Merge remote-tracking branch 'origin/staging' into feat/permission-aware-knowledge

Author: waleedlatif1

.github/workflows/desktop-release.yml

@@ -187,12 +187,47 @@ jobs:
           printf '%s' "$APPLE_API_KEY_P8" > "$RUNNER_TEMP/appstoreconnect/AuthKey.p8"
           chmod 600 "$RUNNER_TEMP/appstoreconnect/AuthKey.p8"
 
-      - name: Package, sign, and notarize
+      - name: Import Apple signing certificate
         if: ${{ inputs.sign }}
-        working-directory: apps/desktop
         env:
           CSC_LINK: ${{ secrets.CSC_LINK }}
           CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+        run: |
+          CERTIFICATE_PATH="$RUNNER_TEMP/desktop-signing.p12"
+          KEYCHAIN_PATH="$RUNNER_TEMP/desktop-signing.keychain-db"
+          KEYCHAIN_PASSWORD="$(openssl rand -base64 32)"
+
+          printf '%s' "$CSC_LINK" | base64 --decode > "$CERTIFICATE_PATH"
+          chmod 600 "$CERTIFICATE_PATH"
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security import "$CERTIFICATE_PATH" -k "$KEYCHAIN_PATH" -P "$CSC_KEY_PASSWORD" \
+            -T /usr/bin/codesign -T /usr/bin/productbuild
+          security set-key-partition-list -S apple-tool:,apple: -s \
+            -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" > /dev/null
+
+          EXISTING_KEYCHAINS=("$KEYCHAIN_PATH")
+          while IFS= read -r EXISTING_KEYCHAIN; do
+            EXISTING_KEYCHAIN="${EXISTING_KEYCHAIN#*\"}"
+            EXISTING_KEYCHAIN="${EXISTING_KEYCHAIN%\"}"
+            if [ "$EXISTING_KEYCHAIN" != "$KEYCHAIN_PATH" ]; then
+              EXISTING_KEYCHAINS+=("$EXISTING_KEYCHAIN")
+            fi
+          done < <(security list-keychains -d user)
+          security list-keychains -d user -s "${EXISTING_KEYCHAINS[@]}"
+
+          SIGNING_IDENTITIES="$(security find-identity -v -p codesigning "$KEYCHAIN_PATH")"
+          if ! grep -q 'Developer ID Application' <<< "$SIGNING_IDENTITIES"; then
+            echo '::error::The signing certificate does not contain a valid Developer ID Application identity.'
+            exit 1
+          fi
+
+      - name: Package, sign, and notarize
+        if: ${{ inputs.sign }}
+        working-directory: apps/desktop
+        env:
+          CSC_KEYCHAIN: ${{ runner.temp }}/desktop-signing.keychain-db
           # Absolute path — @electron/notarize reads this via Node fs, which
           # does not expand a leading '~'.
           APPLE_API_KEY: ${{ runner.temp }}/appstoreconnect/AuthKey.p8
@@ -205,6 +240,13 @@ jobs:
           bunx electron-builder --mac --publish never
           -c.productName="$PRODUCT_NAME" -c.appId="$APP_ID"
 
+      - name: Remove Apple signing credentials
+        if: ${{ always() && inputs.sign }}
+        run: |
+          security delete-keychain "$RUNNER_TEMP/desktop-signing.keychain-db" || true
+          rm -f "$RUNNER_TEMP/desktop-signing.p12"
+          rm -f "$RUNNER_TEMP/appstoreconnect/AuthKey.p8"
+
       # Unsigned artifact-only path: no Developer ID or notarization. The bundle
       # is ad-hoc signed with Hardened Runtime off for local workflow testing and
       # must never be published.

apps/sim/ee/organization-usage/constants.ts

@@ -1,5 +1,7 @@
 import type { ComboboxOption } from '@sim/emcn'
 import {
+  ORGANIZATION_USAGE_BREAKDOWN_DEFAULT_LIMIT,
+  ORGANIZATION_USAGE_BREAKDOWN_MAX_LIMIT,
   USAGE_WINDOW_PRESETS,
   type UsageBreakdownDimension,
   type UsageWindowPreset,
@@ -78,13 +80,12 @@ export const USAGE_TAB_EMPTY_COPY: Record<UsageBreakdownDimension, string> = {
 /**
  * Rows per breakdown before and after the `Other` row is expanded.
  *
- * The collapsed count keeps a tab to one screen; the expanded one is the contract's
- * own ceiling (`usageLimitSchema(50, 10)`), so asking for more would be refused. A
- * dimension with more than {@link EXPANDED_ROW_COUNT} distinct rows still shows an
- * `Other` row after expanding, which is the honest result rather than a bug.
+ * Each tab shows the contract default immediately, then can request the contract
+ * ceiling by expanding `Other`. A dimension with more than
+ * {@link EXPANDED_ROW_COUNT} distinct rows still shows a remainder after expanding.
  */
-export const COLLAPSED_ROW_COUNT = 10
-export const EXPANDED_ROW_COUNT = 50
+export const COLLAPSED_ROW_COUNT = ORGANIZATION_USAGE_BREAKDOWN_DEFAULT_LIMIT
+export const EXPANDED_ROW_COUNT = ORGANIZATION_USAGE_BREAKDOWN_MAX_LIMIT
 
