From 9d4bf1629ba7a14f6a7a1a99c2ade5374ac30bb2 Mon Sep 17 00:00:00 2001
From: Theodore Li <theo@sim.ai>
Date: Thu, 7 May 2026 12:45:56 -0700
Subject: [PATCH 1/2] feat(admin): Increase impersonation timeout to 100 years

---
 apps/sim/lib/auth/auth.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/apps/sim/lib/auth/auth.ts b/apps/sim/lib/auth/auth.ts
index b446fff9727..5a60d435066 100644
--- a/apps/sim/lib/auth/auth.ts
+++ b/apps/sim/lib/auth/auth.ts
@@ -861,7 +861,9 @@ export const auth = betterAuth({
           }),
         ]
       : []),
-    admin(),
+    admin({
+      impersonationSessionDuration: 60 * 60 * 24 * 365 * 100,
+    }),
     jwt({
       jwks: {
         keyPairConfig: { alg: 'RS256' },

From f81eba92988cabde860f80eb1144f92537867402 Mon Sep 17 00:00:00 2001
From: Theodore Li <theo@sim.ai>
Date: Thu, 7 May 2026 13:28:52 -0700
Subject: [PATCH 2/2] fix(workspace): redirect to login on missing session
 instead of leaving blank workspace

---
 apps/sim/app/workspace/[workspaceId]/layout.tsx | 6 +++++-
 apps/sim/lib/auth/auth.ts                       | 4 +---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/apps/sim/app/workspace/[workspaceId]/layout.tsx b/apps/sim/app/workspace/[workspaceId]/layout.tsx
index 5fe6c2dbfe1..5d253320ce1 100644
--- a/apps/sim/app/workspace/[workspaceId]/layout.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/layout.tsx
@@ -1,3 +1,4 @@
+import { redirect } from 'next/navigation'
 import { ToastProvider } from '@/components/emcn'
 import { getSession } from '@/lib/auth'
 import { NavTour } from '@/app/workspace/[workspaceId]/components/product-tour'
@@ -13,8 +14,11 @@ import { getOrgWhitelabelSettings } from '@/ee/whitelabeling/org-branding'
 
 export default async function WorkspaceLayout({ children }: { children: React.ReactNode }) {
   const session = await getSession()
+  if (!session?.user) {
+    redirect('/login')
+  }
   // The organization plugin is conditionally spread so TS can't infer activeOrganizationId on the base session type.
-  const orgId = (session?.session as { activeOrganizationId?: string } | null)?.activeOrganizationId
+  const orgId = (session.session as { activeOrganizationId?: string } | null)?.activeOrganizationId
   const initialOrgSettings = orgId ? await getOrgWhitelabelSettings(orgId) : null
 
   return (
diff --git a/apps/sim/lib/auth/auth.ts b/apps/sim/lib/auth/auth.ts
index 5a60d435066..b446fff9727 100644
--- a/apps/sim/lib/auth/auth.ts
+++ b/apps/sim/lib/auth/auth.ts
@@ -861,9 +861,7 @@ export const auth = betterAuth({
           }),
         ]
       : []),
-    admin({
-      impersonationSessionDuration: 60 * 60 * 24 * 365 * 100,
-    }),
+    admin(),
     jwt({
       jwks: {
         keyPairConfig: { alg: 'RS256' },