserId,
-        workspaceUserId,
-        workspaceId,
-        error: getErrorMessage(error, 'Unknown error'),
-      })
-      return undefined
-    }),
+    getPersonalAndWorkspaceEnv(workspaceUserId, workspaceId, { workspaceAccess: actorAccess }),
   ])
 
-  if (!actor) return personal
-
   /**
    * Each snapshot reports decryption failures across both of its own slices, so
    * a name is only carried over when it belongs to the slice being kept.

apps/sim/lib/workflows/executor/enqueue-execution.ts

@@ -33,6 +33,9 @@ export interface EnqueueWorkflowExecutionParams {
   callChain?: string[]
   executionTimeoutMs: number
   trustedInitialResolvedSecretTraceProvenance?: ResolvedSecretTraceProvenanceV1
+  /** Identity decisions the enqueuing surface made; the worker cannot re-derive them. */
+  enforceCredentialAccess?: boolean
+  isPublicApiAccess?: boolean
 }
 
 /**
@@ -77,6 +80,8 @@ export async function enqueueWorkflowExecution(
     callChain,
     executionTimeoutMs,
     trustedInitialResolvedSecretTraceProvenance,
+    enforceCredentialAccess,
+    isPublicApiAccess,
   } = params
   const asyncLogger = logger.withMetadata({
     requestId,
@@ -107,6 +112,8 @@ export async function enqueueWorkflowExecution(
     requestId,
     correlation,
     callChain,
+    enforceCredentialAccess,
+    isPublicApiAccess,
     executionMode: 'async',
     admissionCompleted: true,
     executionTimeoutMs,

apps/sim/lib/workflows/executor/execute-service.ts

@@ -337,6 +337,8 @@ export async function executeWorkflowService(
         triggerType,
         executionId,
         callChain,
+        enforceCredentialAccess: useAuthenticatedUserAsActor,
+        isPublicApiAccess,
         executionTimeoutMs: preprocessResult.executionTimeout.async,
       })
       executionIdClaimCommitted = enqueue.retainExecutionClaim
@@ -430,7 +432,13 @@ export async function executeWorkflowService(
       const resolvedSelectedOutputs = resolveOutputIds(selectedOutputs, workflowBlocks)
       const streamWorkflow = {
         id: workflow.id,
-        userId: actorUserId,
+        /**
+         * The owner, not the actor: `executeWorkflow` reads this one field to set
+         * `workflowUserId`, which is the personal-environment fallback for runs with
+         * no identifiable caller. Passing the actor here made the streaming path
+         * resolve the actor where the JSON path resolves the owner.
+         */
+        userId: workflow.userId,
         workspaceId,
         isDeployed: workflow.isDeployed,
         variables: workflowVariables,

apps/sim/lib/workflows/executor/execution-core.test.ts

@@ -1699,7 +1699,7 @@ describe('executeWorkflowCore terminal finalization sequencing', () => {
     })
   })
 
-  it('resolves both slices as the billing account for an anonymous public-API run', async () => {
+  it('resolves no personal vars and workspace vars as the billing account on a public-API run', async () => {
     const snapshot = {
       ...createSnapshot(),
       metadata: {
@@ -1715,9 +1715,9 @@ describe('executeWorkflowCore terminal finalization sequencing', () => {
 
     getPersonalAndWorkspaceEnvMock.mockImplementation(async (userId: string) => ({
       personalEncrypted: { PERSONAL: `enc-personal-${userId}` },
-      workspaceEncrypted: {},
+      workspaceEncrypted: { WORKSPACE: `enc-workspace-${userId}` },
       personalDecrypted: { PERSONAL: `personal-${userId}` },
-      workspaceDecrypted: {},
+      workspaceDecrypted: { WORKSPACE: `workspace-${userId}` },
       personalOwners: {},
       conflicts: [],
       decryptionFailures: [],
@@ -1738,7 +1738,7 @@ describe('executeWorkflowCore terminal finalization sequencing', () => {
     expect(getPersonalAndWorkspaceEnvMock).toHaveBeenCalledWith('billing-account', 'workspace-1')
     expect(getPersonalAndWorkspaceEnvMock).not.toHaveBeenCalledWith('workflow-owner', 'workspace-1')
     expect(executorConstructorMock.mock.calls[0]?.[0]?.envVarValues).toEqual({
-      PERSONAL: 'personal-billing-account',
+      WORKSPACE: 'workspace-billing-account',
     })
   })
 

apps/sim/lib/workflows/executor/execution-core.ts

@@ -440,34 +440,39 @@ async function executeWorkflowCoreImpl(
      * so a session, personal API key, or delegated run reads its own personal
      * variables rather than borrowing the workflow owner's.
      *
-     * An anonymous public-API run reaches the actor by the opposite argument —
-     * there is no caller to read as, and no owner consented to lending their
-     * personal namespace to the whole internet — so it uses the workspace's own
-     * billing principal, which is already what its workspace variables resolve as.
-     *
      * The workflow owner remains the fallback for a workspace API key, schedule,
      * or webhook. Someone in the workspace configured each of those, and a
      * deployed workflow is routinely authored against its owner's personal keys.
+     *
+     * An anonymous public-API run resolves no personal variables at all. Anyone
+     * can call that endpoint, so there is no caller to read as and no person whose
+     * private namespace it would be reasonable to lend — such a workflow runs on
+     * workspace secrets alone.
      */
-    const personalEnvUserId =
+    const identifiedCallerUserId =
       (metadata.isClientSession && metadata.sessionUserId) ||
-      (metadata.enforceCredentialAccess || metadata.isPublicApiAccess
-        ? metadata.userId
-        : undefined) ||
-      metadata.workflowUserId
+      (metadata.enforceCredentialAccess ? metadata.userId : undefined)
 
-    if (!personalEnvUserId) {
+    const personalEnvUserId = metadata.isPublicApiAccess
+      ? undefined
+      : identifiedCallerUserId || metadata.workflowUserId
+
+    if (!metadata.isPublicApiAccess && !personalEnvUserId) {
       throw new Error('Missing workflowUserId in execution metadata')
     }
 
     /**
      * The actor already carries the identity each trigger kind should authorize
      * workspace secrets against: the caller for a session, personal API key, or
      * delegated principal, and the workspace billing account for a workspace API
-     * key, schedule, or webhook, where no caller is identifiable. Deriving it
-     * again here would only risk disagreeing with the principal layer.
+     * key, schedule, webhook, or anonymous public-API call, where no caller is
+     * identifiable. Deriving it again here would only risk disagreeing with the
+     * principal layer.
      */
     const workspaceEnvUserId = metadata.userId || personalEnvUserId
+    if (!workspaceEnvUserId) {
+      throw new Error('Missing execution actor in execution metadata')
+    }
 
     /**
      * Resolves the workflow state from the override, the draft tables, or the
@@ -563,7 +568,7 @@ async function executeWorkflowCoreImpl(
       restoredCheckpointVersion: restoredState?.resolvedSecretTraceCheckpointVersion,
       restoreTrusted,
       requireRestoredProvenance,
-      scope: { userId: personalEnvUserId, workspaceId: providedWorkspaceId },
+      scope: { userId: personalEnvUserId ?? workspaceEnvUserId, workspaceId: providedWorkspaceId },
     })
     if (restoredState && !restoreTrusted) {
       resolvedSecretTraceRegistry.markIncomplete('restored-provenance-untrusted')