fix(execution): harden secret projection and block runs

Author: icecrasher321

apps/sim/app/api/workflows/[id]/execute/route.async.test.ts

@@ -468,6 +468,44 @@ describe('workflow execute async route', () => {
     expect(body).toContain('execution:completed')
   })
 
+  it('executes a selected trigger as a fresh authenticated draft run', async () => {
+    const response = await POST(
+      createMockRequest(
+        'POST',
+        {
+          stream: true,
+          input: { message: 'hello' },
+          startBlockId: 'start',
+          triggerType: 'manual',
+          useDraftState: true,
+          isClientSession: true,
+        },
+        {
+          'Content-Type': 'application/json',
+          Cookie: 'session=value',
+        }
+      ),
+      { params: Promise.resolve({ id: 'workflow-1' }) }
+    )
+    await response.text()
+
+    expect(response.status).toBe(200)
+    expect(mockAuthorizeWorkflowByWorkspacePermission).toHaveBeenCalledWith({
+      workflowId: 'workflow-1',
+      userId: 'session-user-1',
+      action: 'write',
+    })
+    const executionArgs = mockExecuteWorkflowCore.mock.calls[0][0]
+    expect(executionArgs.runFromBlock).toBeUndefined()
+    expect(executionArgs.snapshot.metadata).toMatchObject({
+      triggerType: 'manual',
+      triggerBlockId: 'start',
+      useDraftState: true,
+      isClientSession: true,
+      sessionUserId: 'session-user-1',
+    })
+  })
+
   /**
    * A terminal event the replay buffer rejected leaves the stream meta on
    * `active`, so a reconnecting reader polls until its deadline and then errors.
@@ -1529,10 +1567,31 @@ describe('workflow execute async route', () => {
         executionData: { executionState: sourceState },
       },
     ])
+    const workflowStateOverride = {
+      blocks: {
+        'start-block': {
+          id: 'start-block',
+          type: 'function',
+          name: 'Function 1',
+          position: { x: 0, y: 0 },
+          subBlocks: {
+            code: { id: 'code', type: 'code', value: 'return "current editor state"' },
+          },
+          outputs: {},
+          enabled: true,
+        },
+      },
+      edges: [],
+      loops: {},
+      parallels: {},
+    }
     const request = createMockRequest(
       'POST',
       {
         input: { hello: 'world' },
+        useDraftState: true,
+        isClientSession: true,
+        workflowStateOverride,
         runFromBlock: {
           startBlockId: 'start-block',
           executionId: 'source-execution',
@@ -1547,6 +1606,7 @@ describe('workflow execute async route', () => {
     const response = await POST(request, { params: Promise.resolve({ id: 'workflow-1' }) })
 
     expect(response.status).toBe(200)
+    const executionArgs = mockExecuteWorkflowCore.mock.calls[0]?.[0]
     expect(mockExecuteWorkflowCore).toHaveBeenCalledWith(
       expect.objectContaining({
         runFromBlock: {
@@ -1556,6 +1616,12 @@ describe('workflow execute async route', () => {
         },
       })
     )
+    expect(executionArgs?.snapshot.metadata).toMatchObject({
+      useDraftState: true,
+      isClientSession: true,
+      sessionUserId: 'session-user-1',
+      workflowStateOverride,
+    })
   })
 
   it('falls back to an untrusted client snapshot while stored run-from-block state is pending', async () => {

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/hooks/use-workflow-execution.test.tsx

@@ -12,6 +12,7 @@ const {
   mockExecute,
   mockExecuteFromBlock,
   mockFetch,
+  mockHandleExecutionErrorConsole,
   mockResolveStartCandidates,
   mockRunUploadStrategy,
   mockSelectBestTrigger,
@@ -35,7 +36,7 @@ const {
       type: 'starter',
       name: 'Start',
       enabled: true,
-      subBlocks: {},
+      subBlocks: { inputFormat: { value: 'persisted-state' } },
     },
   }
   const idleExecution = {
@@ -76,12 +77,13 @@ const {
     finishRunningEntries: vi.fn(),
     clearExecutionEntries: vi.fn(),
   }
+  const workflowEdges: Array<{ source: string; target: string }> = []
   const workflowStoreState = {
     blocks: workflowBlocks,
-    edges: [],
+    edges: workflowEdges,
     getWorkflowState: vi.fn(() => ({
       blocks: workflowBlocks,
-      edges: [],
+      edges: workflowEdges,
       loops: {},
       parallels: {},
     })),
@@ -93,6 +95,7 @@ const {
     mockExecute: vi.fn(),
     mockExecuteFromBlock: vi.fn(),
     mockFetch: vi.fn(),
+    mockHandleExecutionErrorConsole: vi.fn(),
     mockResolveStartCandidates: vi.fn(),
     mockRunUploadStrategy: vi.fn(),
     mockSelectBestTrigger: vi.fn(),
@@ -179,7 +182,7 @@ vi.mock('@/app/workspace/[workspaceId]/w/[workflowId]/utils/workflow-execution-u
   reconcileFinalBlockLogs: vi.fn(),
   addExecutionErrorConsoleEntry: vi.fn(),
   handleExecutionCancelledConsole: vi.fn(),
-  handleExecutionErrorConsole: vi.fn(),
+  handleExecutionErrorConsole: mockHandleExecutionErrorConsole,
 }))
 
 vi.mock('@/blocks', () => ({
@@ -283,7 +286,7 @@ vi.mock('@/stores/workflows/registry/store', () => ({
 }))
 
