fix(issues): Sim-only delegated body access, pinned review handoff, consistent list snapshot

Author: TheodoreSpeaks

apps/sim/app/workspace/[workspaceId]/issues/components/issue-detail.tsx

@@ -1,7 +1,7 @@
 'use client'
 
 import { useCallback, useState } from 'react'
-import { Chip, ChipLink, cn, pageHeadingClassName, toast } from '@sim/emcn'
+import { Chip, ChipLink, cn, OverflowText, pageHeadingClassName, toast } from '@sim/emcn'
 import { ArrowUpRight, ListChecks } from '@sim/emcn/icons'
 import { getErrorMessage } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
@@ -195,7 +195,7 @@ function IssueBar({ workspaceId, issue, canEdit, visible }: IssueBarProps) {
       )}
     >
       <div className={cn(COLUMN_CLASS, 'flex h-[48px] items-center gap-3 text-small')}>
-        <span className='min-w-0 flex-1 truncate text-[var(--text-primary)]'>{issue.title}</span>
+        <OverflowText label={issue.title} className='flex-1 text-[var(--text-primary)]' />
         <div className='flex shrink-0 items-center gap-2'>
           <IssueActions
             workspaceId={workspaceId}

apps/sim/app/workspace/[workspaceId]/issues/issues.tsx

@@ -1,6 +1,7 @@
 'use client'
 
 import { useState } from 'react'
+import { OverflowText } from '@sim/emcn'
 import { ListChecks, Plus } from '@sim/emcn/icons'
 import Link from 'next/link'
 import { ShimmerText } from '@/components/ui/shimmer-text'
@@ -52,7 +53,7 @@ function noteFor(issue: IssueRecord): string | null {
 
 export function Issues({ workspaceId }: IssuesProps) {
   const [creating, setCreating] = useState(false)
-  const query = useIssueList(workspaceId)
+  const query = useIssueList(workspaceId, { followProgress: true })
   const groups = groupIssues(query.data ?? [])
 
   return (
@@ -114,9 +115,11 @@ function IssueRow({ workspaceId, issue }: IssueRowProps) {
           )}
         </span>
         <span className='sr-only'>{issueStatusLabel(issue)}</span>
-        <span className='min-w-0 flex-1 truncate text-[var(--text-primary)] group-hover:underline group-hover:underline-offset-4'>
-          {issue.title}
-        </span>
+        <OverflowText
+          label={issue.title}
+          focusTarget='nearest-interactive'
+          className='flex-1 text-[var(--text-primary)] group-hover:underline group-hover:underline-offset-4'
+        />
         {note &&
           (issue.status === 'in_progress' && issue.workingChat?.running ? (
             <ShimmerText className='max-w-[280px] truncate text-caption'>{note}</ShimmerText>

apps/sim/hooks/queries/issues.ts

@@ -34,13 +34,24 @@ export const issueKeys = {
   detail: (workspaceId: string, key: string) => [...issueKeys.details(), workspaceId, key] as const,
 }
 
-export function useIssueList(workspaceId: string, options?: { enabled?: boolean }) {
+interface UseIssueListOptions {
+  enabled?: boolean
+  /** Refetch while any issue is in progress, so a page left open sees Sim hand work back. */
+  followProgress?: boolean
+}
+
+export function useIssueList(workspaceId: string, options?: UseIssueListOptions) {
   return useQuery({
     queryKey: issueKeys.list(workspaceId),
     queryFn: ({ signal }) =>
       requestJson(listIssuesContract, { params: { id: workspaceId }, signal }),
     enabled: Boolean(workspaceId) && (options?.enabled ?? true),
     staleTime: ISSUE_LIST_STALE_TIME,
+    refetchInterval: (query) =>
+      options?.followProgress &&
+      query.state.data?.issues.some((issue) => issue.status === 'in_progress')
+        ? ISSUE_RUNNING_REFETCH_INTERVAL
+        : false,
     select: (data) => data.issues,
   })
 }

