fix lifecycle for agentmail infra

Author: icecrasher321

apps/sim/app/api/cron/reconcile-inbox-entitlement/route.ts

@@ -0,0 +1,66 @@
+import { db, workspace } from '@sim/db'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { eq } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import { verifyCronAuth } from '@/lib/auth/internal'
+import { hasWorkspaceInboxGraceAccess } from '@/lib/billing/core/subscription'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { disableInbox } from '@/lib/mothership/inbox/lifecycle'
+
+const logger = createLogger('InboxEntitlementReconcileCron')
+
+export const dynamic = 'force-dynamic'
+
+/**
+ * Periodic inbox (Sim Mailer) entitlement reconciliation. Releases the AgentMail
+ * inbox + webhook for any workspace whose provisioned inbox has outlived its
+ * plan — i.e. `inboxEnabled` is still true but the billing entity no longer
+ * holds an entitled (active or `past_due`) Max/Enterprise subscription.
+ *
+ * Teardown keys off {@link hasWorkspaceInboxGraceAccess}, which tolerates
+ * `past_due`, so a transient payment failure never destroys a paying customer's
+ * inbox — only a genuinely terminal plan (canceled/downgraded) is reclaimed.
+ * `disableInbox` swallows AgentMail delete failures, so a rerun or a race with a
+ * manual disable is a no-op. On self-hosted / billing-disabled deployments the
+ * grace check returns true for every workspace, making this sweep inert.
+ *
+ * Scheduled in helm/sim/values.yaml under cronjobs.jobs.reconcileInboxEntitlement.
+ */
+export const GET = withRouteHandler(async (request: NextRequest) => {
+  const authError = verifyCronAuth(request, 'Inbox entitlement reconciliation')
+  if (authError) {
+    return authError
+  }
+
+  const enabledWorkspaces = await db
+    .select({ id: workspace.id })
+    .from(workspace)
+    .where(eq(workspace.inboxEnabled, true))
+
+  let disabled = 0
+  for (const ws of enabledWorkspaces) {
+    try {
+      if (await hasWorkspaceInboxGraceAccess(ws.id)) {
+        continue
+      }
+      await disableInbox(ws.id)
+      disabled++
+      logger.info('Reclaimed inbox for workspace with terminated Sim Mailer entitlement', {
+        workspaceId: ws.id,
+      })
+    } catch (error) {
+      logger.error('Failed to reconcile inbox entitlement for workspace', {
+        workspaceId: ws.id,
+        error: getErrorMessage(error, 'Unknown error'),
+      })
+    }
+  }
+
+  logger.info('Inbox entitlement reconciliation complete', {
+    checked: enabledWorkspaces.length,
+    disabled,
+  })
+
+  return NextResponse.json({ checked: enabledWorkspaces.length, disabled })
+})

apps/sim/app/api/webhooks/agentmail/route.ts

@@ -19,6 +19,7 @@ import {
   agentMailMessageSchema,
   webhookSvixHeadersSchema,
 } from '@/lib/api/contracts/webhooks'
+import { hasWorkspaceInboxAccess } from '@/lib/billing/core/subscription'
 import { resolveTriggerRegion } from '@/lib/core/async-jobs/region'
 import { isTriggerDevEnabled } from '@/lib/core/config/env-flags'
 import {
@@ -167,30 +168,38 @@ export const POST = withRouteHandler(async (req: Request) => {
     const emailMessageId = message.message_id
     const inReplyTo = message.in_reply_to || null
 
-    const [existingResult, isAllowed, recentCount, parentTaskResult] = await Promise.all([
-      emailMessageId
-        ? db
-            .select({ id: mothershipInboxTask.id })
-            .from(mothershipInboxTask)
-            .where(eq(mothershipInboxTask.emailMessageId, emailMessageId))
-            .limit(1)
-        : Promise.resolve([]),
-      isSenderAllowed(fromEmail, result.id),
-      getRecentTaskCount(result.id),
-      inReplyTo
-        ? db
-            .select({ chatId: mothershipInboxTask.chatId })
-            .from(mothershipInboxTask)
-            .where(eq(mothershipInboxTask.responseMessageId, inReplyTo))
-            .limit(1)
-        : Promise.resolve([]),
-    ])
+    const [existingResult, isAllowed, recentCount, parentTaskResult, isEntitled] =
+      await Promise.all([
+        emailMessageId
+          ? db
+              .select({ id: mothershipInboxTask.id })
+              .from(mothershipInboxTask)
+              .where(eq(mothershipInboxTask.emailMessageId, emailMessageId))
+              .limit(1)
+          : Promise.resolve([]),
+        isSenderAllowed(fromEmail, result.id),
+        getRecentTaskCount(result.id),
+        inReplyTo
+          ? db
+              .select({ chatId: mothershipInboxTask.chatId })
+              .from(mothershipInboxTask)
+              .where(eq(mothershipInboxTask.responseMessageId, inReplyTo))
+              .limit(1)
+          : Promise.resolve([]),
+        hasWorkspaceInboxAccess(result.id),
+      ])
 
