feat(api): gate the whole /api/v2 surface behind one flag; UI stays on v1

Every v2 route now runs exactly one check immediately after auth —
v2ApiGateError — and answers 404 when the `v2-api` flag is off, so the
surface is invisible until it is deliberately rolled out. The gate is
keyed on userId only: a workspace/org-keyed check would have to read
membership for a caller-supplied id before authorization runs, and its
404-vs-403 split would leak cohort membership (the trap the per-domain
table gate worked around by running late). The two executions routes
inherit it from the shared access resolver; the tables-specific gate is
removed so no route checks twice.

`tables-v2-api` stays, now gating only the internal predicate-grammar
route /api/table/[tableId]/query — note v2 tables routes move to the
unified flag, so enabling them is a `v2-api` decision now.

Reverts the deploy modal, copilot handlers, and api_trigger example to
the v1 execute endpoint: v1 works unchanged, and the UI must not
advertise a surface most users would get a 404 from.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CiHhAk2R1NryaS3R8n2yFz

Author: TheodoreSpeaks

apps/sim/app/api/v2/audit-logs/[id]/route.ts

@@ -12,6 +12,7 @@ import { resolveEnterpriseAuditAccess } from '@/app/api/v1/audit-logs/auth'
 import { formatAuditLogEntry } from '@/app/api/v1/audit-logs/format'
 import { buildOrgScopeCondition, getOrgWorkspaceIds } from '@/app/api/v1/audit-logs/query'
 import { checkRateLimit } from '@/app/api/v1/middleware'
+import { v2ApiGateError } from '@/app/api/v2/lib/gate'
 import { v2Data, v2Error, v2RateLimitError, v2ValidationError } from '@/app/api/v2/lib/response'
 
 const logger = createLogger('V2AuditLogDetailAPI')
@@ -38,6 +39,9 @@ export const GET = withRouteHandler(
 
       const userId = rateLimit.userId!
 
+      const gate = await v2ApiGateError(userId)
+      if (gate) return gate
+
       const authResult = await resolveEnterpriseAuditAccess(userId)
       if (!authResult.success) return v2Error('FORBIDDEN', authResult.message)
 

apps/sim/app/api/v2/audit-logs/route.ts

@@ -14,6 +14,7 @@ import {
   queryAuditLogs,
 } from '@/app/api/v1/audit-logs/query'
 import { checkRateLimit } from '@/app/api/v1/middleware'
+import { v2ApiGateError } from '@/app/api/v2/lib/gate'
 import {
   v2CursorList,
   v2Error,
@@ -44,6 +45,9 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
 
     const userId = rateLimit.userId!
 
+    const gate = await v2ApiGateError(userId)
+    if (gate) return gate
+
     const authResult = await resolveEnterpriseAuditAccess(userId)
     if (!authResult.success) return v2Error('FORBIDDEN', authResult.message)
 

apps/sim/app/api/v2/billing/usage/logs/route.test.ts

@@ -20,6 +20,10 @@ vi.mock('@/lib/billing/core/usage-log', () => ({
   getUsageCreditsByLogId: mockGetUsageCreditsByLogId,
 }))
 
+vi.mock('@/app/api/v2/lib/gate', () => ({
+  v2ApiGateError: vi.fn().mockResolvedValue(null),
+}))
+
 import { GET } from '@/app/api/v2/billing/usage/logs/route'
 
 const RATE_LIMIT_OK = {

apps/sim/app/api/v2/billing/usage/logs/route.ts

@@ -13,6 +13,7 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { resolveDateRange } from '@/app/api/users/me/usage-logs/shared'
 import { checkRateLimit } from '@/app/api/v1/middleware'
 import { v2BillingWorkspaceFilter } from '@/app/api/v2/billing/utils'
+import { v2ApiGateError } from '@/app/api/v2/lib/gate'
 import {
   v2CursorList,
   v2Error,
@@ -38,6 +39,10 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
     if (!rateLimit.allowed) return v2RateLimitError(rateLimit)
 
     const userId = rateLimit.userId!
+
+    const gate = await v2ApiGateError(userId)
+    if (gate) return gate
+
     const parsed = await parseRequest(
       v2ListUsageLogsContract,
       request,

apps/sim/app/api/v2/billing/usage/route.test.ts

@@ -35,6 +35,10 @@ vi.mock('@/lib/billing/core/usage-log', () => ({
   getUserUsageLogs: mockGetUserUsageLogs,
 }))
 
+vi.mock('@/app/api/v2/lib/gate', () => ({
+  v2ApiGateError: vi.fn().mockResolvedValue(null),
+}))
+
 import { GET } from '@/app/api/v2/billing/usage/route'
 
 const RATE_LIMIT_OK = {

apps/sim/app/api/v2/billing/usage/route.ts

@@ -11,6 +11,7 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { checkRateLimit } from '@/app/api/v1/middleware'
 import { v2BillingWorkspaceFilter } from '@/app/api/v2/billing/utils'
+import { v2ApiGateError } from '@/app/api/v2/lib/gate'
 import { v2Data, v2Error, v2RateLimitError, v2ValidationError } from '@/app/api/v2/lib/response'
 
 const logger = createLogger('V2BillingUsageAPI')
@@ -32,6 +33,10 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
     if (!rateLimit.allowed) return v2RateLimitError(rateLimit)
 
     const userId = rateLimit.userId!
+
+    const gate = await v2ApiGateError(userId)
+    if (gate) return gate
+
     const parsed = await parseRequest(
       v2GetUsageSummaryContract,
       request,

