fix(app): correct knowledge access and chat state

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/custom-blocks.mdx

@@ -131,7 +131,7 @@ Open a block from **Settings → Organization → Custom blocks** to edit or del
   },
   {
     question: "Can consumers see the workflow behind a block?",
-    answer: "A custom block only exposes the inputs it needs and the outputs you chose to share, and consumers don't need any access to the source workflow. Its steps and intermediate values stay hidden unless you enable Trace runs in consumer logs, which surfaces them in the consumer's run trace."
+    answer: "A custom block only exposes the inputs it needs and the outputs its publisher chose to share, and consumers don't need any access to the source workflow. Its steps and intermediate values stay hidden unless the block's publisher enables Trace runs in consumer logs, which surfaces them in the consumer's run trace."
   },
   {
     question: "Can I change which workflow a block points to?",

apps/docs/content/docs/platform/self-hosting/redis.mdx

@@ -24,7 +24,9 @@ Sim uses Redis as a message bus and shared cache. Both deployments ship it by de
   With more than one app or realtime replica and no `REDIS_URL`, users on different pods stop seeing each other's edits and live status updates. Beyond one startup log line noting single-pod mode, nothing is logged — the app looks healthy and quietly loses events. Treat Redis as mandatory the moment `replicaCount` exceeds 1.
 </Callout>
 
-Everything Sim keeps in Redis is cache, coordination state, or an in-flight event — never committed data, which lives in PostgreSQL and object storage. Persistence is therefore not required. Losing or restarting the instance is not free, though: cancellation markers and the cross-pod half of execution streaming live here, so active runs stop streaming and a cancellation issued across the gap may not land. Completed work is unaffected.
+Committed database records and files live in PostgreSQL and object storage, so Redis persistence is not required to retain them. Redis also stores completed idempotency claims and results when it is the selected idempotency backend. Losing those keys can allow a retried webhook to repeat an already completed side effect.
+
+Losing Redis state also drops cancellation markers and interrupts cross-pod execution streaming, so active runs can stop streaming and a cancellation issued across the gap may not land.
 
 ## Configuration
 
@@ -63,7 +65,7 @@ app:
 
 If the URL lives in a secret store instead — a pre-created Secret or one synced by External Secrets — it also wins, and there is nothing extra to configure. The bundled URL is delivered as a ConfigMap listed before the app Secret in `envFrom`, and Kubernetes lets the last source win for duplicate keys, so your value overrides it without the chart ever reading it.
 
-The bundled Redis is deliberately non-persistent (`--save ""`, `--appendonly no`) with a 512 MB cap: Sim stores coordination state and short-lived keys in it, so a restart costs in-flight live updates rather than committed data.
+The bundled Redis is non-persistent (`--save ""`, `--appendonly no`) with a 512 MB cap. A restart loses its coordination state and idempotency keys, with the retry and live-update consequences described above.
 
 If `networkPolicy.enabled=true`, egress to the bundled Redis is allowed automatically. An **external** Redis needs its own rule under `networkPolicy.egress` — the chart cannot know your host and port at render time.
 

