fix(resume): require write access to resume a paused run on the legacy route by waleedlatif1 · Pull Request #8896 · simstudioai/sim

waleedlatif1 · 2026-10-10T20:01:15Z

Summary

Legacy POST /api/resume/[workflowId]/[executionId]/[contextId] authorized through validateWorkflowAccess, which only checks workspace read, so a read-only member or their API key could answer a human-in-the-loop pause and continue the run with their own input
The route now authenticates with internalWorkflowSessionOrApiKeyAuth and runs resumeWorkflowRun, the same workflows.runs.resume operation (write role) the v2 resume route uses, which also brings the run-to-workflow scope check and cross-tenant concealment
resumeWorkflowRun takes the calling surface (legacy | v2) so the legacy route keeps streaming and job-id polling, and forwards the request signal/headers a streamed resume needs
Inlined the single-consumer resume-handler.ts presenter into the route, keeping its legacy-only "failed sync run → 400 { error }" answer; the GET detail handler stays read
Response contract changes on the legacy route: an unexpected server fault (malformed snapshot, run buffer unavailable, DB error) now returns a generic 500 instead of a 400 echoing the raw message; typed admission failures keep their 4xx. OAuth and delegated principals are now treated as API callers (previously only API keys)

Type of Change

Bug fix

Testing

Regression tests: a read-role member gets 403 from the legacy POST over session and personal-API-key auth, and nothing is enqueued; they go red when resumeRun is lowered to read
The legacy failed-sync-run 400 test goes red when the ported branch is removed
[contextId]/route.test.ts, resume/poll/route.test.ts, run-control.test.ts, v2 resume/route.test.ts (53/53)
bun run lint; generators in sync; remaining audits, type-check, and the full suite run in CI

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

…y route POST /api/resume/[workflowId]/[executionId]/[contextId] authorized with validateWorkflowAccess, which checks workspace read permission, so a read-only member (or their API key) could answer a human-in-the-loop pause and continue the run with arbitrary input. The route now authenticates with the internal workflow session/API-key policy and runs the resumeWorkflowRun use case, the same write-role operation the v2 resume route uses. resumeWorkflowRun takes the calling surface ('legacy' | 'v2') so the legacy route keeps its streaming and job-id polling responses, and forwards the request signal and headers a streamed resume needs.

vercel · 2026-10-10T20:01:21Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 15, 2026 1:15am UTC

cubic-dev-ai

All reported issues were addressed across 8 files

_{Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

Turn on auto-fix | Re-trigger cubic}

greptile-apps · 2026-10-10T20:05:37Z

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge; no actionable new issues were found.

Summary

The legacy resume POST now requires write access through resumeWorkflowRun, while keeping streaming and job polling.

Legacy resume requests now require workspace write access.
Legacy resume responses separate failed runs from server faults.
The project file-search query schema stays local to its contract.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Legacy[Legacy resume POST] --> Auth[Authenticate caller]
  V2[V2 resume POST] --> Auth
  Auth --> Gate[Check run scope and write access]
  Gate --> Resume[resumeWorkflowRun]
  Resume --> Executor[Continue paused run]
  Executor --> LegacyResponse[Legacy stream or JSON response]
  Executor --> V2Response[V2 JSON response]

_{Reviews (4) · Last reviewed commit: "fix(resume): withhold unsafe resume fail..." · Reviewed by Greptile}

…s a 500

waleedlatif1 · 2026-10-10T20:07:29Z

@greptile

waleedlatif1 · 2026-10-10T20:07:30Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-10T20:07:35Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 8 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

Turn on auto-fix | Re-trigger cubic}

…ite-authz # Conflicts: # apps/sim/app/api/resume/[workflowId]/[executionId]/[contextId]/route.test.ts # apps/sim/app/api/resume/resume-handler.ts

… and tighten comments

…ace option

…ite-authz

waleedlatif1 · 2026-10-15T01:06:10Z

@greptile

waleedlatif1 · 2026-10-15T01:06:12Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-15T01:06:18Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

1 issue found across 8 files

Confidence score: 3/5

In resume-run.ts, session-authenticated legacy requests now return started after launching detached work, bypassing the API execution modes and potentially breaking streaming, synchronous failure responses, and async job-ID handling. Preserve the execution-mode behavior for these requests.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/lib/workflows/application/resume-run.ts">

<violation number="1" location="apps/sim/lib/workflows/application/resume-run.ts:35">
P1: Session-authenticated legacy requests now bypass the API execution-mode branches and return `started` after launching detached work, instead of preserving streaming, synchronous failure responses, and async job-ID polling. Treat legacy requests as API callers regardless of principal kind.</violation>
</file>

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

Also drop two unused exports from the v2 Project file search contract that fail check:unused-exports on staging.

waleedlatif1 · 2026-10-15T01:16:08Z

@greptile

waleedlatif1 · 2026-10-15T01:16:09Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-15T01:16:16Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 9 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

cubic-dev-ai Bot reviewed Oct 10, 2026

View reviewed changes

Comment thread apps/sim/app/api/resume/[workflowId]/[executionId]/[contextId]/route.ts Outdated

fix(resume): let unexpected resume failures reach the route handler a…

a53667e

…s a 500

vercel Bot temporarily deployed to Preview October 10, 2026 20:07 Inactive

cubic-dev-ai Bot reviewed Oct 10, 2026

View reviewed changes

waleedlatif1 added 4 commits October 14, 2026 18:00

Merge remote-tracking branch 'origin/staging' into fix/resume-post-wr…

ddca8ea

…ite-authz # Conflicts: # apps/sim/app/api/resume/[workflowId]/[executionId]/[contextId]/route.test.ts # apps/sim/app/api/resume/resume-handler.ts

refactor(resume): fold the legacy route's auth catch into one handler…

c7e6864

… and tighten comments

docs(resume): note the v2 job-id dedupe on the executor's pollingSurf…

5949b2b

…ace option

Merge remote-tracking branch 'origin/staging' into fix/resume-post-wr…

94fe01e

…ite-authz

cubic-dev-ai Bot reviewed Oct 15, 2026

View reviewed changes

Comment thread apps/sim/lib/workflows/application/resume-run.ts

Comment thread apps/sim/app/api/resume/[workflowId]/[executionId]/[contextId]/route.ts

vercel Bot deployed to Preview October 15, 2026 01:09

View deployment

fix(resume): withhold unsafe resume failure messages on the legacy route

224476a

Also drop two unused exports from the v2 Project file search contract that fail check:unused-exports on staging.

vercel Bot temporarily deployed to Preview October 15, 2026 01:15 Inactive

cubic-dev-ai Bot reviewed Oct 15, 2026

View reviewed changes

Conversation

waleedlatif1 commented Oct 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Oct 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

waleedlatif1 commented Oct 10, 2026

Uh oh!

waleedlatif1 commented Oct 10, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 10, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 15, 2026

Uh oh!

waleedlatif1 commented Oct 15, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 15, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 15, 2026

Uh oh!

waleedlatif1 commented Oct 15, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 15, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

This branch was previously deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented Oct 10, 2026 •

edited

Loading

vercel Bot commented Oct 10, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Oct 10, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading