fix(resource-policies): preserve ordinary resource authorization

Author: TheodoreSpeaks

apps/sim/lib/core/application/authorized-workspace-use-case.test.ts

@@ -253,7 +253,7 @@ describe('defineAuthorizedWorkspaceUseCase', () => {
     ])
   })
 
-  it('fails fast when the operation and resource authorization hook disagree', async () => {
+  it('requires policy-bound operations to define resource authorization', async () => {
     const execute = vi.fn(async () => ({ ok: true as const }))
     expect(() =>
       defineAuthorizedWorkspaceUseCase({
@@ -265,19 +265,33 @@ describe('defineAuthorizedWorkspaceUseCase', () => {
       })
     ).toThrow('Operation test.resource_policy requires resource policy authorization')
 
-    expect(() =>
-      defineAuthorizedWorkspaceUseCase({
-        operation,
-        resolveContext: async (_args: { principal: SessionPrincipal; input: TestInput }) =>
-          canonicalContext,
-        authorizationOptions: {},
-        authorizeResource() {},
-        execute,
-      })
-    ).toThrow('Operation test.rename does not declare a resource policy binding')
     expect(execute).not.toHaveBeenCalled()
   })
 
+  it('keeps non-policy resource authorization available to ordinary operations', async () => {
+    const authorizeResource = vi.fn()
+    const useCase = defineAuthorizedWorkspaceUseCase({
+      operation,
+      resolveContext: async (_args: { principal: SessionPrincipal; input: TestInput }) =>
+        canonicalContext,
+      authorizationOptions: {},
+      authorizeResource,
+      async execute() {
+        return { ok: true as const }
+      },
+    })
+
+    await expect(
+      useCase.execute({
+        principal: sessionPrincipal,
+        input: { resourceId: 'resource-1' },
+      })
+    ).resolves.toEqual({ ok: true })
+    expect(authorizeResource).toHaveBeenCalledWith(
+      expect.objectContaining({ context: canonicalContext })
+    )
+  })
+
   it('supports zero or many semantic audit entries', async () => {
     const buildUseCase = (auditCount: number) =>
       defineAuthorizedWorkspaceUseCase({

apps/sim/lib/core/application/authorized-workspace-use-case.ts

@@ -57,7 +57,7 @@ export interface AuthorizedWorkspaceUseCaseDefinition<
     | ((
         args: AuthorizedWorkspaceUseCaseContext<O, I, C>
       ) => WorkspaceAuthorizationOptions<C> | Promise<WorkspaceAuthorizationOptions<C>>)
-  /** Required exactly when the operation declares a resource policy binding. */
+  /** Receives the operation-owned policy binding when the operation declares one. */
   authorizeResource?(args: AuthorizedWorkspaceResourceUseCaseContext<O, I, C>): void | Promise<void>
   execute(args: AuthorizedWorkspaceUseCaseContext<O, I, C>): Promise<R>
   projectAudit?(
@@ -136,14 +136,16 @@ export function defineAuthorizedWorkspaceUseCase<
       }
       const resourcePolicy = definition.operation.resourcePolicy as ResourcePolicyForOperation<O>
       return (executionContext: AuthorizedWorkspaceUseCaseContext<O, I, C>) =>
-        authorizeResource({ ...executionContext, resourcePolicy })
+        authorizeResource({
+          ...executionContext,
+          resourcePolicy,
+        } as AuthorizedWorkspaceResourceUseCaseContext<O, I, C>)
     }
-    if (definition.authorizeResource) {
-      throw new Error(
-        `Operation ${definition.operation.id} does not declare a resource policy binding`
-      )
-    }
-    return undefined
+    const authorizeResource = definition.authorizeResource
+    return authorizeResource
+      ? (executionContext: AuthorizedWorkspaceUseCaseContext<O, I, C>) =>
+          authorizeResource(executionContext as AuthorizedWorkspaceResourceUseCaseContext<O, I, C>)
+      : undefined
   })()
 
   /**