Merge remote-tracking branch 'origin/improvement/v2-endpoints' into codex/v2-application-tables

# Conflicts:
#	apps/sim/lib/api/server/routes/v2-json-route.ts
#	apps/sim/lib/folders/orchestration.ts
#	apps/sim/lib/uploads/upload-session/service.ts

Author: TheodoreSpeaks

apps/sim/app/api/audit-logs/route.test.ts

@@ -0,0 +1,83 @@
+/**
+ * @vitest-environment node
+ */
+import { NextRequest } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  getSession: vi.fn(),
+  execute: vi.fn(),
+}))
+
+vi.mock('@/lib/auth', () => ({ getSession: mocks.getSession }))
+
+vi.mock('@/lib/audit-logs/application/list-audit-logs', () => ({
+  listAuditLogs: { operation: { id: 'audit_logs.list' }, execute: mocks.execute },
+}))
+
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { GET } from '@/app/api/audit-logs/route'
+
+const log = {
+  id: 'audit-1',
+  workspaceId: 'workspace-1',
+  actorId: 'admin-1',
+  actorName: 'Ada',
+  actorEmail: 'ada@example.com',
+  action: 'workspace.updated',
+  resourceType: 'workspace',
+  resourceId: 'workspace-1',
+  resourceName: 'Engineering',
+  description: null,
+  metadata: {},
+  createdAt: new Date('2026-08-01T00:00:00Z'),
+}
+
+describe('GET /api/audit-logs', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.getSession.mockResolvedValue({
+      user: { id: 'admin-1' },
+      session: { id: 'session-1' },
+    })
+    mocks.execute.mockResolvedValue({ data: [log], nextCursor: 'next-1' })
+  })
+
+  it('authenticates before parsing the organization query', async () => {
+    const response = await GET(new NextRequest('http://localhost:3000/api/audit-logs'))
+
+    expect(response.status).toBe(400)
+    expect(mocks.getSession).toHaveBeenCalled()
+    expect(mocks.execute).not.toHaveBeenCalled()
+  })
+
+  it('keeps the internal envelope while sharing the application operation', async () => {
+    const request = new NextRequest(
+      'http://localhost:3000/api/audit-logs?organizationId=organization-1'
+    )
+    const response = await GET(request)
+
+    expect(response.status).toBe(200)
+    expect(await response.json()).toMatchObject({
+      success: true,
+      data: [{ id: 'audit-1', actorId: 'admin-1' }],
+      nextCursor: 'next-1',
+    })
+    expect(mocks.execute).toHaveBeenCalledWith({
+      principal: { kind: 'session', userId: 'admin-1', sessionId: 'session-1' },
+      input: expect.objectContaining({ organizationId: 'organization-1' }),
+      request,
+    })
+  })
+
+  it('preserves internal typed error presentation', async () => {
+    mocks.execute.mockRejectedValueOnce(new OrchestrationError('forbidden', 'Admin required'))
+
+    const response = await GET(
+      new NextRequest('http://localhost:3000/api/audit-logs?organizationId=organization-1')
+    )
+
+    expect(response.status).toBe(403)
+    expect(await response.json()).toEqual({ error: 'Admin required' })
+  })
+})

apps/sim/app/api/audit-logs/route.ts

@@ -1,97 +1,42 @@
-import { createLogger } from '@sim/logger'
-import { getErrorMessage } from '@sim/utils/errors'
-import { type NextRequest, NextResponse } from 'next/server'
 import { listAuditLogsContract } from '@/lib/api/contracts/audit-logs'
-import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
-import { getSession } from '@/lib/auth'
-import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { validateEnterpriseAuditAccess } from '@/app/api/v1/audit-logs/auth'
-import { formatAuditLogEntry } from '@/app/api/v1/audit-logs/format'
 import {
-  buildFilterConditions,
-  buildOrgScopeCondition,
-  getOrgWorkspaceIds,
-  queryAuditLogs,
-} from '@/app/api/v1/audit-logs/query'
-
-const logger = createLogger('AuditLogsAPI')
+  defineInternalJsonRoute,
+  internalPlainOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { listAuditLogs } from '@/lib/audit-logs/application/list-audit-logs'
+import { auditLogOperations } from '@/lib/audit-logs/application/operations'
+import { formatAuditLogEntry } from '@/app/api/v1/audit-logs/format'
 
 export const dynamic = 'force-dynamic'
 
