fix(workflows): bind automated runs to billing actors

Author: TheodoreSpeaks

apps/sim/background/schedule-execution.ts

@@ -598,6 +598,7 @@ async function runWorkflowExecution({
         serviceId: 'schedule',
         workspaceId,
         workflowId: payload.workflowId,
+        subject: { kind: 'sim_user', userId: actorUserId },
       },
       billingAttribution,
       sessionUserId: undefined,

apps/sim/background/webhook-execution.test.ts

@@ -240,6 +240,7 @@ describe('executeWebhookJob fault vs error handling', () => {
         workflowId: 'workflow-1',
         workspaceId: 'workspace-1',
         provider: 'gmail',
+        subject: { kind: 'sim_user', userId: 'user-1' },
       },
     },
     userId: 'user-1',
@@ -337,6 +338,7 @@ describe('executeWebhookJob fault vs error handling', () => {
           workflowId: 'workflow-1',
           workspaceId: 'workspace-1',
           provider: 'gmail',
+          subject: { kind: 'sim_user', userId: 'user-1' },
         },
       }),
       expect.anything(),

apps/sim/background/webhook-execution.ts

@@ -493,6 +493,7 @@ function parseWebhookJobPrincipal(payload: WebhookExecutionJobPayload): Workflow
     workflowId: payload.workflowId,
     workspaceId: payload.workspaceId,
     provider: payload.provider,
+    subject: { kind: 'sim_user', userId: payload.userId },
   })
 }
 

apps/sim/lib/auth/internal.test.ts

@@ -135,6 +135,32 @@ describe('internal executor delegation claims', () => {
     })
   })
 
+  it('derives executor subject authority from a generic webhook billing actor', async () => {
+    const token = await generateInternalDelegationToken({
+      workflowId: 'workflow-1',
+      executionId: 'execution-1',
+      principal: {
+        kind: 'system',
+        serviceId: 'webhook',
+        workspaceId: 'workspace-1',
+        workflowId: 'workflow-1',
+        webhookId: 'webhook-1',
+        provider: 'generic',
+        subject: { kind: 'sim_user', userId: 'billing-actor-1' },
+      },
+    })
+
+    await expect(verifyInternalDelegationToken(token)).resolves.toMatchObject({
+      subjectUserId: 'billing-actor-1',
+      principal: {
+        kind: 'system',
+        serviceId: 'webhook',
+        subject: { kind: 'sim_user', userId: 'billing-actor-1' },
+      },
+    })
+    expect(decodeJwt(token).sub).toBe('billing-actor-1')
+  })
+
   it('round-trips the currently executing deployed workflow authority', async () => {
     const token = await generateInternalDelegationToken({
       subjectUserId: 'user-1',

apps/sim/lib/auth/principal.test.ts

@@ -168,6 +168,21 @@ describe('principal persistence', () => {
     expect(parsePrincipal(serializePrincipal(principal))).toEqual(principal)
   })
 
+  it('round trips a generic webhook billing actor subject', () => {
+    const principal = {
+      kind: 'system' as const,
+      serviceId: 'webhook' as const,
+      workspaceId: 'workspace-1',
+      workflowId: 'workflow-1',
+      webhookId: 'webhook-1',
+      provider: 'generic',
+      subject: { kind: 'sim_user' as const, userId: 'billing-actor-1' },
+    }
+
+    expect(parsePrincipal(serializePrincipal(principal))).toEqual(principal)
+    expect(requirePrincipalSubjectUserId(principal)).toBe('billing-actor-1')
+  })
+
   it('rejects incomplete or cross-provider webhook identity', () => {
     expect(() =>
       parsePrincipal({
@@ -179,7 +194,7 @@ describe('principal persistence', () => {
           workflowId: 'workflow-1',
         },
       })
-    ).toThrow('require webhookId and provider')
+    ).toThrow('require webhookId, provider, and subject')
     expect(() =>
       parsePrincipal({
         version: 1,
@@ -200,6 +215,20 @@ describe('principal persistence', () => {
       })
     ).toThrow('subject provider must match')
   })
+
+  it('rejects a persisted schedule without its billing actor subject', () => {
+    expect(() =>
+      parsePrincipal({
+        version: 1,
+        principal: {
+          kind: 'system',
+          serviceId: 'schedule',
+          workspaceId: 'workspace-1',
+          workflowId: 'workflow-1',
+        },
+      })
+    ).toThrow('Schedule system principals require a Sim user subject')
+  })
 })
 
