fix(copilot): enforce delegated workspace scope in query_logs and set_environment_variables

A model-supplied workspaceId (or a workflowId in another workspace) could
steer both tools to any workspace the acting principal can reach, bypassing
the asserted-vs-context workspace comparison the rest of the Copilot tool
surface enforces. Both now resolve through requireCopilotWorkspace — moved
to a shared module — so an asserted workspace may only re-state the chat's
execution workspace, and the default-workspace fallback is removed so a
missing scope fails closed.

Author: waleedlatif1

apps/sim/lib/copilot/tools/handlers/vfs-mutate.test.ts

@@ -86,6 +86,9 @@ vi.mock('@/lib/copilot/tools/server/files/file-folder-application', () => ({
     ...(fileId ? { resourceScope: { fileId } } : {}),
   })),
   ensureCopilotFileFolderPath: mocks.ensureCopilotFileFolderPath,
+}))
+
+vi.mock('@/lib/copilot/tools/server/workspace-scope', () => ({
   requireCopilotWorkspace: vi.fn((context) => context.workspaceId),
 }))
 

apps/sim/lib/copilot/tools/handlers/vfs-mutate.ts

@@ -11,7 +11,7 @@ import {
 } from '@/lib/copilot/application/execute-workflow-use-case'
 import { messageForCopilotTableError } from '@/lib/copilot/auth/table-delegation'
 import type { ExecutionContext, ToolCallResult } from '@/lib/copilot/request/types'
-import { requireCopilotWorkspace } from '@/lib/copilot/tools/server/files/file-folder-application'
+import { requireCopilotWorkspace } from '@/lib/copilot/tools/server/workspace-scope'
 import { decodeVfsPathSegments, encodeVfsPathSegments } from '@/lib/copilot/vfs/path-utils'
 import { asOrchestrationError } from '@/lib/core/orchestration/types'
 import { PlatformEvents } from '@/lib/core/telemetry'

apps/sim/lib/copilot/tools/server/files/file-folder-application.ts

@@ -1,27 +1,8 @@
 import { executeCopilotFileUseCase } from '@/lib/copilot/application/execute-file-use-case'
 import type { CopilotFileDelegationContext } from '@/lib/copilot/auth/file-delegation'
-import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { findWorkspaceFileFolderIdByPath } from '@/lib/uploads/contexts/workspace/workspace-file-folder-manager'
 import { createWorkspaceFileFolderOperation } from '@/lib/workspace-files/application/workspace-file-folders'
 
-/**
- * Returns the execution workspace only. Model-provided workspace ids may assert the same value,
- * but can never select a different workspace or trigger a default-workspace fallback.
- */
-export function requireCopilotWorkspace(
-  context: CopilotFileDelegationContext,
-  assertedWorkspaceId?: string
-): string {
-  if (!context.workspaceId) throw new Error('Copilot execution workspace is required')
-  if (assertedWorkspaceId && assertedWorkspaceId !== context.workspaceId) {
-    throw new OrchestrationError(
-      'validation',
-      'Workspace ID does not match the Copilot execution workspace'
-    )
-  }
-  return context.workspaceId
-}
-
 /** Creates missing parent folders through the shared folder application operation. */
 export async function ensureCopilotFileFolderPath(
   context: CopilotFileDelegationContext,

apps/sim/lib/copilot/tools/server/files/file-folders.ts

@@ -9,10 +9,8 @@ import {
   type BaseServerTool,
   type ServerToolContext,
 } from '@/lib/copilot/tools/server/base-tool'
-import {
-  ensureCopilotFileFolderPath,
-  requireCopilotWorkspace,
-} from '@/lib/copilot/tools/server/files/file-folder-application'
+import { ensureCopilotFileFolderPath } from '@/lib/copilot/tools/server/files/file-folder-application'
+import { requireCopilotWorkspace } from '@/lib/copilot/tools/server/workspace-scope'
 import { decodeVfsPathSegments } from '@/lib/copilot/vfs/path-utils'
 import { asOrchestrationError, OrchestrationError } from '@/lib/core/orchestration/types'
 import {

