refactor(logs): drop per-workspace retention override; PII redaction stays org-scoped

- Remove the unused per-workspace data-retention-hours override (no UI; superseded
  by workspace-scoped PII rules). Reverts cleanup-dispatcher to org-only retention,
  drops resolveEffectiveRetentionHours, the workspace.dataRetentionSettings column +
  migration, and the workspace data-retention route/contract/hooks. Fixes Bugbot's
  null-as-unset finding by removing the buggy path entirely; org retention behavior
  is unchanged.
- Stop re-checking isWorkspaceOnEnterprisePlan at persist time (it returns false on
  transient errors, which would fail-open and leak PII). Enabled rules already imply
  entitlement; redact whenever rules apply (fail-safe).

Author: TheodoreSpeaks

apps/sim/app/api/workspaces/[id]/data-retention/route.ts

@@ -9,22 +9,13 @@ import {
   type UpdateOrganizationDataRetentionBody,
   updateOrganizationDataRetentionContract,
 } from '@/lib/api/contracts/organization'
-import {
-  getWorkspaceDataRetentionContract,
-  type UpdateWorkspaceDataRetentionBody,
-  updateWorkspaceDataRetentionContract,
-  type WorkspaceDataRetention,
-} from '@/lib/api/contracts/workspaces'
 
 export type RetentionValues = OrganizationRetentionValues
 export type DataRetentionResponse = OrganizationDataRetention
-export type WorkspaceDataRetentionResponse = WorkspaceDataRetention
 
 export const dataRetentionKeys = {
   all: ['dataRetention'] as const,
   settings: (orgId: string) => [...dataRetentionKeys.all, 'settings', orgId] as const,
-  workspaceSettings: (workspaceId: string) =>
-    [...dataRetentionKeys.all, 'workspace', workspaceId] as const,
 }
 
 async function fetchDataRetention(
@@ -66,45 +57,3 @@ export function useUpdateOrganizationRetention() {
     },
   })
 }
-
-async function fetchWorkspaceDataRetention(
-  workspaceId: string,
-  signal?: AbortSignal
-): Promise<WorkspaceDataRetentionResponse> {
-  const { data } = await requestJson(getWorkspaceDataRetentionContract, {
-    params: { id: workspaceId },
-    signal,
-  })
-  return data
-}
-
-export function useWorkspaceRetention(workspaceId: string | undefined) {
-  return useQuery({
-    queryKey: dataRetentionKeys.workspaceSettings(workspaceId ?? ''),
-    queryFn: ({ signal }) => fetchWorkspaceDataRetention(workspaceId as string, signal),
-    enabled: Boolean(workspaceId),
-    staleTime: 60 * 1000,
-  })
-}
-
-interface UpdateWorkspaceRetentionVariables {
-  workspaceId: string
-  settings: UpdateWorkspaceDataRetentionBody
-}
-
-export function useUpdateWorkspaceRetention() {
-  const queryClient = useQueryClient()
-
-  return useMutation({
-    mutationFn: ({ workspaceId, settings }: UpdateWorkspaceRetentionVariables) =>
-      requestJson(updateWorkspaceDataRetentionContract, {
-        params: { id: workspaceId },
-        body: settings,
-      }),
-    onSettled: (_data, _error, { workspaceId }) => {
-      queryClient.invalidateQueries({
-        queryKey: dataRetentionKeys.workspaceSettings(workspaceId),
-      })
-    },
-  })
-}

apps/sim/ee/data-retention/hooks/data-retention.ts

@@ -272,65 +272,3 @@ export const getWorkspaceMembersContract = defineRouteContract({
 })
 