-export const GET = withRouteHandler(async (request: NextRequest) => {
-  try {
-    const session = await getSession()
-    if (!session?.user?.id) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-    }
-
-    const parsed = await parseRequest(
-      listAuditLogsContract,
-      request,
-      {},
-      {
-        validationErrorResponse: (error) =>
-          NextResponse.json(
-            { error: getValidationErrorMessage(error, 'Invalid query parameters') },
-            { status: 400 }
-          ),
-      }
-    )
-    if (!parsed.success) return parsed.response
-
-    const authResult = await validateEnterpriseAuditAccess(
-      session.user.id,
-      parsed.data.query.organizationId
-    )
-    if (!authResult.success) {
-      return authResult.response
-    }
-
-    const { organizationId, orgMemberIds } = authResult.context
-
-    const {
-      organizationId: _targetOrganizationId,
-      search,
-      action,
-      resourceType,
-      actorId,
-      startDate,
-      endDate,
-      includeDeparted,
-      limit,
-      cursor,
-    } = parsed.data.query
-
-    const orgWorkspaceIds = await getOrgWorkspaceIds(organizationId)
-    const scopeCondition = buildOrgScopeCondition({
-      organizationId,
-      orgWorkspaceIds,
-      orgMemberIds,
-      includeDeparted,
-    })
-    const filterConditions = buildFilterConditions({
-      action,
-      resourceType,
-      actorId,
-      search,
-      startDate,
-      endDate,
-    })
-
-    const { data, nextCursor } = await queryAuditLogs(
-      [scopeCondition, ...filterConditions],
-      limit,
-      cursor
-    )
-
-    return NextResponse.json({
-      success: true,
-      data: data.map(formatAuditLogEntry),
-      nextCursor,
-    })
-  } catch (error: unknown) {
-    const message = getErrorMessage(error, 'Unknown error')
-    logger.error('Audit logs fetch error', { error: message })
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
+export const GET = defineInternalJsonRoute({
+  contract: listAuditLogsContract,
+  auth: internalSessionAuth,
+  operation: auditLogOperations.list,
+  rateLimit: internalRateLimits.none({
+    reason: 'Existing authenticated audit-log settings read has no request-rate policy',
+  }),
+  errorPolicy: internalPlainOrchestrationErrorPolicy,
+  mapInput: ({ query }) => ({
+    organizationId: query.organizationId,
+    includeDeparted: query.includeDeparted,
+    filters: {
+      search: query.search,
+      action: query.action,
+      resourceType: query.resourceType,
+      actorId: query.actorId,
+      startDate: query.startDate,
+      endDate: query.endDate,
+    },
+    limit: query.limit,
+    cursor: query.cursor,
+  }),
+  useCase: listAuditLogs,
+  present: ({ data, nextCursor }) => ({
+    success: true,
+    data: data.map(formatAuditLogEntry),
+    nextCursor,
+  }),
 })

apps/sim/app/api/knowledge/[id]/documents/uploads/[uploadId]/complete/route.ts

@@ -1,20 +1,15 @@
 import { type NextRequest, NextResponse } from 'next/server'
 import { completeKnowledgeDocumentUploadContract } from '@/lib/api/contracts/knowledge/upload-sessions'
 import { parseRequest } from '@/lib/api/server'
-import { generateRequestId } from '@/lib/core/utils/request'
+import { PlatformEvents } from '@/lib/core/telemetry'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { completeUploadSession } from '@/lib/uploads/upload-session/service'
-import { uploadSessionErrorResponse } from '@/app/api/files/uploads/utils'
+import { completeKnowledgeDocumentUpload } from '@/lib/knowledge/application/upload-sessions'
+import { captureServerEvent } from '@/lib/posthog/server'
 import {
-  requireKnowledgeDocumentUploadAccess,
+  knowledgeDocumentUploadErrorResponse,
   requireKnowledgeDocumentUploadActor,
-  resolveKnowledgeDocumentUploadAttribution,
 } from '@/app/api/knowledge/[id]/documents/uploads/utils'
-import {
-  finalizeKnowledgeDocumentUpload,
-  getOwnedKnowledgeDocumentUpload,
-  toV2KnowledgeDocumentUpload,
-} from '@/app/api/v2/knowledge/[id]/documents/uploads/utils'
+import { toV2KnowledgeDocumentUpload } from '@/app/api/v2/knowledge/[id]/documents/uploads/utils'
 
