fix(dashboards): scope entitlements, keep mention ids, and tighten contracts

Author: TheodoreSpeaks

apps/sim/app/workspace/[workspaceId]/home/hooks/use-chat.ts

@@ -3423,6 +3423,7 @@ export function useChat(
           ? { viewId: (c.currentView ? c.currentView.viewId : c.viewId) ?? undefined }
           : {}),
         ...('fileId' in c && c.fileId ? { fileId: c.fileId } : {}),
+        ...('dashboardId' in c && c.dashboardId ? { dashboardId: c.dashboardId } : {}),
         ...('folderId' in c && c.folderId ? { folderId: c.folderId } : {}),
         ...(c.kind === 'skill' && 'skillId' in c ? { skillId: c.skillId } : {}),
         ...(c.kind === 'integration' && 'blockType' in c ? { blockType: c.blockType } : {}),

apps/sim/components/charts/time-series-chart.tsx

@@ -23,6 +23,7 @@ export function TimeSeriesChart({ label, option, ...config }: TimeSeriesChartPro
     <div className='h-full min-w-0'>
       <div
         className='mb-2 flex h-8 min-w-0 items-center justify-between gap-4 text-sm tabular-nums'
+        role='group'
         aria-label={`${label} values`}
       >
         <div

apps/sim/lib/api/contracts/dashboards.ts

@@ -13,7 +13,7 @@ export const dashboardRecordSchema = z.object({
   type: z.literal('dashboard'),
   name: z.string(),
   updatedAt: z.string(),
-  revision: z.string(),
+  revision: dashboardRevisionSchema,
 })
 
 /** A workspace has at most one dashboard, which Sim builds; both fields are null until then. */
@@ -25,7 +25,7 @@ export const readWorkspaceDashboardContract = defineRouteContract({
     mode: 'json',
     schema: z.object({
       dashboard: dashboardRecordSchema.nullable(),
-      content: z.string().nullable(),
+      content: dashboardContentSchema.nullable(),
     }),
   },
 })

apps/sim/lib/dashboards/repository.integration.ts

@@ -53,14 +53,15 @@ describe('dashboard repository in PostgreSQL', () => {
   })
 
   it('updates only at the expected revision and advances it', async () => {
-    const current = (await getWorkspaceDashboard('ws-a'))!
+    const current = await insertWorkspaceDashboard('ws-c', 'original', 'user-1')
+    if (!current) throw new Error('ws-c dashboard was not created')
     const updated = await updateDashboardContent(current.id, 'edited', 'user-2', current.revision)
     expect(updated).toMatchObject({
       content: 'edited',
       revision: current.revision + 1,
       updatedBy: 'user-2',
     })
     expect(await updateDashboardContent(current.id, 'stale', 'user-3', current.revision)).toBeNull()
-    expect((await getWorkspaceDashboard('ws-a'))?.content).toBe('edited')
+    expect((await getWorkspaceDashboard('ws-c'))?.content).toBe('edited')
   })
 })

apps/sim/lib/mothership/chat/display-message.test.ts

@@ -154,6 +154,20 @@ describe('display-message', () => {
     ])
   })
 
+  it('keeps the dashboard id on a reopened dashboard mention', () => {
+    const display = toDisplayMessage({
+      id: 'msg-dashboard',
+      role: 'user',
+      content: '@Dashboard',
+      timestamp: '2024-01-01T00:00:00.000Z',
+      contexts: [{ kind: 'dashboard', label: 'Dashboard', dashboardId: 'dash-1' }],
+    })
+
+    expect(display.contexts).toEqual([
+      { kind: 'dashboard', label: 'Dashboard', dashboardId: 'dash-1' },
+    ])
+  })
+
   it('preserves browser and terminal selection metadata for reopened messages', () => {
     const display = toDisplayMessage({
       id: 'msg-selection',