apps/sim/app/api/knowledge/[id]/connectors/[connectorId]/enroll/route.test.ts

@@ -0,0 +1,130 @@
+/**
+ * @vitest-environment node
+ */
+import { createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  getSession: vi.fn(),
+  resolveContext: vi.fn(),
+  resolvePermission: vi.fn(),
+  getConnector: vi.fn(),
+  createEnrollmentLink: vi.fn(),
+  requireAvailable: vi.fn(),
+}))
+
+vi.mock('@/lib/auth', () => ({ getSession: mocks.getSession }))
+vi.mock('@sim/platform-authz/workspace', () => ({
+  resolveEffectiveWorkspacePermission: mocks.resolvePermission,
+  permissionSatisfies: (actual: string | null) => actual !== null,
+}))
+vi.mock('@/lib/knowledge/application/contexts', () => ({
+  resolveActiveKnowledgeConnectorContext: mocks.resolveContext,
+}))
+vi.mock('@/lib/knowledge/application/connectors', () => ({
+  requireConnectorWorkspaceId: (context: { workspaceId: string }) => context.workspaceId,
+  requireSuccessfulOutcome: vi.fn(),
+  resolveConnectorCredentialAccessToken: vi.fn(),
+}))
+vi.mock('@/lib/knowledge/orchestration/connectors', () => ({
+  getKnowledgeConnector: mocks.getConnector,
+}))
+vi.mock('@/lib/knowledge/orchestration/connector-access', () => ({
+  performUpdateKnowledgeConnectorAccess: vi.fn(),
+  resolveKnowledgeConnectorMembersBinding: vi.fn(),
+}))
+vi.mock('@/lib/knowledge/connectors/member-provisioning', () => ({
+  createViewerConnectorEnrollmentLink: mocks.createEnrollmentLink,
+}))
+vi.mock('@/lib/knowledge/access/availability', () => ({
+  requireKnowledgeMemberAccessAvailable: mocks.requireAvailable,
+}))
+vi.mock('@/lib/credential-groups/enrollments', () => ({
+  CredentialGroupEnrollmentError: class extends Error {
+    constructor(
+      message: string,
+      readonly status: 400 | 404 | 409 | 502
+    ) {
+      super(message)
+    }
+  },
+}))
+
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { CredentialGroupEnrollmentError } from '@/lib/credential-groups/enrollments'
+import { POST } from '@/app/api/knowledge/[id]/connectors/[connectorId]/enroll/route'
+
+const context = { params: Promise.resolve({ id: 'kb-1', connectorId: 'connector-1' }) }
+const request = () => createMockRequest('POST')
+
+describe('knowledge connector member enrollment', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.getSession.mockResolvedValue({ user: { id: 'user-1' }, session: { id: 'session-1' } })
+    mocks.resolvePermission.mockResolvedValue('read')
+    mocks.resolveContext.mockResolvedValue({
+      workspaceId: 'ws-1',
+      workspaceOrganizationId: null,
+      allowPersonalApiKeys: true,
+      knowledgeBaseId: 'kb-1',
+      connectorId: 'connector-1',
+    })
+    mocks.getConnector.mockResolvedValue({ accessMode: 'members', credentialGroupId: 'group-1' })
+    mocks.createEnrollmentLink.mockResolvedValue('https://example.com/enroll')
+  })
+
+  it.each([
+    { status: 404 as const, message: 'Credential group not found' },
+    { status: 409 as const, message: 'Credential group is disabled' },
+    {
+      status: 409 as const,
+      message: 'Add an account type or OAuth MCP server before inviting people',
+    },
+  ])('returns $status for $message', async ({ status, message }) => {
+    mocks.createEnrollmentLink.mockRejectedValue(
+      new CredentialGroupEnrollmentError(message, status)
+    )
+
+    const response = await POST(request(), context)
+
+    expect(response.status).toBe(status)
+    expect(await response.json()).toMatchObject({ error: message })
+  })
+
+  it('preserves the revoked-enrollment refusal', async () => {
+    mocks.createEnrollmentLink.mockRejectedValue(
+      new OrchestrationError('forbidden', 'A workspace admin removed your access to this connector')
+    )
+
+    const response = await POST(request(), context)
+
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({
+      error: 'A workspace admin removed your access to this connector',
+    })
+  })
+
+  it('does not disclose an unexpected enrollment failure', async () => {
+    mocks.createEnrollmentLink.mockRejectedValue(new Error('Database connection failed'))
+
+    const response = await POST(request(), context)
+
+    expect(response.status).toBe(500)
+    expect(await response.json()).toMatchObject({ error: 'Internal server error' })
+  })
+
+  it('issues the current member an enrollment link', async () => {
+    const response = await POST(request(), context)
+
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({
+      success: true,
+      data: { url: 'https://example.com/enroll' },
+    })
+    expect(mocks.createEnrollmentLink).toHaveBeenCalledWith({
+      userId: 'user-1',
+      workspaceId: 'ws-1',
+      credentialGroupId: 'group-1',
+    })
+  })
+})

