fix(security): close two disclosure gaps and finish the slot-leak fix

The payer-pool gate only covered the workspace branch. A personal API key that
omits workspaceId takes the account branch, where getHighestPrioritySubscription
resolves an organization subscription from any member row regardless of role -
so a plain member read the organization-wide credit and storage pool by dropping
one query parameter. The account branch is now gated by the same authority, and
the storage pool is not queried when it may not be disclosed. Forcing that
branch self-scoped instead would have downgraded plan, period, and status, which
is what a member needs to see whether the org is blocked.

GET /api/v1/logs/executions/[executionId] emitted the workflow snapshot raw,
carrying password sub-block values and oauth-input credential ids. It now shares
the sanitizer the v2 read already used, extracted so there is one implementation
rather than two. Env-var references are still preserved.

cancelWorkflowGroupExecution itself was unguarded, so an unexpected throw from
its transaction escaped ahead of every release site - the same reservation leak
this branch set out to close, still open on the adjacent path. It now releases
through the shared predicate and rethrows, because a failed transition means the
cell state is unknown and a success-shaped answer would be a lie. The comment
claiming the abort record cannot be taken back was false and now states the real
reason: a refusal is always a terminal-or-absent state.

Author: waleedlatif1

apps/sim/app/api/v1/logs/executions/[executionId]/route.test.ts

@@ -0,0 +1,155 @@
+/**
+ * @vitest-environment node
+ */
+import { NextRequest, NextResponse } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  checkRateLimit: vi.fn(),
+  validateWorkspaceAccess: vi.fn(),
+  getPublicWorkflowLog: vi.fn(),
+  getUserLimits: vi.fn(),
+}))
+
+vi.mock('@/app/api/v1/middleware', () => ({
+  checkRateLimit: mocks.checkRateLimit,
+  createRateLimitResponse: () => NextResponse.json({ error: 'Rate limit' }, { status: 429 }),
+  validateWorkspaceAccess: mocks.validateWorkspaceAccess,
+}))
+
+vi.mock('@/lib/logs/public-queries', () => ({
+  getPublicWorkflowLog: mocks.getPublicWorkflowLog,
+}))
+
+vi.mock('@/app/api/v1/logs/meta', () => ({
+  getUserLimits: mocks.getUserLimits,
+  createApiResponse: <T, L>(data: T, limits: L) => ({ body: { ...data, limits }, headers: {} }),
+}))
+
+/**
+ * Overrides the global stub, whose empty `subBlocks` would let the sanitizer
+ * no-op and make this suite pass against an unsanitized route.
+ */
+vi.mock('@/blocks/registry', () => ({
+  getBlock: vi.fn(() => ({
+    name: 'Gmail',
+    subBlocks: [
+      { id: 'credential', type: 'oauth-input' },
+      { id: 'apiKey', type: 'short-input', password: true },
+      { id: 'envApiKey', type: 'short-input', password: true },
+      { id: 'subject', type: 'short-input' },
+    ],
+    outputs: {},
+  })),
+  getAllBlocks: vi.fn(() => []),
+  getLatestBlock: vi.fn(() => undefined),
+  getBlockRegistry: vi.fn(() => ({})),
+  getBlockByToolName: vi.fn(() => undefined),
+}))
+
+import { GET } from '@/app/api/v1/logs/executions/[executionId]/route'
+
+const rateLimit = {
+  allowed: true,
+  userId: 'user-1',
+  limit: 100,
+  remaining: 99,
+  resetAt: new Date('2026-08-11T00:00:00Z'),
+}
+
+function snapshot() {
+  return {
+    blocks: {
+      'block-1': {
+        id: 'block-1',
+        type: 'gmail',
+        subBlocks: {
+          credential: { id: 'credential', type: 'oauth-input', value: 'credential-row-id' },
+          apiKey: { id: 'apiKey', type: 'short-input', value: 'literal-secret-value' },