apps/sim/lib/mothership/chat/display-message.ts

@@ -2,7 +2,11 @@ import type { PersistedContentBlock } from '@/lib/api/contracts/copilot-messages
 import { getMothershipAttachmentPreviewUrl } from '@/lib/mothership/chat/attachment-preview'
 import { isLiveAssistantMessageId } from '@/lib/mothership/chat/live-message-id'
 import type { PersistedMessage } from '@/lib/mothership/chat/persisted-message'
-import { isUnsettledToolState, withBlockTiming } from '@/lib/mothership/chat/persisted-message'
+import {
+  copyPersistedMessageContext,
+  isUnsettledToolState,
+  withBlockTiming,
+} from '@/lib/mothership/chat/persisted-message'
 import {
   MothershipStreamV1CompletionStatus,
   MothershipStreamV1EventType,
@@ -141,25 +145,10 @@ function toDisplayContexts(
   contexts: PersistedMessage['contexts']
 ): ChatMessageContext[] | undefined {
   if (!contexts || contexts.length === 0) return undefined
-  return contexts.map((c) => ({
-    kind: c.kind as ChatContextKind,
-    label: c.label,
-    ...(c.workflowId ? { workflowId: c.workflowId } : {}),
-    ...(c.knowledgeId ? { knowledgeId: c.knowledgeId } : {}),
-    ...(c.tableId ? { tableId: c.tableId } : {}),
-    ...(c.viewId ? { viewId: c.viewId } : {}),
-    ...(c.fileId ? { fileId: c.fileId } : {}),
-    ...(c.folderId ? { folderId: c.folderId } : {}),
-    ...(c.chatId ? { chatId: c.chatId } : {}),
-    ...(c.blockType ? { blockType: c.blockType } : {}),
-    ...(c.skillId ? { skillId: c.skillId } : {}),
-    ...(c.serverId ? { serverId: c.serverId } : {}),
-    ...(c.fileName ? { fileName: c.fileName } : {}),
-    ...(c.tableName ? { tableName: c.tableName } : {}),
-    ...(c.tabId ? { tabId: c.tabId } : {}),
-    ...(c.terminalId ? { terminalId: c.terminalId } : {}),
-    ...(c.selection ? { selection: { ...c.selection } } : {}),
-  }))
+  return contexts.map((c) => {
+    const copy = copyPersistedMessageContext(c)
+    return { ...copy, kind: copy.kind as ChatContextKind }
+  })
 }
 
 const WORKSPACE_FILE_TOOL = 'prepare_file_edit'

apps/sim/lib/mothership/chat/payload.test.ts

@@ -372,6 +372,23 @@ describe('buildCopilotRequestPayload', () => {
     }
   )
 
+  it('never grants the workspace-only dashboards entitlement to an organization chat', async () => {
+    mockDashboardAvailability.mockResolvedValue(true)
+    const payload = await buildCopilotRequestPayload(
+      {
+        message: 'Show my dashboard',
+        userId: 'actor',
+        userMessageId: 'message-1',
+        organizationId: 'org-1',
+        principal: { kind: 'session' as const, userId: 'actor' },
+        mode: 'agent',
+        model: '',
+      },
+      { selectedModel: '' }
+    )
+    expect(payload.entitlements).toEqual([])
+  })
+
   beforeEach(() => {
     mockTrackChatUpload.mockResolvedValue({ displayName: 'payroll.xlsx' })
     mockSecretNames.mockResolvedValue({ names: [] })

apps/sim/lib/mothership/chat/persisted-message.ts

@@ -38,7 +38,7 @@ export interface PersistedFileAttachment {
   size: number
 }
 
-interface PersistedMessageContext {
+export interface PersistedMessageContext {
   kind: string
   label: string
   workflowId?: string
@@ -87,6 +87,30 @@ function copyTextSelection(
   }
 }
 
