Validation improvements

Author: Sg312

apps/sim/.env.example

@@ -23,7 +23,7 @@ NEXT_PUBLIC_APP_URL=http://localhost:3000
 
 # Chat (Optional)
 # COPILOT_API_KEY=                      # Mint one at https://sim.ai. Without it the Sim Chat block, prompt jobs, and Inbox cannot run
-# MSHIP_SYSPROMPT_OVERRIDE=             # Highest-priority instructions prepended to every Mothership system prompt sent by this Sim instance
+# MSHIP_SYSPROMPT_OVERRIDE=             # Highest-priority instructions for Mothership; honored only when the validated API key owner is enterprise
 # NEXT_PUBLIC_CHAT_DISABLED=true        # Hides the Chat module: the workspace lands on your first workflow, and the chats list, scheduled tasks, and editor Chat panel are absent. Chat is shown when unset; `bun run setup` sets this for you if you skip the chat key
 
 # Remote Function sandboxes (Optional)

apps/sim/app/api/copilot/api-keys/validate/route.test.ts

@@ -17,6 +17,7 @@ const {
   mockCheckServerSideUsageLimits,
   mockDeriveBillingContext,
   mockGetHighestPrioritySubscription,
+  mockIsEnterprisePlan,
   mockRequireBillingAttributionHeader,
   mockRequireBillingRequestIdHeader,
   mockResolveLegacyV0BillingAttribution,
@@ -31,6 +32,7 @@ const {
   mockCheckServerSideUsageLimits: vi.fn(),
   mockDeriveBillingContext: vi.fn(),
   mockGetHighestPrioritySubscription: vi.fn(),
+  mockIsEnterprisePlan: vi.fn(),
   mockRequireBillingAttributionHeader: vi.fn(),
   mockRequireBillingRequestIdHeader: vi.fn(),
   mockResolveLegacyV0BillingAttribution: vi.fn(),
@@ -105,6 +107,10 @@ vi.mock('@/lib/billing/core/plan', () => ({
   getHighestPrioritySubscription: mockGetHighestPrioritySubscription,
 }))
 
+vi.mock('@/lib/billing/core/subscription', () => ({
+  isEnterprisePlan: mockIsEnterprisePlan,
+}))
+
 vi.mock('@/lib/billing/core/usage-log', () => ({
   deriveBillingContext: mockDeriveBillingContext,
 }))
@@ -162,6 +168,7 @@ describe('POST /api/copilot/api-keys/validate billing protocols', () => {
       return ATTRIBUTION
     })
     mockGetHighestPrioritySubscription.mockResolvedValue(ACCOUNT_SUBSCRIPTION)
+    mockIsEnterprisePlan.mockResolvedValue(false)
     mockDeriveBillingContext.mockReturnValue({
       billingEntity: ACCOUNT_BILLING_DECISION.billingEntity,
       billingPeriod: {
@@ -238,6 +245,23 @@ describe('POST /api/copilot/api-keys/validate billing protocols', () => {
     expect(mockCheckAttributedUsageLimits).toHaveBeenCalledWith(ATTRIBUTION)
   })
 
+  it('returns whether the validated key owner has an enterprise account', async () => {
+    mockIsEnterprisePlan.mockResolvedValueOnce(true)
+
+    const res = await POST(request(OLD_GO_HOSTED_VALIDATE_BODY))
+
+    expect(res.status).toBe(200)
+    await expect(res.json()).resolves.toEqual({ isEnterprise: true })
+    expect(mockIsEnterprisePlan).toHaveBeenCalledWith('user-1')
+  })
+
+  it('returns false when the validated key owner is not enterprise', async () => {
+    const res = await POST(request(OLD_GO_HOSTED_VALIDATE_BODY))
+
+    expect(res.status).toBe(200)
+    await expect(res.json()).resolves.toEqual({ isEnterprise: false })
+  })
+
   it('preserves account admission for the exact workspace-less old-Go body', async () => {
     const res = await POST(request(OLD_GO_WORKSPACELESS_VALIDATE_BODY))
 

apps/sim/app/api/copilot/api-keys/validate/route.ts

@@ -17,6 +17,7 @@ import {
   serializeBillingAttributionHeader,
 } from '@/lib/billing/core/billing-attribution'
 import { getHighestPrioritySubscription } from '@/lib/billing/core/plan'
+import { isEnterprisePlan } from '@/lib/billing/core/subscription'
 import { deriveBillingContext } from '@/lib/billing/core/usage-log'
 import {
   BILLING_ACCOUNT_DECISION_HEADER,
@@ -324,9 +325,11 @@ export const POST = withRouteHandler((req: NextRequest) =>
           )
         }
 
