feat(admin): added admin APIs for admin management #2206
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Greptile OverviewGreptile SummaryThis PR introduces a comprehensive Admin API v1 system for administrative management of the Sim platform. The implementation adds 16 new API endpoints across users, workspaces, and workflows, including listing, detailed views, deletion, and import/export operations. The system uses environment-variable based authentication ( The admin API follows RESTful conventions with consistent response structures, pagination support, and proper error handling. Key functionality includes workspace export/import (ZIP and JSON formats), bulk workflow operations, user management, and folder management. The implementation leverages existing database patterns using Drizzle ORM, maintains referential integrity through transactions, and includes comprehensive TypeScript types with utility functions for data transformation. All endpoints use the Important Files Changed
Confidence score: 3/5
Sequence DiagramsequenceDiagram
participant User as "Admin User"
participant Client as "HTTP Client"
participant Middleware as "Admin Auth Middleware"
participant AuthModule as "Admin Auth Module"
participant Handler as "API Route Handler"
participant DB as "Database"
participant Logger as "Logger"
User->>Client: "Send admin API request"
Client->>Middleware: "HTTP Request with x-admin-key header"
Middleware->>AuthModule: "authenticateAdminRequest(request)"
AuthModule->>AuthModule: "Check ADMIN_API_KEY environment variable"
alt ADMIN_API_KEY not configured
AuthModule->>Middleware: "{ authenticated: false, notConfigured: true }"
Middleware->>Client: "503 Not Configured Response"
Client->>User: "Admin API not configured error"
else Missing x-admin-key header
AuthModule->>Middleware: "{ authenticated: false, error: 'Key required' }"
Middleware->>Client: "401 Unauthorized Response"
Client->>User: "Authentication required error"
else Invalid admin key
AuthModule->>AuthModule: "constantTimeCompare(providedKey, adminKey)"
AuthModule->>Logger: "Log invalid key attempt"
AuthModule->>Middleware: "{ authenticated: false, error: 'Invalid key' }"
Middleware->>Client: "401 Unauthorized Response"
Client->>User: "Invalid admin key error"
else Valid authentication
AuthModule->>Middleware: "{ authenticated: true }"
Middleware->>Handler: "Call route handler"
Handler->>DB: "Database query/operation"
DB->>Handler: "Query results"
Handler->>Logger: "Log operation"
Handler->>Middleware: "Response data"
Middleware->>Client: "200 Success Response"
Client->>User: "API response data"
end
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| workflowCount: workflowCountResult[0].count, | ||
| folderCount: folderCountResult[0].count, |
There was a problem hiding this comment.
logic: accessing array index [0] without checking if results exist could cause runtime error if count query returns empty array
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/sim/app/api/v1/admin/workspaces/[id]/route.ts
Line: 51:52
Comment:
**logic:** accessing array index [0] without checking if results exist could cause runtime error if count query returns empty array
How can I resolve this? If you propose a fix, please make it concise.| // ============================================================================= | ||
| // Common Error Responses | ||
| // ============================================================================= |
There was a problem hiding this comment.
style: avoid using separator comments like this
Context Used: Context from dashboard - .cursorrules (source)
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/sim/app/api/v1/admin/responses.ts
Line: 52:54
Comment:
**style:** avoid using separator comments like this
**Context Used:** Context from `dashboard` - .cursorrules ([source](https://app.greptile.com/review/custom-context?memory=493a526c-5c62-4263-a434-6a91d855febe))
<sub>Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!</sub>
How can I resolve this? If you propose a fix, please make it concise.| // ============================================================================= | ||
| // Database Model Types (inferred from schema) | ||
| // ============================================================================= |
There was a problem hiding this comment.
style: Consider removing the section separator comments to align with the .cursorrules that state not to use ==== for comments and to avoid non-TSDoc comments
| // ============================================================================= | |
| // Database Model Types (inferred from schema) | |
| // ============================================================================= | |
| /** | |
| * Database Model Types (inferred from schema) | |
| */ |
Context Used: Context from dashboard - .cursorrules (source)
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/sim/app/api/v1/admin/types.ts
Line: 13:15
Comment:
**style:** Consider removing the section separator comments to align with the .cursorrules that state not to use ==== for comments and to avoid non-TSDoc comments
```suggestion
/**
* Database Model Types (inferred from schema)
*/
```
**Context Used:** Context from `dashboard` - .cursorrules ([source](https://app.greptile.com/review/custom-context?memory=493a526c-5c62-4263-a434-6a91d855febe))
<sub>Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!</sub>
How can I resolve this? If you propose a fix, please make it concise.| return varsObj.map((v) => ({ | ||
| id: v.id, | ||
| name: v.name, | ||
| type: v.type, | ||
| value: v.value, | ||
| })) |
There was a problem hiding this comment.
