improvement(api): consolidate public v2 route handling

Author: TheodoreSpeaks

apps/sim/app/api/public-api-route-handler.test.ts

@@ -0,0 +1,228 @@
+/**
+ * @vitest-environment node
+ */
+import { NextRequest, NextResponse } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { z } from 'zod'
+import { defineRouteContract } from '@/lib/api/contracts'
+import { buildRateLimitHeaders, recordRateLimitSnapshot } from '@/lib/api/server/rate-limit-context'
+
+const { mockAuthenticateRequest, mockHandler, mockLoggerInfo, requestContextState } = vi.hoisted(
+  () => ({
+    mockAuthenticateRequest: vi.fn(),
+    mockHandler: vi.fn(),
+    mockLoggerInfo: vi.fn(),
+    requestContextState: {
+      current: undefined as { requestId: string; method?: string; path?: string } | undefined,
+    },
+  })
+)
+
+vi.mock('@sim/logger', () => ({
+  createLogger: () => ({
+    info: (...arguments_: unknown[]) =>
+      mockLoggerInfo(requestContextState.current?.requestId, ...arguments_),
+    warn: vi.fn(),
+    error: vi.fn(),
+  }),
+  getRequestContext: () => requestContextState.current,
+  runWithRequestContext: async <T>(
+    context: { requestId: string; method?: string; path?: string },
+    callback: () => T | Promise<T>
+  ): Promise<T> => {
+    requestContextState.current = context
+    try {
+      return await callback()
+    } finally {
+      requestContextState.current = undefined
+    }
+  },
+}))
+
+vi.mock('@/lib/core/utils/request', () => ({
+  generateRequestId: () => requestContextState.current?.requestId ?? 'outer-request-id',
+}))
+
+vi.mock('@/app/api/v1/middleware', () => ({
+  authenticateRequest: mockAuthenticateRequest,
+}))
+
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withPublicApiRouteHandler } from '@/app/api/public-api-route-handler'
+
+const RATE_LIMIT = {
+  allowed: true,
+  limit: 400,
+  remaining: 399,
+  resetAt: new Date('2026-08-06T20:00:00.000Z'),
+  userId: 'user-1',
+  keyType: 'personal' as const,
+}
+
+const queryContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/test/:itemId',
+  params: z.object({ itemId: z.string().min(1) }),
+  query: z.object({ limit: z.coerce.number().int().positive() }),
+  body: z.object({ name: z.string().min(1) }),
+  response: { mode: 'json', schema: z.object({ ok: z.boolean() }) },
+})
+
+const listContract = defineRouteContract({
+  method: 'GET',
+  path: '/api/test',
+  query: z.object({ workspaceId: z.string().min(1) }),
+  response: { mode: 'json', schema: z.object({ ok: z.boolean() }) },
+})
+
+const POST = withPublicApiRouteHandler({
+  contract: queryContract,
+  rateLimitEndpoint: 'v2-table-rows',
+  parseOptions: { maxBodyBytes: 32 },
+  handler: async (arguments_) => {
+    mockHandler(arguments_)
+    return NextResponse.json({ ok: true })
+  },
+})
+
+const GET = withPublicApiRouteHandler({
+  contract: listContract,
+  rateLimitEndpoint: 'v2-tables',
+  handler: async (arguments_) => {
+    mockHandler(arguments_)
+    return NextResponse.json({ ok: true })
+  },
+})
+
+const FAILING_GET = withPublicApiRouteHandler({
+  contract: listContract,
+  rateLimitEndpoint: 'v2-tables',
+  handler: async () => {
+    throw new Error('handler failed')
+  },
+})
+
+function postRequest(body: string): NextRequest {
+  return new NextRequest('http://localhost:3000/api/test/item-1?limit=10', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body,
+  })
+}
+
+function listRequest(query = 'workspaceId=workspace-1'): NextRequest {
+  return new NextRequest(`http://localhost:3000/api/test?${query}`)
+}
+
+describe('withPublicApiRouteHandler', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockAuthenticateRequest.mockImplementation(async (request: NextRequest) => {
+      recordRateLimitSnapshot(request, RATE_LIMIT)
+      return {