apps/sim/app/api/v2/files/[fileId]/route.ts

@@ -7,6 +7,7 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { fetchWorkspaceFileBuffer, getWorkspaceFile } from '@/lib/uploads/contexts/workspace'
 import { performDeleteWorkspaceFileItems } from '@/lib/workspace-files/orchestration'
 import { checkRateLimit, resolveWorkspaceAccess } from '@/app/api/v1/middleware'
+import { v2ApiGateError } from '@/app/api/v2/lib/gate'
 import type { V2ErrorCode } from '@/app/api/v2/lib/response'
 import {
   rateLimitHeaders,
@@ -39,6 +40,10 @@ export const GET = withRouteHandler(async (request: NextRequest, context: FileRo
     if (!rateLimit.allowed) return v2RateLimitError(rateLimit)
 
     const userId = rateLimit.userId!
+
+    const gate = await v2ApiGateError(userId)
+    if (gate) return gate
+
     const parsed = await parseRequest(v2DownloadFileContract, request, context, {
       validationErrorResponse: v2ValidationError,
     })
@@ -84,6 +89,10 @@ export const DELETE = withRouteHandler(async (request: NextRequest, context: Fil
     if (!rateLimit.allowed) return v2RateLimitError(rateLimit)
 
     const userId = rateLimit.userId!
+
+    const gate = await v2ApiGateError(userId)
+    if (gate) return gate
+
     const parsed = await parseRequest(v2DeleteFileContract, request, context, {
       validationErrorResponse: v2ValidationError,
     })

apps/sim/app/api/v2/files/route.ts

@@ -21,6 +21,7 @@ import {
   uploadWorkspaceFile,
 } from '@/lib/uploads/contexts/workspace'
 import { checkRateLimit, resolveWorkspaceAccess } from '@/app/api/v1/middleware'
+import { v2ApiGateError } from '@/app/api/v2/lib/gate'
 import {
   decodeCursor,
   encodeCursor,
@@ -65,6 +66,10 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
     if (!rateLimit.allowed) return v2RateLimitError(rateLimit)
 
     const userId = rateLimit.userId!
+
+    const gate = await v2ApiGateError(userId)
+    if (gate) return gate
+
     const parsed = await parseRequest(
       v2ListFilesContract,
       request,
@@ -130,6 +135,10 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     if (!rateLimit.allowed) return v2RateLimitError(rateLimit)
 
     const userId = rateLimit.userId!
+
+    const gate = await v2ApiGateError(userId)
+    if (gate) return gate
+
     const parsed = await parseRequest(
       v2UploadFileContract,
       request,

apps/sim/app/api/v2/knowledge/[id]/documents/[documentId]/route.ts

@@ -17,6 +17,7 @@ import { deleteDocument } from '@/lib/knowledge/documents/service'
 import type { KnowledgeBaseWithCounts } from '@/lib/knowledge/types'
 import { resolveKnowledgeBase, serializeDate } from '@/app/api/v1/knowledge/utils'
 import { checkRateLimit, type RateLimitResult } from '@/app/api/v1/middleware'
+import { v2ApiGateError } from '@/app/api/v2/lib/gate'
 import { v2Data, v2Error, v2RateLimitError, v2ValidationError } from '@/app/api/v2/lib/response'
 
 const logger = createLogger('V2KnowledgeDocumentDetailAPI')
@@ -59,6 +60,10 @@ export const GET = withRouteHandler(
       if (!rateLimit.allowed) return v2RateLimitError(rateLimit)
 
       const userId = rateLimit.userId!
+
+      const gate = await v2ApiGateError(userId)
+      if (gate) return gate
+
       const parsed = await parseRequest(v2GetKnowledgeDocumentContract, request, context, {
         validationErrorResponse: v2ValidationError,
       })
@@ -151,6 +156,10 @@ export const DELETE = withRouteHandler(
       if (!rateLimit.allowed) return v2RateLimitError(rateLimit)
 
       const userId = rateLimit.userId!
+
+      const gate = await v2ApiGateError(userId)
+      if (gate) return gate
+
       const parsed = await parseRequest(v2DeleteKnowledgeDocumentContract, request, context, {
         validationErrorResponse: v2ValidationError,
       })

apps/sim/app/api/v2/knowledge/[id]/documents/route.ts

@@ -32,6 +32,7 @@ import { uploadWorkspaceFile } from '@/lib/uploads/contexts/workspace'
 import { validateFileType } from '@/lib/uploads/utils/validation'
 import { resolveKnowledgeBase, serializeDate } from '@/app/api/v1/knowledge/utils'
 import { checkRateLimit, type RateLimitResult } from '@/app/api/v1/middleware'
+import { v2ApiGateError } from '@/app/api/v2/lib/gate'
 import {
   decodeCursor,
   encodeCursor,
@@ -84,6 +85,10 @@ export const GET = withRouteHandler(async (request: NextRequest, context: Docume
     if (!rateLimit.allowed) return v2RateLimitError(rateLimit)
 
     const userId = rateLimit.userId!
+
+    const gate = await v2ApiGateError(userId)
+    if (gate) return gate
+
     const parsed = await parseRequest(v2ListKnowledgeDocumentsContract, request, context, {
       validationErrorResponse: v2ValidationError,
     })
@@ -161,6 +166,10 @@ export const POST = withRouteHandler(
       if (!rateLimit.allowed) return v2RateLimitError(rateLimit)
 
       const userId = rateLimit.userId!
+
+      const gate = await v2ApiGateError(userId)
+      if (gate) return gate
+
       const parsed = await parseRequest(v2UploadKnowledgeDocumentContract, request, context, {
         validationErrorResponse: v2ValidationError,
       })