 describe('principal subjects', () => {
@@ -234,8 +263,9 @@ describe('principal subjects', () => {
         serviceId: 'schedule',
         workspaceId: 'workspace-1',
         workflowId: 'workflow-1',
+        subject: { kind: 'sim_user', userId: 'billing-actor-1' },
       })
-    ).toBeNull()
+    ).toEqual({ kind: 'sim_user', userId: 'billing-actor-1' })
   })
 })
 

apps/sim/lib/credential-groups/application/authorization.test.ts

@@ -145,7 +145,7 @@ describe('requireCredentialGroupCredentialAccess', () => {
     const principal = executorPrincipal()
     principal.delegationContext!.principal = {
       kind: 'system',
-      serviceId: 'schedule',
+      serviceId: 'internal',
       workspaceId: 'workspace-1',
       workflowId: 'root-workflow',
     }
@@ -164,7 +164,7 @@ describe('requireCredentialGroupCredentialAccess', () => {
     const principal = executorPrincipal()
     principal.delegationContext!.principal = {
       kind: 'system',
-      serviceId: 'schedule',
+      serviceId: 'internal',
       workspaceId: 'workspace-1',
       workflowId: 'root-workflow',
     }

apps/sim/lib/knowledge/api/internal-route.test.ts

@@ -0,0 +1,35 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { internalKnowledgeActorUserId } from '@/lib/knowledge/api/internal-route'
+
+describe('internal knowledge principal subject', () => {
+  it('uses the generic webhook billing actor carried by executor delegation', () => {
+    expect(
+      internalKnowledgeActorUserId({
+        kind: 'delegated',
+        serviceId: 'executor',
+        subjectUserId: 'billing-actor-1',
+        workspaceId: 'workspace-1',
+        delegationId: 'executor-1',
+        audience: 'sim:knowledge',
+        issuedAt: new Date('2026-01-01'),
+        expiresAt: new Date('2099-01-01'),
+        delegationContext: {
+          kind: 'workflow_execution',
+          workflowId: 'workflow-1',
+          principal: {
+            kind: 'system',
+            serviceId: 'webhook',
+            workspaceId: 'workspace-1',
+            workflowId: 'workflow-1',
+            webhookId: 'webhook-1',
+            provider: 'generic',
+            subject: { kind: 'sim_user', userId: 'billing-actor-1' },
+          },
+        },
+      })
+    ).toBe('billing-actor-1')
+  })
+})

apps/sim/lib/table/application/rows.test.ts

@@ -199,6 +199,30 @@ const TABLE: TableDefinition = {
 }
 
 const PRINCIPAL = { kind: 'session' as const, userId: 'user-1', sessionId: 'session-1' }
+const GENERIC_WEBHOOK_EXECUTOR = {
+  kind: 'delegated' as const,
+  serviceId: 'executor' as const,
+  subjectUserId: 'billing-actor-1',
+  workspaceId: TABLE.workspaceId,
+  delegationId: 'executor-1',
+  audience: 'sim:tables',
+  issuedAt: new Date('2026-01-01'),
+  expiresAt: new Date('2099-01-01'),
+  resourceScope: { tableId: TABLE.id },
+  delegationContext: {
+    kind: 'workflow_execution' as const,
+    workflowId: 'workflow-1',
+    principal: {
+      kind: 'system' as const,
+      serviceId: 'webhook' as const,
+      workspaceId: TABLE.workspaceId,
+      workflowId: 'workflow-1',
+      webhookId: 'webhook-1',
+      provider: 'generic',
+      subject: { kind: 'sim_user' as const, userId: 'billing-actor-1' },
+    },
+  },
+}
 
 /**
  * The active-table context every row command resolves before it does any work.
@@ -990,6 +1014,20 @@ describe('table row write secret provenance defaulting', () => {
       {}
     )
   })
+
+  it('executes a generic webhook upsert as its principal billing actor', async () => {
+    await upsertTableRow.execute({
+      principal: GENERIC_WEBHOOK_EXECUTOR,
+      input: { tableId: TABLE.id, data: { name: 'Ada' } },
+    })
+
+    expect(mockUpsertRow).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: 'billing-actor-1' }),
+      TABLE,
+      expect.any(String),
+      {}
+    )
+  })
 })
 
