fix(guardrails): coerce stored redaction language in the resolver

The persist-path resolver accepted any stored language string, so a stale/invalid
code (e.g. a dropped locale) would reach Presidio and scrub the log even though the
admin UI shows English. Coerce against the supported set via a shared
coercePiiLanguage helper (now reused by the data-retention route too), falling back
to en for unknown values.

Author: TheodoreSpeaks

apps/sim/app/api/organizations/[id]/data-retention/route.ts

@@ -16,14 +16,7 @@ import { isOrganizationOnEnterprisePlan } from '@/lib/billing/core/subscription'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { PII_LANGUAGE_CODES, type PIILanguage } from '@/lib/guardrails/pii-entities'
-
-/** Narrow a stored (loosely-typed) language to the supported set; unknown ⇒ undefined (defaults to en). */
-function coercePiiLanguage(value: string | undefined): PIILanguage | undefined {
-  return value && (PII_LANGUAGE_CODES as readonly string[]).includes(value)
-    ? (value as PIILanguage)
-    : undefined
-}
+import { coercePiiLanguage } from '@/lib/guardrails/pii-entities'
 
 const logger = createLogger('DataRetentionAPI')
 

apps/sim/lib/billing/retention.test.ts

@@ -46,6 +46,16 @@ describe('resolveEffectivePiiRedaction', () => {
     expect(result).toEqual({ enabled: true, entityTypes: ['ES_NIF'], language: 'es' })
   })
 
+  it('falls back to en when a stored language is unsupported/stale', () => {
+    const result = resolveEffectivePiiRedaction({
+      orgSettings: settings([
+        { id: 'r-de', entityTypes: ['EMAIL_ADDRESS'], workspaceId: 'ws-1', language: 'de' },
+      ]),
+      workspaceId: 'ws-1',
+    })
+    expect(result).toEqual({ enabled: true, entityTypes: ['EMAIL_ADDRESS'], language: 'en' })
+  })
+
   it('exempts a workspace when its specific rule has no entity types', () => {
     const result = resolveEffectivePiiRedaction({
       orgSettings: settings([allRule, { id: 'r-1', entityTypes: [], workspaceId: 'ws-1' }]),

apps/sim/lib/billing/retention.ts

@@ -1,5 +1,5 @@
 import type { DataRetentionSettings } from '@sim/db/schema'
-import { DEFAULT_PII_LANGUAGE } from '@/lib/guardrails/pii-entities'
+import { coercePiiLanguage, DEFAULT_PII_LANGUAGE } from '@/lib/guardrails/pii-entities'
 
 export interface EffectivePiiRedaction {
   enabled: boolean
@@ -38,6 +38,6 @@ export function resolveEffectivePiiRedaction(params: {
     ? rule.entityTypes.filter((t): t is string => typeof t === 'string')
     : []
   if (types.length === 0) return DEFAULT_PII_REDACTION
-  const language = typeof rule?.language === 'string' ? rule.language : DEFAULT_PII_LANGUAGE
+  const language = coercePiiLanguage(rule?.language) ?? DEFAULT_PII_LANGUAGE
   return { enabled: true, entityTypes: types, language }
 }

apps/sim/lib/guardrails/pii-entities.ts

@@ -145,3 +145,14 @@ export const PII_LANGUAGE_CODES = PII_LANGUAGES.map((l) => l.value) as [
 
 /** Default redaction language when a rule doesn't set one. */
 export const DEFAULT_PII_LANGUAGE: PIILanguage = 'en'
+
+/**
+ * Narrow a loosely-typed (stored/legacy) language to a supported code. Unknown or
+ * stale values (e.g. a dropped locale) return `undefined` so callers fall back to
+ * the default rather than forwarding an unsupported language to Presidio.
+ */
+export function coercePiiLanguage(value: string | undefined): PIILanguage | undefined {
+  return value && (PII_LANGUAGE_CODES as readonly string[]).includes(value)
+    ? (value as PIILanguage)
+    : undefined
+}