 export type WorkspacesResponse = ContractJsonResponse<typeof listWorkspacesContract>
-
-const workspaceRetentionHoursSchema = z.number().int().min(24).max(43800).nullable().optional()
-
-/**
- * Per-workspace override of the org-level data retention settings. Any omitted
- * key falls back to the org default at resolution time, so a workspace need only
- * send the keys it wants to override.
- */
-export const updateWorkspaceDataRetentionBodySchema = z.object({
-  logRetentionHours: workspaceRetentionHoursSchema,
-  softDeleteRetentionHours: workspaceRetentionHoursSchema,
-  taskCleanupHours: workspaceRetentionHoursSchema,
-})
-
-const workspaceRetentionValuesSchema = z.object({
-  logRetentionHours: z.number().int().nullable(),
-  softDeleteRetentionHours: z.number().int().nullable(),
-  taskCleanupHours: z.number().int().nullable(),
-})
-
-const workspaceDataRetentionDataSchema = z.object({
-  isEnterprise: z.boolean(),
-  defaults: workspaceRetentionValuesSchema,
-  /** The org-level default this workspace inherits from when unset. */
-  orgConfigured: workspaceRetentionValuesSchema,
-  /** This workspace's own override (nulls where it defers to the org). */
-  workspaceConfigured: workspaceRetentionValuesSchema,
-  /** Resolved per key: workspace override ?? org default ?? plan default. */
-  effective: workspaceRetentionValuesSchema,
-})
-
-export type WorkspaceDataRetention = z.output<typeof workspaceDataRetentionDataSchema>
-
-export const workspaceDataRetentionResponseSchema = z.object({
-  success: z.boolean(),
-  data: workspaceDataRetentionDataSchema,
-})
-
-export const getWorkspaceDataRetentionContract = defineRouteContract({
-  method: 'GET',
-  path: '/api/workspaces/[id]/data-retention',
-  params: workspaceParamsSchema,
-  response: {
-    mode: 'json',
-    schema: workspaceDataRetentionResponseSchema,
-  },
-})
-
-export const updateWorkspaceDataRetentionContract = defineRouteContract({
-  method: 'PUT',
-  path: '/api/workspaces/[id]/data-retention',
-  params: workspaceParamsSchema,
-  body: updateWorkspaceDataRetentionBodySchema,
-  response: {
-    mode: 'json',
-    schema: workspaceDataRetentionResponseSchema,
-  },
-})
-
-export type UpdateWorkspaceDataRetentionBody = z.input<
-  typeof updateWorkspaceDataRetentionBodySchema
->

apps/sim/lib/api/contracts/workspaces.ts

@@ -1,13 +1,12 @@
 import { db } from '@sim/db'
-import type { DataRetentionSettings, WorkspaceMode } from '@sim/db/schema'
+import type { WorkspaceMode } from '@sim/db/schema'
 import { organization, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { tasks } from '@trigger.dev/sdk'
 import { and, asc, eq, gt, isNull } from 'drizzle-orm'
 import { getOrganizationSubscription } from '@/lib/billing/core/billing'
 import { getHighestPriorityPersonalSubscription } from '@/lib/billing/core/subscription'
 import { getPlanType, type PlanCategory } from '@/lib/billing/plan-helpers'
-import { resolveEffectiveRetentionHours } from '@/lib/billing/retention'
 import { chunkArray } from '@/lib/cleanup/batch-delete'
 import { getJobQueue } from '@/lib/core/async-jobs'
 import { shouldExecuteInline } from '@/lib/core/async-jobs/config'
@@ -59,7 +58,6 @@ interface WorkspaceCleanupScopeRow {
   organizationId: string | null
   workspaceMode: WorkspaceMode
   organizationSettings: OrganizationRetentionSettings | null
-  workspaceSettings: DataRetentionSettings | null
 }
 
 const DAY = 24
@@ -101,7 +99,6 @@ async function listActiveWorkspaceCleanupScopeRowsPage(
       organizationId: workspace.organizationId,
       workspaceMode: workspace.workspaceMode,
       organizationSettings: organization.dataRetentionSettings,
-      workspaceSettings: workspace.dataRetentionSettings,
     })
     .from(workspace)
     .leftJoin(organization, eq(organization.id, workspace.organizationId))
@@ -117,7 +114,6 @@ async function listActiveWorkspaceCleanupScopeRowsPage(
     ...row,
     organizationSettings:
       (row.organizationSettings as OrganizationRetentionSettings | null) ?? null,
-    workspaceSettings: (row.workspaceSettings as DataRetentionSettings | null) ?? null,
   }))
 }
 
@@ -269,12 +265,7 @@ async function forEachCleanupChunk(
 
     for (const row of rows) {
       if (planByWorkspaceId.get(row.id) !== 'enterprise') continue
-      const hours = resolveEffectiveRetentionHours({
-        workspaceSettings: row.workspaceSettings,
-        orgSettings: row.organizationSettings,
-        key: config.key,
-        fallback: config.defaults.enterprise,
-      })
+      const hours = row.organizationSettings?.[config.key]
       if (hours == null) continue
       workspaceCount++
       await emitChunk({