apps/sim/lib/copilot/tools/server/user/set-environment-variables.test.ts

@@ -15,13 +15,11 @@ afterAll(resetEnvironmentUtilsMock)
 const {
   ensureWorkflowAccessMock,
   ensureWorkspaceAccessMock,
-  getDefaultWorkspaceIdMock,
   listCredentialsMock,
   performUpdateCredentialMock,
 } = vi.hoisted(() => ({
   ensureWorkflowAccessMock: vi.fn(),
   ensureWorkspaceAccessMock: vi.fn(),
-  getDefaultWorkspaceIdMock: vi.fn(),
   listCredentialsMock: vi.fn(),
   performUpdateCredentialMock: vi.fn(),
 }))
@@ -37,7 +35,6 @@ vi.mock('@/lib/credentials/orchestration', () => ({
 vi.mock('@/lib/copilot/tools/handlers/access', () => ({
   ensureWorkflowAccess: ensureWorkflowAccessMock,
   ensureWorkspaceAccess: ensureWorkspaceAccessMock,
-  getDefaultWorkspaceId: getDefaultWorkspaceIdMock,
 }))
 
 import { setEnvironmentVariablesServerTool } from './set-environment-variables'
@@ -49,7 +46,6 @@ describe('setEnvironmentVariablesServerTool', () => {
       workflow: { id: 'wf-1', workspaceId: 'ws-from-workflow' },
     })
     ensureWorkspaceAccessMock.mockResolvedValue(undefined)
-    getDefaultWorkspaceIdMock.mockResolvedValue('ws-default')
     upsertPersonalEnvVarsMock.mockResolvedValue({ added: ['API_KEY'], updated: [] })
     upsertWorkspaceEnvVarsMock.mockResolvedValue(['API_KEY'])
     listCredentialsMock.mockResolvedValue({
@@ -97,22 +93,59 @@ describe('setEnvironmentVariablesServerTool', () => {
     expect(result.scope).toBe('personal')
   })
 
-  it('falls back to the default workspace when none is in context', async () => {
-    await setEnvironmentVariablesServerTool.execute(
-      {
-        variables: [{ name: 'API_KEY', value: 'secret' }],
-      },
-      {
-        userId: 'user-1',
-      }
+  it('fails closed when the context carries no workspace', async () => {
+    await expect(
+      setEnvironmentVariablesServerTool.execute(
+        { variables: [{ name: 'API_KEY', value: 'secret' }] },
+        { userId: 'user-1' }
+      )
+    ).rejects.toThrow('Copilot execution workspace is required')
+
+    expect(upsertWorkspaceEnvVarsMock).not.toHaveBeenCalled()
+  })
+
+  it('accepts a workspaceId that re-asserts the execution workspace', async () => {
+    const result = await setEnvironmentVariablesServerTool.execute(
+      { workspaceId: 'ws-1', variables: [{ name: 'API_KEY', value: 'secret' }] },
+      { userId: 'user-1', workspaceId: 'ws-1' }
     )
 
