fix(api): address v2 review findings

Author: TheodoreSpeaks

apps/docs/openapi-v2-workflows.json

@@ -1358,7 +1358,7 @@
       "get": {
         "operationId": "listWorkflowExecutionsV2",
         "summary": "List workflow executions",
-        "description": "List the durable executions belonging to one workflow. This lifecycle collection is intentionally lightweight; fetch one execution for output and pause detail, or fetch `/api/v2/logs/{executionId}` for diagnostic trace data.",
+        "description": "List the durable executions belonging to one workflow. Freshly queued runs are available through their execution status URL but do not enter this history until durable execution logging begins. This lifecycle collection is intentionally lightweight; fetch one execution for output and pause detail, or fetch `/api/v2/logs/{executionId}` for diagnostic trace data.",
         "tags": ["Workflows"],
         "security": [
           {
@@ -1375,7 +1375,7 @@
             "required": false,
             "schema": {
               "type": "string",
-              "enum": ["queued", "pending", "running", "completed", "failed", "cancelled", "paused"]
+              "enum": ["pending", "running", "completed", "failed", "cancelled", "paused"]
             }
           },
           {
@@ -2881,7 +2881,7 @@
           },
           "status": {
             "type": "string",
-            "enum": ["queued", "pending", "running", "completed", "failed", "cancelled", "paused"]
+            "enum": ["pending", "running", "completed", "failed", "cancelled", "paused"]
           },
           "trigger": {
             "type": "string"

apps/sim/app/api/v1/audit-logs/auth.test.ts

@@ -99,13 +99,17 @@ describe('enterprise audit access', () => {
       expect(result.success).toBe(false)
     })
 
-    it('still requires organization membership', async () => {
+    it('names the requested organization when target membership is missing', async () => {
       setEnvFlags({ isAuditLogsEnabled: true })
       queueTableRows(schemaMock.member, [])
 
-      const result = await validateEnterpriseAuditAccess('viewer')
+      const result = await validateEnterpriseAuditAccess('viewer', 'organization-route')
 
-      expect(result.success).toBe(false)
+      if (result.success) throw new Error('Expected organization membership to be rejected')
+      expect(result.response.status).toBe(403)
+      await expect(result.response.json()).resolves.toEqual({
+        error: 'Not a member of the requested organization',
+      })
     })
   })
 })

apps/sim/app/api/v1/audit-logs/auth.ts

@@ -65,7 +65,13 @@ export async function resolveEnterpriseAuditAccess(
     .limit(1)
 
   if (!membership) {
-    return { success: false, status: 403, message: 'Not a member of any organization' }
+    return {
+      success: false,
+      status: 403,
+      message: targetOrganizationId
+        ? 'Not a member of the requested organization'
+        : 'Not a member of any organization',
+    }
   }
 
   if (membership.role !== 'admin' && membership.role !== 'owner') {

apps/sim/app/api/v1/logs/executions/[executionId]/route.ts

@@ -13,6 +13,13 @@ import {
 
 const logger = createLogger('V1ExecutionAPI')
 
+function countWorkflowStateBlocks(workflowState: unknown): number {
+  if (!workflowState || typeof workflowState !== 'object' || Array.isArray(workflowState)) return 0
+  const blocks = (workflowState as Record<string, unknown>).blocks
+  if (!blocks || typeof blocks !== 'object' || Array.isArray(blocks)) return 0
+  return Object.keys(blocks).length
+}
+
 export const GET = withRouteHandler(
   async (request: NextRequest, context: { params: Promise<{ executionId: string }> }) => {
     try {
@@ -64,7 +71,7 @@ export const GET = withRouteHandler(
 
       logger.debug(`Successfully fetched execution data for: ${executionId}`)
       logger.debug(
-        `Workflow state contains ${Object.keys((workflowLog.workflowState as any)?.blocks || {}).length} blocks`
+        `Workflow state contains ${countWorkflowStateBlocks(workflowLog.workflowState)} blocks`
       )
 
       // Get user's workflow execution limits and usage

apps/sim/app/api/v1/logs/route.ts

@@ -54,7 +54,9 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       },
     })
 
-    const decodedCursor = params.cursor ? decodePublicLogCursor(params.cursor) : null
+    const decodedCursor = params.cursor
+      ? decodePublicLogCursor(params.cursor, params.order ?? 'desc')
+      : null
     if (params.cursor && !decodedCursor) {
       return NextResponse.json({ error: 'Invalid cursor' }, { status: 400 })
     }

apps/sim/app/api/v2/logs/route.ts

@@ -70,7 +70,9 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
     )
     const includesRoot = resolvedFolderIds?.includes(null) ?? false
 
