fix(api): make workflow import atomic and clarify what export redacts

Writes the imported graph and its variables in a single transaction and
deletes the shell workflow row on any failure, so a caller that receives an
error is never left with a partially imported workflow. Previously a throw
from the variables update returned 500 while leaving the workflow behind
with an empty variables map.

Also narrows the export route's sanitization claim: workflow variables are
emitted as stored, matching GET /api/v1/workflows/[id] and the in-app
export. They are plaintext configuration readable at the same permission
level this route requires; secrets belong in environment variables, which
travel as unresolved references.

Author: waleedlatif1

apps/docs/openapi.json

@@ -1245,7 +1245,7 @@
       "get": {
         "operationId": "exportWorkflow",
         "summary": "Export Workflow",
-        "description": "Export a workflow as a portable JSON envelope that POST /api/v1/workflows/import accepts verbatim. Stored credentials and secret field values are redacted from the payload, while `{{ENV_VAR}}` references and block positions are preserved. Requires read permission on the workflow's workspace. Returns 404 when the workflow does not exist or you do not have access to it.",
+        "description": "Export a workflow as a portable JSON envelope that POST /api/v1/workflows/import accepts verbatim. Credential and password field values stored on blocks are redacted from the payload, while `{{ENV_VAR}}` references and block positions are preserved. Workflow variables are returned as stored \u2014 they are plaintext configuration readable by anyone with workspace read, and secrets belong in environment variables, which travel as unresolved references. Requires read permission on the workflow's workspace. Returns 404 when the workflow does not exist or you do not have access to it.",
         "tags": ["Workflows"],
         "x-codeSamples": [
           {
@@ -7575,15 +7575,15 @@
           },
           "variables": {
             "type": "object",
-            "description": "Workflow-level variables, keyed by variable id.",
+            "description": "Workflow-level variables, keyed by variable id. Emitted as stored \u2014 treat as plaintext configuration, not a secret store.",
             "additionalProperties": true,
             "example": {}
           }
         }
       },
       "WorkflowExport": {
         "type": "object",
-        "description": "A portable workflow export envelope. Pass this object straight back to POST /api/v1/workflows/import to recreate the workflow. Stored credentials and secret field values are redacted; `{{ENV_VAR}}` references are preserved.",
+        "description": "A portable workflow export envelope. Pass this object straight back to POST /api/v1/workflows/import to recreate the workflow. Credential and password field values stored on blocks are redacted; `{{ENV_VAR}}` references and workflow variables are preserved as stored.",
         "properties": {
           "version": {
             "type": "string",

apps/sim/app/api/v1/workflows/[id]/export/route.ts

@@ -67,8 +67,16 @@ function toExportedEdge(edge: Edge): ExportedEdge {
  *
  * Unlike the admin export (`/api/v1/admin/workflows/[id]/export`), which emits
  * the raw state for backup/restore, this surface runs the payload through
- * `sanitizeForExport`: stored credentials and secret sub-block values are
- * stripped while `{{ENV_VAR}}` references and block positions are preserved.
+ * `sanitizeForExport`: block sub-block values declared `password: true` or
+ * `oauth-input` are nulled, while `{{ENV_VAR}}` references and block positions
+ * are preserved.
+ *
+ * Workflow **variables** are emitted as stored, matching `GET
+ * /api/v1/workflows/[id]` and the in-app export. Variables are plaintext
+ * workflow configuration readable by anyone with workspace read (the same
+ * permission this route requires); secrets belong in environment variables,
+ * which travel as unresolved `{{ENV_VAR}}` references. Redacting them here
+ * would break import round-trips without narrowing access.
  */
 export const GET = withRouteHandler(
   async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {

apps/sim/app/api/v1/workflows/import/route.test.ts

@@ -75,7 +75,7 @@ vi.mock('@sim/db', () => ({
       })),
     })),
     delete: mockDbDelete,
-    update: mockDbUpdate,
+    transaction: vi.fn(async (fn: (tx: unknown) => Promise<void>) => fn({ update: mockDbUpdate })),
   },
 }))
 
@@ -223,7 +223,11 @@ describe('POST /api/v1/workflows/import', () => {
       createdAt: CREATED_AT.toISOString(),
       updatedAt: CREATED_AT.toISOString(),
     })
-    expect(mockSaveWorkflowToNormalizedTables).toHaveBeenCalledWith('wf-new', expect.anything())
+    expect(mockSaveWorkflowToNormalizedTables).toHaveBeenCalledWith(
+      'wf-new',
+      expect.anything(),
+      expect.anything()
+    )
   })
 
   it('derives the name from the export envelope and deduplicates it', async () => {
@@ -313,6 +317,22 @@ describe('POST /api/v1/workflows/import', () => {
     expect(mockDbUpdate).not.toHaveBeenCalled()
   })
 
