fix(interfaces): close a public output leak and three correctness gaps

Findings from a full-branch audit pass.

Security:
- The public form-submit route returned the workflow run's entire `output` to
  an anonymous visitor. A form module has no `outputConfigs`, so unlike the
  chat path there is nothing redacting it — for an agent block that means
  `toolCalls.list`: the literal arguments sent to every tool and the literal
  responses. No client consumed it. Dropped from the public contract; the
  authenticated in-app response is unchanged.
- The interface share PUT validated the org policy against `authType ?? 'public'`
  while `upsertResourceShare` persists `authType ?? stored ?? 'public'`, so a
  bare re-enable was checked against the wrong mode in both directions. Now
  mirrors the file route, whose comment names this exact bug.
- The public *file* OTP route compared codes with `!==`. The interfaces route
  added `safeCompare`; brought the files route up to it.

Correctness:
- A combined name+layout PATCH pre-validated with no `previous`, making the
  pre-flight stricter than the write it guards — renaming an interface that
  referenced an archived table would 400 on a layout the write accepts.
- `DataRow`'s memo comparator observed `renderCellEditor` unconditionally. That
  callback is rebuilt on every keystroke that opens an editor and on every
  in-flight save, so every mounted row re-rendered where one needed to. Gated
  on the editing row, replacing the gate the editor-injection refactor dropped.
- `CellContent` derives both the overlay and the dimmed cell from the editor's
  presence, so "editing with no editor" — a blank, unreadable cell — is
  unreachable rather than merely unused.

CI:
- `check:resources` was in package.json but ran nowhere. Added to test-build.

Cleanup: deleted an unused `tableResourceId` and a duplicate
`PendingTagIndicator`; consolidated the interface row mapper and the form
submit-label default onto one definition each; completed a `vi.mock` factory
missing three error classes the route narrows on with `instanceof`; corrected
stale doc references and a comment asserting a Tailwind limitation that
does not exist.

Author: waleedlatif1

.github/workflows/test-build.yml

@@ -123,6 +123,9 @@ jobs:
       - name: API contract boundary audit
         run: bun run check:api-validation:strict
 
+      - name: Resource view boundary audit
+        run: bun run check:resources
+
       - name: Desktop bridge contract audit
         run: bun run check:desktop-bridge
 

apps/sim/app/(landing)/components/share-link-button/share-link-button.tsx

@@ -54,15 +54,15 @@ export function ShareLinkButton({ title, kind }: ShareLinkButtonProps) {
       </DropdownMenuTrigger>
       <DropdownMenuContent align='end'>
         <DropdownMenuItem onSelect={() => copy(window.location.href)}>
-          <Duplicate className='size-4' />
+          <Duplicate />
           {copied ? 'Copied!' : 'Copy link'}
         </DropdownMenuItem>
         <DropdownMenuItem onSelect={() => openShare(buildXShareUrl(composePost('@simdotai')))}>
-          <XIcon className='size-4' />
+          <XIcon />
           Post on X
         </DropdownMenuItem>
         <DropdownMenuItem onSelect={() => openShare(buildLinkedInPostUrl(composePost('Sim')))}>
-          <LinkedInIcon className='size-4' />
+          <LinkedInIcon />
           Post on LinkedIn
         </DropdownMenuItem>
       </DropdownMenuContent>

apps/sim/app/api/files/public/[token]/otp/route.ts

@@ -1,4 +1,5 @@
 import { createLogger } from '@sim/logger'
+import { safeCompare } from '@sim/security/compare'
 import { normalizeEmail } from '@sim/utils/string'
 import type { NextRequest } from 'next/server'
 import { NextResponse } from 'next/server'
@@ -164,7 +165,7 @@ export const PUT = withRouteHandler(
         )
       }
 
-      if (storedOTP !== otp) {
+      if (!safeCompare(storedOTP, otp)) {
         const result = await incrementOTPAttempts('file', resolved.share.id, email, storedValue)
         if (result === 'locked') {
           return NextResponse.json(

apps/sim/app/api/interfaces/[interfaceId]/modules/[moduleId]/submit/route.test.ts

