Method applyPiiRedaction

apps/sim/lib/logs/execution/logger.ts:619–665

* Mask PII from log content before persistence when the execution's workspace * (via workspace override or org default) has enterprise PII redaction enabled. * Resolved at persist time so both the inline and externalized write paths are * covered. Returns the payload unchanged when disabled

(
    workspaceId: string | null,
    payload: RedactablePayload,
    storeContext: { workflowId?: string | null; executionId: string; userId?: string | null }
  )

   * covered. Returns the payload unchanged when disabled or non-enterprise.
   */
  private async applyPiiRedaction(
    workspaceId: string | null,
    payload: RedactablePayload,
    storeContext: { workflowId?: string | null; executionId: string; userId?: string | null }
  ): Promise<RedactablePayload> {
    if (!workspaceId) return payload

    const [row] = await db
      .select({ orgSettings: organization.dataRetentionSettings })
      .from(workspace)
      .leftJoin(organization, eq(organization.id, workspace.organizationId))
      .where(eq(workspace.id, workspaceId))
      .limit(1)
    if (!row) return payload

    // Resolve from stored rules UNCONDITIONALLY — deliberately NOT gated on the
    // `pii-redaction` feature flag or the enterprise-plan check. Rules are only
    // writable by entitled orgs (route-gated), so their presence is the source of
    // truth; re-checking the flag/plan here returns false on a transient read and
    // would silently skip masking, leaking PII (fail-open). Absence of rules
    // yields the disabled default, so non-PII orgs incur only the lookup.
    const config = resolveEffectivePiiRedaction({ orgSettings: row.orgSettings, workspaceId }).logs
    if (!config.enabled) return payload

    // The string redactor can't reach values already offloaded to large-value
    // storage (>8MB refs). Always hydrate → mask → re-store them under the LOGS
    // policy, even if the block-output stage already masked before offload: that
    // used the block-output entity set, which can differ from the logs set, so
    // the log's large values must get the logs policy applied like inline content
    // does. Masking is idempotent, so already-masked spans are unaffected; a ref
    // that can't be materialized/re-stored falls back to a marker.
    const working = await redactLargeValueRefs(payload, {
      entityTypes: config.entityTypes,
      language: config.language,
      store: {
        workspaceId,
        workflowId: storeContext.workflowId ?? undefined,
        executionId: storeContext.executionId,
        userId: storeContext.userId ?? undefined,
      },
    })

    return redactPIIFromExecution(working, {
      entityTypes: config.entityTypes,
      language: config.language,
    })
  }

  async completeWorkflowExecution(params: {
    executionId: string