logic: Type assertion without validation creates potential runtime errors if the object structure doesn't match expected format. Should there be validation to ensure the mapped object has the required properties before type assertion?
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/sim/app/api/v1/admin/types.ts
Line: 319:324
Comment:
**logic:** Type assertion without validation creates potential runtime errors if the object structure doesn't match expected format. Should there be validation to ensure the mapped object has the required properties before type assertion?
How can I resolve this? If you propose a fix, please make it concise.| const workflowContent = | ||
| typeof body.workflow === 'string' ? body.workflow : JSON.stringify(body.workflow) | ||
|
|
||
| const { data: workflowData, errors } = parseWorkflowJson(workflowContent) | ||
|
|
||
| if (!workflowData || errors.length > 0) { | ||
| return badRequestResponse(`Invalid workflow: ${errors.join(', ')}`) | ||
| } | ||
|
|
||
| const parsedWorkflow = | ||
| typeof body.workflow === 'string' | ||
| ? (() => { | ||
| try { | ||
| return JSON.parse(body.workflow) | ||
| } catch { | ||
| return null | ||
| } | ||
| })() | ||
| : body.workflow |
There was a problem hiding this comment.
style: Workflow is being parsed twice - once as string for validation and once for metadata extraction. Consider parsing once and reusing the result to avoid redundant operations.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/sim/app/api/v1/admin/workflows/import/route.ts
Line: 68:86
Comment:
**style:** Workflow is being parsed twice - once as string for validation and once for metadata extraction. Consider parsing once and reusing the result to avoid redundant operations.
<sub>Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!</sub>
How can I resolve this? If you propose a fix, please make it concise.| id: workflowId, | ||
| userId: workspaceData.ownerId, | ||
| workspaceId, | ||
| folderId: folderId || null, |
There was a problem hiding this comment.
style: Consider validating that folderId exists in the target workspace before creating the workflow to prevent orphaned folder references. Should there be validation to ensure the folderId exists within the target workspace?
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/sim/app/api/v1/admin/workflows/import/route.ts
Line: 101:101
Comment:
**style:** Consider validating that folderId exists in the target workspace before creating the workflow to prevent orphaned folder references. Should there be validation to ensure the folderId exists within the target workspace?
<sub>Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!</sub>
How can I resolve this? If you propose a fix, please make it concise.| const parsedContent = (() => { | ||
| try { | ||
| return JSON.parse(wf.content) | ||
| } catch { | ||
| return null | ||
| } | ||
| })() |
There was a problem hiding this comment.
style: JSON parsing duplicates work already done by parseWorkflowJson on line 186
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/sim/app/api/v1/admin/workspaces/[id]/import/route.ts
Line: 231:237
Comment:
**style:** JSON parsing duplicates work already done by parseWorkflowJson on line 186
<sub>Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!</sub>
How can I resolve this? If you propose a fix, please make it concise.| } | ||
|
|
||
| if (!constantTimeCompare(providedKey, adminKey)) { | ||
| logger.warn('Invalid admin API key attempted', { keyPrefix: providedKey.slice(0, 8) }) |
There was a problem hiding this comment.
style: Potential information disclosure - logging partial key could aid brute force attacks
| logger.warn('Invalid admin API key attempted', { keyPrefix: providedKey.slice(0, 8) }) | |
| logger.warn('Invalid admin API key attempted') |
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/sim/app/api/v1/admin/auth.ts
Line: 58:58
Comment:
**style:** Potential information disclosure - logging partial key could aid brute force attacks
```suggestion
logger.warn('Invalid admin API key attempted')
```
<sub>Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!</sub>
How can I resolve this? If you propose a fix, please make it concise.
Summary
Type of Change
Testing
Tested manually
Checklist