 vi.mock('@/stores/workflows/utils', () => ({
-  mergeSubblockState: () => workflowBlocks,
+  mergeSubblockState: (blocks: Record<string, unknown>) => blocks,
 }))
 
 vi.mock('@/stores/workflows/workflow/store', () => ({
@@ -633,6 +636,22 @@ describe('useWorkflowExecution attachment uploads', () => {
     }
     executionStoreState.getLastExecutionSnapshot.mockReturnValueOnce(sourceSnapshot)
     workflowStoreState.edges.push({ source: 'start', target: 'function-1' } as never)
+    const currentBlocks = {
+      ...workflowBlocks,
+      'function-1': {
+        id: 'function-1',
+        type: 'function',
+        name: 'Function 1',
+        enabled: true,
+        subBlocks: { code: { value: 'return "current editor state"' } },
+      },
+    }
+    workflowStoreState.getWorkflowState.mockReturnValueOnce({
+      blocks: currentBlocks,
+      edges: workflowStoreState.edges,
+      loops: {},
+      parallels: {},
+    })
 
     const { result, unmount } = renderWorkflowExecutionHook()
 
@@ -646,6 +665,132 @@ describe('useWorkflowExecution attachment uploads', () => {
         startBlockId: 'function-1',
         sourceExecutionId: 'source-execution-1',
         sourceSnapshot,
+        useDraftState: true,
+        isClientSession: true,
+        workflowStateOverride: {
+          blocks: currentBlocks,
+          edges: workflowStoreState.edges,
+          loops: {},
+          parallels: {},
+        },
+      })
+    )
+
+    unmount()
+  })
+
+  it('uses fresh execution for trigger block runs instead of restoring an empty snapshot', async () => {
+    const currentBlocks = {
+      ...workflowBlocks,
+      start: {
+        ...workflowBlocks.start,
+        subBlocks: { inputFormat: { value: 'current-editor-state' } },
+      },
+    }
+    workflowStoreState.getWorkflowState.mockReturnValueOnce({
+      blocks: currentBlocks,
+      edges: [],
+      loops: {},
+      parallels: {},
+    })
+    const { result, unmount } = renderWorkflowExecutionHook()
+
+    await act(async () => {
+      await result().handleRunFromBlock('start', 'workflow-1')
+    })
+
+    expect(mockExecute).toHaveBeenCalledWith(
+      expect.objectContaining({
+        workflowId: 'workflow-1',
+        startBlockId: 'start',
+        triggerType: 'manual',
+        useDraftState: true,
+        isClientSession: true,
+        workflowStateOverride: {
+          blocks: currentBlocks,
+          edges: [],
+          loops: {},
+          parallels: {},
+        },
+      })
+    )
+    expect(mockExecute.mock.calls[0]?.[0]).not.toHaveProperty('sourceSnapshot')
+    expect(mockExecuteFromBlock).not.toHaveBeenCalled()
+
+    unmount()
+  })
+
+  it('fails closed when a legacy run-from-block error has no display projection', async () => {
+    mockExecute.mockImplementationOnce(async (options) => {
+      executionStoreState.getCurrentExecutionId.mockReturnValue('execution-1')
+      options.onExecutionId?.('execution-1')
+      await options.callbacks?.onExecutionError?.({
+        error: 'raw-secret-value caused the failure',
+        duration: 8,
+        finalBlockLogs: [],
+      })
+    })
+
+    const { result, unmount } = renderWorkflowExecutionHook()
+
+    await act(async () => {
+      await result().handleRunFromBlock('start', 'workflow-1')
+    })
+
+    expect(mockHandleExecutionErrorConsole).toHaveBeenCalledWith(
+      expect.objectContaining({
+        addConsole: terminalStoreState.addConsole,
+      }),
+      expect.objectContaining({
+        workflowId: 'workflow-1',
+        executionId: 'execution-1',
+        error: 'raw-secret-value caused the failure',
+        hasDisplayProjection: true,
+        durationMs: 8,
+      })
+    )
+    expect(mockHandleExecutionErrorConsole.mock.calls[0]?.[1]).not.toHaveProperty('displayError')
+
+    unmount()
+  })
+
+  it('shows one safe error when run-from-block fails before receiving an execution ID', async () => {
+    const sourceSnapshot = {
+      blockStates: { start: { output: { value: 'ready' } } },
+      executedBlocks: ['start'],
+      blockLogs: [],
+      decisions: { router: {}, condition: {} },
+      completedLoops: [],
+      activeExecutionPath: ['start'],
+      sourceExecutionId: 'source-execution-1',
+    }
+    executionStoreState.getLastExecutionSnapshot.mockReturnValueOnce(sourceSnapshot)
+    workflowStoreState.edges.push({ source: 'start', target: 'function-1' } as never)
+    mockExecuteFromBlock.mockImplementationOnce(async (options) => {
+      await options.callbacks?.onExecutionError?.({
+        error: 'raw pre-execution failure',
+        duration: 0,
+      })
+      throw new Error('raw pre-execution failure')
+    })
+
+    const { result, unmount } = renderWorkflowExecutionHook()
+
+    await act(async () => {
+      await result().handleRunFromBlock('function-1', 'workflow-1')
+    })
+
+    expect(mockHandleExecutionErrorConsole).toHaveBeenCalledTimes(1)
+    expect(mockHandleExecutionErrorConsole).toHaveBeenCalledWith(
+      expect.objectContaining({
+        addConsole: terminalStoreState.addConsole,
+      }),
+      expect.objectContaining({
+        workflowId: 'workflow-1',
+        error: 'raw pre-execution failure',
+        hasDisplayProjection: true,
+        durationMs: 0,
+        blockLogs: [],
       })
     )