GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix(execution): resolve secrets against the acting principal, not the workflow owner by icecrasher321 · Pull Request #6690 · simstudioai/sim

Conversation

@icecrasher321

@icecrasher321 icecrasher321 commented Aug 14, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Summary

  • Workspace env vars now authorize against the execution actor rather than the workflow owner, so a run resolves only the secrets its caller is actually a credential member of
  • Personal env vars resolve as the caller whenever one is identifiable (session, personal API key, delegated, copilot)
  • Anonymous public-API runs resolve both slices as the workspace billing account. Nobody in the workspace triggered those and the endpoint is callable by anyone, so lending one human's personal namespace to it was never opted into
  • The workflow-owner fallback for personal vars now applies only to workspace API keys, schedules, and webhooks — each configured by someone in the workspace, and routinely authored against the owner's personal keys
  • Adds getExecutionEnvironment, which resolves the two slices from their own identities and collapses to the single existing query when they match. If the billing account can no longer reach the workspace (billedAccountUserId is a stored column, so an org ownership transfer can strand it), it falls back to the owner and logs rather than failing every background run
  • Threads enforceCredentialAccess and isPublicApiAccess through the streaming execution path and executeWorkflowService, which build their own metadata and would otherwise disagree with the JSON path and with v2
  • Marks workflow.userId deprecated as an execution identity in the schema, documenting the one fallback that remains. It stays the ownership column everywhere else

Intentional behavior changes: runs with an identifiable caller no longer resolve workspace secrets the caller lacks credential membership for, nor personal secrets that exist only in the owner's namespace; anonymous public-API runs no longer resolve the owner's personal vars.

Type of Change

  • Bug fix

Testing

Tested manually. type-check clean; 4,500 tests across lib/workflows, lib/environment, lib/execution, lib/copilot, app/api/workflows, and app/api/v2; lint; block-registry check; all 26 audits via check:audits. check:migrations reports no new migrations — the schema change is comment-only.

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
greptile-apps[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction
Vikhyath Mondreti
fix(execution): resolve secrets against the acting principal, not the…
b2a7295 
… workflow owner
@vercel

vercel Bot commented Aug 14, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docs Ready Ready Preview Aug 14, 2026 1:50am

Request Review
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@cursor

cursor Bot commented Aug 14, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

PR Summary

High Risk
Changes who can see which secrets at runtime across API, streaming, async, and public endpoints—incorrect wiring would leak owner personal keys or deny production workspace secrets.

Overview
Fixes secret resolution so runs use the acting principal, not workflow.userId, for authorization and personal-env fallback.

Workspace secrets are loaded with credential membership for the execution actor (ExecutionMetadata.userId), not the workflow owner. Personal secrets come from the identifiable caller when enforceCredentialAccess is set (session, personal API key, copilot); otherwise from the workflow owner (workspace API key, schedule, webhook). Anonymous public-API runs set isPublicApiAccess and resolve no personal secrets—workspace billing principal only.

Adds getExecutionEnvironment(personalUserId, workspaceUserId, workspaceId) to merge two slices (single query when identities match; logs and falls back to the owner if the billing actor cannot access the workspace).

Path consistency: enforceCredentialAccess and isPublicApiAccess are forwarded through async enqueue, the background worker, executeWorkflowService, streaming (executeWorkflow), and pause/resume snapshot serialization. Streaming fixes streamWorkflow.userId to the owner for workflowUserId fallback (was incorrectly the actor).

Docs (credentials.mdx) and schema comments deprecate using workflow.userId as execution identity except the personal-env fallback.

Reviewed by Cursor Bugbot for commit 3c4dd6b. Configure here.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@greptile-apps

greptile-apps Bot commented Aug 14, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Greptile Summary

The PR separates personal-secret ownership from workspace-secret authorization so execution environments resolve against the appropriate principal across synchronous, streaming, queued, and resumed runs.

