fix(tables): verify workflow belongs to table's workspace before binding

[waleedlatif1]

Summary

• Added a check in the table workflow-group POST and PATCH handlers that verifies a supplied workflowId resolves to an active workflow in the table's own workspace before it's persisted onto the group.
• Rejects with 400 when the workflow doesn't exist or belongs to a different workspace.

Type of Change

• Bug fix

Testing

• Added apps/sim/app/api/table/[tableId]/groups/route.test.ts covering: rejection on a different-workspace workflowId, rejection on a nonexistent workflowId, success for same-workspace workflowId (POST + PATCH), and no-op when workflowId isn't being changed.
• bun run check:api-validation passes.
• Full apps/sim/app/api/table/** test suite passes (107/107).
• Typecheck and lint clean.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 3, 2026 9:22pm

[cursor]

PR Summary

Medium Risk
Tightens authorization on table–workflow binding using existing platform authz; behavior change is limited to invalid cross-workspace IDs but touches write APIs users rely on for table automation.

Overview
POST and PATCH on api/table/[tableId]/groups now call validateWorkflowInWorkspace (via getActiveWorkflowContext) before addWorkflowGroup / updateWorkflowGroup persist a workflowId. Missing workflows or workflows in another workspace return 400 with Invalid workflow ID.

Validation runs only when a workflow is actually supplied: POST when group.workflowId is truthy, PATCH when workflowId is present in the body. Enrichment groups with no workflowId and PATCH updates that only change other fields skip the lookup.

New Vitest coverage in route.test.ts exercises cross-workspace rejection, missing workflow rejection, same-workspace success, and the skip paths for POST and PATCH.

^{Reviewed by Cursor Bugbot for commit b75971f. Configure here.}

[greptile-apps]

Greptile Summary

This PR adds a workspace-ownership check before persisting a workflowId onto a table workflow group. Without this check, a caller could bind a workflow from a different workspace to a table by supplying a foreign workflow ID in the POST or PATCH body.

• route.ts: Introduces validateWorkflowInWorkspace, a small helper that calls getActiveWorkflowContext and returns a 400 if the resolved workflow is missing or belongs to a different workspace. Both the POST and PATCH handlers invoke this check when a workflowId is being set or changed, while correctly skipping it for enrichment groups (empty workflowId) or PATCH requests that don't touch workflowId at all.
• route.test.ts: New test file covering all four cases per handler — rejection on cross-workspace ID, rejection on non-existent ID, acceptance on same-workspace ID, and the no-op skip path.

Confidence Score: 5/5

Safe to merge. The change is a targeted guard that adds one extra DB lookup per POST/PATCH when a workflowId is supplied; all existing behaviour is preserved.

The fix is minimal and well-contained: a single helper called in two places, both guarded by the existing schema constraints (workflowId is either a non-empty string or undefined/empty-default, so neither handler can pass a blank string into the check). The skip conditions — empty workflowId for enrichment groups and undefined workflowId for PATCH no-ops — are correct and tested. The test suite covers all four paths per handler and mocks are properly scoped.

No files require special attention.

Important Files Changed

Filename	Overview
apps/sim/app/api/table/[tableId]/groups/route.ts	Adds workspace-ownership validation for workflowId in POST and PATCH handlers via new validateWorkflowInWorkspace helper; skip logic is correct for enrichment groups and PATCH no-ops.
apps/sim/app/api/table/[tableId]/groups/route.test.ts	New test file covering all four cross-workspace/missing/valid/no-op scenarios for both POST and PATCH; mocks are correctly scoped per describe block.

_{Reviews (3): Last reviewed commit: "fix(tables): reorder JSDoc for mapWorkfl..." | Re-trigger Greptile}

[waleedlatif1]

Fixed — moved the validateWorkflowInWorkspace JSDoc back so mapWorkflowGroupError's original comment sits directly above it again. Pushed in b75971f.

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b75971f. Configure here.}

[waleedlatif1]

@greptile