+/** The one field-wise copy of a message context, shared by every write, read and display path. */
+export function copyPersistedMessageContext(c: PersistedMessageContext): PersistedMessageContext {
+  return {
+    kind: c.kind,
+    label: c.label,
+    ...(c.workflowId ? { workflowId: c.workflowId } : {}),
+    ...(c.knowledgeId ? { knowledgeId: c.knowledgeId } : {}),
+    ...(c.tableId ? { tableId: c.tableId } : {}),
+    ...(c.viewId ? { viewId: c.viewId } : {}),
+    ...(c.fileId ? { fileId: c.fileId } : {}),
+    ...(c.dashboardId ? { dashboardId: c.dashboardId } : {}),
+    ...(c.folderId ? { folderId: c.folderId } : {}),
+    ...(c.chatId ? { chatId: c.chatId } : {}),
+    ...(c.blockType ? { blockType: c.blockType } : {}),
+    ...(c.skillId ? { skillId: c.skillId } : {}),
+    ...(c.serverId ? { serverId: c.serverId } : {}),
+    ...(c.fileName ? { fileName: c.fileName } : {}),
+    ...(c.tableName ? { tableName: c.tableName } : {}),
+    ...(c.tabId ? { tabId: c.tabId } : {}),
+    ...(c.terminalId ? { terminalId: c.terminalId } : {}),
+    ...(c.selection ? { selection: copyTextSelection(c.selection) } : {}),
+  }
+}
+
 export interface PersistedMessage {
   id: string
   role: 'user' | 'assistant'
@@ -464,26 +488,7 @@ export function buildPersistedUserMessage(params: UserMessageParams): PersistedM
   }
 
   if (params.contexts && params.contexts.length > 0) {
-    message.contexts = params.contexts.map((c) => ({
-      kind: c.kind,
-      label: c.label,
-      ...(c.workflowId ? { workflowId: c.workflowId } : {}),
-      ...(c.knowledgeId ? { knowledgeId: c.knowledgeId } : {}),
-      ...(c.tableId ? { tableId: c.tableId } : {}),
-      ...(c.viewId ? { viewId: c.viewId } : {}),
-      ...(c.fileId ? { fileId: c.fileId } : {}),
-      ...(c.dashboardId ? { dashboardId: c.dashboardId } : {}),
-      ...(c.folderId ? { folderId: c.folderId } : {}),
-      ...(c.chatId ? { chatId: c.chatId } : {}),
-      ...(c.blockType ? { blockType: c.blockType } : {}),
-      ...(c.skillId ? { skillId: c.skillId } : {}),
-      ...(c.serverId ? { serverId: c.serverId } : {}),
-      ...(c.fileName ? { fileName: c.fileName } : {}),
-      ...(c.tableName ? { tableName: c.tableName } : {}),
-      ...(c.tabId ? { tabId: c.tabId } : {}),
-      ...(c.terminalId ? { terminalId: c.terminalId } : {}),
-      ...(c.selection ? { selection: copyTextSelection(c.selection) } : {}),
-    }))
+    message.contexts = params.contexts.map(copyPersistedMessageContext)
   }
 
   return message
@@ -816,26 +821,7 @@ export function normalizeMessage(raw: Record<string, unknown>): PersistedMessage
 
   const rawContexts = raw.contexts as PersistedMessageContext[] | undefined
   if (Array.isArray(rawContexts) && rawContexts.length > 0) {
-    msg.contexts = rawContexts.map((c) => ({
-      kind: c.kind,
-      label: c.label,
-      ...(c.workflowId ? { workflowId: c.workflowId } : {}),
-      ...(c.knowledgeId ? { knowledgeId: c.knowledgeId } : {}),
-      ...(c.tableId ? { tableId: c.tableId } : {}),
-      ...(c.viewId ? { viewId: c.viewId } : {}),
-      ...(c.fileId ? { fileId: c.fileId } : {}),
-      ...(c.dashboardId ? { dashboardId: c.dashboardId } : {}),
-      ...(c.folderId ? { folderId: c.folderId } : {}),
-      ...(c.chatId ? { chatId: c.chatId } : {}),
-      ...(c.blockType ? { blockType: c.blockType } : {}),
-      ...(c.skillId ? { skillId: c.skillId } : {}),
-      ...(c.serverId ? { serverId: c.serverId } : {}),
-      ...(c.fileName ? { fileName: c.fileName } : {}),
-      ...(c.tableName ? { tableName: c.tableName } : {}),
-      ...(c.tabId ? { tabId: c.tabId } : {}),
-      ...(c.terminalId ? { terminalId: c.terminalId } : {}),
-      ...(c.selection ? { selection: copyTextSelection(c.selection) } : {}),
-    }))
+    msg.contexts = rawContexts.map(copyPersistedMessageContext)
   }
 
   return msg

apps/sim/lib/mothership/entitlements.ts

@@ -1,6 +1,5 @@
 import type { Principal } from '@sim/auth/principal'
 import { readDashboardAvailability } from '@/lib/dashboards/application/availability'
-import { isDashboardsEnabled } from '@/lib/dashboards/feature-flag'
 import { ENTITLEMENTS, type Entitlement } from '@/lib/mothership/generated/protocol'
 
