GeezerVison

* fix(invites): preserve active organization for external access

Keep organization activation server-owned so failed membership checks cannot clear a valid session context.

* feat(admin, billing, settings): cleanup settings visibility, billing actor resolution, new admin routes

* address comments

* chore(db): reset pending migrations before staging merge

Remove locally generated migrations so they can be regenerated against the latest staging schema without preserving stale snapshots or numbering.

* regen migrations

* address comments

* chore(db): reset generated migrations before staging merge

Remove this branch's generated migrations so they can be regenerated against the latest staging schema with fresh numbering.

* upgrade global work

* fix lint

* address comments

* legacy callbacks correctness

* address comments

* update

* guardrail attribution

Loading branch information

Uh oh!

There was an error while loading. Please reload this page.

icecrasher321 authored Jul 13, 2026

commit ef7c8e24b2f3392b68aca6bfe95dd595ef5e18bd

There are no files selected for viewing

11 changes: 8 additions & 3 deletions 11 apps/docs/content/docs/de/api-reference/authentication.mdx

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -12,18 +12,23 @@ To access the Sim API, you need an API key. Sim supports two types of API keys

		\| \| Personal Keys \| Workspace Keys \|
		\| --- \| --- \| --- \|
		\| Billed to \| Your individual account \| Workspace owner \|
		\| Billing \| Workspace payer for workspace-hosted usage \| Workspace payer \|
		\| Scope \| Across workspaces you have access to \| Shared across the workspace \|
		\| Managed by \| Each user individually \| Workspace admins \|
		\| Permissions \| Must be enabled at workspace level \| Require admin permissions \|

		<Callout type="info">
		Workspace admins can disable personal API key usage for their workspace. If disabled, only workspace keys can be used.
		Personal keys identify the user making a request; they do not select who pays.
		Hosted usage is billed to the workspace's organization or personal billing
		account and, for organizations, is attributed to the actor's member cap.
		Workspace admins can disable personal API key usage for their workspace. If
		disabled, only workspace keys can be used.
		</Callout>

		## Generating API Keys

		To generate a key, open the Sim dashboard and navigate to Settings, then go to Sim Keys and click Create.
		To generate a personal key, open Account settings → Sim API keys. Workspace
		administrators can create shared keys from Workspace settings → Sim API keys.

		<Callout type="warn">
		API keys are only shown once when generated. Store your key securely — you will not be able to view it again.
Expand Down

11 changes: 8 additions & 3 deletions 11 apps/docs/content/docs/en/api-reference/authentication.mdx

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -12,18 +12,23 @@ To access the Sim API, you need an API key. Sim supports two types of API keys

		\| \| Personal Keys \| Workspace Keys \|
		\| --- \| --- \| --- \|
		\| Billed to \| Your individual account \| Workspace owner \|
		\| Billing \| Workspace payer for workspace-hosted usage \| Workspace payer \|
		\| Scope \| Across workspaces you have access to \| Shared across the workspace \|
		\| Managed by \| Each user individually \| Workspace admins \|
		\| Permissions \| Must be enabled at workspace level \| Require admin permissions \|

		<Callout type="info">
		Workspace admins can disable personal API key usage for their workspace. If disabled, only workspace keys can be used.
		Personal keys identify the user making a request; they do not select who pays.
		Hosted usage is billed to the workspace's organization or personal billing
		account and, for organizations, is attributed to the actor's member cap.
		Workspace admins can disable personal API key usage for their workspace. If
		disabled, only workspace keys can be used.
		</Callout>

		## Generating API Keys

		To generate a key, open the Sim dashboard and navigate to Settings, then go to Sim Keys and click Create.
		To generate a personal key, open Account settings → Sim API keys. Workspace
		administrators can create shared keys from Workspace settings → Sim API keys.

		<Callout type="warn">
		API keys are only shown once when generated. Store your key securely — you will not be able to view it again.
Expand Down

7 changes: 5 additions & 2 deletions 7 apps/docs/content/docs/en/platform/costs.mdx

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -305,7 +305,9 @@ By default, your usage is capped at the credits included in your plan. To allow
		- Disable On-Demand: Resets your usage limit back to the plan's included amount (only available if your current usage hasn't already exceeded it).