apps/sim/app/api/knowledge/member-connectors/route.test.ts

@@ -0,0 +1,59 @@
+/**
+ * @vitest-environment node
+ */
+import { createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({ getSession: vi.fn(), listConnectors: vi.fn() }))
+
+vi.mock('@/lib/auth', () => ({ getSession: mocks.getSession }))
+vi.mock('@/lib/knowledge/application/connectors', async () => {
+  const { knowledgeOperations } = await import('@/lib/knowledge/application/operations')
+  return {
+    listWorkspaceMemberConnectors: {
+      operation: knowledgeOperations.listWorkspaceMemberConnectors,
+      execute: mocks.listConnectors,
+    },
+  }
+})
+
+import { NoWorkspaceAccessError } from '@/lib/core/application'
+import { GET } from '@/app/api/knowledge/member-connectors/route'
+
+const request = () =>
+  createMockRequest(
+    'GET',
+    undefined,
+    {},
+    'http://localhost:3000/api/knowledge/member-connectors?workspaceId=ws-1'
+  )
+
+describe('workspace member connector listing', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.getSession.mockResolvedValue({ user: { id: 'user-1' }, session: { id: 'session-1' } })
+    mocks.listConnectors.mockResolvedValue({ connectors: [] })
+  })
+
+  it('returns a workspace denial without concealing a nonexistent knowledge-base target', async () => {
+    mocks.listConnectors.mockRejectedValue(new NoWorkspaceAccessError())
+
+    const response = await GET(request())
+
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({ error: 'Insufficient workspace permissions' })
+  })
+
+  it('preserves the connector-list response for an authorized member', async () => {
+    const response = await GET(request())
+
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({ success: true, data: [] })
+    expect(mocks.listConnectors).toHaveBeenCalledWith(
+      expect.objectContaining({
+        principal: { kind: 'session', userId: 'user-1', sessionId: 'session-1' },
+        input: { workspaceId: 'ws-1' },
+      })
+    )
+  })
+})

apps/sim/app/api/knowledge/member-connectors/route.ts

@@ -13,7 +13,7 @@ export const GET = defineInternalJsonRoute({
   auth: internalSessionAuth,
   operation: knowledgeOperations.listWorkspaceMemberConnectors,
   rateLimit: internalRateLimits.none({ reason: 'One small read per visit to the Search tab' }),
-  errorPolicy: internalKnowledgeErrorPolicies.connectors,
+  errorPolicy: internalKnowledgeErrorPolicies.list,
   mapInput: ({ query }) => ({ workspaceId: query.workspaceId }),
   useCase: listWorkspaceMemberConnectors,
   present: ({ connectors }) => ({ success: true as const, data: connectors }),

