fix(knowledge): enforce trusted workspace scope

[TheodoreSpeaks]

Summary

• consume the merged delegated-identity foundation and send server-authored workflow/execution scope through shared executor headers for all 14 internal Knowledge HTTP tools
• resolve document, chunk, tag, connector, workspace-file, and knowledge-base targets canonically before current authorization; conceal trusted-workspace mismatches before mutation
• route every knowledge_base Copilot branch through the shared Copilot application adapter
• compose add_file, bulk knowledge-base delete, and bulk document delete as three fixed bounded application commands with no nested authorized use cases or generic multi-operation executor
• migrate ordinary internal Knowledge JSON routes to defineInternalJsonRoute, including explicit session-only operations for legacy personal knowledge bases
• keep multipart and large-body behavior declarative while preserving upload-session binding, byte-plane ordering, billing, analytics, and wire compatibility

Composition behavior

• addWorkspaceFilesToKnowledgeBase owns canonical KB/file resolution, per-resource current authorization, provenance checks, presigned storage preparation, one bounded usage admission, sequential best-effort registration/processing, authoritative audit, and success effects
• bulkDeleteKnowledgeBases and bulkDeleteKnowledgeDocuments each have a distinct semantic operation, a 100-item sequential best-effort cost policy, per-resource canonical authorization, explicit partial outcomes, audit, effects, and cancellation state
• searchKnowledge remains one semantic query operation with an explicit post-parse cost policy and now returns canonical KB presentation metadata, removing the redundant pre-search read
• cancellation stops between mutations; already-completed items are audited and effected before the Copilot adapter rethrows the user stop
• if a later batch item hits an unknown infrastructure failure, completed items are audited and effected before the original failure propagates to the adapter and is rendered generically to the model

Trusted identity

• Copilot identity comes only from the shared server-authored execution context; model workspace, user, operation, and resource fields are requested targets only
• executor identity is signed from trusted workflow/user/execution fields; missing scope fails before transport and model _context cannot supply it
• session, API-key, and delegated callers re-check current workspace authorization at the application boundary
• billing ownership remains attribution only and never supplies authorization identity

Copilot tool inventory

• migrate: create, get, and update now enter exclusively through executeCopilotKnowledgeUseCase
• migrate: query uses one knowledge.search command and its canonical presentation metadata
• migrate: add_file uses one bounded knowledge.documents.add_workspace_files command
• migrate: delete uses one bounded knowledge.bulk_delete command
• migrate: delete_document uses one bounded knowledge.documents.bulk_delete command
• migrate: update_document
• migrate: list_tags, create_tag, update_tag, delete_tag, get_tag_usage
• migrate: add_connector, update_connector, delete_connector, sync_connector
• defer: none

Internal Knowledge route inventory

• migrate: /api/knowledge and /api/knowledge/[id]
• migrate: /api/knowledge/[id]/restore
• migrate: /api/knowledge/search
• migrate: /api/knowledge/[id]/documents and /api/knowledge/[id]/documents/[documentId]
• migrate: /api/knowledge/[id]/documents/[documentId]/chunks and /api/knowledge/[id]/documents/[documentId]/chunks/[chunkId]
• migrate: /api/knowledge/[id]/documents/[documentId]/tag-definitions
• migrate: /api/knowledge/[id]/documents/upsert
• migrate: /api/knowledge/[id]/documents/uploads, /api/knowledge/[id]/documents/uploads/[uploadId], /parts, and /complete
• migrate: /api/knowledge/[id]/tag-definitions, /api/knowledge/[id]/tag-definitions/[tagId], /api/knowledge/[id]/tag-usage, and /api/knowledge/[id]/next-available-slot
• migrate: /api/knowledge/[id]/connectors, /api/knowledge/[id]/connectors/[connectorId], /documents, and /sync
• non-goal: /api/knowledge/connectors/sync is a cron-authenticated capped scheduler/recovery job, not an ordinary caller resource operation
• defer: none

v2 inventory

• migrate / declarative: knowledge-base collection/detail, folders, document collection/detail, upload controls, and search
• specialized declarative lifecycle: multipart document POST preserves IP abuse limit -> authentication -> rollout -> operation rate limit -> canonical admission/quota -> bounded multipart read -> storage transfer -> authorized registration -> presenter/effects
• non-goal: v1 routes remain unchanged
• defer: none

Compatibility and safety

• GET /api/knowledge still accepts omitted workspaceId for personal knowledge bases and scope=active|archived|all
• existing aliases, result shapes, partial-result envelopes, messages, upload size/type validation, billing attribution, analytics, PostHog behavior, and v2 503 mapping are preserved
• PersonalApiKeysDisabledError remains 403; shared v2 concealment converts only resource authorization failures to 404
• no DB migration, dependency change, fallback authorization, or bun.lock change

Type of Change

• Bug fix

Testing

• 23 focused Vitest files, 191 passing tests
• Sim type-check
• Biome on all touched files
• bun run check:api-validation:strict
• git diff --check

Checklist

• Code follows project style guidelines
• Self-reviewed changes and memory-loading boundaries
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 10, 2026 1:28am

[cursor]

PR Summary

Medium Risk
Touches many Knowledge authorization and upload paths plus OAuth token refresh imports; behavior is intended to be preserved but the breadth of route refactors increases regression risk in auth, billing, and provenance handling.