@@ -19,7 +19,10 @@ const {
   mockValidateFormSubmission,
   InterfaceConflictErrorMock,
   InterfaceLayoutErrorMock,
+  InterfaceNotArchivedErrorMock,
+  InterfaceNotFoundErrorMock,
   InterfaceStaleWriteErrorMock,
+  InterfaceWorkspaceArchivedErrorMock,
   InvalidModuleReferenceErrorMock,
 } = vi.hoisted(() => {
   class InterfaceConflictErrorMock extends Error {
@@ -39,14 +42,27 @@ const {
   class InvalidModuleReferenceErrorMock extends Error {
     readonly code = 'INVALID_MODULE_REFERENCE' as const
   }
+  /**
+   * Not thrown anywhere in this suite, and still stubbed. `@/app/api/interfaces/utils`
+   * — which the route imports — narrows on all three with `instanceof`, so omitting
+   * one from the factory leaves it `undefined` and turns that narrowing into a
+   * TypeError the moment this route maps a domain error. Cheaper to keep the
+   * factory complete than to rediscover that as a 500.
+   */
+  class InterfaceNotFoundErrorMock extends Error {}
+  class InterfaceNotArchivedErrorMock extends Error {}
+  class InterfaceWorkspaceArchivedErrorMock extends Error {}
   return {
     mockExecuteWorkflow: vi.fn(),
     mockGetInterfaceById: vi.fn(),
     mockReleaseExecutionSlot: vi.fn(),
     mockValidateFormSubmission: vi.fn(),
     InterfaceConflictErrorMock,
     InterfaceLayoutErrorMock,
+    InterfaceNotArchivedErrorMock,
+    InterfaceNotFoundErrorMock,
     InterfaceStaleWriteErrorMock,
+    InterfaceWorkspaceArchivedErrorMock,
     InvalidModuleReferenceErrorMock,
   }
 })
@@ -61,6 +77,9 @@ vi.mock('@/lib/interfaces', () => ({
   InterfaceConflictError: InterfaceConflictErrorMock,
   InterfaceLayoutError: InterfaceLayoutErrorMock,
   InterfaceStaleWriteError: InterfaceStaleWriteErrorMock,
+  InterfaceNotFoundError: InterfaceNotFoundErrorMock,
+  InterfaceNotArchivedError: InterfaceNotArchivedErrorMock,
+  InterfaceWorkspaceArchivedError: InterfaceWorkspaceArchivedErrorMock,
   InvalidModuleReferenceError: InvalidModuleReferenceErrorMock,
 }))
 
@@ -73,7 +92,10 @@ vi.mock('@/lib/billing/calculations/usage-reservation', () => ({
 }))
 
 vi.mock('@/lib/execution/preprocessing', () => executionPreprocessingMock)
-vi.mock('@/lib/posthog/server', () => ({ captureServerEvent: vi.fn() }))
+vi.mock('@/lib/posthog/server', () => ({
+  captureServerEvent: vi.fn(),
+  getPostHogClient: vi.fn(() => null),
+}))
 
 vi.mock('@/lib/workspaces/permissions/utils', () => permissionsMock)
 

apps/sim/app/api/interfaces/[interfaceId]/route.test.ts

@@ -299,7 +299,10 @@ describe('PATCH /api/interfaces/[interfaceId]', () => {
     await expect(response.json()).resolves.toEqual({
       error: 'Table "tbl-1" was not found in this workspace',
     })
-    expect(mockValidateLayout).toHaveBeenCalledWith('ws-1', EMPTY_LAYOUT)
+    // The committed layout is passed as `previous` so the pre-flight grandfathers
+    // exactly what the write does — otherwise a rename would 400 on a reference
+    // (an archived table, say) that `updateInterfaceLayout` would have accepted.
+    expect(mockValidateLayout).toHaveBeenCalledWith('ws-1', EMPTY_LAYOUT, buildDefinition().layout)
     expect(mockRenameInterface).not.toHaveBeenCalled()
     expect(mockUpdateInterfaceLayout).not.toHaveBeenCalled()
     expect(mockRecordAudit).not.toHaveBeenCalled()