+  it('writes the graph and variables inside a single transaction', async () => {
+    mockParseWorkflowJson.mockReturnValue({
+      data: {
+        ...PARSED_STATE,
+        variables: { 'var-1': { id: 'var-1', name: 'host', type: 'string', value: 'x' } },
+      },
+      errors: [],
+    })
+
+    await POST(makeRequest(validBody()))
+
+    const tx = { update: mockDbUpdate }
+    expect(mockSaveWorkflowToNormalizedTables).toHaveBeenCalledWith('wf-new', expect.anything(), tx)
+    expect(mockDbUpdate).toHaveBeenCalled()
+  })
+
   it('deletes the created row and returns 500 when persisting state fails', async () => {
     const whereSpy = vi.fn().mockResolvedValue(undefined)
     mockDbDelete.mockReturnValue({ where: whereSpy })
@@ -325,6 +345,27 @@ describe('POST /api/v1/workflows/import', () => {
     expect(whereSpy).toHaveBeenCalled()
   })
 
+  it('rolls back the created workflow when the variables write throws', async () => {
+    const whereSpy = vi.fn().mockResolvedValue(undefined)
+    mockDbDelete.mockReturnValue({ where: whereSpy })
+    mockDbUpdate.mockImplementation(() => {
+      throw new Error('variables write failed')
+    })
+    mockParseWorkflowJson.mockReturnValue({
+      data: {
+        ...PARSED_STATE,
+        variables: { 'var-1': { id: 'var-1', name: 'host', type: 'string', value: 'x' } },
+      },
+      errors: [],
+    })
+
+    const response = await POST(makeRequest(validBody()))
+
+    expect(response.status).toBe(500)
+    expect(mockDbDelete).toHaveBeenCalled()
+    expect(whereSpy).toHaveBeenCalled()
+  })
+
   it('unwraps an export response envelope so its metadata still resolves', async () => {
     await POST(makeRequest(validBody({ workflow: { data: EXPORT_ENVELOPE, limits: {} } })))
 

apps/sim/app/api/v1/workflows/import/route.ts

@@ -229,24 +229,37 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     const workflowId = created.workflow.id
 
-    const saveResult = await saveWorkflowToNormalizedTables(workflowId, workflowState)
-    if (!saveResult.success) {
-      await db.delete(workflow).where(eq(workflow.id, workflowId))
-      logger.error(`[${requestId}] Failed to persist imported workflow state`, {
+    const variables = toVariablesRecord(workflowState.variables)
+
+    /**
+     * The graph and the variables are written in one transaction so an import
+     * can never half-land, and any failure deletes the shell row created above
+     * — a caller that receives an error must not be left with a partially
+     * imported workflow in their workspace.
+     */
+    try {
+      await db.transaction(async (tx) => {
+        const saveResult = await saveWorkflowToNormalizedTables(workflowId, workflowState, tx)
+        if (!saveResult.success) {
+          throw new Error(saveResult.error || 'Failed to save workflow state')
+        }
+
+        if (Object.keys(variables).length > 0) {
+          await tx
+            .update(workflow)
+            .set({ variables, updatedAt: new Date() })
+            .where(eq(workflow.id, workflowId))
+        }
+      })
+    } catch (error) {
+      logger.error(`[${requestId}] Failed to persist imported workflow, rolling back`, {
         workflowId,
-        error: saveResult.error,
+        error: getErrorMessage(error, 'Unknown error'),
       })
+      await db.delete(workflow).where(eq(workflow.id, workflowId))
       return NextResponse.json({ error: 'Failed to save workflow state' }, { status: 500 })
     }
 
-    const variables = toVariablesRecord(workflowState.variables)
-    if (Object.keys(variables).length > 0) {
-      await db
-        .update(workflow)
-        .set({ variables, updatedAt: new Date() })
-        .where(eq(workflow.id, workflowId))
-    }
-
     logger.info(`[${requestId}] Imported workflow ${workflowId} into workspace ${workspaceId}`, {
       name: created.workflow.name,
       blocksCount: Object.keys(workflowState.blocks).length,