fix(auth): copilot routes

[Sg312]

Summary

Make function execute use check session or internal auth since copilot tool calls originate from the client

Type of Change

• Bug fix

Testing

Manual

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Review	Updated (UTC)
docs	Skipped		Jan 24, 2026 8:23pm

[greptile-apps]

Greptile Summary

This PR fixes authentication for the function execute endpoint by switching from checkInternalAuth to checkSessionOrInternalAuth. This change allows the endpoint to accept authenticated requests from both the web UI (session-based) and internal services (JWT-based), which is necessary for the copilot feature that originates from the client. The authentication logic properly rejects API key access and validates both authentication methods appropriately.

• Impact: Expands authentication methods accepted by the function execution endpoint to support copilot tool calls originating from authenticated user sessions
• Security: Maintains security by still rejecting API key authentication and properly validating all authentication types
• Scope: Single-line change affecting authentication validation only

Confidence Score: 5/5

• This PR is safe to merge with no concerns - it's a targeted authentication fix with proper security validation
• This is a minimal, well-motivated change that correctly updates the authentication method. The new checkSessionOrInternalAuth function properly handles both session and internal JWT authentication while explicitly rejecting API keys. The change aligns with the stated goal of supporting copilot tool calls from authenticated clients. No new security vulnerabilities are introduced, and the existing security model is preserved.
• No files require special attention

Important Files Changed

Filename	Overview
apps/sim/app/api/function/execute/route.ts	Changed auth method from checkInternalAuth to checkSessionOrInternalAuth to support both session-based authentication (from UI/copilot) and internal JWT tokens. This is a proper security improvement that allows the endpoint to accept requests from authenticated users with session cookies, while still maintaining internal token support.

Sequence Diagram

sequenceDiagram
    actor User as User/Copilot
    participant UI as Browser UI
    participant API as /api/copilot/execute-tool
    participant Execute as /api/function/execute
    
    User->>UI: Triggers copilot code execution
    UI->>API: POST (with session cookie)
    activate API
    Note over API: Validates session auth<br/>(getSession())
    API->>Execute: POST (with internal JWT)
    deactivate API
    activate Execute
    Note over Execute: NEW: checkSessionOrInternalAuth<br/>- Accepts session auth<br/>- Accepts internal JWT<br/>- Rejects API keys
    Execute-->>API: Success response
    deactivate Execute
    API-->>UI: Tool execution result
    UI-->>User: Display result

Loading