apps/sim/app/api/interfaces/[interfaceId]/route.ts

@@ -110,7 +110,16 @@ export const PATCH = withRouteHandler(
        */
       const layoutSharesRequest = body.name !== undefined || body.description !== undefined
       if (body.layout !== undefined && layoutSharesRequest) {
-        await validateLayout(access.definition.workspaceId, body.layout)
+        /**
+         * Passed the committed layout as `previous` for the same reason
+         * `updateInterfaceLayout` does: references already stored are
+         * grandfathered, so an interface whose table was archived stays
+         * renameable. Without it this pre-flight is stricter than the write it
+         * is guarding, and renaming would 400 on a layout the write would have
+         * accepted. It is only a fail-fast — the authoritative check still runs
+         * inside the transaction against a `FOR UPDATE` re-read.
+         */
+        await validateLayout(access.definition.workspaceId, body.layout, access.definition.layout)
       }
 
       let result: InterfaceDefinition = access.definition

apps/sim/app/api/interfaces/[interfaceId]/share/route.ts

@@ -105,11 +105,19 @@ export const PUT = withRouteHandler(
       // master on/off and the per-auth-type allow-list); disabling is always
       // allowed so users can still un-share after the policy is turned on.
       if (isActive) {
+        // Validate the auth type that will ACTUALLY be persisted. upsertResourceShare
+        // falls back to the existing share's authType when none is passed, so a bare
+        // re-enable must be checked against that stored mode — not 'public' — or a
+        // now-disallowed password/email/sso share could be silently reactivated, and
+        // a still-permitted one could be falsely rejected by a group that only bars
+        // 'public'.
+        const existingShare = await getShareForResource('interface', interfaceId)
+        const effectiveAuthType = authType ?? existingShare?.authType ?? 'public'
         try {
           await validatePublicInterfaceSharing(
             session.user.id,
             definition.workspaceId,
-            authType ?? 'public'
+            effectiveAuthType
           )
         } catch (error) {
           if (error instanceof PublicInterfaceSharingNotAllowedError) {

apps/sim/app/api/interfaces/public/[token]/modules/[moduleId]/submit/route.ts

@@ -182,7 +182,6 @@ export const POST = withRouteHandler(
         success: true,
         data: {
           executionId: run.metadata?.executionId ?? executionId,
-          output: run.output,
         },
       })
     } finally {

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/index.ts

@@ -31,7 +31,6 @@ export {
 } from '@/components/chat/special-tags/parse'
 export {
   CredentialDisplay,
-  PendingTagIndicator,
   SpecialTags,
   WorkspaceResourceDisplay,
 } from './special-tags'

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags.tsx

@@ -27,7 +27,6 @@ import type {
   WorkspaceResourceTagData,
   WorkspaceResourceTagType,
 } from '@/components/chat/special-tags/parse'
-import { ThinkingLoader } from '@/components/ui'
 import { useSession } from '@/lib/auth/auth-client'
 import { buildHostedUpgradeUrl, HOSTED_BILLING_SETTINGS_URL } from '@/lib/billing/upgrade-reasons'
 import { canManageWorkspaceBilling } from '@/lib/billing/workspace-permissions'
@@ -124,22 +123,6 @@ export function SpecialTags({
   }
 }
 
-interface PendingTagIndicatorProps {
-  /** Activity phrase next to the loader; crossfades on change. */
-  label: string
-}
-
-/**
- * Renders the turn-level activity shimmer.
- */
-export function PendingTagIndicator({ label }: PendingTagIndicatorProps) {
-  return (
-    <div className='animate-stream-fade-in py-2'>
-      <ThinkingLoader size={20} startVariant='corners' label={label} labelRatio={0.7} />
-    </div>
-  )
-}
-
 interface OptionsDisplayProps {
   data: OptionsTagData
   onSelect?: (id: string) => void