 export const DEFAULT_USAGE_PRESET = 'current-period' as const
 export const DEFAULT_USAGE_TAB = USAGE_OVERVIEW_TAB

apps/sim/hooks/queries/organization-usage.ts

@@ -6,6 +6,7 @@ import {
   getOrganizationUsageBreakdownContract,
   getOrganizationUsageSummaryContract,
   listOrganizationUsageEventsContract,
+  ORGANIZATION_USAGE_BREAKDOWN_DEFAULT_LIMIT,
   type OrganizationUsageBreakdown,
   type OrganizationUsageEventPage,
   type OrganizationUsageSummary,
@@ -96,7 +97,7 @@ export function useOrganizationUsageBreakdown(
   dimension: UsageBreakdownDimension,
   options: UseBreakdownOptions = {}
 ) {
-  const limit = options.limit ?? 10
+  const limit = options.limit ?? ORGANIZATION_USAGE_BREAKDOWN_DEFAULT_LIMIT
   const { workspaceId } = options
   const queryKey = organizationUsageKeys.breakdown(
     organizationId ?? '',

apps/sim/lib/api/contracts/organization-usage.test.ts

@@ -2,7 +2,10 @@
  * @vitest-environment node
  */
 import { describe, expect, it } from 'vitest'
-import { organizationUsageEventsQuerySchema } from '@/lib/api/contracts/organization-usage'
+import {
+  organizationUsageBreakdownQuerySchema,
+  organizationUsageEventsQuerySchema,
+} from '@/lib/api/contracts/organization-usage'
 
 /** The shared window fields every usage contract extends, exercised through one of them. */
 function parseWindow(input: Record<string, unknown>) {
@@ -68,3 +71,20 @@ describe('organization usage window contract', () => {
     expect(parseWindow({ timezone: 'Mars/Olympus_Mons' }).success).toBe(false)
   })
 })
+
+describe('organization usage breakdown contract', () => {
+  const baseQuery = { dimension: 'workspace' as const }
+
+  it('defaults to 50 rows', () => {
+    expect(organizationUsageBreakdownQuerySchema.parse(baseQuery).limit).toBe(50)
+  })
+
+  it('allows expansion to 100 rows and refuses larger requests', () => {
+    expect(
+      organizationUsageBreakdownQuerySchema.safeParse({ ...baseQuery, limit: 100 }).success
+    ).toBe(true)
+    expect(
+      organizationUsageBreakdownQuerySchema.safeParse({ ...baseQuery, limit: 101 }).success
+    ).toBe(false)
+  })
+})

apps/sim/lib/api/contracts/organization-usage.ts

@@ -40,6 +40,9 @@ export type UsageBreakdownDimension = z.output<typeof usageBreakdownDimensionSch
  */
 export const MAX_CUSTOM_RANGE_DAYS = 92
 
+export const ORGANIZATION_USAGE_BREAKDOWN_DEFAULT_LIMIT = 50
+export const ORGANIZATION_USAGE_BREAKDOWN_MAX_LIMIT = 100
+
 /**
  * A bare `YYYY-MM-DD` calendar date, and nothing else.
  *
@@ -144,7 +147,10 @@ export type OrganizationUsageSummaryQuery = z.input<typeof organizationUsageSumm
 export const organizationUsageBreakdownQuerySchema = organizationUsageWindowQuerySchema.extend({
   ...usageWorkspaceScopeShape,
   dimension: usageBreakdownDimensionSchema,
-  limit: usageLimitSchema(50, 10),
+  limit: usageLimitSchema(
+    ORGANIZATION_USAGE_BREAKDOWN_MAX_LIMIT,
+    ORGANIZATION_USAGE_BREAKDOWN_DEFAULT_LIMIT
+  ),
 })
 export type OrganizationUsageBreakdownQuery = z.input<typeof organizationUsageBreakdownQuerySchema>