fix(workflow-auth): adding workflowId param to only internal urls

[icecrasher321]

Summary

Did not have internal URL check. So was adding workflowId to external calls too. Not ignored by some providers.

Type of Change

• Bug fix

Testing

Manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
docs	Skipped			Oct 22, 2025 2:27am

[greptile-apps]

Greptile Overview

Summary

Fixed a bug where the workflowId query parameter was being added to all API requests, including external third-party API calls. The fix moves the isInternalRoute check (line 432) before the workflowId is conditionally added to the URL (line 435), ensuring that only internal routes (/api/*) receive this parameter.

• Moved isInternalRoute determination earlier in the function flow
• Added conditional check to only append workflowId for internal routes
• External API providers that don't recognize workflowId will no longer receive or potentially reject requests with this parameter

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The change is a targeted bug fix that adds a simple conditional check to prevent internal-only parameters from leaking to external APIs. The logic is sound, the fix is minimal (3 lines moved/added), and it addresses a real issue where external API providers could reject requests with unrecognized parameters
• No files require special attention

Important Files Changed

File Analysis

Filename	Score	Overview
apps/sim/tools/index.ts	5/5	Moved isInternalRoute check before workflowId is added to URL params, preventing external API calls from receiving the parameter

Sequence Diagram

sequenceDiagram
    participant Client as Client/Executor
    participant handleInternal as handleInternalRequest
    participant URL as URL Constructor
    participant API as API Endpoint
    
    Client->>handleInternal: tool execution request
    handleInternal->>handleInternal: get endpointUrl from tool config
    handleInternal->>handleInternal: check if endpointUrl.startsWith('/api/')
    
    alt Internal Route (/api/*)
        handleInternal->>URL: new URL(endpointUrl, baseUrl)
        handleInternal->>handleInternal: isInternalRoute = true
        handleInternal->>URL: add workflowId to searchParams
        handleInternal->>API: fetch with workflowId param
        API-->>handleInternal: response
    else External Route
        handleInternal->>URL: new URL(endpointUrl, baseUrl)
        handleInternal->>handleInternal: isInternalRoute = false
        handleInternal->>handleInternal: skip adding workflowId
        handleInternal->>API: fetch without workflowId param
        API-->>handleInternal: response
    end
    
    handleInternal-->>Client: tool response

Loading

_{1 file reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}