fix(webhooks): guard against a non-string workspaceId when resolving env vars

workflow.workspaceId as string | undefined was an unchecked cast on a
Record<string, unknown> — if a caller ever passed a workflow-like object
where workspaceId isn't actually a string, workspace-scoped {{VAR}}
references would silently stay unresolved and the provider would receive
the literal template as the credential, reproducing the exact class of bug
this change exists to fix. Replaced with a runtime typeof check that falls
back to undefined (personal-env-only resolution) instead of forwarding an
unvalidated value.

Author: waleedlatif1

apps/sim/lib/webhooks/provider-subscriptions.test.ts

@@ -74,6 +74,29 @@ describe('createExternalWebhookSubscription', () => {
     expect(result.updatedProviderConfig.externalId).toBe('ext-1')
   })
 
+  it('falls back to personal-only env resolution when workspaceId is not a string', async () => {
+    const createSubscription = vi.fn().mockResolvedValue({
+      providerConfigUpdates: { externalId: 'ext-1' },
+    })
+    mockGetProviderHandler.mockReturnValue({ createSubscription })
+
+    const webhookData = {
+      provider: 'ashby',
+      providerConfig: { apiKey: '{{ASHBY_API_KEY}}', triggerId: 'ashby_application_submit' },
+    }
+    const workflow = { id: 'wf-1', workspaceId: null }
+
+    await createExternalWebhookSubscription(
+      {} as NextRequest,
+      webhookData,
+      workflow,
+      'user-1',
+      'req-1'
+    )
+
+    expect(mockGetEffectiveDecryptedEnv).toHaveBeenCalledWith('user-1', undefined)
+  })
+
   it('skips resolution and provider call entirely when the provider has no createSubscription', async () => {
     mockGetProviderHandler.mockReturnValue({})
 

apps/sim/lib/webhooks/provider-subscriptions.ts

@@ -115,10 +115,12 @@ export async function createExternalWebhookSubscription(
     return { updatedProviderConfig: providerConfig, externalSubscriptionCreated: false }
   }
 
+  const workspaceId = typeof workflow.workspaceId === 'string' ? workflow.workspaceId : undefined
+
   const resolvedProviderConfig = await resolveWebhookProviderConfig(
     providerConfig,
     userId,
-    workflow.workspaceId as string | undefined
+    workspaceId
   )
 
   const result = await handler.createSubscription({