fix(security): close the triggerType rate-limit bypass on workflow execute

Caller-supplied triggerType flowed unchecked into preprocessExecution,
whose checkRateLimit default turns OFF for 'manual'/'chat' — so any
API-key caller, and any anonymous public-API caller billed to the
workspace owner, could execute unthrottled by sending
{"triggerType":"manual"} (async runs also skipped the worker-side check
via admissionCompleted). External callers may now only send the
redundant 'api' value; internal JWT callers ('workflow'/'mcp') are
unaffected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CiHhAk2R1NryaS3R8n2yFz

Author: TheodoreSpeaks

apps/sim/app/api/workflows/[id]/execute/route.async.test.ts

@@ -1269,4 +1269,60 @@ describe('workflow execute async route', () => {
         : executionCall.snapshot
     expect(snapshot.metadata.enforceCredentialAccess).toBe(true)
   })
+  describe('triggerType override gate', () => {
+    it.each([
+      ['personal API key', EXECUTION_CALLERS[1]],
+      ['workspace API key', EXECUTION_CALLERS[2]],
+      ['public API', EXECUTION_CALLERS[3]],
+    ] as const)(
+      'rejects caller-supplied triggerType "manual" from %s callers',
+      async (_name, caller) => {
+        configureExecutionCaller(caller)
+        const req = createMockRequest(
+          'POST',
+          { hello: 'world', triggerType: 'manual' },
+          { 'Content-Type': 'application/json', ...caller.headers }
+        )
+
+        const response = await POST(req, { params: Promise.resolve({ id: 'workflow-1' }) })
+
+        expect(response.status).toBe(400)
+        await expect(response.json()).resolves.toMatchObject({
+          error: 'External callers cannot override triggerType',
+        })
+        expect(mockPreprocessExecution).not.toHaveBeenCalled()
+      }
+    )
+
+    it('accepts the redundant explicit "api" triggerType from API-key callers', async () => {
+      const caller = EXECUTION_CALLERS[1]
+      configureExecutionCaller(caller)
+      const req = createMockRequest(
+        'POST',
+        { hello: 'world', triggerType: 'api' },
+        { 'Content-Type': 'application/json', ...caller.headers, 'X-Execution-Mode': 'async' }
+      )
+
+      const response = await POST(req, { params: Promise.resolve({ id: 'workflow-1' }) })
+
+      expect(response.status).toBe(202)
+    })
+
+    it('still allows internal JWT callers to set triggerType', async () => {
+      const caller = EXECUTION_CALLERS[4]
+      configureExecutionCaller(caller)
+      const req = createMockRequest(
+        'POST',
+        { hello: 'world', triggerType: 'workflow' },
+        { 'Content-Type': 'application/json', ...caller.headers, 'X-Execution-Mode': 'async' }
+      )
+
+      const response = await POST(req, { params: Promise.resolve({ id: 'workflow-1' }) })
+
+      expect(response.status).toBe(202)
+      expect(mockPreprocessExecution).toHaveBeenCalledWith(
+        expect.objectContaining({ triggerType: 'workflow' })
+      )
+    })
+  })
 })

apps/sim/app/api/workflows/[id]/execute/route.ts

@@ -730,6 +730,24 @@ async function handleExecutePost(
       )
     }
 
+    /**
+     * External callers may not override the trigger type: `manual`/`chat` turn
+     * rate limiting off entirely (`preprocessExecution` defaults `checkRateLimit`
+     * from the trigger type), so a caller-supplied value is a quota bypass.
+     * `'api'` (the value they would get anyway) stays accepted for compatibility
+     * with callers that send it redundantly.
+     */
+    if (
+      (auth.authType === AuthType.API_KEY || isPublicApiAccess) &&
+      body.triggerType !== undefined &&
+      body.triggerType !== 'api'
+    ) {
+      return NextResponse.json(
+        { error: 'External callers cannot override triggerType' },
+        { status: 400 }
+      )
+    }
+
     if (auth.authType === 'api_key') {
       if (isClientSession) {
         return NextResponse.json(