feat(workflows): expose authenticated run subjects

Author: TheodoreSpeaks

apps/sim/app/api/auth/oauth/token/route.ts

@@ -1,5 +1,8 @@
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
-import type { WorkflowExecutionDelegatedPrincipal } from '@sim/auth/principal'
+import {
+  resolvePrincipalSubject,
+  type WorkflowExecutionDelegatedPrincipal,
+} from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
@@ -206,16 +209,19 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           request,
         })
 
-        captureServerEvent(
-          managedOAuthPrincipal.subjectUserId,
-          'credential_used',
-          {
-            credential_type: 'managed_oauth',
-            provider_id: toolMetadata.oauth.provider,
-            workspace_id: managedOAuthPrincipal.workspaceId,
-          },
-          { groups: { workspace: managedOAuthPrincipal.workspaceId } }
-        )
+        const managedOAuthSubject = resolvePrincipalSubject(managedOAuthPrincipal)
+        if (managedOAuthSubject?.kind === 'sim_user') {
+          captureServerEvent(
+            managedOAuthSubject.userId,
+            'credential_used',
+            {
+              credential_type: 'managed_oauth',
+              provider_id: toolMetadata.oauth.provider,
+              workspace_id: managedOAuthPrincipal.workspaceId,
+            },
+            { groups: { workspace: managedOAuthPrincipal.workspaceId } }
+          )
+        }
 
         return NextResponse.json(
           {

apps/sim/app/api/chat/[identifier]/otp/route.test.ts

@@ -483,6 +483,13 @@ describe('Chat OTP API Route', () => {
 
       expect(mockRedisGet).toHaveBeenCalledWith(`otp:${mockEmail}:${mockChatId}`)
       expect(mockRedisDel).toHaveBeenCalledWith(`otp:${mockEmail}:${mockChatId}`)
+      expect(mockSetChatAuthCookie).toHaveBeenCalledWith(
+        expect.anything(),
+        mockChatId,
+        'email',
+        undefined,
+        mockEmail
+      )
       expect(dbChainMockFns.select).toHaveBeenCalledTimes(1)
     })
   })

apps/sim/app/api/chat/[identifier]/otp/route.ts

@@ -222,7 +222,7 @@ export const PUT = withRouteHandler(
         includeThinking: deployment.includeThinking ?? false,
         includeToolCalls: deployment.includeToolCalls ?? false,
       })
-      setChatAuthCookie(response, deployment.id, deployment.authType, deployment.password)
+      setChatAuthCookie(response, deployment.id, deployment.authType, deployment.password, email)
 
       return response
     } catch (error) {

apps/sim/app/api/chat/[identifier]/route.test.ts

@@ -413,6 +413,39 @@ describe('Chat Identifier API Route', () => {
       )
     }, 10000)
 
+    it('executes with the email proven by the chat authentication gate', async () => {
+      mockValidateChatAuth.mockResolvedValueOnce({
+        authorized: true,
+        authenticatedEmail: 'person@example.com',
+      })
+      const req = createMockNextRequest('POST', { input: 'Hello world' })
+
+      const response = await POST(req, {
+        params: Promise.resolve({ identifier: 'test-chat' }),
+      })
+      expect(response.status).toBe(200)
+
+      const streamOptions = vi.mocked(createStreamingResponse).mock.calls[0][0]
+      await streamOptions.executeFn({
+        onStream: vi.fn(),
+        onBlockComplete: vi.fn(),
+        abortSignal: new AbortController().signal,
+      })
+
+      expect(vi.mocked(executeWorkflow).mock.calls[0][4]).toMatchObject({
+        principal: {
+          kind: 'system',
+          serviceId: 'chat',
+          workspaceId: 'test-workspace-id',
+          workflowId: 'workflow-id',
+          subject: {
+            kind: 'authenticated_email',
+            email: 'person@example.com',
+          },
+        },
+      })
+    }, 10000)
+
     /**
      * A row predating the column has no tool policy, so it has not opted in.
      * Thinking must not drag tool frames along with it.

apps/sim/app/api/chat/[identifier]/route.ts

@@ -310,6 +310,20 @@ export const POST = withRouteHandler(
               resolvedActorUserId,
               {
                 enabled: true,
+                principal: {
+                  kind: 'system',
+                  serviceId: 'chat',
+                  workspaceId,
+                  workflowId: deployment.workflowId,
+                  ...(authResult.authenticatedEmail
+                    ? {
+                        subject: {
+                          kind: 'authenticated_email' as const,
+                          email: authResult.authenticatedEmail,
+                        },
+                      }
+                    : {}),
+                },
                 selectedOutputs,
                 isSecureMode: true,
                 workflowTriggerType: 'chat',

apps/sim/app/api/chat/utils.test.ts

@@ -18,14 +18,14 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 const {
   mockMergeSubblockStateWithValues,
   mockMergeSubBlockValues,
-  mockValidateAuthToken,
+  mockReadDeploymentAuthToken,
   mockSetDeploymentAuthCookie,
   mockIsEmailAllowed,
   mockCheckRateLimitDirect,
 } = vi.hoisted(() => ({
   mockMergeSubblockStateWithValues: vi.fn().mockReturnValue({}),
   mockMergeSubBlockValues: vi.fn().mockReturnValue({}),
-  mockValidateAuthToken: vi.fn().mockReturnValue(false),
+  mockReadDeploymentAuthToken: vi.fn().mockReturnValue(null),
   mockSetDeploymentAuthCookie: vi.fn(),
   mockIsEmailAllowed: vi.fn(),
   mockCheckRateLimitDirect: vi.fn().mockResolvedValue({ allowed: true }),
@@ -57,7 +57,7 @@ vi.mock('@sim/workflow-persistence/subblocks', () => ({
 vi.mock('@/lib/core/security/encryption', () => encryptionMock)
 
