fix(mailer): permissions entitlements for enabling/disabling

Author: icecrasher321

apps/sim/app/api/workspaces/[id]/inbox/route.ts

@@ -6,7 +6,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { updateInboxConfigContract } from '@/lib/api/contracts/inbox'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { hasInboxAccess } from '@/lib/billing/core/subscription'
+import { hasWorkspaceInboxAccess } from '@/lib/billing/core/subscription'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { disableInbox, enableInbox, updateInboxAddress } from '@/lib/mothership/inbox/lifecycle'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
@@ -21,18 +21,12 @@ export const GET = withRouteHandler(
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
     }
 
-    const [hasAccess, permission] = await Promise.all([
-      hasInboxAccess(session.user.id),
-      getUserEntityPermissions(session.user.id, 'workspace', workspaceId),
-    ])
-    if (!hasAccess) {
-      return NextResponse.json({ error: 'Sim Mailer requires a Max plan' }, { status: 403 })
-    }
+    const permission = await getUserEntityPermissions(session.user.id, 'workspace', workspaceId)
     if (!permission) {
       return NextResponse.json({ error: 'Not found' }, { status: 404 })
     }
 
-    const [wsResult, statsResult] = await Promise.all([
+    const [wsResult, statsResult, entitled] = await Promise.all([
       db
         .select({
           inboxEnabled: workspace.inboxEnabled,
@@ -49,6 +43,7 @@ export const GET = withRouteHandler(
         .from(mothershipInboxTask)
         .where(eq(mothershipInboxTask.workspaceId, workspaceId))
         .groupBy(mothershipInboxTask.status),
+      hasWorkspaceInboxAccess(workspaceId),
     ])
 
     const [ws] = wsResult
@@ -73,6 +68,7 @@ export const GET = withRouteHandler(
     return NextResponse.json({
       enabled: ws.inboxEnabled,
       address: ws.inboxAddress,
+      entitled,
       taskStats: stats,
     })
   }
@@ -86,21 +82,24 @@ export const PATCH = withRouteHandler(
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
     }
 
-    const [hasAccess, permission] = await Promise.all([
-      hasInboxAccess(session.user.id),
-      getUserEntityPermissions(session.user.id, 'workspace', workspaceId),
-    ])
-    if (!hasAccess) {
-      return NextResponse.json({ error: 'Sim Mailer requires a Max plan' }, { status: 403 })
-    }
+    const permission = await getUserEntityPermissions(session.user.id, 'workspace', workspaceId)
     if (permission !== 'admin') {
       return NextResponse.json({ error: 'Admin access required' }, { status: 403 })
     }
 
+    const parsed = await parseRequest(updateInboxConfigContract, req, context)
+    if (!parsed.success) return parsed.response
+    const body = parsed.data.body
+
     try {
-      const parsed = await parseRequest(updateInboxConfigContract, req, context)
-      if (!parsed.success) return parsed.response
-      const body = parsed.data.body
+      if (body.enabled === false) {
+        await disableInbox(workspaceId)
+        return NextResponse.json({ enabled: false, address: null })
+      }
+
+      if (!(await hasWorkspaceInboxAccess(workspaceId))) {
+        return NextResponse.json({ error: 'Sim Mailer requires a Max plan' }, { status: 403 })
+      }
 
       if (body.enabled === true) {
         const [current] = await db
@@ -115,11 +114,6 @@ export const PATCH = withRouteHandler(
         return NextResponse.json(config)
       }
 
-      if (body.enabled === false) {
-        await disableInbox(workspaceId)
-        return NextResponse.json({ enabled: false, address: null })
-      }
-
       if (body.username) {
         const config = await updateInboxAddress(workspaceId, body.username)
         return NextResponse.json(config)

apps/sim/app/api/workspaces/[id]/inbox/senders/route.ts

@@ -6,7 +6,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { addInboxSenderContract, removeInboxSenderContract } from '@/lib/api/contracts/inbox'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { hasInboxAccess } from '@/lib/billing/core/subscription'
+import { hasWorkspaceInboxAccess } from '@/lib/billing/core/subscription'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
@@ -21,7 +21,7 @@ export const GET = withRouteHandler(
     }
 
     const [hasAccess, permission] = await Promise.all([
-      hasInboxAccess(session.user.id),
+      hasWorkspaceInboxAccess(workspaceId),
       getUserEntityPermissions(session.user.id, 'workspace', workspaceId),
     ])
     if (!hasAccess) {
@@ -77,7 +77,7 @@ export const POST = withRouteHandler(
     }
 
     const [hasAccess, permission] = await Promise.all([
-      hasInboxAccess(session.user.id),
+      hasWorkspaceInboxAccess(workspaceId),
       getUserEntityPermissions(session.user.id, 'workspace', workspaceId),
     ])
     if (!hasAccess) {
@@ -136,7 +136,7 @@ export const DELETE = withRouteHandler(
     }
 
