improvement(cli-auth): reuse the api-key access schema and tidy handoff validation

Author: waleedlatif1

apps/sim/app/api/cli/auth/approve/route.ts

@@ -28,8 +28,9 @@ const logger = createLogger('CliAuthApproveAPI')
  *
  * That makes the approval record the sole carrier of the decision. The poll body
  * is a request id and a secret and nothing else, so it cannot assert a scope, a
- * workspace, a binding, an access level, or a lifetime of its own — a refusal here writes no record, and a
- * poll driven directly against the same request id answers `pending` forever.
+ * workspace, a binding, an access level, or a lifetime of its own — a refusal
+ * here writes no record, and a poll driven directly against the same request id
+ * answers `pending` forever.
  */
 export const POST = withRouteHandler(async (request: NextRequest) => {
   const session = await getSession()

apps/sim/app/api/cli/auth/poll/route.ts

@@ -1,3 +1,4 @@
+import type { ApiKeyAccess } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
 import { pollCliAuthContract } from '@/lib/api/contracts'
@@ -67,7 +68,7 @@ async function mintForGrant(grant: ApprovalGrant): Promise<
   | {
       ok: true
       key: { id: string; apiKey: string }
-      settings?: { access: 'read' | 'write'; expiresAt: string | null }
+      settings?: { access: ApiKeyAccess; expiresAt: string | null }
     }
   | { ok: false; status: number; message: string }
 > {

apps/sim/app/cli/auth/cli-auth-request.ts

@@ -72,20 +72,18 @@ export function resolveCliAuthRequest({
     return { valid: false, reason: 'Key access and expiry only apply to Sim API keys.' }
   }
 
-  const keyAccess: ApiKeyAccess | null =
-    access === null ? 'write' : access === 'read' || access === 'write' ? access : null
-  if (!keyAccess) {
+  const keyAccess = access ?? 'write'
+  if (keyAccess !== 'read' && keyAccess !== 'write') {
     return { valid: false, reason: 'The requested key access is malformed.' }
   }
 
   const expiresInDays = expires === null ? null : Number(expires)
   if (
     expires !== null &&
-    !(
-      /^\d+$/.test(expires) &&
-      Number(expires) >= CLI_AUTH_MIN_EXPIRY_DAYS &&
-      Number(expires) <= CLI_AUTH_MAX_EXPIRY_DAYS
-    )
+    (!/^\d+$/.test(expires) ||
+      expiresInDays === null ||
+      expiresInDays < CLI_AUTH_MIN_EXPIRY_DAYS ||
+      expiresInDays > CLI_AUTH_MAX_EXPIRY_DAYS)
   ) {
     return {
       valid: false,

apps/sim/lib/api/contracts/api-keys.ts

@@ -4,7 +4,7 @@ import { defineRouteContract } from '@/lib/api/contracts/types'
 /** One day in milliseconds: a key's expiry options and its creation bounds are counted in days. */
 export const DAY_MS = 24 * 60 * 60 * 1000
 
-const apiKeyAccessSchema = z.enum(['read', 'write'])
+export const apiKeyAccessSchema = z.enum(['read', 'write'])
 export type ApiKeyAccessLevel = z.output<typeof apiKeyAccessSchema>
 
 const apiKeyMetadataSchema = z.object({

apps/sim/lib/api/contracts/cli-auth.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod'
+import { apiKeyAccessSchema } from '@/lib/api/contracts/api-keys'
 import { workspaceIdSchema } from '@/lib/api/contracts/primitives'
 import { defineRouteContract } from '@/lib/api/contracts/types'
 
@@ -29,9 +30,6 @@ const base64Url43 = (message: string) => z.string().regex(/^[A-Za-z0-9\-_]{43}$/
 export const cliAuthScopeSchema = z.enum(['copilot', 'platform']).default('copilot')
 export type CliAuthScope = z.output<typeof cliAuthScopeSchema>
 
-/** Access a minted platform key carries: full (`write`) or read-only (`read`). */
-const cliAuthKeyAccessSchema = z.enum(['read', 'write'])
-
 /**
  * Bounds on a minted platform key's lifetime, in whole days. The same window
  * every other key-creation surface allows: one day to one year.
@@ -72,7 +70,7 @@ export const approveCliAuthBodySchema = z.object({
    * approves; recording it here, rather than reading it at poll time, is what
    * keeps the unauthenticated poll from widening it.
    */
-  access: cliAuthKeyAccessSchema.optional().default('write'),
+  access: apiKeyAccessSchema.optional().default('write'),
   /** Platform scope only: days until the minted key expires. Absent means it never expires. */
   expiresInDays: cliAuthExpiresInDaysSchema.optional(),
 })
@@ -132,7 +130,7 @@ export const pollCliAuthContract = defineRouteContract({
          * A terminal that asked for read-only must check this rather than
          * assume it — a server that predates the field mints full access.
          */
-        access: cliAuthKeyAccessSchema.optional(),
+        access: apiKeyAccessSchema.optional(),
         /** Platform scope only: when the key expires, or null when it never does. */
         expiresAt: z.string().nullable().optional(),
       }),

apps/sim/lib/workspaces/application/update-workspace.ts

@@ -12,7 +12,10 @@ import {
   resolveActiveWorkspaceApplicationContext,
 } from '@/lib/workspaces/application/context'
 import { workspaceUpdateOperations } from '@/lib/workspaces/application/operations'
-import { countPublicWorkspaceMembers } from '@/lib/workspaces/public-queries'
+import {
+  countPublicWorkspaceMembers,
+  type PublicWorkspaceDetail,
+} from '@/lib/workspaces/public-queries'
 import {
   applyWorkspaceUpdate,
   readWorkspaceIdentityRecord,
@@ -111,7 +114,15 @@ export const updateWorkspaceIdentity = defineAuthorizedWorkspaceUseCase({
       ...result,
       patch,
       identity: presentIdentity(result.updated),
-      workspace: { id, name, color, logoUrl, memberCount, createdAt, updatedAt },
+      workspace: {
+        id,
+        name,
+        color,
+        logoUrl,
+        memberCount,
+        createdAt,
+        updatedAt,
+      } satisfies PublicWorkspaceDetail,
     }
   },
   projectAudit: ({ result }) => projectUpdateAudit(result.patch, result),