+          envApiKey: { id: 'envApiKey', type: 'short-input', value: '{{GMAIL_API_KEY}}' },
+          subject: { id: 'subject', type: 'short-input', value: 'Weekly digest' },
+        },
+      },
+    },
+    edges: [],
+  }
+}
+
+function requestFor(executionId: string) {
+  return {
+    request: new NextRequest(`http://localhost:3000/api/v1/logs/executions/${executionId}`),
+    context: { params: Promise.resolve({ executionId }) },
+  }
+}
+
+describe('GET /api/v1/logs/executions/[executionId]', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.checkRateLimit.mockResolvedValue(rateLimit)
+    mocks.validateWorkspaceAccess.mockResolvedValue(null)
+    mocks.getUserLimits.mockResolvedValue({ usage: { plan: 'free' } })
+    mocks.getPublicWorkflowLog.mockResolvedValue({
+      workflowId: 'workflow-1',
+      workspaceId: 'workspace-1',
+      workflowState: snapshot(),
+      trigger: 'api',
+      startedAt: new Date('2026-08-11T00:00:00Z'),
+      endedAt: new Date('2026-08-11T00:00:01Z'),
+      totalDurationMs: 1000,
+      costTotal: '0.01',
+    })
+  })
+
+  it('redacts credentials from the snapshot while preserving env-var references', async () => {
+    const { request, context } = requestFor('execution-1')
+    const response = await GET(request, context)
+    const body = await response.json()
+
+    expect(response.status).toBe(200)
+
+    const subBlocks = body.workflowState.blocks['block-1'].subBlocks
+    expect(subBlocks.credential.value).toBeNull()
+    expect(subBlocks.apiKey.value).toBeNull()
+    expect(subBlocks.envApiKey.value).toBe('{{GMAIL_API_KEY}}')
+    expect(subBlocks.subject.value).toBe('Weekly digest')
+    expect(JSON.stringify(body)).not.toContain('literal-secret-value')
+    expect(JSON.stringify(body)).not.toContain('credential-row-id')
+  })
+
+  it('keeps the surrounding response shape intact', async () => {
+    const { request, context } = requestFor('execution-1')
+    const body = await (await GET(request, context)).json()
+
+    expect(body).toMatchObject({
+      executionId: 'execution-1',
+      workflowId: 'workflow-1',
+      executionMetadata: {
+        trigger: 'api',
+        startedAt: '2026-08-11T00:00:00.000Z',
+        endedAt: '2026-08-11T00:00:01.000Z',
+        totalDurationMs: 1000,
+        cost: { total: 0.01 },
+      },
+      limits: { usage: { plan: 'free' } },
+    })
+  })
+
+  it('reports a missing snapshot as not found', async () => {
+    mocks.getPublicWorkflowLog.mockResolvedValueOnce({
+      workflowId: 'workflow-1',
+      workspaceId: 'workspace-1',
+      workflowState: null,
+      trigger: 'api',
+      startedAt: new Date('2026-08-11T00:00:00Z'),
+      endedAt: null,
+      totalDurationMs: 1000,
+      costTotal: null,
+    })
+
+    const { request, context } = requestFor('execution-1')
+    const response = await GET(request, context)
+
+    expect(response.status).toBe(404)
+    expect(await response.json()).toEqual({ error: 'Workflow state snapshot not found' })
+  })
+})

apps/sim/app/api/v1/logs/executions/[executionId]/route.ts

@@ -4,6 +4,7 @@ import { v1GetExecutionContract } from '@/lib/api/contracts/v1/logs'
 import { parseRequest } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { getPublicWorkflowLog } from '@/lib/logs/public-queries'
+import { sanitizeExecutionSnapshotState } from '@/lib/logs/snapshot-sanitizer'
 import { createApiResponse, getUserLimits } from '@/app/api/v1/logs/meta'
 import {
   checkRateLimit,
@@ -50,14 +51,21 @@ export const GET = withRouteHandler(
         return NextResponse.json({ error: 'Workflow execution not found' }, { status: 404 })
       }
 
