feat(infra): CORS + CSP coverage for the v2 execute path

/api/v2/workflows/:id/execute gets the same wildcard-origin,
credential-free CORS policy as v1 (the default credentialed policy
would block browser API-key calls and open a cookie CSRF surface) with
X-Sim-Stream-Protocol allowed and no X-Execution-Mode (async is
body-selected on v2), plus the COEP/COOP/CSP header block.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CiHhAk2R1NryaS3R8n2yFz

Author: TheodoreSpeaks

apps/sim/next.config.ts

@@ -254,6 +254,17 @@ const nextConfig: NextConfig = {
           },
         ],
       },
+      {
+        source: '/api/v2/workflows/:id/execute',
+        headers: [
+          { key: 'Cross-Origin-Embedder-Policy', value: 'unsafe-none' },
+          { key: 'Cross-Origin-Opener-Policy', value: 'unsafe-none' },
+          {
+            key: 'Content-Security-Policy',
+            value: getWorkflowExecutionCSPPolicy(),
+          },
+        ],
+      },
       {
         // Exclude Vercel internal resources and static assets from strict COEP, Google Drive Picker
         // and the /demo Cal.com booking embed to prevent 'refused to connect' / slow-load issues

apps/sim/proxy.test.ts

@@ -90,6 +90,29 @@ describe('resolveApiCorsPolicy', () => {
     expect(policy.headers).toContain('X-Execution-Id')
   })
 
+  it('serves v2 workflow execute with wildcard origin and the stream-protocol header', () => {
+    const policy = resolveApiCorsPolicy(
+      makeRequest('/api/v2/workflows/workflow-123/execute', 'https://other.example')
+    )
+    expect(policy.origin).toBe('*')
+    expect(policy.credentials).toBe(false)
+    expect(policy.headers).toContain('X-Execution-Id')
+    expect(policy.headers).toContain('X-Sim-Stream-Protocol')
+    // Async is body-selected on v2 — the mode header is deliberately absent.
+    expect(policy.headers).not.toContain('X-Execution-Mode')
+  })
+
+  it('does not match the v2 execute rule for nested or executions paths', () => {
+    const nested = resolveApiCorsPolicy(
+      makeRequest('/api/v2/workflows/workflow-123/execute/extra', 'https://other.example')
+    )
+    expect(nested.origin).toBe('https://app.sim.test')
+    const executions = resolveApiCorsPolicy(
+      makeRequest('/api/v2/workflows/workflow-123/executions/e-1', 'https://other.example')
+    )
+    expect(executions.origin).toBe('https://app.sim.test')
+  })
+
   it('does not match the workflow execute rule for nested paths', () => {
     const policy = resolveApiCorsPolicy(
       makeRequest('/api/workflows/workflow-123/execute/extra', 'https://other.example')
@@ -113,6 +136,7 @@ describe('resolveApiCorsPolicy', () => {
       '/api/mcp/copilot',
       '/api/chat/abc',
       '/api/workflows/wf/execute',
+      '/api/v2/workflows/wf/execute',
       '/api/files/upload',
     ]
     for (const path of paths) {

apps/sim/proxy.ts

@@ -23,6 +23,9 @@ const DEFAULT_API_ALLOWED_HEADERS =
 const WORKFLOW_EXECUTE_HEADERS =
   'X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version, X-API-Key, X-Execution-Id'
 
+/** v2 execute: async is body-selected (no X-Execution-Mode) and streaming negotiates X-Sim-Stream-Protocol. */
+const WORKFLOW_EXECUTE_V2_HEADERS = `${WORKFLOW_EXECUTE_HEADERS}, X-Sim-Stream-Protocol`
+
 /** Subpaths under /api/chat/* that serve the workspace UI, not embeds. */
 const EMBED_RESERVED_SEGMENTS = new Set(['manage', 'validate'])
 
@@ -82,6 +85,18 @@ const CORS_RULES: readonly CorsRule[] = [
       headers: WORKFLOW_EXECUTE_HEADERS,
     }),
   },
+  {
+    // Mirrors the v1 rule: public execute endpoints are wildcard-origin and
+    // credential-free — the default credentialed policy would both block
+    // browser API-key calls and open a cookie-bearing CSRF surface.
+    match: (p) => /^\/api\/v2\/workflows\/[^/]+\/execute$/.test(p),
+    policy: () => ({
+      origin: '*',
+      credentials: false,
+      methods: 'POST,OPTIONS',
+      headers: WORKFLOW_EXECUTE_V2_HEADERS,
+    }),
+  },
 ]
 
 /** Single source of truth for /api/* CORS — resolved at request time, not baked at build. */