apps/sim/lib/issues/__integration__/issue-body-access.integration.ts

@@ -6,7 +6,11 @@ import path from 'node:path'
 import type { Principal } from '@sim/auth/principal'
 import { db, dbFor } from '@sim/db'
 import { copilotChats, issue, issueEvent, organization, user, workspace } from '@sim/db/schema'
-import { createSessionPrincipal, createWorkspaceApiKeyPrincipal } from '@sim/testing'
+import {
+  createExecutorPrincipal,
+  createSessionPrincipal,
+  createWorkspaceApiKeyPrincipal,
+} from '@sim/testing'
 import { and, eq, inArray } from 'drizzle-orm'
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
 
@@ -130,6 +134,12 @@ describe('issue bodies in PostgreSQL', () => {
     await expect(
       readBody(filed.bodyFileId, createWorkspaceApiKeyPrincipal({ workspaceId: ids.workspaceId }))
     ).rejects.toMatchObject(notFound)
+    await expect(
+      readBody(
+        filed.bodyFileId,
+        createExecutorPrincipal({ subjectUserId: ids.aliceId, workspaceId: ids.workspaceId })
+      )
+    ).rejects.toMatchObject(notFound)
 
     flags.issues = false
     try {

apps/sim/lib/issues/application/issues.ts

@@ -415,7 +415,10 @@ export const requestIssueReview = defineAuthorizedWorkspaceUseCase({
       )
     await transition(
       context.issue.id,
-      { statuses: ['in_progress'] },
+      {
+        statuses: ['in_progress'],
+        ...(context.issue.workingChatId ? { workingChatId: context.issue.workingChatId } : {}),
+      },
       { status: 'inbox', reviewSummary: summary },
       (row) => [{ kind: 'review_requested', payload: { chatId: row.workingChatId, summary } }],
       principal

apps/sim/lib/issues/repository.ts

@@ -123,16 +123,20 @@ function issueListQuery(executor: DbOrTx) {
 /** Every open issue, plus the most recently closed ones. */
 export async function listWorkspaceIssues(workspaceId: string): Promise<IssueListRow[]> {
   const active = and(eq(issue.workspaceId, workspaceId), isNull(issue.deletedAt))
-  const [open, done] = await Promise.all([
-    issueListQuery(db)
-      .where(and(active, ne(issue.status, 'done')))
-      .orderBy(desc(issue.updatedAt)),
-    issueListQuery(db)
-      .where(and(active, eq(issue.status, 'done')))
-      .orderBy(desc(issue.completedAt))
-      .limit(LISTED_DONE_ISSUES),
-  ])
-  return [...open, ...done]
+  // One snapshot for both reads, so an issue closing in between is listed exactly once.
+  return db.transaction(
+    async (tx) => {
+      const open = await issueListQuery(tx)
+        .where(and(active, ne(issue.status, 'done')))
+        .orderBy(desc(issue.updatedAt))
+      const done = await issueListQuery(tx)
+        .where(and(active, eq(issue.status, 'done')))
+        .orderBy(desc(issue.completedAt))
+        .limit(LISTED_DONE_ISSUES)
+      return [...open, ...done]
+    },
+    { isolationLevel: 'repeatable read', accessMode: 'read only' }
+  )
 }
 
 export async function getIssueListRow(issueId: string): Promise<IssueListRow | null> {
@@ -144,6 +148,8 @@ export interface IssueStateGuard {
   statuses: readonly IssueStatus[]
   /** Inbox with a working chat is waiting for review; without one it is new. */
   hasWorkingChat?: boolean
+  /** The exact working chat the caller read, so a replaced chat's late request changes nothing. */
+  workingChatId?: string
   /** Fields that must still hold the values the caller read, so an edit never logs a stale "from". */
   unchanged?: { title?: string; priority?: number; ownerId?: string | null }
 }
@@ -172,6 +178,9 @@ export async function updateIssueInTx(
         eq(issue.id, issueId),
         inArray(issue.status, [...guard.statuses]),
         chatCondition,
+        guard.workingChatId === undefined
+          ? undefined
+          : eq(issue.workingChatId, guard.workingChatId),
         guard.unchanged?.title === undefined ? undefined : eq(issue.title, guard.unchanged.title),
         guard.unchanged?.priority === undefined
           ? undefined

