fix(security): thread workflowId through internal HITL cancellation calls and remove dead branches in credential-access

Author: waleedlatif1

apps/sim/lib/auth/credential-access.ts

@@ -78,44 +78,40 @@ export async function authorizeCredentialUse(
         return { ok: false, error: 'Credential is not accessible from this workflow workspace' }
       }
 
-      if (actingUserId) {
-        const requesterPerm = await getUserEntityPermissions(
-          actingUserId,
-          'workspace',
-          platformCredential.workspaceId
-        )
+      const requesterPerm = await getUserEntityPermissions(
+        actingUserId,
+        'workspace',
+        platformCredential.workspaceId
+      )
 
-        const [membership] = await db
-          .select({ id: credentialMember.id })
-          .from(credentialMember)
-          .where(
-            and(
-              eq(credentialMember.credentialId, platformCredential.id),
-              eq(credentialMember.userId, actingUserId),
-              eq(credentialMember.status, 'active')
-            )
+      const [membership] = await db
+        .select({ id: credentialMember.id })
+        .from(credentialMember)
+        .where(
+          and(
+            eq(credentialMember.credentialId, platformCredential.id),
+            eq(credentialMember.userId, actingUserId),
+            eq(credentialMember.status, 'active')
           )
-          .limit(1)
-
-        if (!membership) {
-          return {
-            ok: false,
-            error:
-              'You do not have access to this credential. Ask the credential admin to add you as a member.',
-          }
-        }
-        if (requesterPerm === null) {
-          return { ok: false, error: 'You do not have access to this workspace.' }
+        )
+        .limit(1)
+
+      if (!membership) {
+        return {
+          ok: false,
+          error:
+            'You do not have access to this credential. Ask the credential admin to add you as a member.',
         }
-      } else if (!workflowContext) {
-        return { ok: false, error: 'workflowId is required' }
+      }
+      if (requesterPerm === null) {
+        return { ok: false, error: 'You do not have access to this workspace.' }
       }
 
       return {
         ok: true,
         authType: auth.authType as CredentialAccessResult['authType'],
         requesterUserId: auth.userId,
-        credentialOwnerUserId: actingUserId || auth.userId,
+        credentialOwnerUserId: actingUserId,
         workspaceId: platformCredential.workspaceId,
         resolvedCredentialId: platformCredential.id,
       }
@@ -139,36 +135,34 @@ export async function authorizeCredentialUse(
       return { ok: false, error: 'Credential account not found' }
     }
 
-    if (actingUserId) {
-      const requesterPerm = await getUserEntityPermissions(
-        actingUserId,
-        'workspace',
-        platformCredential.workspaceId
-      )
+    const requesterPerm = await getUserEntityPermissions(
+      actingUserId,
+      'workspace',
+      platformCredential.workspaceId
+    )
 
-      const [membership] = await db
-        .select({ id: credentialMember.id })
-        .from(credentialMember)
-        .where(
-          and(
-            eq(credentialMember.credentialId, platformCredential.id),
-            eq(credentialMember.userId, actingUserId),
-            eq(credentialMember.status, 'active')
-          )
+    const [membership] = await db
+      .select({ id: credentialMember.id })
+      .from(credentialMember)
+      .where(
+        and(
+          eq(credentialMember.credentialId, platformCredential.id),
+          eq(credentialMember.userId, actingUserId),
+          eq(credentialMember.status, 'active')
         )
-        .limit(1)
+      )
+      .limit(1)
 
-      if (!membership) {
-        return {
-          ok: false,
-          error: `You do not have access to this credential. Ask the credential admin to add you as a member.`,
-        }
+    if (!membership) {
+      return {
+        ok: false,
+        error: `You do not have access to this credential. Ask the credential admin to add you as a member.`,
       }
-      if (requesterPerm === null) {
-        return {
-          ok: false,
-          error: 'You do not have access to this workspace.',
-        }
+    }
+    if (requesterPerm === null) {
+      return {
+        ok: false,
+        error: 'You do not have access to this workspace.',
       }
     }
 
@@ -222,25 +216,23 @@ export async function authorizeCredentialUse(
       return { ok: false, error: 'Credential account not found' }
     }
 
-    if (actingUserId) {
-      const [membership] = await db
-        .select({ id: credentialMember.id })
-        .from(credentialMember)
-        .where(
-          and(
-            eq(credentialMember.credentialId, workspaceCredential.id),
-            eq(credentialMember.userId, actingUserId),
-            eq(credentialMember.status, 'active')
-          )
+    const [membership] = await db
+      .select({ id: credentialMember.id })
+      .from(credentialMember)
+      .where(
+        and(
+          eq(credentialMember.credentialId, workspaceCredential.id),
+          eq(credentialMember.userId, actingUserId),
+          eq(credentialMember.status, 'active')
         )
-        .limit(1)
+      )
+      .limit(1)
 
-      if (!membership) {
-        return {
-          ok: false,
-          error:
-            'You do not have access to this credential. Ask the credential admin to add you as a member.',
-        }
+    if (!membership) {
+      return {
+        ok: false,
+        error:
+          'You do not have access to this credential. Ask the credential admin to add you as a member.',
       }
     }
 

apps/sim/lib/workflows/executor/human-in-the-loop-manager.ts

@@ -476,10 +476,14 @@ export class PauseResumeManager {
             failureReason: 'Resume execution cancelled',
           })
           const pausedCancellationStatus = await PauseResumeManager.getPausedCancellationStatus(
-            pausedExecution.executionId
+            pausedExecution.executionId,
+            pausedExecution.workflowId
           )
           if (pausedCancellationStatus === 'cancelling') {
-            await PauseResumeManager.completePausedCancellation(pausedExecution.executionId)
+            await PauseResumeManager.completePausedCancellation(
+              pausedExecution.executionId,
+              pausedExecution.workflowId
+            )
           }
         } else {
           await PauseResumeManager.updateSnapshotAfterResume({