-    const decodedCursor = params.cursor ? decodePublicLogCursor(params.cursor) : null
+    const decodedCursor = params.cursor
+      ? decodePublicLogCursor(params.cursor, params.order ?? 'desc')
+      : null
     if (params.cursor && !decodedCursor) return v2Error('BAD_REQUEST', 'Invalid cursor')
     const cursor = decodedCursor ?? undefined
 

apps/sim/app/api/v2/workflows/[id]/executions/route.test.ts

@@ -97,6 +97,10 @@ describe('GET /api/v2/workflows/[id]/executions', () => {
 
     expect(body.data).toHaveLength(2)
     expect(body.nextCursor).toEqual(expect.any(String))
+    expect(JSON.parse(Buffer.from(body.nextCursor, 'base64').toString())).toEqual({
+      sort: 'startedAt:desc',
+      keys: ['2026-08-05T00:01:00.000Z', 'row-1'],
+    })
   })
 
   it('rejects an invalid cursor', async () => {
@@ -106,6 +110,27 @@ describe('GET /api/v2/workflows/[id]/executions', () => {
     expect(dbChainMockFns.limit).not.toHaveBeenCalled()
   })
 
+  it('rejects a cursor minted under a different order', async () => {
+    const cursor = Buffer.from(
+      JSON.stringify({
+        sort: 'startedAt:desc',
+        keys: ['2026-08-05T00:01:00.000Z', 'row-1'],
+      })
+    ).toString('base64')
+
+    const response = await callGet(`?order=asc&cursor=${encodeURIComponent(cursor)}`)
+
+    expect(response.status).toBe(400)
+    expect(dbChainMockFns.limit).not.toHaveBeenCalled()
+  })
+
+  it('rejects queued as a durable-history filter', async () => {
+    const response = await callGet('?status=queued')
+
+    expect(response.status).toBe(400)
+    expect(dbChainMockFns.limit).not.toHaveBeenCalled()
+  })
+
   it('authorizes the workflow before validating filters', async () => {
     mockResolveV2WorkflowAccess.mockResolvedValue({
       ok: false,

apps/sim/app/api/v2/workflows/[id]/executions/route.ts

@@ -4,15 +4,17 @@ import type { NextRequest } from 'next/server'
 import {
   type V2WorkflowExecutionListItem,
   v2ListWorkflowExecutionsContract,
-  v2WorkflowExecutionStatusValueSchema,
+  v2WorkflowExecutionListStatusValueSchema,
 } from '@/lib/api/contracts/v2/workflows'
 import { parseRequest } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { listWorkflowExecutions } from '@/lib/workflows/executor/execution-queries'
 import {
-  decodeCursor,
-  encodeCursor,
+  cursorSortKey,
+  decodeSortedCursor,
+  encodeSortedCursor,
   v2CursorList,
+  v2CursorSortError,
   v2Error,
   v2ValidationError,
 } from '@/app/api/v2/lib/response'
@@ -23,11 +25,6 @@ const logger = createLogger('V2WorkflowExecutionsAPI')
 export const dynamic = 'force-dynamic'
 export const revalidate = 0
 
-interface EncodedWorkflowExecutionCursor {
-  startedAt: string
-  rowId: string
-}
-
 /** List the durable executions belonging to one workflow. */
 export const GET = withRouteHandler(
   async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
@@ -41,13 +38,19 @@ export const GET = withRouteHandler(
     if (!parsed.success) return parsed.response
 
     const { status, trigger, startDate, endDate, limit, cursor, order } = parsed.data.query
-    const decodedCursor = cursor ? decodeCursor<EncodedWorkflowExecutionCursor>(cursor) : null
-    const cursorDate = decodedCursor ? new Date(decodedCursor.startedAt) : null
+    const sort = cursorSortKey('startedAt', order)
+    const decodedCursor = decodeSortedCursor(cursor, sort)
+    if (decodedCursor.status === 'invalid') return v2CursorSortError()
+    const [cursorStartedAt, cursorRowId] = decodedCursor.status === 'ok' ? decodedCursor.keys : []
+    const cursorDate = typeof cursorStartedAt === 'string' ? new Date(cursorStartedAt) : null
     if (
-      cursor &&
-      (!decodedCursor || !decodedCursor.rowId || !cursorDate || Number.isNaN(cursorDate.getTime()))
+      decodedCursor.status === 'ok' &&
+      (decodedCursor.keys.length !== 2 ||
+        !cursorDate ||
+        Number.isNaN(cursorDate.getTime()) ||
+        typeof cursorRowId !== 'string')
     ) {
-      return v2Error('BAD_REQUEST', 'Invalid cursor')
+      return v2CursorSortError()
     }
 
     try {
@@ -59,16 +62,16 @@ export const GET = withRouteHandler(
         endDate: endDate ? new Date(endDate) : undefined,
         limit,
         cursor:
-          decodedCursor && cursorDate
-            ? { startedAt: cursorDate, rowId: decodedCursor.rowId }
+          decodedCursor.status === 'ok' && cursorDate && typeof cursorRowId === 'string'
+            ? { startedAt: cursorDate, rowId: cursorRowId }
             : undefined,
         order,
       })
 