     if (existingResult[0]) {
       logger.info('Duplicate webhook, skipping', { emailMessageId })
       return NextResponse.json({ ok: true })
     }
 
+    if (!isEntitled) {
+      logger.info('Inbox no longer entitled, rejecting', { workspaceId: result.id })
+      await createRejectedTask(result.id, message, 'not_entitled')
+      return NextResponse.json({ ok: true })
+    }
+
     if (!isAllowed) {
       await createRejectedTask(result.id, message, 'sender_not_allowed')
       return NextResponse.json({ ok: true })

apps/sim/app/workspace/[workspaceId]/settings/components/inbox/components/inbox-task-list/inbox-task-list.tsx

@@ -193,6 +193,8 @@ function formatRejectionReason(reason: string): string {
       return 'Automated sender'
     case 'rate_limit_exceeded':
       return 'Rate limit exceeded'
+    case 'not_entitled':
+      return 'Plan no longer includes Sim Mailer'
     default:
       return reason
   }

apps/sim/lib/billing/core/subscription.ts

@@ -10,6 +10,7 @@ import {
 } from '@/lib/billing/core/plan'
 import {
   getPlanTierCredits,
+  isEnterprise as isPlanEnterprise,
   isPro as isPlanPro,
   isTeam as isPlanTeam,
 } from '@/lib/billing/plan-helpers'
@@ -521,12 +522,13 @@ export async function isWorkspaceOnEnterprisePlan(workspaceId: string): Promise<
 const MAX_PLAN_CREDITS = 25000
 
 /**
- * Whether a resolved subscription entitles the inbox (Sim Mailer) feature: a Max
- * tier (credits >= 25000, covering `pro_25000` and `team_25000`) or any
- * enterprise plan.
+ * Whether a plan tier entitles the inbox (Sim Mailer) feature: a Max tier
+ * (credits >= 25000, covering `pro_25000` and `team_25000`) or any enterprise
+ * plan. Subscription status (usable vs entitled) is gated by callers before this
+ * runs — the predicate is tier-only.
  */
-function isInboxEntitledPlan(sub: { plan: string }): boolean {
-  return getPlanTierCredits(sub.plan) >= MAX_PLAN_CREDITS || checkEnterprisePlan(sub)
+function isInboxEntitledPlan(plan: string): boolean {
+  return getPlanTierCredits(plan) >= MAX_PLAN_CREDITS || isPlanEnterprise(plan)
 }
 
 /**
@@ -554,7 +556,7 @@ export async function hasWorkspaceInboxAccess(workspaceId: string): Promise<bool
     if (ws.organizationId) {
       if (await isOrganizationBillingBlocked(ws.organizationId)) return false
       const orgSub = await getOrganizationSubscriptionUsable(ws.organizationId)
-      return !!orgSub && isInboxEntitledPlan(orgSub)
+      return !!orgSub && isInboxEntitledPlan(orgSub.plan)
     }
 
     const [billedSub, billingStatus] = await Promise.all([
@@ -563,13 +565,48 @@ export async function hasWorkspaceInboxAccess(workspaceId: string): Promise<bool
     ])
     if (!billedSub) return false
     if (!hasUsableSubscriptionAccess(billedSub.status, billingStatus.billingBlocked)) return false
-    return isInboxEntitledPlan(billedSub)
+    return isInboxEntitledPlan(billedSub.plan)
   } catch (error) {
     logger.error('Error checking workspace inbox access', { error, workspaceId })
     return false
   }
 }
 
