fix(interfaces): re-assert same-workspace on the authenticated form submit

The public submit route re-checks that the resolved workflow still belongs to
the interface's workspace, with a comment explaining why it is not redundant:
validateLayout grandfathers references that were already stored, so a stored
workflowId is only proven in-workspace at the moment it was introduced.

The authenticated route skipped that check and executed against
workflowRecord.workspaceId — the workflow's workspace, not the interface's.
It also grants at level 'read', so it was the lower-privilege of the two paths
reaching the same executor. Adds the guard, releasing the reserved billing
slot on the early exit exactly as the sibling branch above it does.

The test is mutation-verified: without the guard it returns 200 instead of
404.

Author: waleedlatif1

apps/sim/app/api/interfaces/[interfaceId]/modules/[moduleId]/submit/route.test.ts

@@ -211,6 +211,35 @@ describe('POST /api/interfaces/[interfaceId]/modules/[moduleId]/submit', () => {
     expect(executionPreprocessingMockFns.mockPreprocessExecution).not.toHaveBeenCalled()
   })
 
+  it("refuses a workflow that has left the interface's workspace, and frees the billing slot", async () => {
+    /**
+     * `validateLayout` grandfathers references already stored, so a stored
+     * workflowId is only proven in-workspace at the moment it was introduced.
+     * The public twin re-asserts this; so must the authenticated route, which
+     * grants at `level: 'read'` and is therefore the lower-privilege of the two
+     * paths reaching the same executor.
+     */
+    executionPreprocessingMockFns.mockPreprocessExecution.mockResolvedValue({
+      success: true,
+      actorUserId: 'actor-1',
+      billingAttribution: BILLING_ATTRIBUTION,
+      workflowRecord: {
+        id: 'wf-1',
+        userId: 'owner-1',
+        workspaceId: 'ws-somewhere-else',
+        isDeployed: true,
+        variables: {},
+      },
+    })
+
+    const response = await callPost(validBody)
+
+    expect(response.status).toBe(404)
+    expect(mockExecuteWorkflow).not.toHaveBeenCalled()
+    // The reserved slot must be released, or the workspace leaks concurrency.
+    expect(mockReleaseExecutionSlot).toHaveBeenCalledTimes(1)
+  })
+
   it('returns 404 when the interface belongs to another workspace', async () => {
     mockGetInterfaceById.mockResolvedValue({
       ...buildDefinition(),

apps/sim/app/api/interfaces/[interfaceId]/modules/[moduleId]/submit/route.ts

@@ -114,6 +114,23 @@ export const POST = withRouteHandler(
         return NextResponse.json({ error: 'Workflow has no associated workspace' }, { status: 500 })
       }
 
+      /**
+       * Re-assert same-workspace on the resolved workflow, exactly as the public
+       * twin does. `validateLayout` grandfathers references that were already
+       * stored, so a stored reference is only proven in-workspace at the moment
+       * it was introduced — and this route grants at `level: 'read'`, so it is
+       * the lower-privilege of the two paths that reach the same executor.
+       *
+       * Same slot accounting as the branch above: release the reserved billing
+       * slot on this early exit, since no LoggingSession will finalize to free
+       * it.
+       */
+      if (workflowRecord.workspaceId !== access.definition.workspaceId) {
+        logger.warn(`[${requestId}] Interface form workflow left the workspace`, { moduleId })
+        await releaseExecutionSlot(executionId)
+        return NextResponse.json({ error: 'Module is not available' }, { status: 404 })
+      }
+
       const result = await executeWorkflow(
         {
           id: workflowRecord.id,