-    expect(getDefaultWorkspaceIdMock).toHaveBeenCalledWith('user-1')
-    expect(upsertWorkspaceEnvVarsMock).toHaveBeenCalledWith(
-      'ws-default',
-      { API_KEY: 'secret' },
-      'user-1'
+    expect(upsertWorkspaceEnvVarsMock).toHaveBeenCalledWith('ws-1', { API_KEY: 'secret' }, 'user-1')
+    expect(result.workspaceId).toBe('ws-1')
+  })
+
+  it('rejects a workspaceId that names a different workspace', async () => {
+    await expect(
+      setEnvironmentVariablesServerTool.execute(
+        { workspaceId: 'ws-other', variables: [{ name: 'API_KEY', value: 'secret' }] },
+        { userId: 'user-1', workspaceId: 'ws-1' }
+      )
+    ).rejects.toThrow('Workspace ID does not match the Copilot execution workspace')
+
+    expect(upsertWorkspaceEnvVarsMock).not.toHaveBeenCalled()
+  })
+
+  it('resolves the workspace from a workflow in the execution workspace', async () => {
+    ensureWorkflowAccessMock.mockResolvedValue({ workflow: { id: 'wf-1', workspaceId: 'ws-1' } })
+
+    await setEnvironmentVariablesServerTool.execute(
+      { workflowId: 'wf-1', variables: [{ name: 'API_KEY', value: 'secret' }] },
+      { userId: 'user-1', workspaceId: 'ws-1' }
     )
+
+    expect(ensureWorkflowAccessMock).toHaveBeenCalledWith('wf-1', 'user-1', 'write')
+    expect(upsertWorkspaceEnvVarsMock).toHaveBeenCalledWith('ws-1', { API_KEY: 'secret' }, 'user-1')
+  })
+
+  it('rejects a workflowId whose workspace differs from the execution workspace', async () => {
+    await expect(
+      setEnvironmentVariablesServerTool.execute(
+        { workflowId: 'wf-1', variables: [{ name: 'API_KEY', value: 'secret' }] },
+        { userId: 'user-1', workspaceId: 'ws-1' }
+      )
+    ).rejects.toThrow('Workspace ID does not match the Copilot execution workspace')
+
+    expect(upsertWorkspaceEnvVarsMock).not.toHaveBeenCalled()
   })
 
   it('describes a workspace secret through the credential update handler, never rewriting its value', async () => {

apps/sim/lib/copilot/tools/server/user/set-environment-variables.ts

@@ -1,12 +1,9 @@
 import { createLogger } from '@sim/logger'
 import { z } from 'zod'
 import { SetEnvironmentVariables } from '@/lib/copilot/generated/tool-catalog-v1'
-import {
-  ensureWorkflowAccess,
-  ensureWorkspaceAccess,
-  getDefaultWorkspaceId,
-} from '@/lib/copilot/tools/handlers/access'
+import { ensureWorkflowAccess, ensureWorkspaceAccess } from '@/lib/copilot/tools/handlers/access'
 import type { BaseServerTool, ServerToolContext } from '@/lib/copilot/tools/server/base-tool'
+import { requireCopilotWorkspace } from '@/lib/copilot/tools/server/workspace-scope'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { performUpdateCredential } from '@/lib/credentials/orchestration'
 import { listVisibleWorkspaceCredentials } from '@/lib/credentials/queries'
@@ -153,6 +150,12 @@ async function describeSecrets(params: {
   return { described, failures }
 }
 
+/**
+ * Workspace secrets always land in the chat's delegated workspace. Model-supplied
+ * `workspaceId`/`workflowId` may only re-assert that workspace — never select a
+ * different one the acting user happens to access, and never fall back to a
+ * default workspace when the scope is missing.
+ */
 async function resolveWorkspaceId(
   params: SetEnvironmentVariablesParams,
   context: ServerToolContext | undefined,
@@ -166,16 +169,12 @@ async function resolveWorkspaceId(
         `Workflow ${params.workflowId} is not associated with a workspace`
       )
     }
-    return workflow.workspaceId
-  }
-
-  const workspaceId = params.workspaceId ?? context?.workspaceId
-  if (workspaceId) {
-    await ensureWorkspaceAccess(workspaceId, userId, 'write')
-    return workspaceId
+    return requireCopilotWorkspace(context ?? {}, workflow.workspaceId)
   }
 
-  return getDefaultWorkspaceId(userId)
+  const workspaceId = requireCopilotWorkspace(context ?? {}, params.workspaceId)
+  await ensureWorkspaceAccess(workspaceId, userId, 'write')
+  return workspaceId
 }
 
 export const setEnvironmentVariablesServerTool: BaseServerTool<

apps/sim/lib/copilot/tools/server/workflow/query-logs.test.ts

@@ -215,6 +215,36 @@ describe('queryLogsServerTool', () => {
     expect(result.error).toContain('missing')
   })
 
