fix(admin): validate retention workspace targets on the Admin API too

retentionOverrides and per-workspace PII rules both name a workspace, and
neither field is a foreign key. The settings UI rejected ids belonging to
another organization; the Admin API did not, so the two paths could persist
different data for the same org.

Extracts the check as getForeignWorkspaceTargetsReason and points both routes
at it, so they cannot drift apart again.

Author: icecrasher321

apps/sim/app/api/organizations/[id]/data-retention/route.ts

@@ -1,9 +1,9 @@
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
 import type { DataRetentionSettings } from '@sim/db/schema'
-import { member, organization, workspace } from '@sim/db/schema'
+import { member, organization } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, eq, inArray } from 'drizzle-orm'
+import { and, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import {
   type OrganizationRetentionValues,
@@ -13,7 +13,10 @@ import { parseRequest, validationErrorResponse } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { CLEANUP_CONFIG } from '@/lib/billing/cleanup-dispatcher'
 import { isOrganizationOnEnterprisePlan } from '@/lib/billing/core/subscription'
-import { getPiiRedactionDenialReason } from '@/lib/billing/retention'
+import {
+  getForeignWorkspaceTargetsReason,
+  getPiiRedactionDenialReason,
+} from '@/lib/billing/retention'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -220,27 +223,13 @@ export const PUT = withRouteHandler(
       merged.retentionOverrides = body.retentionOverrides
     }
 
-    const targetedWorkspaceIds = new Set<string>()
-    for (const override of body.retentionOverrides ?? []) {
-      targetedWorkspaceIds.add(override.workspaceId)
-    }
-    for (const rule of body.piiRedaction?.rules ?? []) {
-      if (rule.workspaceId) targetedWorkspaceIds.add(rule.workspaceId)
-    }
-    if (targetedWorkspaceIds.size > 0) {
-      const ids = [...targetedWorkspaceIds]
-      const orgWorkspaces = await db
-        .select({ id: workspace.id })
-        .from(workspace)
-        .where(and(eq(workspace.organizationId, organizationId), inArray(workspace.id, ids)))
-      const known = new Set(orgWorkspaces.map((row) => row.id))
-      const unknown = ids.filter((id) => !known.has(id))
-      if (unknown.length > 0) {
-        return NextResponse.json(
-          { error: `Override targets workspaces outside this organization: ${unknown.join(', ')}` },
-          { status: 400 }
-        )
-      }
+    const foreignTargetsReason = await getForeignWorkspaceTargetsReason({
+      organizationId,
+      retentionOverrides: body.retentionOverrides,
+      piiRedaction: body.piiRedaction,
+    })
+    if (foreignTargetsReason) {
+      return NextResponse.json({ error: foreignTargetsReason }, { status: 400 })
     }
 
     const [updated] = await db

apps/sim/app/api/v1/admin/organizations/[id]/data-retention/route.ts

@@ -23,13 +23,17 @@ import { createLogger } from '@sim/logger'
 import { eq } from 'drizzle-orm'
 import { adminV1UpdateOrganizationDataRetentionContract } from '@/lib/api/contracts/v1/admin'
 import { parseRequest } from '@/lib/api/server'
-import { getPiiRedactionDenialReason } from '@/lib/billing/retention'
+import {
+  getForeignWorkspaceTargetsReason,
+  getPiiRedactionDenialReason,
+} from '@/lib/billing/retention'
 import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
 import {
   adminInvalidJsonResponse,
   adminValidationErrorResponse,
+  badRequestResponse,
   forbiddenResponse,
   internalErrorResponse,
   notFoundResponse,
@@ -105,6 +109,20 @@ export const PATCH = withRouteHandler(
         merged.retentionOverrides = body.retentionOverrides
       }
 
+      /**
+       * Same ownership check the settings UI applies. Neither `workspaceId`
+       * field is a foreign key, so without it the Admin API could persist an
+       * override naming another organization's workspace.
+       */
+      const foreignTargetsReason = await getForeignWorkspaceTargetsReason({
+        organizationId,
+        retentionOverrides: body.retentionOverrides,
+        piiRedaction: body.piiRedaction,
+      })
+      if (foreignTargetsReason) {
+        return badRequestResponse(foreignTargetsReason)
+      }
+
       await db
         .update(organization)
         .set({ dataRetentionSettings: merged, updatedAt: new Date() })

