fix(workflows): authorize paused execution reads

[waleedlatif1]

Summary

• Authorize paused execution reads through the shared workflow application boundary before loading execution detail
• Protect both resume-detail routes and the server-rendered page while concealing cross-workspace access
• Preserve login and retry behavior, prevent cached client data exposure, and validate deep-linked contexts against authorized pause points

Type of Change

• Bug fix

Testing

• bun run lint
• bun run check:audits (39 audits)
• Focused Vitest suites (60 tests)
• bunx turbo run type-check --filter=@sim/app --filter=@sim/auth
• bun run test:actorless-executor-operations
• bun run check:api-validation:strict

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 31, 2026 8:52pm

[greptile-apps]

Greptile Summary

The PR routes paused-execution reads through the shared workflow authorization boundary and updates the resume surface to fetch protected details client-side.

• Adds a workflow read operation and authorized paused-execution use case.
• Migrates both detail endpoints to the internal JSON route framework with authorization concealment and private, non-cacheable responses.
• Reauthorizes the server-rendered resume page and validates deep-linked pause contexts against returned execution data.
• Adds loading, login-redirection, concealed-not-found, and retryable infrastructure-error states with focused tests.

Confidence Score: 5/5

The PR appears safe to merge, with paused-execution detail consistently protected at the page, API, application, and data-lookup boundaries.

Authorization completes before protected detail loading, execution lookup is constrained by both workflow and execution identifiers, and client failure states avoid rendering inaccessible cached details.

Important Files Changed

Filename	Overview
apps/sim/lib/workflows/application/read-paused-workflow-execution.ts	Adds an authorized read use case whose manager lookup remains bound to the canonical workflow and requested execution.
apps/sim/app/api/resume/[workflowId]/[executionId]/route.ts	Migrates the resume-detail endpoint to the shared authenticated route boundary with concealed authorization errors and no-store responses.
apps/sim/app/api/workflows/[id]/paused/[executionId]/route.ts	Applies the same authorized paused-execution read behavior to the sibling workflow endpoint.
apps/sim/app/(interfaces)/resume/[workflowId]/[executionId]/page.tsx	Requires a valid session and workflow-read authorization before rendering the client resume surface.
apps/sim/app/(interfaces)/resume/[workflowId]/[executionId]/resume-page-client.tsx	Moves protected detail loading client-side, validates deep-linked contexts, and distinguishes authentication, concealment, and retryable failures.
apps/sim/hooks/queries/resume-execution.ts	Removes server-provided initial detail and adds bounded retry behavior that treats authorization and not-found responses as terminal.
apps/sim/lib/workflows/application/operations.ts	Registers paused-execution detail as a workspace-scoped workflow read operation.

Sequence Diagram

sequenceDiagram
  participant U as User
  participant P as Resume page
  participant R as Detail API
  participant A as Workflow authorization
  participant M as Pause manager
  U->>P: Open resume deep link
  P->>A: Authorize session for workflow
  alt Unauthorized or workflow unavailable
    A-->>P: Forbidden or not found
    P-->>U: Concealed unavailable state
  else Authorized
    A-->>P: Allowed
    P-->>U: Render client surface
    U->>R: Fetch paused execution detail
    R->>A: Authorize workflow read
    A-->>R: Authorized workflow context
    R->>M: Load by workflowId and executionId
    M-->>R: Protected execution detail
    R-->>U: Private, no-store response
  end

Loading

_{Reviews (1): Last reviewed commit: "fix(workflows): authorize paused executi..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 14 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}