-      if (!workflowLog.workflowState) {
+      /**
+       * The stored snapshot carries `password: true` sub-block values and `oauth-input`
+       * credential ids, so it is redacted before it reaches this public wire — the same
+       * treatment the v2 run detail applies. A snapshot the sanitizer cannot walk projects
+       * as `null`, which keeps the pre-existing "not found" outcome for an absent one.
+       */
+      const workflowState = sanitizeExecutionSnapshotState(workflowLog.workflowState)
+      if (!workflowState) {
         return NextResponse.json({ error: 'Workflow state snapshot not found' }, { status: 404 })
       }
 
       const response = {
         executionId,
         workflowId: workflowLog.workflowId,
-        workflowState: workflowLog.workflowState,
+        workflowState,
         executionMetadata: {
           trigger: workflowLog.trigger,
           startedAt: workflowLog.startedAt.toISOString(),
@@ -70,9 +78,7 @@ export const GET = withRouteHandler(
       }
 
       logger.debug(`Successfully fetched execution data for: ${executionId}`)
-      logger.debug(
-        `Workflow state contains ${countWorkflowStateBlocks(workflowLog.workflowState)} blocks`
-      )
+      logger.debug(`Workflow state contains ${countWorkflowStateBlocks(workflowState)} blocks`)
 
       // Get user's workflow execution limits and usage
       const limits = await getUserLimits(userId)

apps/sim/lib/api/contracts/v2/billing.ts

@@ -37,13 +37,16 @@ export const v2BillingStatusQuerySchema = z.object({
  * and source analytics deliberately live outside this status resource.
  *
  * `credits` and `storage` report the resolved payer's pooled allowances, which
- * are shared across every workspace that payer funds. They are populated only
- * for a caller who may manage that payer's billing: the billed account holder,
- * or an admin of the hosting organization. Billing authority is a property of
- * a person, so an actor-less workspace API key never qualifies. Every other
- * caller reads both as `null` while still seeing the plan, period, and
- * standing that the workspace already surfaces to them — enough to monitor for
- * `limit_exceeded` and `billing_blocked`.
+ * are shared across every workspace and member that payer funds. They are
+ * populated only for a caller who may manage that payer's billing: the billed
+ * account holder, or an admin of the owning organization. Billing authority is
+ * a property of a person, so an actor-less workspace API key never qualifies.
+ * This holds on both scopes — omitting `workspaceId` resolves the payer from
+ * the caller's own subscriptions and organization memberships, and plain
+ * membership is not authority over the organization's pool. Every other caller
+ * reads both as `null` while still seeing the plan, period, and standing of
+ * the payer that funds them — enough to monitor for `limit_exceeded` and
+ * `billing_blocked`.
  */
 export const v2BillingStatusDataSchema = z
   .object({

apps/sim/lib/billing/application/billing-use-cases.test.ts

@@ -25,10 +25,12 @@ const mocks = vi.hoisted(() => ({
   getWorkspaceUsageLogs: vi.fn(),
   recordAudit: vi.fn(),
   canUserManageWorkspaceBilling: vi.fn(),
+  canUserManageBillingEntity: vi.fn(),
 }))
 
 vi.mock('@/lib/billing/core/workspace-billing-authority', () => ({
   canUserManageWorkspaceBilling: mocks.canUserManageWorkspaceBilling,
+  canUserManageBillingEntity: mocks.canUserManageBillingEntity,
 }))
 
 vi.mock('@/lib/workspaces/application/workspace-context', () => ({
@@ -100,6 +102,7 @@ describe('billing application use cases', () => {
     mocks.loadWorkspace.mockResolvedValue(workspaceContext)
     mocks.resolvePermission.mockResolvedValue('read')
     mocks.canUserManageWorkspaceBilling.mockResolvedValue(false)
+    mocks.canUserManageBillingEntity.mockResolvedValue(false)
     mocks.checkUsageStatus.mockResolvedValue({ currentUsage: 1, limit: 10, isExceeded: false })
     mocks.checkAttributedBlocks.mockResolvedValue({ blocked: false })
     mocks.toUsageLimitSubscription.mockReturnValue(null)
@@ -289,6 +292,81 @@ describe('billing application use cases', () => {
     expect(result.storage).not.toBeNull()
   })
 