  • Adds a two-identity environment resolver with an explicit workspace-access fallback for stranded billing accounts.
  • Propagates caller and public-API identity decisions through execution metadata, queue payloads, and pause snapshots.
  • Updates tests, shared mocks, schema documentation, and user-facing credential documentation to match the new resolution policy.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed
Filename Overview
apps/sim/lib/environment/utils.ts Introduces split-principal environment resolution and narrows the owner fallback to an explicit workspace-access denial.
apps/sim/lib/workflows/executor/execution-core.ts Selects personal and workspace environment identities from execution metadata and applies the combined environment snapshot.
apps/sim/app/api/workflows/[id]/execute/route.ts Propagates caller-authorization and anonymous-public-API decisions consistently across sync, stream, and async execution.
apps/sim/background/workflow-execution.ts Preserves identity decisions in queued execution payloads so workers resolve secrets consistently with request-bound paths.
apps/sim/executor/execution/snapshot-serializer.ts Persists both identity flags across human-in-the-loop pause and resume.
packages/testing/src/mocks/environment-utils.mock.ts Recomputes conflict and decryption-failure metadata from the retained personal and workspace slices, addressing the previous mock-divergence finding.
packages/db/schema.ts Adds documentation clarifying that workflow ownership is not generally an execution identity; no database shape changes are introduced.

Flowchart

 
%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Trigger[Execution trigger] --> Identity{Identifiable caller?}
  Identity -->|Yes| Caller[Caller identity]
  Identity -->|No| Billing[Workspace billing account]
  Caller --> Personal[Resolve personal secrets as caller]
  Caller --> Workspace[Authorize workspace secrets as caller]
  Billing --> Public{Anonymous public API?}
  Public -->|Yes| NoPersonal[No personal-secret slice]
  Public -->|No| Owner[Resolve personal secrets as workflow owner]
  Billing --> WorkspaceBilling[Authorize workspace secrets as billing account]
  WorkspaceBilling --> Access{Workspace access?}
  Access -->|Yes| Merge[Merge personal and workspace slices]
  Access -->|No| OwnerFallback[Resolve both slices as workflow owner]
  Personal --> Merge
  Workspace --> Merge
  NoPersonal --> Merge
  Owner --> Merge
  OwnerFallback --> Merge
Loading

Reviews (2): Last reviewed commit: "fix(execution): propagate run identity a..." | Re-trigger Greptile
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
greptile-apps[bot]
greptile-apps Bot reviewed Aug 14, 2026
View reviewed changes
Comment thread apps/sim/lib/environment/utils.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread packages/testing/src/mocks/environment-utils.mock.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.
cursor[bot]
cursor Bot reviewed Aug 14, 2026
View reviewed changes
Comment thread apps/sim/lib/workflows/executor/execute-service.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread apps/sim/lib/workflows/executor/execution-core.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread apps/sim/lib/workflows/executor/execution-core.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.
@vercel
vercel Bot deployed to Preview August 14, 2026 01:18
View deployment
Vikhyath Mondreti
fix(execution): resolve anonymous public-API runs as the workspace bi…
0717b01 
…lling account
@vercel
vercel Bot temporarily deployed to Preview August 14, 2026 01:20 Inactive
Vikhyath Mondreti
fix(execution): propagate run identity across dispatch paths and scop…
3c4dd6b 
…e public runs to workspace secrets
@icecrasher321

icecrasher321 commented Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

@greptile
greptile-apps[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@icecrasher321

icecrasher321 commented Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

@cursor review
cursor[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
cursor[bot]
cursor Bot reviewed Aug 14, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit 3c4dd6b. Configure here.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@vercel
vercel Bot deployed to Preview August 14, 2026 01:50
View deployment
@icecrasher321
icecrasher321 merged commit fa394e5 into staging Aug 14, 2026
30 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@icecrasher321
icecrasher321 deleted the fix/execution-secret-actor-identity branch August 14, 2026 01:50
@waleedlatif1 waleedlatif1 mentioned this pull request Aug 14, 2026
v0.8.1: grok 4.6, v2 endpoints extension, workflow UI improvements, logrocket, perf improvements #6646
Merged

This branch was successfully deployed

1 active deployment
Preview — 3c4dd6b8 Deployed Aug 14, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments
@cursor cursor[bot] cursor[bot] left review comments

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

@icecrasher321
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.