+        requestId: generateRequestId(),
+        userId: 'user-1',
+        rateLimit: RATE_LIMIT,
+      }
+    })
+  })
+
+  it.each([
+    ['authentication failure', 401],
+    ['rate-limit denial', 429],
+  ])('short-circuits %s before reading or parsing the body', async (_label, status) => {
+    mockAuthenticateRequest.mockImplementation(async (request: NextRequest) => {
+      if (status === 401) {
+        return NextResponse.json({ error: 'API key required' }, { status })
+      }
+
+      recordRateLimitSnapshot(request, RATE_LIMIT)
+      return NextResponse.json(
+        { error: 'Rate limit exceeded' },
+        {
+          status,
+          headers: { ...buildRateLimitHeaders(RATE_LIMIT), 'Retry-After': '30' },
+        }
+      )
+    })
+    const request = postRequest('{not valid json')
+
+    const response = await POST(request, { params: { itemId: 'item-1' } })
+
+    expect(response.status).toBe(status)
+    expect(request.bodyUsed).toBe(false)
+    expect(mockHandler).not.toHaveBeenCalled()
+    expect(mockAuthenticateRequest).toHaveBeenCalledWith(request, 'v2-table-rows')
+    if (status === 401) {
+      expect(response.headers.get('X-RateLimit-Limit')).toBeNull()
+    } else {
+      expect(response.headers.get('Retry-After')).toBe('30')
+      expect(response.headers.get('X-RateLimit-Limit')).toBe('400')
+    }
+  })
+
+  it('returns a contract validation response after authentication', async () => {
+    const response = await POST(postRequest(JSON.stringify({ name: '' })), {
+      params: { itemId: 'item-1' },
+    })
+
+    expect(response.status).toBe(400)
+    expect(response.headers.get('X-RateLimit-Limit')).toBe('400')
+    expect(mockHandler).not.toHaveBeenCalled()
+  })
+
+  it('forwards the body-size parse option', async () => {
+    const response = await POST(postRequest(JSON.stringify({ name: 'x'.repeat(40) })), {
+      params: { itemId: 'item-1' },
+    })
+
+    expect(response.status).toBe(413)
+    expect(response.headers.get('X-RateLimit-Remaining')).toBe('399')
+    expect(mockHandler).not.toHaveBeenCalled()
+  })
+
+  it('provides parsed params, query, body, and auth to the handler', async () => {
+    const request = postRequest(JSON.stringify({ name: 'Ada' }))
+    const response = await POST(request, { params: Promise.resolve({ itemId: 'item-1' }) })
+
+    expect(response.status).toBe(200)
+    expect(mockHandler).toHaveBeenCalledWith({
+      request,
+      input: {
+        params: { itemId: 'item-1' },
+        query: { limit: 10 },
+        body: { name: 'Ada' },
+        headers: undefined,
+      },
+      auth: {
+        requestId: 'outer-request-id',
+        userId: 'user-1',
+        rateLimit: RATE_LIMIT,
+      },
+    })
+    expect(response.headers.get('x-request-id')).toBe('outer-request-id')
+    expect(response.headers.get('X-RateLimit-Reset')).toBe(RATE_LIMIT.resetAt.toISOString())
+    expect(mockLoggerInfo).toHaveBeenCalledWith(
+      'outer-request-id',
+      'OK',
+      expect.objectContaining({ status: 200 })
+    )
+  })
+
+  it('supports direct invocation without a route context', async () => {
+    const request = listRequest()
+    const response = await GET(request)
+
+    expect(response.status).toBe(200)
+    expect(mockHandler.mock.calls[0][0].input.query).toEqual({ workspaceId: 'workspace-1' })
+    expect(mockAuthenticateRequest).toHaveBeenCalledWith(request, 'v2-tables')
+  })
+
+  it('keeps rate-limit and request headers on unhandled endpoint errors', async () => {
+    const response = await FAILING_GET(listRequest())
+
+    expect(response.status).toBe(500)
+    expect(response.headers.get('x-request-id')).toBe('outer-request-id')
+    expect(response.headers.get('X-RateLimit-Limit')).toBe('400')
+  })
+})