     const [hasAccess, permission] = await Promise.all([
-      hasInboxAccess(session.user.id),
+      hasWorkspaceInboxAccess(workspaceId),
       getUserEntityPermissions(session.user.id, 'workspace', workspaceId),
     ])
     if (!hasAccess) {

apps/sim/app/api/workspaces/[id]/inbox/tasks/route.ts

@@ -4,7 +4,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { inboxTasksQuerySchema, inboxWorkspaceParamsSchema } from '@/lib/api/contracts/inbox'
 import { getValidationErrorMessage } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { hasInboxAccess } from '@/lib/billing/core/subscription'
+import { hasWorkspaceInboxAccess } from '@/lib/billing/core/subscription'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
@@ -24,7 +24,7 @@ export const GET = withRouteHandler(
     }
 
     const [hasAccess, permission] = await Promise.all([
-      hasInboxAccess(session.user.id),
+      hasWorkspaceInboxAccess(workspaceId),
       getUserEntityPermissions(session.user.id, 'workspace', workspaceId),
     ])
     if (!hasAccess) {

apps/sim/app/workspace/[workspaceId]/settings/components/inbox/inbox.tsx

@@ -3,34 +3,36 @@
 import { Chip } from '@sim/emcn'
 import { ArrowRight } from 'lucide-react'
 import { useParams, useRouter } from 'next/navigation'
-import { getSubscriptionAccessState } from '@/lib/billing/client'
+import { useUserPermissionsContext } from '@/app/workspace/[workspaceId]/providers/workspace-permissions-provider'
 import {
   InboxEnableToggle,
   InboxSettingsTab,
   InboxTaskList,
 } from '@/app/workspace/[workspaceId]/settings/components/inbox/components'
 import { SettingsPanel } from '@/app/workspace/[workspaceId]/settings/components/settings-panel'
 import { SettingsSection } from '@/app/workspace/[workspaceId]/settings/components/settings-section/settings-section'
-import { isBillingEnabled } from '@/app/workspace/[workspaceId]/settings/navigation'
 import { useInboxConfig } from '@/hooks/queries/inbox'
-import { useSubscriptionData } from '@/hooks/queries/subscription'
 
 export function Inbox() {
   const params = useParams()
   const router = useRouter()
   const workspaceId = params.workspaceId as string
 
   const { data: config, isLoading } = useInboxConfig(workspaceId)
-  const { data: subscriptionResponse, isLoading: isSubLoading } = useSubscriptionData({
-    enabled: isBillingEnabled,
-  })
-  const subscriptionAccess = getSubscriptionAccessState(subscriptionResponse?.data)
+  const { canAdmin } = useUserPermissionsContext()
 
-  if (isLoading || (isBillingEnabled && isSubLoading)) {
+  if (isLoading) {
     return null
   }
 
-  if (isBillingEnabled && !subscriptionAccess.hasUsableMaxAccess) {
+  if (!config?.entitled) {
+    if (config?.enabled && canAdmin) {
+      return (
+        <SettingsPanel>
+          <InboxEnableToggle />
+        </SettingsPanel>
+      )
+    }
     return (
       <div className='flex h-full flex-col bg-[var(--bg)]'>
         <div className='min-h-0 flex-1 overflow-y-auto px-6 [scrollbar-gutter:stable_both-edges]'>

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx

@@ -23,6 +23,7 @@ import { SidebarTooltip } from '@/app/workspace/[workspaceId]/w/components/sideb
 import { useSSOProviders } from '@/ee/sso/hooks/sso'
 import { prefetchWorkspaceCredentials } from '@/hooks/queries/credentials'
 import { prefetchGeneralSettings, useGeneralSettings } from '@/hooks/queries/general-settings'
+import { useInboxConfig } from '@/hooks/queries/inbox'
 import { useOrganizations } from '@/hooks/queries/organization'
 import { prefetchSubscriptionData, useSubscriptionData } from '@/hooks/queries/subscription'
 import { usePermissionConfig } from '@/hooks/use-permission-config'
@@ -63,6 +64,7 @@ export function SettingsSidebar({
     enabled: isBillingEnabled,
     staleTime: 5 * 60 * 1000,
   })
+  const { data: inboxConfig } = useInboxConfig(workspaceId)
   const { data: ssoProvidersData, isLoading: isLoadingSSO } = useSSOProviders({
     enabled: !isHosted,
   })
@@ -78,6 +80,7 @@ export function SettingsSidebar({
   const isAdmin = userRole === 'admin'
   const isOrgAdminOrOwner = isOwner || isAdmin
   const subscriptionAccess = getSubscriptionAccessState(subscriptionData?.data)
+  const inboxEntitled = inboxConfig?.entitled ?? false
   const hasTeamPlan = subscriptionAccess.hasUsableTeamAccess
   const hasEnterprisePlan = subscriptionAccess.hasUsableEnterpriseAccess
   const isEnterprisePlan = isEnterprise(subscriptionData?.data?.plan)
@@ -296,7 +299,11 @@ export function SettingsSidebar({
                   {sectionItems.map((item) => {
                     const Icon = item.icon
                     const active = activeSection === item.id
-                    const isLocked = item.requiresMax && !subscriptionAccess.hasUsableMaxAccess
+                    const isLocked =
+                      item.requiresMax &&
+                      (item.id === 'inbox'
+                        ? !inboxEntitled
+                        : !subscriptionAccess.hasUsableMaxAccess)
                     const itemClassName = chipVariants({ active, fullWidth: true })
                     const content = (
                       <>