apps/sim/app/api/v1/knowledge/[id]/documents/[documentId]/route.test.ts

@@ -0,0 +1,114 @@
+/**
+ * @vitest-environment node
+ */
+import { createMockRequest } from '@sim/testing'
+import { NextResponse } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  authenticate: vi.fn(),
+  resolveKnowledgeBase: vi.fn(),
+  resolveAccess: vi.fn(),
+  getDocument: vi.fn(),
+  deleteDocument: vi.fn(),
+}))
+
+vi.mock('@/app/api/v1/middleware', () => ({
+  authenticateRequest: mocks.authenticate,
+  v1ValidationErrorResponse: () => NextResponse.json({ error: 'Invalid request' }, { status: 400 }),
+}))
+vi.mock('@/app/api/v1/knowledge/utils', () => ({
+  resolveKnowledgeBase: mocks.resolveKnowledgeBase,
+  resolveV1KnowledgeAccessScope: mocks.resolveAccess,
+  serializeDate: vi.fn(),
+  handleError: () => NextResponse.json({ error: 'Unexpected error' }, { status: 500 }),
+}))
+vi.mock('@/lib/knowledge/documents/service', () => ({
+  getKnowledgeDocument: mocks.getDocument,
+}))
+vi.mock('@/lib/knowledge/orchestration', () => ({
+  performDeleteKnowledgeDocument: mocks.deleteDocument,
+}))
+
+import { WORKSPACE_ACCESS_SCOPE } from '@/lib/knowledge/access/scope'
+import type { KnowledgeAccessScope } from '@/lib/knowledge/access/types'
+import { DELETE } from '@/app/api/v1/knowledge/[id]/documents/[documentId]/route'
+
+const userAccess: KnowledgeAccessScope = {
+  kind: 'user',
+  userId: 'user-1',
+  tokens: ['pub', 'ws', 's:credential-1'],
+}
+const context = { params: Promise.resolve({ id: 'kb-1', documentId: 'doc-1' }) }
+const request = () =>
+  createMockRequest(
+    'DELETE',
+    undefined,
+    {},
+    'http://localhost:3000/api/v1/knowledge/kb-1/documents/doc-1?workspaceId=ws-1'
+  )
+
+describe('v1 knowledge document deletion', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.authenticate.mockResolvedValue({
+      userId: 'user-1',
+      requestId: 'req-1',
+      rateLimit: { keyType: 'personal' },
+    })
+    mocks.resolveKnowledgeBase.mockResolvedValue({
+      kb: { id: 'kb-1', name: 'Knowledge base', workspaceId: 'ws-1' },
+    })
+    mocks.resolveAccess.mockResolvedValue(userAccess)
+    mocks.getDocument.mockResolvedValue({ id: 'doc-1', filename: 'document.txt' })
+    mocks.deleteDocument.mockResolvedValue({ success: true })
+  })
+
+  it.each([
+    { keyType: 'personal', access: userAccess },
+    { keyType: 'workspace', access: WORKSPACE_ACCESS_SCOPE },
+  ])('carries $keyType access through lookup and deletion', async ({ keyType, access }) => {
+    mocks.authenticate.mockResolvedValue({
+      userId: 'user-1',
+      requestId: 'req-1',
+      rateLimit: { keyType },
+    })
+    mocks.resolveAccess.mockResolvedValue(access)
+
+    const response = await DELETE(request(), context)
+
+    expect(response.status).toBe(200)
+    expect(mocks.resolveAccess).toHaveBeenCalledExactlyOnceWith('user-1', { keyType }, 'ws-1')
+    expect(mocks.getDocument).toHaveBeenCalledWith('kb-1', 'doc-1', access)
+    expect(mocks.deleteDocument).toHaveBeenCalledWith(
+      expect.objectContaining({
+        access,
+        knowledgeBase: { id: 'kb-1', name: 'Knowledge base', workspaceId: 'ws-1' },
+      })
+    )
+    expect(await response.json()).toEqual({
+      success: true,
+      data: { message: 'Document deleted successfully' },
+    })
+  })
+
+  it('returns not found when access is lost between lookup and deletion', async () => {
+    mocks.deleteDocument.mockResolvedValue({
+      success: false,
+      errorCode: 'not_found',
+      error: 'Document not found',
+    })
+
+    const response = await DELETE(request(), context)
+
+    expect(response.status).toBe(404)
+    expect(await response.json()).toEqual({ error: 'Document not found' })
+  })
+
+  it('does not delete a document the initial lookup conceals', async () => {
+    mocks.getDocument.mockResolvedValue(null)
+
+    expect((await DELETE(request(), context)).status).toBe(404)
+    expect(mocks.deleteDocument).not.toHaveBeenCalled()
+  })
+})

apps/sim/app/api/v1/knowledge/[id]/documents/[documentId]/route.ts

@@ -113,17 +113,19 @@ export const DELETE = withRouteHandler(
       )
       if (result instanceof NextResponse) return result
 
-      const doc = await getKnowledgeDocument(
-        knowledgeBaseId,
-        documentId,
-        await resolveV1KnowledgeAccessScope(userId, rateLimit, parsed.data.query.workspaceId)
+      const access = await resolveV1KnowledgeAccessScope(
+        userId,
+        rateLimit,
+        parsed.data.query.workspaceId
       )
+      const doc = await getKnowledgeDocument(knowledgeBaseId, documentId, access)
 
       if (!doc) {
         return NextResponse.json({ error: 'Document not found' }, { status: 404 })
       }
 
       const outcome = await performDeleteKnowledgeDocument({
+        access,
         knowledgeBase: {
           id: knowledgeBaseId,
           name: result.kb.name,