		<Callout type="info">
		On-demand billing is managed by workspace admins for team plans. Non-admin team members cannot toggle on-demand billing.
		On-demand billing for team plans is managed by organization owners and
		administrators. Workspace admin permission alone does not grant billing
		authority.
		</Callout>

		## Plan Limits
Expand Down Expand Up		@@ -371,7 +373,8 @@ Sim uses a base subscription + overage billing model:

		Team Plans:
		- Usage is pooled across internal team members in the organization
		- External workspace members keep their own organization or personal billing context for runs where they are the billing actor
		- Usage in an organization-owned workspace is billed to that workspace's organization, including work performed by external collaborators
		- Each authenticated actor's usage is also counted toward their member cap for that organization
		- Overage is calculated from total team usage against the pooled limit
		- Organization owner receives one bill

Expand Down

11 changes: 8 additions & 3 deletions 11 apps/docs/content/docs/es/api-reference/authentication.mdx

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -12,18 +12,23 @@ To access the Sim API, you need an API key. Sim supports two types of API keys

		\| \| Personal Keys \| Workspace Keys \|
		\| --- \| --- \| --- \|
		\| Billed to \| Your individual account \| Workspace owner \|
		\| Billing \| Workspace payer for workspace-hosted usage \| Workspace payer \|
		\| Scope \| Across workspaces you have access to \| Shared across the workspace \|
		\| Managed by \| Each user individually \| Workspace admins \|
		\| Permissions \| Must be enabled at workspace level \| Require admin permissions \|

		<Callout type="info">
		Workspace admins can disable personal API key usage for their workspace. If disabled, only workspace keys can be used.
		Personal keys identify the user making a request; they do not select who pays.
		Hosted usage is billed to the workspace's organization or personal billing
		account and, for organizations, is attributed to the actor's member cap.
		Workspace admins can disable personal API key usage for their workspace. If
		disabled, only workspace keys can be used.
		</Callout>

		## Generating API Keys

		To generate a key, open the Sim dashboard and navigate to Settings, then go to Sim Keys and click Create.
		To generate a personal key, open Account settings → Sim API keys. Workspace
		administrators can create shared keys from Workspace settings → Sim API keys.

		<Callout type="warn">
		API keys are only shown once when generated. Store your key securely — you will not be able to view it again.
Expand Down

11 changes: 8 additions & 3 deletions 11 apps/docs/content/docs/fr/api-reference/authentication.mdx

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -12,18 +12,23 @@ To access the Sim API, you need an API key. Sim supports two types of API keys

		\| \| Personal Keys \| Workspace Keys \|
		\| --- \| --- \| --- \|
		\| Billed to \| Your individual account \| Workspace owner \|
		\| Billing \| Workspace payer for workspace-hosted usage \| Workspace payer \|
		\| Scope \| Across workspaces you have access to \| Shared across the workspace \|
		\| Managed by \| Each user individually \| Workspace admins \|
		\| Permissions \| Must be enabled at workspace level \| Require admin permissions \|

		<Callout type="info">
		Workspace admins can disable personal API key usage for their workspace. If disabled, only workspace keys can be used.
		Personal keys identify the user making a request; they do not select who pays.
		Hosted usage is billed to the workspace's organization or personal billing
		account and, for organizations, is attributed to the actor's member cap.
		Workspace admins can disable personal API key usage for their workspace. If
		disabled, only workspace keys can be used.
		</Callout>

		## Generating API Keys

		To generate a key, open the Sim dashboard and navigate to Settings, then go to Sim Keys and click Create.
		To generate a personal key, open Account settings → Sim API keys. Workspace
		administrators can create shared keys from Workspace settings → Sim API keys.

		<Callout type="warn">
		API keys are only shown once when generated. Store your key securely — you will not be able to view it again.
Expand Down

11 changes: 8 additions & 3 deletions 11 apps/docs/content/docs/ja/api-reference/authentication.mdx

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -12,18 +12,23 @@ To access the Sim API, you need an API key. Sim supports two types of API keys

		\| \| Personal Keys \| Workspace Keys \|
		\| --- \| --- \| --- \|
		\| Billed to \| Your individual account \| Workspace owner \|
		\| Billing \| Workspace payer for workspace-hosted usage \| Workspace payer \|
		\| Scope \| Across workspaces you have access to \| Shared across the workspace \|
		\| Managed by \| Each user individually \| Workspace admins \|
		\| Permissions \| Must be enabled at workspace level \| Require admin permissions \|

		<Callout type="info">
		Workspace admins can disable personal API key usage for their workspace. If disabled, only workspace keys can be used.
		Personal keys identify the user making a request; they do not select who pays.
		Hosted usage is billed to the workspace's organization or personal billing
		account and, for organizations, is attributed to the actor's member cap.
		Workspace admins can disable personal API key usage for their workspace. If
		disabled, only workspace keys can be used.
		</Callout>

		## Generating API Keys

		To generate a key, open the Sim dashboard and navigate to Settings, then go to Sim Keys and click Create.
		To generate a personal key, open Account settings → Sim API keys. Workspace
		administrators can create shared keys from Workspace settings → Sim API keys.