       const data: V2WorkflowExecutionListItem[] = result.data.map((row) => ({
         executionId: row.executionId,
         workflowId: row.workflowId ?? workflowId,
-        status: v2WorkflowExecutionStatusValueSchema.parse(row.status),
+        status: v2WorkflowExecutionListStatusValueSchema.parse(row.status),
         trigger: row.trigger,
         startedAt: row.startedAt.toISOString(),
         endedAt: row.endedAt?.toISOString() ?? null,
@@ -77,10 +80,10 @@ export const GET = withRouteHandler(
       }))
 
       const nextCursor = result.nextCursor
-        ? encodeCursor({
-            startedAt: result.nextCursor.startedAt.toISOString(),
-            rowId: result.nextCursor.rowId,
-          })
+        ? encodeSortedCursor(sort, [
+            result.nextCursor.startedAt.toISOString(),
+            result.nextCursor.rowId,
+          ])
         : null
 
       return v2CursorList(data, nextCursor)

apps/sim/app/api/workflows/[id]/executions/[executionId]/cancel/route.test.ts

@@ -25,6 +25,9 @@ const {
   mockWriteEvent,
   mockWriteTerminalEvent,
   mockWorkflowExecutionBelongsToWorkflow,
+  mockGetJobQueue,
+  mockGetJob,
+  mockCancelJob,
 } = vi.hoisted(() => ({
   mockMarkExecutionCancelled: vi.fn(),
   mockAbortManualExecution: vi.fn(),
@@ -38,6 +41,13 @@ const {
   mockWriteEvent: vi.fn(),
   mockWriteTerminalEvent: vi.fn(),
   mockWorkflowExecutionBelongsToWorkflow: vi.fn(),
+  mockGetJobQueue: vi.fn(),
+  mockGetJob: vi.fn(),
+  mockCancelJob: vi.fn(),
+}))
+
+vi.mock('@/lib/core/async-jobs', () => ({
+  getJobQueue: mockGetJobQueue,
 }))
 
 vi.mock('@/lib/workflows/executor/execution-queries', () => ({
@@ -106,6 +116,9 @@ describe('POST /api/workflows/[id]/executions/[executionId]/cancel', () => {
     mockWriteEvent.mockResolvedValue({ eventId: 1 })
     mockWriteTerminalEvent.mockResolvedValue({ eventId: 1 })
     mockWorkflowExecutionBelongsToWorkflow.mockResolvedValue(true)
+    mockGetJob.mockResolvedValue(null)
+    mockCancelJob.mockResolvedValue(undefined)
+    mockGetJobQueue.mockResolvedValue({ getJob: mockGetJob, cancelJob: mockCancelJob })
   })
 
   it('returns success when cancellation was durably recorded', async () => {
@@ -148,6 +161,29 @@ describe('POST /api/workflows/[id]/executions/[executionId]/cancel', () => {
     })
   })
 
+  it('durably cancels a queued execution through its queue run', async () => {
+    mockMarkExecutionCancelled.mockResolvedValue({
+      durablyRecorded: false,
+      reason: 'redis_unavailable',
+    })
+    mockGetJob.mockResolvedValue({ id: 'run-1', status: 'pending' })
+
+    const response = await POST(makeRequest(), makeParams())
+
+    expect(response.status).toBe(200)
+    await expect(response.json()).resolves.toEqual({
+      success: true,
+      executionId: 'ex-1',
+      redisAvailable: false,
+      durablyRecorded: true,
+      locallyAborted: false,
+      pausedCancelled: false,
+      reason: 'recorded',
+    })
+    expect(mockGetJob).toHaveBeenCalledWith('workflow-execution:ex-1')
+    expect(mockCancelJob).toHaveBeenCalledWith('run-1')
+  })
+
   it('returns unsuccessful response when Redis persistence fails', async () => {
     mockMarkExecutionCancelled.mockResolvedValue({
       durablyRecorded: false,

apps/sim/lib/api/contracts/v2/workflows.ts

@@ -472,9 +472,18 @@ export const v2WorkflowExecutionStatusValueSchema = z.enum([
   'paused',
 ])
 
+export const v2WorkflowExecutionListStatusValueSchema = z.enum([
+  'pending',
+  'running',
+  'completed',
+  'failed',
+  'cancelled',
+  'paused',
+])
+
 export const v2ListWorkflowExecutionsQuerySchema = z
   .object({
-    status: v2WorkflowExecutionStatusValueSchema.optional(),
+    status: v2WorkflowExecutionListStatusValueSchema.optional(),
     trigger: z.string().min(1, 'trigger cannot be empty').optional(),
     startDate: z.string().datetime().optional(),
     endDate: z.string().datetime().optional(),
@@ -499,7 +508,7 @@ export type V2ListWorkflowExecutionsQuery = z.output<typeof v2ListWorkflowExecut
 export const v2WorkflowExecutionListItemSchema = z.object({
   executionId: z.string(),
   workflowId: z.string(),
-  status: v2WorkflowExecutionStatusValueSchema,
+  status: v2WorkflowExecutionListStatusValueSchema,
   trigger: z.string(),
   startedAt: z.string(),
   endedAt: z.string().nullable(),