fix(api): publish the workspace PATCH body rules and check CLI-minted keys exactly

- PATCH /v2/workspaces/{id}: the body schema publishes minProperties 1, and
  logoUrl is a pattern (root-relative path or https URL, protocol-relative
  refused) instead of an unpublished refine.
- sim login refuses a minted key whose access or expiry differs from the
  request in either direction, with the expiry checked against the requested
  days within a clock tolerance.
- sim workspaces update --logo-url documents that clearing the logo goes
  through the API or MCP.

Author: waleedlatif1

apps/docs/content/docs/cli/reference.mdx

@@ -9255,7 +9255,7 @@ sim workspaces update [options]
 | Option | Required | Description |
 | --- | --- | --- |
 | `--name <value>` | No | New workspace display name. |
-| `--logo-url <value>` | No | New workspace logo URL, or null to remove the logo. (--logo-url null sends the word, not JSON null). |
+| `--logo-url <value>` | No | New workspace logo: a root-relative path (starting with /) or an https:// URL. To remove the logo, send logoUrl: null through the API or MCP (--logo-url null sends the word, not JSON null). |
 
 </CommandTable>
 

apps/docs/content/docs/cli/workspaces.mdx

@@ -56,7 +56,7 @@ sim workspaces update [options]
 | Option | Required | Description |
 | --- | --- | --- |
 | `--name <value>` | No | New workspace display name. |
-| `--logo-url <value>` | No | New workspace logo URL, or null to remove the logo. (--logo-url null sends the word, not JSON null). |
+| `--logo-url <value>` | No | New workspace logo: a root-relative path (starting with /) or an https:// URL. To remove the logo, send logoUrl: null through the API or MCP (--logo-url null sends the word, not JSON null). |
 
 </CommandTable>
 

apps/docs/openapi-v2-resources.json

@@ -15258,10 +15258,11 @@
             "maxLength": 255
           },
           "logoUrl": {
-            "description": "New workspace logo URL, or null to remove the logo.",
+            "description": "New workspace logo URL: a root-relative path (starting with /) or an https:// URL. Send null to remove the logo.",
             "anyOf": [
               {
-                "type": "string"
+                "type": "string",
+                "pattern": "^(\\/(?!\\/)|https:\\/\\/)"
               },
               {
                 "type": "null"
@@ -15270,6 +15271,7 @@
           }
         },
         "additionalProperties": false,
+        "minProperties": 1,
         "title": "Update workspace body",
         "description": "The workspace fields to change.",
         "examples": [

apps/sim/lib/api/contracts/v2/workspaces.ts

@@ -121,17 +121,18 @@ const v2UpdateWorkspaceBodySchema = z
       .describe('New workspace display name.'),
     logoUrl: z
       .string()
-      .refine((value) => value.startsWith('/') || value.startsWith('https://'), {
-        message: 'logoUrl must be an absolute path or an HTTPS URL',
-      })
+      .regex(/^(\/(?!\/)|https:\/\/)/, 'logoUrl must be a root-relative path or an HTTPS URL')
       .nullable()
       .optional()
-      .describe('New workspace logo URL, or null to remove the logo.'),
+      .describe(
+        'New workspace logo URL: a root-relative path (starting with /) or an https:// URL. Send null to remove the logo.'
+      ),
   })
   .strict()
   .refine((body) => body.name !== undefined || body.logoUrl !== undefined, {
     message: 'Provide name or logoUrl',
   })
+  .meta({ minProperties: 1 })
 
 export const v2UpdateWorkspaceContract = defineRouteContract({
   method: 'PATCH',

packages/sim-cli/src/commands/auth.test.ts

@@ -343,14 +343,33 @@ describe('login command', () => {
       expiresAt: null,
     })
 
-    await expect(login('--read-only')).rejects.toThrow('not the read-only key requested')
+    await expect(login('--read-only')).rejects.toThrow(
+      'issued a full-access key, not the key requested'
+    )
 
     expect(mocks.writeCredentialsProfile).not.toHaveBeenCalled()
     expect(vi.mocked(console.log).mock.calls.flat().join('\n')).toContain(
       'API key key-id was created but could not be stored safely'
     )
   })
 