+/**
+ * Whether a workspace should RETAIN its provisioned inbox (Sim Mailer)
+ * infrastructure. Unlike {@link hasWorkspaceInboxAccess}, which gates active use
+ * on a *usable* (active) subscription, this uses the broader *entitled* status
+ * set (active OR `past_due`) so a transient payment failure never triggers the
+ * destructive teardown of a paying customer's inbox.
+ *
+ * Reconciliation should delete AgentMail resources only when this returns
+ * `false` — i.e. the plan is genuinely terminal (canceled, downgraded off
+ * Max/Enterprise, or gone). Fails open (returns `true`) on any error or
+ * ambiguity: never tear down on uncertainty.
+ */
+export async function hasWorkspaceInboxGraceAccess(workspaceId: string): Promise<boolean> {
+  try {
+    if (isInboxEnabled) return true
+    if (!isBillingEnabled) return true
+
+    const { getWorkspaceWithOwner } = await import('@/lib/workspaces/permissions/utils')
+    const ws = await getWorkspaceWithOwner(workspaceId, { includeArchived: true })
+    if (!ws) return true
+
+    if (ws.organizationId) {
+      const { getOrganizationSubscription } = await import('@/lib/billing/core/billing')
+      const orgSub = await getOrganizationSubscription(ws.organizationId)
+      return !!orgSub && isInboxEntitledPlan(orgSub.plan)
+    }
+
+    const billedSub = await getHighestPrioritySubscription(ws.billedAccountUserId)
+    return !!billedSub && isInboxEntitledPlan(billedSub.plan)
+  } catch (error) {
+    logger.error('Error checking workspace inbox grace access', { error, workspaceId })
+    return true
+  }
+}
+
 /**
  * Check if user has access to live sync (every 5 minutes) for KB connectors
  * Returns true if:

apps/sim/lib/mothership/inbox/types.ts

@@ -2,7 +2,11 @@ import type { mothershipInboxTask } from '@sim/db'
 
 export type InboxTask = typeof mothershipInboxTask.$inferSelect
 export type InboxTaskStatus = 'received' | 'processing' | 'completed' | 'failed' | 'rejected'
-export type RejectionReason = 'sender_not_allowed' | 'automated_sender' | 'rate_limit_exceeded'
+export type RejectionReason =
+  | 'sender_not_allowed'
+  | 'automated_sender'
+  | 'rate_limit_exceeded'
+  | 'not_entitled'
 
 export interface InboxConfig {
   enabled: boolean

helm/sim/values.yaml

@@ -1276,6 +1276,18 @@ cronjobs:
       successfulJobsHistoryLimit: 3
       failedJobsHistoryLimit: 1
 
+    # Releases AgentMail inbox + webhook for workspaces whose Sim Mailer plan
+    # lapsed (canceled/downgraded off Max/Enterprise). Tolerates past_due, so a
+    # transient payment failure never tears down a paying customer's inbox.
+    reconcileInboxEntitlement:
+      enabled: true
+      name: reconcile-inbox-entitlement
+      schedule: "0 3 * * *"
+      path: "/api/cron/reconcile-inbox-entitlement"
+      concurrencyPolicy: Forbid
+      successfulJobsHistoryLimit: 3
+      failedJobsHistoryLimit: 1
+
     workspaceEventsPoll:
       enabled: true
       name: workspace-events-poll

scripts/check-api-validation-contracts.ts

@@ -9,8 +9,8 @@ const QUERY_HOOKS_DIR = path.join(ROOT, 'apps/sim/hooks/queries')
 const SELECTOR_HOOKS_DIR = path.join(ROOT, 'apps/sim/hooks/selectors')
 
 const BASELINE = {
-  totalRoutes: 873,
-  zodRoutes: 873,
+  totalRoutes: 874,
+  zodRoutes: 874,
   nonZodRoutes: 0,
 } as const
 
@@ -65,6 +65,7 @@ const INDIRECT_ZOD_ROUTES = new Set([
   'apps/sim/app/api/cron/cleanup-stale-executions/route.ts',
   'apps/sim/app/api/cron/renew-subscriptions/route.ts',
   'apps/sim/app/api/cron/reconcile-billing-seats/route.ts',
+  'apps/sim/app/api/cron/reconcile-inbox-entitlement/route.ts',
   'apps/sim/app/api/cron/run-data-drains/route.ts',
   'apps/sim/app/api/logs/cleanup/route.ts',
   'apps/sim/app/api/knowledge/connectors/sync/route.ts',