		<Callout type="warn">
		API keys are only shown once when generated. Store your key securely — you will not be able to view it again.
Expand Down

11 changes: 8 additions & 3 deletions 11 apps/docs/content/docs/zh/api-reference/authentication.mdx

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -12,18 +12,23 @@ To access the Sim API, you need an API key. Sim supports two types of API keys

		\| \| Personal Keys \| Workspace Keys \|
		\| --- \| --- \| --- \|
		\| Billed to \| Your individual account \| Workspace owner \|
		\| Billing \| Workspace payer for workspace-hosted usage \| Workspace payer \|
		\| Scope \| Across workspaces you have access to \| Shared across the workspace \|
		\| Managed by \| Each user individually \| Workspace admins \|
		\| Permissions \| Must be enabled at workspace level \| Require admin permissions \|

		<Callout type="info">
		Workspace admins can disable personal API key usage for their workspace. If disabled, only workspace keys can be used.
		Personal keys identify the user making a request; they do not select who pays.
		Hosted usage is billed to the workspace's organization or personal billing
		account and, for organizations, is attributed to the actor's member cap.
		Workspace admins can disable personal API key usage for their workspace. If
		disabled, only workspace keys can be used.
		</Callout>

		## Generating API Keys

		To generate a key, open the Sim platform and navigate to Settings, then go to Sim Keys and click Create.
		To generate a personal key, open Account settings → Sim API keys. Workspace
		administrators can create shared keys from Workspace settings → Sim API keys.

		<Callout type="warn">
		API keys are only shown once when generated. Store your key securely — you will not be able to view it again.
Expand Down

12 changes: 12 additions & 0 deletions 12 apps/sim/app/(interfaces)/resume/[workflowId]/[executionId]/resume-page-client.tsx

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -819,6 +819,18 @@ export default function ResumeExecutionPage({
		</div>
		</div>

		{selectedDetail.pausePoint.automaticResumeWaitingReason && (
		<div className='rounded-[8px] border border-[var(--border)] bg-[var(--surface-1)] px-4 py-3'>
		<Label>Waiting to resume automatically</Label>
		<p className='mt-1 text-[13px] text-[var(--text-secondary)]'>
		{selectedDetail.pausePoint.automaticResumeWaitingReason}
		</p>
		<p className='mt-1 text-[12px] text-[var(--text-muted)]'>
		Sim will retry automatically.
		</p>
		</div>
		)}

		{/* Already resolved - show form fields with submitted values */}
		{selectedStatus === 'resumed' \|\| selectedStatus === 'failed' ? (
		<div className='overflow-hidden rounded-[8px] border border-[var(--border)] bg-[var(--surface-1)]'>
Expand Down

104 changes: 97 additions & 7 deletions 104 apps/sim/app/_shell/providers/session-provider.test.tsx

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -6,23 +6,22 @@ import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
		import { createRoot, type Root } from 'react-dom/client'
		import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'

		const { mockGetSession, mockSetActive, mockRequestJson } = vi.hoisted(() => ({
		const { mockGetSession, mockListOrganizations, mockSetActive } = vi.hoisted(() => ({
		mockGetSession: vi.fn(),
		mockListOrganizations: vi.fn(),
		mockSetActive: vi.fn(),
		mockRequestJson: vi.fn(),
		}))

		vi.mock('@/lib/auth/auth-client', () => ({
		client: {
		getSession: mockGetSession,
		organization: { setActive: mockSetActive },
		organization: {
		list: mockListOrganizations,
		setActive: mockSetActive,
		},
		},
		}))

		vi.mock('@/lib/api/client/request', () => ({
		requestJson: mockRequestJson,
		}))

		vi.mock('posthog-js', () => ({
		default: {
		identify: vi.fn(),
Expand Down Expand Up		@@ -66,6 +65,16 @@ const FRESH_SESSION: AppSession = {
		session: { id: 's1', userId: 'user-1', activeOrganizationId: 'org-1' },
		}

		const NO_ACTIVE_ORGANIZATION_SESSION: AppSession = {
		user: { id: 'user-1', email: '[email protected]', name: 'No active organization' },
		session: { id: 's1', userId: 'user-1' },
		}

		const RECOVERED_ORGANIZATION_SESSION: AppSession = {
		user: { id: 'user-1', email: '[email protected]', name: 'Recovered organization' },
		session: { id: 's1', userId: 'user-1', activeOrganizationId: 'org-member' },
		}

		interface Harness {
		ctx: () => SessionHookResult \| null
		queryClient: QueryClient
Expand Down Expand Up		@@ -152,6 +161,8 @@ describe('useSessionQuery', () => {
		describe('SessionProvider', () => {
		beforeEach(() => {
		vi.clearAllMocks()
		mockListOrganizations.mockResolvedValue({ data: [], error: null })
		mockSetActive.mockResolvedValue({ data: null, error: null })
		setSearch('')
		})

