fix(selectors): expose route verb to contract audit

Author: Bill Leoutsakos

apps/sim/app/api/selectors/execute/route.test.ts

@@ -8,10 +8,10 @@ const mocks = vi.hoisted(() => ({ status: 200 }))
 
 vi.mock('@/lib/api/server/routes', () => ({
   defineInternalJsonRoute: vi.fn(
-    () => async () =>
+    (options: { staticResponseHeaders?: HeadersInit }) => async () =>
       new Response(JSON.stringify({ ok: mocks.status < 400 }), {
         status: mocks.status,
-        headers: { 'Content-Type': 'application/json' },
+        headers: options.staticResponseHeaders,
       })
   ),
   extendInternalErrorPolicy: vi.fn(() => ({})),

apps/sim/app/api/selectors/execute/route.ts

@@ -30,7 +30,7 @@ const selectorErrorPolicy = extendInternalErrorPolicy(internalOrchestrationError
   return null
 })
 
-const executeSelectorRoute = defineInternalJsonRoute({
+export const POST = defineInternalJsonRoute({
   contract: executeSelectorContract,
   auth: internalSessionAuth,
   operation: selectorOperations.execute,
@@ -41,12 +41,5 @@ const executeSelectorRoute = defineInternalJsonRoute({
   parseOptions: { maxBodyBytes: 256 * 1024 },
   mapInput: ({ body }, { request }) => ({ ...body, signal: request.signal }),
   useCase: executeSelector,
-  responseHeaders: () => PRIVATE_NO_STORE,
+  staticResponseHeaders: PRIVATE_NO_STORE,
 })
-
-/** Applies the privacy header to authentication, parse, and unhandled failures too. */
-export async function POST(...args: Parameters<typeof executeSelectorRoute>): Promise<Response> {
-  const response = await executeSelectorRoute(...args)
-  response.headers.set('Cache-Control', PRIVATE_NO_STORE['Cache-Control'])
-  return response
-}

apps/sim/lib/api/server/routes/internal-json-route.test.ts

@@ -215,6 +215,75 @@ describe('defineInternalJsonRoute', () => {
     expect(body.requestId).toBe('req-parse')
   })
 
+  it('applies static response headers to success and every failure stage', async () => {
+    const staticHeaderContract = defineRouteContract({
+      method: 'POST',
+      path: '/api/test/internal-json-route',
+      body: z.object({ outcome: z.enum(['success', 'failure']) }),
+      response: { mode: 'json', schema: z.object({ value: z.string() }) },
+    })
+    const handler = defineInternalJsonRoute({
+      contract: staticHeaderContract,
+      auth: {
+        async authenticate(request) {
+          if (request.headers.get('x-reject-auth') === 'true') {
+            throw new InternalUnauthenticatedError('Unauthorized')
+          }
+          return { kind: 'session' as const, userId: 'user-1', sessionId: 'session-1' }
+        },
+      },
+      operation,
+      rateLimit: internalRateLimits.none({ reason: 'Unit test' }),
+      errorPolicy: internalOrchestrationErrorPolicy,
+      mapInput: ({ body }) => body.outcome,
+      useCase: {
+        operation,
+        async execute({ input }) {
+          if (input === 'failure') throw new Error('Unhandled')
+          return { value: 'ok' }
+        },
+      },
+      staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
+    })
+
+    const cases: Array<[NextRequest, number]> = [
+      [
+        new NextRequest('http://localhost/api/test/internal-json-route', {
+          method: 'POST',
+          body: JSON.stringify({ outcome: 'success' }),
+        }),
+        200,
+      ],
+      [
+        new NextRequest('http://localhost/api/test/internal-json-route', {
+          method: 'POST',
+          headers: { 'x-reject-auth': 'true' },
+        }),
+        401,
+      ],
+      [
+        new NextRequest('http://localhost/api/test/internal-json-route', {
+          method: 'POST',
+          body: '{',
+        }),
+        400,
+      ],
+      [
+        new NextRequest('http://localhost/api/test/internal-json-route', {
+          method: 'POST',
+          body: JSON.stringify({ outcome: 'failure' }),
+        }),
+        500,
+      ],
+    ]
+
+    for (const [request, expectedStatus] of cases) {
+      const response = await handler(request)
+      expect(response.status).toBe(expectedStatus)
+      expect(response.headers.get('Cache-Control')).toBe('private, no-store')
+    }
+  })
+
   it('orders auth, rate limiting, parsing, async mapping, and application execution', async () => {
     const events: string[] = []
     const orderedContract = defineRouteContract({

apps/sim/lib/api/server/routes/internal-json-route.ts

@@ -256,6 +256,8 @@ type InternalJsonRouteOptions<
   }): void | Promise<void>
   onSuccess?(args: { principal: P; input: NoInfer<I>; result: NoInfer<R> }): void | Promise<void>
   statusForResult?(result: NoInfer<R>): number
+  /** Headers applied last to every response path, including authentication and parse failures. */
+  staticResponseHeaders?: HeadersInit
   responseHeaders?(args: { principal: P; input: NoInfer<I>; result: NoInfer<R> }): HeadersInit
   finalizeResponse?(args: {
     request: NextRequest
@@ -408,5 +410,13 @@ export function defineInternalJsonRoute<
     }
   )
 
-  return async (request, context) => wrapped(request, context)
+  return async (request, context) => {
+    const response = await wrapped(request, context)
+    if (options.staticResponseHeaders) {
+      new Headers(options.staticResponseHeaders).forEach((value, key) => {
+        response.headers.set(key, value)
+      })
+    }
+    return response
+  }
 }