+  it('stores nothing when the issued expiry is not the one requested', async () => {
+    setInteractive(false)
+    mocks.pollForKey.mockResolvedValue({
+      id: 'key-id',
+      apiKey: 'sim-key',
+      scope: 'platform',
+      workspaceBound: false,
+      workspaceId: 'ws_1',
+      access: 'write',
+      expiresAt: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000).toISOString(),
+    })
+
+    await expect(login('--expires-in', '30')).rejects.toThrow('not the key requested')
+
+    expect(mocks.writeCredentialsProfile).not.toHaveBeenCalled()
+  })
+
   it('stores nothing when the server answers with a malformed key', async () => {
     setInteractive(false)
     mocks.pollForKey.mockResolvedValue({

packages/sim-cli/src/commands/auth.ts

@@ -639,26 +639,47 @@ export function loginCommand(): Command {
     })
 }
 
+const DAY_MS = 24 * 60 * 60 * 1000
+
+/**
+ * Clock difference tolerated between this machine and the server when checking
+ * a minted key's expiry against the lifetime requested.
+ */
+const EXPIRY_TOLERANCE_MS = 60 * 60 * 1000
+
 /**
- * Refuses a minted key that is not the one requested.
+ * Refuses a minted key that is not exactly the one requested.
  *
  * The approval decides what is minted, and a server that predates read-only
  * and expiring handoff keys ignores the request and mints a full-access key
- * that never expires. Storing that after `--read-only` would hand back the
- * opposite of what was asked for.
+ * that never expires. A server that reports anything else — full access after
+ * `--read-only`, read-only without it, a lifetime other than `--expires-in` —
+ * minted a key nobody asked for, and storing it would hide that.
  */
 function requireRequestedKey(key: MintedKey, keyRequest: KeyRequest): void {
-  if (keyRequest.readOnly && key.access !== 'read') {
-    throw new SimApiError(
-      'The server issued a full-access key, not the read-only key requested. Nothing was stored; update the Sim deployment or drop --read-only.',
+  const refuse = (issued: string, flag: string) =>
+    new SimApiError(
+      `The server issued ${issued}, not the key requested. Nothing was stored; update the Sim deployment or adjust ${flag}.`,
       0
     )
+
+  const requestedAccess = keyRequest.readOnly ? 'read' : 'write'
+  // A server that predates the field reports none and mints full access.
+  const issuedAccess = key.access ?? 'write'
+  if (issuedAccess !== requestedAccess) {
+    throw refuse(issuedAccess === 'read' ? 'a read-only key' : 'a full-access key', '--read-only')
   }
-  if (keyRequest.expiresInDays !== undefined && !key.expiresAt) {
-    throw new SimApiError(
-      'The server issued a key that never expires, not one with the requested expiry. Nothing was stored; update the Sim deployment or drop --expires-in.',
-      0
-    )
+
+  if (keyRequest.expiresInDays === undefined) {
+    if (key.expiresAt)
+      throw refuse(`a key that expires ${safeOneLine(key.expiresAt ?? '')}`, '--expires-in')
+    return
+  }
+  const expiresAt = key.expiresAt ? Date.parse(key.expiresAt) : Number.NaN
+  if (Number.isNaN(expiresAt)) throw refuse('a key that never expires', '--expires-in')
+  const requested = Date.now() + keyRequest.expiresInDays * DAY_MS
+  if (Math.abs(expiresAt - requested) > EXPIRY_TOLERANCE_MS) {
+    throw refuse(`a key that expires ${safeOneLine(key.expiresAt ?? '')}`, '--expires-in')
   }
 }
 

packages/sim-cli/src/contract/commands.ts

@@ -1538,6 +1538,15 @@ export const CLI_CONTRACT: CliContract = {
   updateWorkspace: {
     profileWorkspacePath: true,
     fields: WORKSPACE_FIELDS,
+    // Body strings are sent as typed, so this flag cannot send JSON null; the
+    // literal "null" fails the path-or-HTTPS rule with a 400 rather than
+    // storing anything. Clearing stays an API and MCP capability.
+    flags: {
+      logoUrl: {
+        describe:
+          'New workspace logo: a root-relative path (starting with /) or an https:// URL. To remove the logo, send logoUrl: null through the API or MCP',
+      },
+    },
   },
   listWorkspaceMembers: {
     command: 'workspaces members list',

packages/sim-cli/src/generated/v2-api.ts

@@ -25290,7 +25290,11 @@ export const V2_OPERATIONS = {
     workspaceKeyUnsupported: true,
     body: {
       name: { kind: 'string', describe: 'New workspace display name.' },
-      logoUrl: { kind: 'string', describe: 'New workspace logo URL, or null to remove the logo.' },
+      logoUrl: {
+        kind: 'string',
+        describe:
+          'New workspace logo URL: a root-relative path (starting with /) or an https:// URL. Send null to remove the logo.',
+      },
     },
   },
   updateWorkspaceForkExclusions: {