apps/sim/lib/billing/retention.test.ts

@@ -2,9 +2,11 @@
  * @vitest-environment node
  */
 import type { DataRetentionSettings, PiiRedactionRule } from '@sim/db/schema'
-import { describe, expect, it } from 'vitest'
+import { queueTableRows, resetDbChainMock, schemaMock } from '@sim/testing'
+import { afterAll, beforeEach, describe, expect, it } from 'vitest'
 import {
   DEFAULT_PII_REDACTION,
+  getForeignWorkspaceTargetsReason,
   getPiiRedactionDenialReason,
   resolveEffectivePiiRedaction,
   resolveEffectiveRetentionHours,
@@ -466,3 +468,51 @@ describe('getPiiRedactionDenialReason', () => {
     ).toBeNull()
   })
 })
+
+describe('getForeignWorkspaceTargetsReason', () => {
+  beforeEach(resetDbChainMock)
+  afterAll(resetDbChainMock)
+
+  it('skips the lookup entirely when nothing targets a workspace', async () => {
+    await expect(
+      getForeignWorkspaceTargetsReason({
+        organizationId: 'org-1',
+        retentionOverrides: [],
+        piiRedaction: { rules: [{ workspaceId: null }] },
+      })
+    ).resolves.toBeNull()
+  })
+
+  it('accepts overrides whose workspaces belong to the organization', async () => {
+    queueTableRows(schemaMock.workspace, [{ id: 'ws-1' }, { id: 'ws-2' }])
+
+    await expect(
+      getForeignWorkspaceTargetsReason({
+        organizationId: 'org-1',
+        retentionOverrides: [{ workspaceId: 'ws-1' }, { workspaceId: 'ws-2' }],
+      })
+    ).resolves.toBeNull()
+  })
+
+  it('rejects an override naming a workspace the organization does not own', async () => {
+    queueTableRows(schemaMock.workspace, [{ id: 'ws-1' }])
+
+    await expect(
+      getForeignWorkspaceTargetsReason({
+        organizationId: 'org-1',
+        retentionOverrides: [{ workspaceId: 'ws-1' }, { workspaceId: 'ws-foreign' }],
+      })
+    ).resolves.toContain('ws-foreign')
+  })
+
+  it('also checks workspaces named by PII rules, not just overrides', async () => {
+    queueTableRows(schemaMock.workspace, [])
+
+    await expect(
+      getForeignWorkspaceTargetsReason({
+        organizationId: 'org-1',
+        piiRedaction: { rules: [{ workspaceId: 'ws-foreign' }] },
+      })
+    ).resolves.toContain('ws-foreign')
+  })
+})

apps/sim/lib/billing/retention.ts

@@ -1,4 +1,7 @@
+import { db } from '@sim/db'
 import type { CustomPiiPattern, DataRetentionSettings, PiiStagePolicy } from '@sim/db/schema'
+import { workspace } from '@sim/db/schema'
+import { and, eq, inArray } from 'drizzle-orm'
 import {
   coercePiiLanguage,
   DEFAULT_PII_LANGUAGE,
@@ -214,3 +217,42 @@ export function getPiiRedactionDenialReason(params: {
     ? 'Granular PII redaction (workflow input and block outputs) is not enabled for this organization'
     : null
 }
+
+/**
+ * Rejects retention settings that point at workspaces the organization does not
+ * own. Returns `null` when every referenced workspace belongs to it.
+ *
+ * Both `retentionOverrides` and per-workspace `piiRedaction` rules name a
+ * workspace, and neither is a foreign key — an id that belongs to another
+ * organization would persist silently and then be applied by
+ * `resolveEffectiveRetentionHours` / `resolveEffectivePiiRedaction` to whatever
+ * workspace later matched it. Shared so the settings API and the Admin API
+ * cannot accept different data for the same organization.
+ */
+export async function getForeignWorkspaceTargetsReason(params: {
+  organizationId: string
+  retentionOverrides?: Array<{ workspaceId: string }> | null
+  piiRedaction?: PiiRedactionRulesLike | null
+}): Promise<string | null> {
+  const targeted = new Set<string>()
+  for (const override of params.retentionOverrides ?? []) {
+    if (override?.workspaceId) targeted.add(override.workspaceId)
+  }
+  for (const rule of params.piiRedaction?.rules ?? []) {
+    if (rule.workspaceId) targeted.add(rule.workspaceId)
+  }
+  if (targeted.size === 0) return null
+
+  const ids = [...targeted]
+  const owned = await db
+    .select({ id: workspace.id })
+    .from(workspace)
+    .where(and(eq(workspace.organizationId, params.organizationId), inArray(workspace.id, ids)))
+
+  const known = new Set(owned.map((row) => row.id))
+  const unknown = ids.filter((id) => !known.has(id))
+
+  return unknown.length > 0
+    ? `Override targets workspaces outside this organization: ${unknown.join(', ')}`
+    : null
+}