+  /**
+   * `getHighestPrioritySubscription` resolves an organization subscription from
+   * any `member` row regardless of role, so dropping `workspaceId` must not
+   * hand a plain member the organization-wide pool the workspace branch
+   * withholds.
+   */
+  it('withholds the organization pool from an account caller who cannot manage it', async () => {
+    mocks.getSubscription.mockResolvedValue({ plan: 'team', referenceId: 'organization-1' })
+    mocks.deriveBillingContext.mockReturnValue({
+      billingEntity: { type: 'organization', id: 'organization-1' },
+      billingPeriod: {
+        start: new Date('2026-01-01T00:00:00Z'),
+        end: new Date('2026-02-01T00:00:00Z'),
+      },
+    })
+    mocks.canUserManageBillingEntity.mockResolvedValue(false)
+    mocks.checkBillingBlocked.mockResolvedValue({ blocked: false })
+    mocks.checkBillingEntityBlocked.mockResolvedValue({ blocked: false })
+
+    const result = await getBillingStatus.execute({ principal: personalPrincipal, input: {} })
+
+    expect(result.credits).toBeNull()
+    expect(result.storage).toBeNull()
+    expect(result).toMatchObject({ workspaceId: null, plan: 'team', status: 'active' })
+    expect(mocks.canUserManageBillingEntity).toHaveBeenCalledWith(
+      { type: 'organization', id: 'organization-1' },
+      'user-1'
+    )
+    expect(mocks.getUserStorageUsage).not.toHaveBeenCalled()
+    expect(mocks.getUserStorageLimit).not.toHaveBeenCalled()
+  })
+
+  it('still reports an exceeded organization limit to an account caller who cannot read it', async () => {
+    mocks.getSubscription.mockResolvedValue({ plan: 'team', referenceId: 'organization-1' })
+    mocks.deriveBillingContext.mockReturnValue({
+      billingEntity: { type: 'organization', id: 'organization-1' },
+      billingPeriod: {
+        start: new Date('2026-01-01T00:00:00Z'),
+        end: new Date('2026-02-01T00:00:00Z'),
+      },
+    })
+    mocks.canUserManageBillingEntity.mockResolvedValue(false)
+    mocks.checkBillingBlocked.mockResolvedValue({ blocked: false })
+    mocks.checkBillingEntityBlocked.mockResolvedValue({ blocked: false })
+    mocks.checkUsageStatus.mockResolvedValue({ currentUsage: 40, limit: 10, isExceeded: true })
+
+    const result = await getBillingStatus.execute({ principal: personalPrincipal, input: {} })
+
+    expect(result.status).toBe('limit_exceeded')
+    expect(result.credits).toBeNull()
+  })
+
+  it('projects the organization pool to an account caller who administers it', async () => {
+    mocks.getSubscription.mockResolvedValue({ plan: 'team', referenceId: 'organization-1' })
+    mocks.deriveBillingContext.mockReturnValue({
+      billingEntity: { type: 'organization', id: 'organization-1' },
+      billingPeriod: {
+        start: new Date('2026-01-01T00:00:00Z'),
+        end: new Date('2026-02-01T00:00:00Z'),
+      },
+    })
+    mocks.canUserManageBillingEntity.mockResolvedValue(true)
+    mocks.checkBillingBlocked.mockResolvedValue({ blocked: false })
+    mocks.checkBillingEntityBlocked.mockResolvedValue({ blocked: false })
+
+    const result = await getBillingStatus.execute({ principal: personalPrincipal, input: {} })
+
+    expect(result.credits).toEqual({ used: 200, limit: 2_000, remaining: 1_800 })
+    expect(result.storage).toEqual({
+      usedBytes: 5_242_880,
+      limitBytes: 1_073_741_824,
+      percentUsed: 0.48828125,
+    })
+  })
+
   it('uses the personal principal as account authority', async () => {
     mocks.getSubscription.mockResolvedValue({ plan: 'pro' })
     mocks.deriveBillingContext.mockReturnValue({