 vi.mock('@/lib/core/security/deployment', () => ({
-  validateAuthToken: mockValidateAuthToken,
+  readDeploymentAuthToken: mockReadDeploymentAuthToken,
   setDeploymentAuthCookie: mockSetDeploymentAuthCookie,
   isEmailAllowed: mockIsEmailAllowed,
   deploymentAuthCookieName: (prefix: string, id: string) => `${prefix}_auth_${id}`,
@@ -84,7 +84,7 @@ describe('Chat API Utils', () => {
 
   describe('Auth token utils', () => {
     it('should accept valid auth cookie via validateChatAuth', async () => {
-      mockValidateAuthToken.mockReturnValue(true)
+      mockReadDeploymentAuthToken.mockReturnValue({})
 
       const deployment = {
         id: 'chat-id',
@@ -100,7 +100,7 @@ describe('Chat API Utils', () => {
       } as any
 
       const result = await validateChatAuth('request-id', deployment, mockRequest)
-      expect(mockValidateAuthToken).toHaveBeenCalledWith(
+      expect(mockReadDeploymentAuthToken).toHaveBeenCalledWith(
         'valid-token',
         'chat-id',
         'password',
@@ -110,7 +110,7 @@ describe('Chat API Utils', () => {
     })
 
     it('should reject invalid auth cookie via validateChatAuth', async () => {
-      mockValidateAuthToken.mockReturnValue(false)
+      mockReadDeploymentAuthToken.mockReturnValue(null)
 
       const deployment = {
         id: 'chat-id',
@@ -128,6 +128,26 @@ describe('Chat API Utils', () => {
       const result = await validateChatAuth('request-id', deployment, mockRequest)
       expect(result.authorized).toBe(false)
     })
+
+    it('returns the authenticated email carried by a valid email-auth cookie', async () => {
+      mockReadDeploymentAuthToken.mockReturnValue({ authenticatedEmail: 'person@example.com' })
+
+      const deployment = {
+        id: 'chat-id',
+        authType: 'email',
+      }
+      const mockRequest = {
+        method: 'POST',
+        cookies: {
+          get: vi.fn().mockReturnValue({ value: 'valid-token' }),
+        },
+      } as any
+
+      await expect(validateChatAuth('request-id', deployment, mockRequest)).resolves.toEqual({
+        authorized: true,
+        authenticatedEmail: 'person@example.com',
+      })
+    })
   })
 
   describe('Cookie handling', () => {
@@ -143,9 +163,27 @@ describe('Chat API Utils', () => {
         'chat',
         'test-chat-id',
         'password',
+        undefined,
         undefined
       )
     })
+
+    it('forwards an authenticated email into the signed deployment cookie', () => {
+      const mockResponse = {
+        cookies: { set: vi.fn() },
+      } as unknown as NextResponse
+
+      setChatAuthCookie(mockResponse, 'test-chat-id', 'email', undefined, 'person@example.com')
+
+      expect(mockSetDeploymentAuthCookie).toHaveBeenCalledWith(
+        mockResponse,
+        'chat',
+        'test-chat-id',
+        'email',
+        undefined,
+        'person@example.com'
+      )
+    })
   })
 
   describe('Chat auth validation', () => {
@@ -427,14 +465,17 @@ describe('Chat API Utils', () => {
       })
 
       it('authorizes execution when session email is allowlisted', async () => {
-        mockGetSession.mockResolvedValue({ user: { email: 'user@example.com' } })
+        mockGetSession.mockResolvedValue({ user: { email: 'User@Example.com' } })
         mockIsEmailAllowed.mockReturnValue(true)
 
         const result = await validateChatAuth('request-id', ssoDeployment, postRequest, {
           input: 'hello',
         })
 
-        expect(result.authorized).toBe(true)
+        expect(result).toEqual({
+          authorized: true,
+          authenticatedEmail: 'user@example.com',
+        })
       })
 
       it('rejects execution when session email is not allowlisted', async () => {

apps/sim/app/api/chat/utils.ts

@@ -13,9 +13,10 @@ export function setChatAuthCookie(
   response: NextResponse,
   chatId: string,
   type: string,
-  encryptedPassword?: string | null
+  encryptedPassword?: string | null,
+  authenticatedEmail?: string
 ): void {
-  setDeploymentAuthCookie(response, 'chat', chatId, type, encryptedPassword)
+  setDeploymentAuthCookie(response, 'chat', chatId, type, encryptedPassword, authenticatedEmail)
 }
 
 /**

apps/sim/app/api/files/public/[token]/otp/route.test.ts

@@ -237,7 +237,8 @@ describe('PUT /api/files/public/[token]/otp', () => {
       'file',
       'sh_1',
       'email',
-      null
+      null,
+      'user@acme.com'
     )
   })
 

apps/sim/app/api/files/public/[token]/otp/route.ts

@@ -207,7 +207,8 @@ export const PUT = withRouteHandler(
         'file',
         resolved.share.id,
         resolved.share.authType,
-        resolved.share.password
+        resolved.share.password,
+        email
       )
       logger.info(`[${requestId}] OTP verified for share ${resolved.share.id}`)
       return response

apps/sim/app/api/files/uploads/purposes.ts

@@ -251,6 +251,8 @@ async function principalUserId(principal: Principal, workspaceId?: string): Prom
       }
     case 'delegated':
       throw new UploadSessionError('forbidden', 'Delegated principals cannot create uploads')
+    case 'system':
+      throw new UploadSessionError('forbidden', 'System principals cannot create uploads')
     case 'credential_group_enrollment':
       throw new UploadSessionError(
         'forbidden',