 interface KnowledgeDocumentUploadRouteParams {
   params: Promise<{ id: string; uploadId: string }>
@@ -28,44 +23,46 @@ export const POST = withRouteHandler(
     if (!parsed.success) return parsed.response
     const { id: knowledgeBaseId, uploadId } = parsed.data.params
     const { workspaceId } = parsed.data.query
-    const access = await requireKnowledgeDocumentUploadAccess({
-      knowledgeBaseId,
-      workspaceId,
-      userId: actor.id,
-    })
-    if (access instanceof NextResponse) return access
-    const requestId = generateRequestId()
     try {
-      const upload = await getOwnedKnowledgeDocumentUpload({
-        knowledgeBaseId,
-        uploadId,
-        workspaceId,
-        userId: actor.id,
-        uploadToken: parsed.data.headers['upload-token'],
-      })
-      const completed = await completeUploadSession({
-        session: upload,
-        finalize: (claimed) =>
-          finalizeKnowledgeDocumentUpload({
-            claimed,
-            knowledgeBaseId,
-            knowledgeBaseName: access.knowledgeBase.name,
-            workspaceId,
-            userId: actor.id,
-            resolveAttribution: () =>
-              resolveKnowledgeDocumentUploadAttribution({ workspaceId, userId: actor.id }),
-            source: 'ui',
-            requestId,
-            request,
-            actorName: actor.name,
-            actorEmail: actor.email,
-          }),
+      const completed = await completeKnowledgeDocumentUpload.execute({
+        principal: { kind: 'session', userId: actor.id, sessionId: actor.sessionId },
+        input: {
+          knowledgeBaseId,
+          assertedWorkspaceId: workspaceId,
+          uploadId,
+          uploadToken: parsed.data.headers['upload-token'],
+          source: 'ui',
+        },
+        request,
       })
+      if (completed.value.created) {
+        captureServerEvent(
+          actor.id,
+          'knowledge_base_document_uploaded',
+          {
+            knowledge_base_id: completed.knowledgeBaseId,
+            workspace_id: completed.workspaceId,
+            document_count: 1,
+            upload_type: 'single',
+          },
+          {
+            groups: { workspace: completed.workspaceId },
+            setOnce: { first_document_uploaded_at: new Date().toISOString() },
+          }
+        )
+        PlatformEvents.knowledgeBaseDocumentsUploaded({
+          knowledgeBaseId: completed.knowledgeBaseId,
+          documentsCount: 1,
+          uploadType: 'single',
+          mimeType: completed.value.document.mimeType,
+          fileSize: completed.value.document.fileSize,
+        })
+      }
       return NextResponse.json({
-        data: toV2KnowledgeDocumentUpload(completed.session, completed.value),
+        data: toV2KnowledgeDocumentUpload(completed.session, completed.value.document),
       })
     } catch (error) {
-      const classified = uploadSessionErrorResponse(error)
+      const classified = knowledgeDocumentUploadErrorResponse(error)
       if (classified) return classified
       throw error
     }

apps/sim/app/api/knowledge/[id]/documents/uploads/[uploadId]/parts/route.ts

@@ -2,13 +2,11 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { createKnowledgeDocumentUploadPartUrlsContract } from '@/lib/api/contracts/knowledge/upload-sessions'
 import { parseRequest } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { createUploadPartUrls } from '@/lib/uploads/upload-session/service'
-import { uploadSessionErrorResponse } from '@/app/api/files/uploads/utils'
+import { issueKnowledgeDocumentUploadParts } from '@/lib/knowledge/application/upload-sessions'
 import {
-  requireKnowledgeDocumentUploadAccess,
+  knowledgeDocumentUploadErrorResponse,
   requireKnowledgeDocumentUploadActor,
 } from '@/app/api/knowledge/[id]/documents/uploads/utils'
-import { getOwnedKnowledgeDocumentUpload } from '@/app/api/v2/knowledge/[id]/documents/uploads/utils'
 
 interface KnowledgeDocumentUploadRouteParams {
   params: Promise<{ id: string; uploadId: string }>
@@ -26,28 +24,21 @@ export const POST = withRouteHandler(
     if (!parsed.success) return parsed.response
     const { id: knowledgeBaseId, uploadId } = parsed.data.params
     const { workspaceId } = parsed.data.query
-    const access = await requireKnowledgeDocumentUploadAccess({
-      knowledgeBaseId,
-      workspaceId,
-      userId: actor.id,
-    })
-    if (access instanceof NextResponse) return access
     try {
-      const upload = await getOwnedKnowledgeDocumentUpload({
-        knowledgeBaseId,
-        uploadId,
-        workspaceId,
-        userId: actor.id,
-        uploadToken: parsed.data.headers['upload-token'],
-      })
-      const parts = await createUploadPartUrls({
-        session: upload,
-        partNumbers: parsed.data.body.partNumbers,
-        localOrigin: request.nextUrl.origin,
+      const { parts } = await issueKnowledgeDocumentUploadParts.execute({
+        principal: { kind: 'session', userId: actor.id, sessionId: actor.sessionId },
+        input: {
+          knowledgeBaseId,
+          assertedWorkspaceId: workspaceId,
+          uploadId,
+          uploadToken: parsed.data.headers['upload-token'],
+          partNumbers: parsed.data.body.partNumbers,
+        },
+        request,
       })
       return NextResponse.json({ data: { parts } })
     } catch (error) {
-      const classified = uploadSessionErrorResponse(error)
+      const classified = knowledgeDocumentUploadErrorResponse(error)
       if (classified) return classified
       throw error
     }