apps/sim/lib/api/contracts/inbox.ts

@@ -17,6 +17,7 @@ export const inboxTaskStatusSchema = z.enum([
 export const inboxConfigSchema = z.object({
   enabled: z.boolean(),
   address: z.string().nullable(),
+  entitled: z.boolean(),
   taskStats: z.object({
     total: z.number(),
     completed: z.number(),

apps/sim/lib/billing/core/subscription.ts

@@ -518,30 +518,54 @@ export async function isWorkspaceOnEnterprisePlan(workspaceId: string): Promise<
   }
 }
 
+const MAX_PLAN_CREDITS = 25000
+
 /**
- * Check if user has access to inbox (Sim Mailer) feature
+ * Whether a resolved subscription entitles the inbox (Sim Mailer) feature: a Max
+ * tier (credits >= 25000, covering `pro_25000` and `team_25000`) or any
+ * enterprise plan.
+ */
+function isInboxEntitledPlan(sub: { plan: string }): boolean {
+  return getPlanTierCredits(sub.plan) >= MAX_PLAN_CREDITS || checkEnterprisePlan(sub)
+}
+
+/**
+ * Check whether a workspace is entitled to the inbox (Sim Mailer) feature.
+ * Entitlement follows the workspace's billing entity — not the acting user — so
+ * any workspace admin (including an external member) can manage the inbox when
+ * the workspace's organization, or its billed account for personal workspaces,
+ * is on a Max or enterprise plan.
+ *
  * Returns true if:
- * - INBOX_ENABLED env var is set, OR
- * - Non-production environment, OR
- * - User has a Max plan (credits >= 25000) or enterprise plan
+ * - INBOX_ENABLED env var is set (self-hosted override), OR
+ * - billing is disabled, OR
+ * - the workspace belongs to an organization on a Max/enterprise plan (org-mode), OR
+ * - the billed user has an individual Max/enterprise subscription (personal workspace).
  */
-export async function hasInboxAccess(userId: string): Promise<boolean> {
+export async function hasWorkspaceInboxAccess(workspaceId: string): Promise<boolean> {
   try {
-    if (isInboxEnabled) {
-      return true
-    }
-    if (!isBillingEnabled) {
-      return true
+    if (isInboxEnabled) return true
+    if (!isBillingEnabled) return true
+
+    const { getWorkspaceWithOwner } = await import('@/lib/workspaces/permissions/utils')
+    const ws = await getWorkspaceWithOwner(workspaceId, { includeArchived: true })
+    if (!ws) return false
+
+    if (ws.organizationId) {
+      if (await isOrganizationBillingBlocked(ws.organizationId)) return false
+      const orgSub = await getOrganizationSubscriptionUsable(ws.organizationId)
+      return !!orgSub && isInboxEntitledPlan(orgSub)
     }
-    const [sub, billingStatus] = await Promise.all([
-      getHighestPrioritySubscription(userId),
-      getEffectiveBillingStatus(userId),
+
+    const [billedSub, billingStatus] = await Promise.all([
+      getHighestPrioritySubscription(ws.billedAccountUserId),
+      getEffectiveBillingStatus(ws.billedAccountUserId),
     ])
-    if (!sub) return false
-    if (!hasUsableSubscriptionAccess(sub.status, billingStatus.billingBlocked)) return false
-    return getPlanTierCredits(sub.plan) >= 25000 || checkEnterprisePlan(sub)
+    if (!billedSub) return false
+    if (!hasUsableSubscriptionAccess(billedSub.status, billingStatus.billingBlocked)) return false
+    return isInboxEntitledPlan(billedSub)
   } catch (error) {
-    logger.error('Error checking inbox access', { error, userId })
+    logger.error('Error checking workspace inbox access', { error, workspaceId })
     return false
   }
 }