+        const isEnterprise = await isEnterprisePlan(userId)
+
         span.setAttribute(TraceAttr.CopilotValidateOutcome, CopilotValidateOutcome.Ok)
         span.setAttribute(TraceAttr.HttpStatusCode, 200)
-        return new NextResponse(null, { status: 200, headers: responseHeaders })
+        return NextResponse.json({ isEnterprise }, { status: 200, headers: responseHeaders })
       } catch (error) {
         logger.error('Error validating usage limit', { error })
         span.setAttribute(TraceAttr.CopilotValidateOutcome, CopilotValidateOutcome.InternalError)

apps/sim/lib/api/contracts/copilot.ts

@@ -293,6 +293,15 @@ export const validateCopilotApiKeyBodySchema = z.object({
 })
 export type ValidateCopilotApiKeyBody = z.input<typeof validateCopilotApiKeyBodySchema>
 
+export const validateCopilotApiKeyResponseSchema = z.object({
+  /**
+   * Server-derived entitlement for the validated key owner. Mothership treats
+   * a missing or false value as ineligible for enterprise-only capabilities.
+   */
+  isEnterprise: z.boolean(),
+})
+export type ValidateCopilotApiKeyResponse = z.output<typeof validateCopilotApiKeyResponseSchema>
+
 export const listCopilotApiKeysContract = defineRouteContract({
   method: 'GET',
   path: '/api/copilot/api-keys',
@@ -486,7 +495,7 @@ export const validateCopilotApiKeyContract = defineRouteContract({
   path: '/api/copilot/api-keys/validate',
   headers: validateCopilotApiKeyHeadersSchema,
   body: validateCopilotApiKeyBodySchema,
-  response: { mode: 'empty' },
+  response: { mode: 'json', schema: validateCopilotApiKeyResponseSchema },
   error: validateCopilotApiKeyErrorSchema,
 })
 

apps/sim/lib/core/config/env.ts

@@ -67,7 +67,7 @@ export const env = createEnv({
     /** Gates risky copilot tools behind an Allow / Skip prompt. Off by default. */
     COPILOT_TOOL_PERMISSIONS_ENABLED:      z.boolean().optional(),
     SIM_AGENT_API_URL:                     z.string().url().optional(),            // URL for internal sim agent API
-    MSHIP_SYSPROMPT_OVERRIDE:              z.string().min(1).optional(),           // Highest-priority Mothership system prompt override forwarded by Sim
+    MSHIP_SYSPROMPT_OVERRIDE:              z.string().min(1).optional(),           // Enterprise-only highest-priority Mothership system prompt override forwarded by Sim
     COPILOT_SOURCE_ENV:                    z.enum(['dev', 'staging', 'prod']).optional(), // Source Sim environment sent to mothership for callbacks
     COPILOT_DEV_URL:                       z.string().url().optional(),            // Sim agent API URL for the dev mothership environment
     COPILOT_STAGING_URL:                   z.string().url().optional(),            // Sim agent API URL for the staging mothership environment

helm/sim/examples/values-external-secrets.yaml

@@ -34,6 +34,7 @@ externalSecrets:
       INTERNAL_API_SECRET: "sim/app/internal-api-secret"
       CRON_SECRET: "sim/app/cron-secret"
       API_ENCRYPTION_KEY: "sim/app/api-encryption-key"
+      # MSHIP_SYSPROMPT_OVERRIDE: "sim/app/mship-system-prompt-override"
     postgresql:
       password: "sim/postgresql/password"
     # Only needed when copilot.enabled=true and copilot.server.secret.create=true