+  it('accepts a workspaceId that re-asserts the execution workspace', async () => {
+    listLogsMock.mockResolvedValue({ data: [], nextCursor: null, total: 0 })
+
+    await queryLogsServerTool.execute({ view: 'list', workspaceId: 'ws-1' } as any, ctx)
+
+    expect(listLogsMock).toHaveBeenCalledTimes(1)
+    expect(listLogsMock.mock.calls[0][0].workspaceId).toBe('ws-1')
+  })
+
+  it('rejects a workspaceId that names a different workspace', async () => {
+    await expect(
+      queryLogsServerTool.execute({ view: 'list', workspaceId: 'ws-other' } as any, ctx)
+    ).rejects.toThrow('Workspace ID does not match the Copilot execution workspace')
+
+    expect(listLogsMock).not.toHaveBeenCalled()
+  })
+
+  it('fails closed when the context carries no workspace', async () => {
+    await expect(
+      queryLogsServerTool.execute(
+        { view: 'list', workspaceId: 'ws-1' } as any,
+        {
+          userId: 'user-1',
+        } as any
+      )
+    ).rejects.toThrow('Copilot execution workspace is required')
+
+    expect(listLogsMock).not.toHaveBeenCalled()
+  })
+
   it('throws when unauthenticated', async () => {
     await expect(
       queryLogsServerTool.execute({ view: 'overview', executionId: 'exec-1' } as any, {} as any)

apps/sim/lib/copilot/tools/server/workflow/query-logs.ts

@@ -2,7 +2,7 @@ import { createLogger } from '@sim/logger'
 import { z } from 'zod'
 import { QueryLogs } from '@/lib/copilot/generated/tool-catalog-v1'
 import type { BaseServerTool, ServerToolContext } from '@/lib/copilot/tools/server/base-tool'
-import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { requireCopilotWorkspace } from '@/lib/copilot/tools/server/workspace-scope'
 import {
   collectLargeValueExecutionIds,
   collectLargeValueKeys,
@@ -118,12 +118,13 @@ const queryLogsArgsSchema = z.preprocess((value) => {
 
 type QueryLogsArgs = z.infer<typeof queryLogsArgsSchema>
 
+/**
+ * Logs are always read from the chat's delegated workspace. A model-supplied
+ * `workspaceId` may only re-assert that workspace — it can never select a
+ * different one, even one the acting user could otherwise access.
+ */
 function resolveWorkspaceId(args: QueryLogsArgs, context?: ServerToolContext): string {
-  const workspaceId = args.workspaceId ?? context?.workspaceId
-  if (!workspaceId) {
-    throw new OrchestrationError('validation', 'workspaceId is required')
-  }
-  return workspaceId
+  return requireCopilotWorkspace(context ?? {}, args.workspaceId)
 }
 
 function buildLogViewContext(

apps/sim/lib/copilot/tools/server/workspace-scope.ts

@@ -0,0 +1,23 @@
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+
+interface CopilotWorkspaceScopeContext {
+  workspaceId?: string
+}
+
+/**
+ * Returns the execution workspace only. Model-provided workspace ids may assert the same value,
+ * but can never select a different workspace or trigger a default-workspace fallback.
+ */
+export function requireCopilotWorkspace(
+  context: CopilotWorkspaceScopeContext,
+  assertedWorkspaceId?: string
+): string {
+  if (!context.workspaceId) throw new Error('Copilot execution workspace is required')
+  if (assertedWorkspaceId && assertedWorkspaceId !== context.workspaceId) {
+    throw new OrchestrationError(
+      'validation',
+      'Workspace ID does not match the Copilot execution workspace'
+    )
+  }
+  return context.workspaceId
+}