Overview
This PR relocates OAuth credential/token helpers from app/api/auth/oauth/utils to @/lib/oauth/credential-service and updates OAuth, cron, and callback routes to import from the shared module.

The larger change is rewiring internal Knowledge HTTP handlers from hand-written withRouteHandler logic to defineInternalJsonRoute, with auth/error policies from internalKnowledgeSessionOrExecutorAuth and use cases under @/lib/knowledge/application/* (connectors, documents, chunks, tags, uploads). Routes become thin maps from contracts to application commands, with shared presenters for wire shapes, billing attribution, analytics hooks, and secret-provenance finalization preserved where they existed before.

Connector routes drop inline DB/orchestration and the route-local sourceConfig validator; that behavior moves behind application-layer connector commands. Document list gains explicit contract-based query parsing (including limit/offset on connector documents). Several route-level Vitest files are removed as handlers no longer embed the tested logic.

^{Reviewed by Cursor Bugbot for commit 647e2e2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR moves Knowledge operations behind shared application boundaries that derive authorization scope from trusted execution context rather than model-supplied targets.

• Migrates internal and v2 Knowledge routes to declarative authenticated route adapters.
• Adds canonical resource resolution and workspace-scoped authorization across Knowledge bases, documents, chunks, tags, connectors, uploads, and search.
• Routes Copilot Knowledge tools through shared delegated-identity application adapters.
• Introduces bounded batch commands with partial-result, cancellation, audit, and effect handling.
• Extracts shared OAuth credential services and updates their consumers.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/copilot/application/execute-knowledge-use-case.ts	Centralizes Copilot Knowledge execution behind a delegated principal derived from trusted server-authored context.
apps/sim/lib/copilot/tools/server/knowledge/knowledge-base.ts	Routes Knowledge tool branches through shared application use cases while preserving canonical workspace scope.
apps/sim/lib/knowledge/application/authorization.ts	Adds canonical resource resolution and current workspace authorization at the Knowledge application boundary.
apps/sim/lib/knowledge/application/add-workspace-files.ts	Implements bounded sequential workspace-file ingestion with partial outcomes, cancellation, authorization, audit, and effects.
apps/sim/lib/knowledge/application/operations.ts	Defines bounded bulk Knowledge mutations with per-resource authorization and explicit partial-result handling.
apps/sim/lib/api/server/routes/internal-json-route.ts	Provides the shared declarative lifecycle used by migrated internal JSON routes.
apps/sim/lib/api/server/routes/v2-body-lifecycle-route.ts	Encapsulates v2 body lifecycle policy while retaining specialized upload behavior.
apps/sim/app/api/knowledge/[id]/documents/[documentId]/chunks/[chunkId]/route.ts	Migrates chunk operations to the shared route and application layers while retaining rejection of unknown secret provenance.
apps/sim/lib/oauth/credential-service.ts	Relocates reusable OAuth credential operations from an API-route-local utility module into shared library code.

Sequence Diagram

sequenceDiagram
  participant Model as Copilot Model
  participant Exec as Tool Executor
  participant Adapter as Copilot Application Adapter
  participant Auth as Workspace Authorization
  participant App as Knowledge Use Case
  participant Store as Knowledge Storage

  Model->>Exec: Knowledge tool call with requested targets
  Exec->>Exec: Attach server-authored execution context
  Exec->>Adapter: Tool input + trusted context
  Adapter->>Adapter: Build delegated principal
  Adapter->>Auth: Re-check current workspace permission
  Auth-->>Adapter: Authorized canonical scope
  Adapter->>App: Execute bounded semantic command
  App->>Store: Resolve and mutate canonical resources
  Store-->>App: Result or partial outcome
  App-->>Adapter: Audit and success effects
  Adapter-->>Exec: Presented result
  Exec-->>Model: Tool response

Loading

_{Reviews (8): Last reviewed commit: "fix(knowledge): page connector documents..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6c8a34e. Configure here.}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

1 issue from previous review remains unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 0af5acf. Configure here.}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 647e2e2. Configure here.}