Expand Down Expand Up		@@ -179,6 +190,85 @@ describe('SessionProvider', () => {
		h.unmount()
		})

		it('preserves an intentional no-active-organization state on a normal load', async () => {
		mockGetSession.mockResolvedValue({ data: NO_ACTIVE_ORGANIZATION_SESSION })
		mockListOrganizations.mockResolvedValue({
		data: [{ id: 'org-member', name: 'Member organization' }],
		error: null,
		})

		const h = renderProvider()
		await flushUntil(() => h.ctx()?.data != null)

		expect(h.ctx()?.data).toEqual(NO_ACTIVE_ORGANIZATION_SESSION)
		expect(mockListOrganizations).not.toHaveBeenCalled()
		expect(mockSetActive).not.toHaveBeenCalled()

		h.unmount()
		})

		it('does not auto-select an organization for an external-only user during recovery', async () => {
		setSearch('?upgraded=true')
		mockGetSession.mockResolvedValue({ data: NO_ACTIVE_ORGANIZATION_SESSION })
		mockListOrganizations.mockResolvedValue({ data: [], error: null })

		const h = renderProvider()
		await flushUntil(() => mockListOrganizations.mock.calls.length > 0)

		expect(mockListOrganizations).toHaveBeenCalledTimes(1)
		expect(mockSetActive).not.toHaveBeenCalled()

		h.unmount()
		})

		it('recovers the sole valid viewer organization membership when upgrade recovery is explicit', async () => {
		window.history.replaceState({}, '', '/workspace/workspace-b?upgraded=true')
		mockListOrganizations.mockResolvedValue({
		data: [{ id: 'org-member', name: 'Member organization' }],
		error: null,
		})
		mockGetSession.mockImplementation(() =>
		Promise.resolve({
		data:
		mockSetActive.mock.calls.length > 0
		? RECOVERED_ORGANIZATION_SESSION
		: NO_ACTIVE_ORGANIZATION_SESSION,
		})
		)

		const h = renderProvider()
		await flushUntil(
		() =>
		h.queryClient.getQueryData<AppSession>(sessionKeys.detail())?.session
		?.activeOrganizationId === 'org-member'
		)

		expect(mockSetActive).toHaveBeenCalledWith({ organizationId: 'org-member' })
		expect(h.queryClient.getQueryData(sessionKeys.detail())).toEqual(RECOVERED_ORGANIZATION_SESSION)

		h.unmount()
		})

		it('does not choose arbitrarily when multiple valid memberships need recovery', async () => {
		setSearch('?upgraded=true')
		mockGetSession.mockResolvedValue({ data: NO_ACTIVE_ORGANIZATION_SESSION })
		mockListOrganizations.mockResolvedValue({
		data: [
		{ id: 'org-a', name: 'Organization A' },
		{ id: 'org-b', name: 'Organization B' },
		],
		error: null,
		})

		const h = renderProvider()
		await flushUntil(() => mockListOrganizations.mock.calls.length > 0)

		expect(mockListOrganizations).toHaveBeenCalledTimes(1)
		expect(mockSetActive).not.toHaveBeenCalled()

		h.unmount()
		})

		it('upgrade path: fresh disableCookieCache read wins even when the stale mount query resolves LAST', async () => {
		setSearch('?upgraded=true')

Expand Down

9 changes: 3 additions & 6 deletions 9 apps/sim/app/_shell/providers/session-provider.tsx

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -4,8 +4,6 @@ import type React from 'react'
		import { createContext, useEffect, useMemo } from 'react'
		import { createLogger } from '@sim/logger'
		import { useQueryClient } from '@tanstack/react-query'
		import { requestJson } from '@/lib/api/client/request'
		import { listCreatorOrganizationsContract } from '@/lib/api/contracts/organizations'
		import { client } from '@/lib/auth/auth-client'
		import {
		type AppSession,
Expand Down Expand Up		@@ -79,10 +77,9 @@ export function SessionProvider({ children }: { children: React.ReactNode }) {
		}

		try {
		const orgData = await requestJson(listCreatorOrganizationsContract, {}).catch(() => null)
		if (!orgData) return

		const organizationId = orgData.organizations?.[0]?.id
		const organizationsResponse = await client.organization.list()
		const organizations = organizationsResponse.data ?? []
		const organizationId = organizations.length === 1 ? organizations[0]?.id : null

		if (!organizationId \|\| isCancelled) {
		return
Expand Down

Oops, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Oops, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.

You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.