apps/sim/lib/workspace-files/application/read-workspace-file-artifact.ts

@@ -8,6 +8,7 @@ import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/appl
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveRenderedWorkspaceArtifact } from '@/lib/workspace-files/application/resolve-rendered-workspace-artifact'
 import { resolveReferencedWorkspaceFileContext } from '@/lib/workspace-files/application/resolve-workspace-file-reference'
+import { secretProvenanceContextOf } from '@/lib/workspace-files/secret-provenance-context'
 
 interface ReadWorkspaceFileArtifactInput {
   workspaceId: string
@@ -35,7 +36,7 @@ export const readWorkspaceFileArtifact = defineAuthorizedWorkspaceFileUseCase({
     const safe = await isOpaqueWorkspaceFileEgressSafe(context.workspaceId, {
       fileId: file.id,
       key: file.key,
-      context: file.storageContext ?? 'workspace',
+      context: secretProvenanceContextOf(file),
       ...(file.contentUpdatedAt ? { contentUpdatedAt: file.contentUpdatedAt } : {}),
     })
     if (!safe) throw new OrchestrationError('forbidden', MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE)

apps/sim/lib/workspace-files/application/read-workspace-file-text.ts

@@ -30,6 +30,7 @@ import {
   type ReferencedWorkspaceFileContext,
   resolveReferencedWorkspaceFileContext,
 } from '@/lib/workspace-files/application/resolve-workspace-file-reference'
+import { secretProvenanceContextOf } from '@/lib/workspace-files/secret-provenance-context'
 import { parseWorkspaceFileText } from '@/lib/workspace-files/text-extraction'
 import { workspaceFileTextFormat } from '@/lib/workspace-files/text-format'
 import { sliceFileTextLines } from '@/lib/workspace-files/text-lines'
@@ -137,7 +138,7 @@ export async function extractWorkspaceFileRecordText(
       ? await getBoundWorkspaceFileSecretProvenance(file.workspaceId, {
           fileId: file.id,
           key: file.key,
-          context: file.storageContext ?? 'workspace',
+          context: secretProvenanceContextOf(file),
           contentUpdatedAt: file.contentUpdatedAt ?? undefined,
         })
       : undefined)

apps/sim/lib/workspace-files/application/workspace-file-context.ts

@@ -25,24 +25,29 @@ export interface WorkspaceFileContextInput {
   issueBodyPrincipal?: Principal
 }
 
-/** Principals the issue operations admit; workspace API keys and system callers never reach a body. */
+/**
+ * Principals the issue operations admit. A delegated caller must be Sim itself: a workflow's File
+ * tool delegates as the executor, and the issue operations refuse it.
+ */
 const ISSUE_BODY_PRINCIPAL_KINDS = new Set<Principal['kind']>([
   'session',
   'personal_api_key',
   'oauth_access_token',
-  'delegated',
 ])
 
+function isIssueBodyPrincipal(principal: Principal): boolean {
+  return principal.kind === 'delegated'
+    ? principal.serviceId === 'copilot'
+    : ISSUE_BODY_PRINCIPAL_KINDS.has(principal.kind)
+}
+
 /** An issue body follows its live issue: the rollout flag, and the issue operations' principal kinds. */
 export async function assertIssueBodyAccess(
   principal: Principal,
   context: ActiveWorkspaceFileContext
 ): Promise<void> {
   if (context.fileContext !== 'issue') return
-  if (
-    !ISSUE_BODY_PRINCIPAL_KINDS.has(principal.kind) ||
-    !(await hasLiveIssueForBody(context.fileId))
-  ) {
+  if (!isIssueBodyPrincipal(principal) || !(await hasLiveIssueForBody(context.fileId))) {
     throw new OrchestrationError('not_found', 'File not found')
   }
   await requireIssuesEnabled(context.workspaceOrganizationId)