 /** The owner of one chat turn: exactly one of a workspace or an organization. */
@@ -10,6 +9,26 @@ export interface EntitlementOwner {
   organizationId?: string
 }
 
+interface WorkspaceOwner {
+  principal: Principal
+  workspaceId: string
+}
+
+interface OrganizationOwner {
+  principal?: Principal
+  organizationId: string
+}
+
+/**
+ * Each entitlement declares the chat scopes it exists in. A scope it does not
+ * declare is never granted, so a workspace-only capability cannot leak into an
+ * organization chat that has no workspace to run it against.
+ */
+interface EntitlementEvaluator {
+  workspace?: (owner: WorkspaceOwner) => Promise<boolean>
+  organization?: (owner: OrganizationOwner) => Promise<boolean>
+}
+
 /**
  * Entitlements are gated capabilities sent to Mothership as the chat payload's
  * `entitlements` list. The worker hides the matching commands, skills and prompt
@@ -19,21 +38,35 @@ export interface EntitlementOwner {
  * 1. Worker: add the name to `ENTITLEMENTS` in `packages/contracts/src/protocol.ts`, run
  *    `bun run contracts:sync`, then declare it on the gated surfaces (`entitlement` on a
  *    command spec, `entitlement:` frontmatter on a skill, or an `entitled()` prompt section).
- * 2. Here: add an evaluator. Every payload site picks it up through `buildCopilotRequestPayload`.
+ * 2. Here: add an evaluator for each scope it exists in. Every payload site picks it up
+ *    through `buildCopilotRequestPayload`.
  * 3. Keep enforcement in Sim. The payload is forgeable, so the operation behind the gated
  *    surface must re-check the same predicate when it runs.
  */
-const EVALUATORS: Record<Entitlement, (owner: EntitlementOwner) => Promise<boolean>> = {
-  [ENTITLEMENTS.dashboards]: async ({ principal, workspaceId, organizationId }) => {
-    if (organizationId) return isDashboardsEnabled(organizationId)
-    if (!workspaceId || !principal) return false
-    return readDashboardAvailability.execute({ principal, input: { workspaceId } })
+const EVALUATORS: Record<Entitlement, EntitlementEvaluator> = {
+  [ENTITLEMENTS.dashboards]: {
+    workspace: ({ principal, workspaceId }) =>
+      readDashboardAvailability.execute({ principal, input: { workspaceId } }),
   },
 }
 
+function evaluate(evaluator: EntitlementEvaluator, owner: EntitlementOwner): Promise<boolean> {
+  const { principal, workspaceId, organizationId } = owner
+  if (workspaceId && organizationId) {
+    throw new Error('Entitlement owner must be a workspace or an organization, not both')
+  }
+  if (organizationId) {
+    return evaluator.organization?.({ principal, organizationId }) ?? Promise.resolve(false)
+  }
+  if (workspaceId && principal) {
+    return evaluator.workspace?.({ principal, workspaceId }) ?? Promise.resolve(false)
+  }
+  return Promise.resolve(false)
+}
+
 /** The entitlements Sim grants a turn's owner, evaluated fresh for every turn. */
 export async function computeEntitlements(owner: EntitlementOwner): Promise<Entitlement[]> {
   const names = Object.values(ENTITLEMENTS)
-  const granted = await Promise.all(names.map((name) => EVALUATORS[name](owner)))
+  const granted = await Promise.all(names.map((name) => evaluate(EVALUATORS[name], owner)))
   return names.filter((_, index) => granted[index])
 }