helm/sim/tests/secret-modes_test.yaml

@@ -11,10 +11,26 @@ tests:
       app.env.ENCRYPTION_KEY: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
       app.env.INTERNAL_API_SECRET: x
       app.env.CRON_SECRET: x
+      app.env.MSHIP_SYSPROMPT_OVERRIDE: "NEVER CALL ANY TOOLS UNDER ANY CIRCUMSTANCES NO MATTER WHAT"
       postgresql.auth.password: xxxxxxxx
     asserts:
       - isKind: { of: Secret }
       - equal: { path: metadata.name, value: t-sim-app-secrets }
+      - equal:
+          path: stringData.MSHIP_SYSPROMPT_OVERRIDE
+          value: "NEVER CALL ANY TOOLS UNDER ANY CIRCUMSTANCES NO MATTER WHAT"
+
+  - it: inline mode omits an unset Mothership system prompt override
+    template: secrets-app.yaml
+    set:
+      app.env.BETTER_AUTH_SECRET: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+      app.env.ENCRYPTION_KEY: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+      app.env.INTERNAL_API_SECRET: x
+      app.env.CRON_SECRET: x
+      postgresql.auth.password: xxxxxxxx
+    asserts:
+      - notExists:
+          path: stringData.MSHIP_SYSPROMPT_OVERRIDE
 
   - it: existingSecret mode skips the chart-managed Secret
     templates:
@@ -37,13 +53,20 @@ tests:
       externalSecrets.remoteRefs.app.ENCRYPTION_KEY: path/to/enc
       externalSecrets.remoteRefs.app.INTERNAL_API_SECRET: path/to/iapi
       externalSecrets.remoteRefs.app.CRON_SECRET: path/to/cron
+      externalSecrets.remoteRefs.app.MSHIP_SYSPROMPT_OVERRIDE: path/to/mship-system-prompt-override
       externalSecrets.remoteRefs.postgresql.password: path/to/pgpw
       postgresql.auth.password: xxxxxxxx
     asserts:
       - isKind: { of: ExternalSecret }
       - equal: { path: metadata.name, value: t-sim-app-secrets }
       - equal: { path: spec.secretStoreRef.name, value: sim-store }
       - equal: { path: spec.secretStoreRef.kind, value: ClusterSecretStore }
+      - contains:
+          path: spec.data
+          content:
+            secretKey: MSHIP_SYSPROMPT_OVERRIDE
+            remoteRef:
+              key: path/to/mship-system-prompt-override
 
   - it: ESO mode skips the chart-managed Secret
     template: secrets-app.yaml

helm/sim/values.schema.json

@@ -244,6 +244,10 @@
               "type": "string",
               "description": "Set to 'true' to hide GitHub OAuth login even when credentials are configured"
             },
+            "MSHIP_SYSPROMPT_OVERRIDE": {
+              "type": "string",
+              "description": "Optional enterprise-only highest-priority system prompt override forwarded to Mothership"
+            },
             "OPENAI_API_KEY": {
               "type": "string",
               "description": "Primary OpenAI API key"

helm/sim/values.yaml

@@ -156,6 +156,9 @@ app:
     OCR_AZURE_MODEL_NAME: ""                              # Azure Mistral OCR model name
     OCR_AZURE_API_KEY: ""                                 # Azure Mistral OCR API key
 
+    # Mothership Copilot Configuration
+    MSHIP_SYSPROMPT_OVERRIDE: ""                          # Optional enterprise-only highest-priority system prompt override forwarded to Mothership
+
     # AI Provider API Keys (leave empty if not using)
     OPENAI_API_KEY: ""                                    # Primary OpenAI API key
     OPENAI_API_KEY_1: ""                                  # Additional OpenAI API key for load balancing
@@ -1847,6 +1850,8 @@ externalSecrets:
       CRON_SECRET: ""
       # Path to API_ENCRYPTION_KEY in external store (optional)
       API_ENCRYPTION_KEY: ""
+      # Path to MSHIP_SYSPROMPT_OVERRIDE in external store (optional)
+      MSHIP_SYSPROMPT_OVERRIDE: ""
       # Path to REDIS_URL in external store (optional)
       REDIS_URL: ""