 /**

apps/sim/lib/webhooks/execution-principal.test.ts

@@ -0,0 +1,68 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import {
+  assertWebhookExecutionPrincipal,
+  createWebhookExecutionPrincipal,
+} from '@/lib/webhooks/execution-principal'
+
+describe('webhook execution principals', () => {
+  it('represents a generic webhook as its billing actor', () => {
+    const principal = createWebhookExecutionPrincipal({
+      webhookId: 'webhook-1',
+      workflowId: 'workflow-1',
+      workspaceId: 'workspace-1',
+      provider: 'generic',
+      subject: { kind: 'sim_user', userId: 'billing-actor-1' },
+    })
+
+    expect(principal.subject).toEqual({ kind: 'sim_user', userId: 'billing-actor-1' })
+    expect(() =>
+      assertWebhookExecutionPrincipal(principal, {
+        webhookId: 'webhook-1',
+        workflowId: 'workflow-1',
+        workspaceId: 'workspace-1',
+        provider: 'generic',
+        userId: 'billing-actor-1',
+      })
+    ).not.toThrow()
+  })
+
+  it('rejects a generic webhook whose subject is not its billing actor', () => {
+    expect(() =>
+      createWebhookExecutionPrincipal({
+        webhookId: 'webhook-1',
+        workflowId: 'workflow-1',
+        workspaceId: 'workspace-1',
+        provider: 'generic',
+        subject: {
+          kind: 'external_user',
+          provider: 'generic',
+          tenantId: 'tenant-1',
+          subjectId: 'subject-1',
+        },
+      })
+    ).toThrow('Generic webhook execution requires a Sim user billing actor')
+  })
+
+  it('rejects a serialized Sim subject that disagrees with the admitted billing actor', () => {
+    const principal = createWebhookExecutionPrincipal({
+      webhookId: 'webhook-1',
+      workflowId: 'workflow-1',
+      workspaceId: 'workspace-1',
+      provider: 'generic',
+      subject: { kind: 'sim_user', userId: 'billing-actor-1' },
+    })
+
+    expect(() =>
+      assertWebhookExecutionPrincipal(principal, {
+        webhookId: 'webhook-1',
+        workflowId: 'workflow-1',
+        workspaceId: 'workspace-1',
+        provider: 'generic',
+        userId: 'different-user',
+      })
+    ).toThrow('Webhook job principal does not match its canonical execution scope')
+  })
+})

apps/sim/lib/webhooks/execution-principal.ts

@@ -1,5 +1,5 @@
 import type {
-  ExternalUserSubject,
+  PrincipalSubject,
   WebhookSystemPrincipal,
   WorkflowExecutionPrincipal,
 } from '@sim/auth/principal'
@@ -14,23 +14,26 @@ export function createWebhookExecutionPrincipal(input: {
   workflowId: string
   workspaceId: string
   provider: string
-  subject?: ExternalUserSubject
+  subject: PrincipalSubject
 }): WebhookSystemPrincipal {
   const provider = normalizeWebhookPrincipalProvider(input.provider)
   if (!input.webhookId.trim()) throw new Error('Webhook execution requires a webhook ID')
   if (!input.workflowId.trim()) throw new Error('Webhook execution requires a workflow ID')
   if (!input.workspaceId.trim()) throw new Error('Webhook execution requires a workspace ID')
-  if (input.subject && input.subject.provider !== provider) {
+  if (input.subject.kind === 'external_user' && input.subject.provider !== provider) {
     throw new Error('Webhook execution subject provider must match the webhook provider')
   }
+  if (provider === 'generic' && input.subject.kind !== 'sim_user') {
+    throw new Error('Generic webhook execution requires a Sim user billing actor')
+  }
   return {
     kind: 'system',
     serviceId: 'webhook',
     webhookId: input.webhookId,
     workflowId: input.workflowId,
     workspaceId: input.workspaceId,
     provider,
-    ...(input.subject ? { subject: input.subject } : {}),
+    subject: input.subject,
   }
 }
 
@@ -41,15 +44,19 @@ export function assertWebhookExecutionPrincipal(
     workflowId: string
     workspaceId: string
     provider: string
+    userId: string
   }
 ): asserts principal is WebhookSystemPrincipal {
+  const provider = normalizeWebhookPrincipalProvider(expected.provider)
   if (
     principal.kind !== 'system' ||
     principal.serviceId !== 'webhook' ||
     principal.webhookId !== expected.webhookId ||
     principal.workflowId !== expected.workflowId ||
     principal.workspaceId !== expected.workspaceId ||
-    principal.provider !== normalizeWebhookPrincipalProvider(expected.provider)
+    principal.provider !== provider ||
+    (provider === 'generic' && principal.subject.kind !== 'sim_user') ||
+    (principal.subject.kind === 'sim_user' && principal.subject.userId !== expected.userId)
   ) {
     throw new Error('Webhook job principal does not match its canonical execution scope')
   }