apps/sim/app/api/public-api-route-handler.ts

@@ -0,0 +1,60 @@
+import type { NextRequest } from 'next/server'
+import { NextResponse } from 'next/server'
+import type { AnyApiRouteContract } from '@/lib/api/contracts'
+import { type ParsedRequest, type ParseRequestOptions, parseRequest } from '@/lib/api/server'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import {
+  type ApiEndpoint,
+  type AuthorizedRequest,
+  authenticateRequest,
+} from '@/app/api/v1/middleware'
+
+interface PublicApiRouteContext {
+  params?:
+    | Promise<Record<string, string | string[] | undefined>>
+    | Record<string, string | string[] | undefined>
+}
+
+interface PublicApiRouteHandlerArguments<C extends AnyApiRouteContract> {
+  request: NextRequest
+  input: ParsedRequest<C>
+  auth: AuthorizedRequest
+}
+
+interface PublicApiRouteHandlerOptions<C extends AnyApiRouteContract> {
+  contract: C
+  rateLimitEndpoint: ApiEndpoint
+  parseOptions?: ParseRequestOptions
+  handler: (
+    arguments_: PublicApiRouteHandlerArguments<C>
+  ) => Promise<NextResponse | Response> | NextResponse | Response
+}
+
+type PublicApiNextRouteHandler = (
+  request: NextRequest,
+  context?: PublicApiRouteContext
+) => Promise<NextResponse | Response>
+
+/**
+ * Wraps an API-key-authenticated public route with request context, rate
+ * limiting, authentication, and contract parsing before invoking the route's
+ * authorization and business logic.
+ */
+export function withPublicApiRouteHandler<C extends AnyApiRouteContract>({
+  contract,
+  rateLimitEndpoint,
+  parseOptions,
+  handler,
+}: PublicApiRouteHandlerOptions<C>): PublicApiNextRouteHandler {
+  const wrapped = withRouteHandler<PublicApiRouteContext | undefined>(async (request, context) => {
+    const auth = await authenticateRequest(request, rateLimitEndpoint)
+    if (auth instanceof NextResponse) return auth
+
+    const parsed = await parseRequest(contract, request, context ?? {}, parseOptions)
+    if (!parsed.success) return parsed.response
+
+    return handler({ request, input: parsed.data, auth })
+  })
+
+  return async (request, context) => wrapped(request, context)
+}

apps/sim/app/api/v1/middleware.test.ts

@@ -41,6 +41,7 @@ vi.mock('@/lib/core/rate-limiter', () => ({
 }))
 
 import {
+  authenticateRequest,
   checkRateLimit,
   createRateLimitResponse,
   v1ValidationErrorResponse,
@@ -107,6 +108,29 @@ describe('checkRateLimit', () => {
   })
 })
 
+describe('authenticateRequest', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockAuthenticateV1Request.mockResolvedValue({
+      authenticated: true,
+      keyType: 'personal',
+    })
+    mockGetSubscription.mockResolvedValue({ plan: 'team' })
+    mockGetRateLimit.mockReturnValue(TEAM_BUCKET)
+    mockCheckRateLimit.mockResolvedValue({
+      allowed: true,
+      remaining: 399,
+      resetAt: new Date('2026-07-28T18:28:48.354Z'),
+    })
+  })
+
+  it('fails fast when an allowed result has no user ID', async () => {
+    await expect(authenticateRequest(request(), 'workflows')).rejects.toThrow(
+      'Allowed public API request is missing a user ID'
+    )
+  })
+})
+
 describe('createRateLimitResponse', () => {
   const throttled = {
     allowed: false,

apps/sim/app/api/v1/middleware.ts

@@ -146,7 +146,7 @@ export async function checkRateLimit(
 }
 
 /**
- * Authenticates and rate-limits a v1 API request.
+ * Authenticates and rate-limits a public API request.
  * Returns NextResponse on failure, AuthorizedRequest on success.
  */
 export async function authenticateRequest(
@@ -158,7 +158,10 @@ export async function authenticateRequest(
   if (!rateLimit.allowed) {
     return createRateLimitResponse(rateLimit)
   }
-  return { requestId, userId: rateLimit.userId!, rateLimit }
+  if (!rateLimit.userId) {
+    throw new Error('Allowed public API request is missing a user ID')
+  }
+  return { requestId, userId: rateLimit.userId, rateLimit }
 }
 
 export function createRateLimitResponse(result: RateLimitResult): NextResponse {