fix(mailer): permissions entitlements for enabling/disabling

[icecrasher321]

Summary

Workspace admins should be able to enable/disable inboxes. AgentMail infra teardown on subscription deletion.

Type of Change

• Bug fix

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 1, 2026 3:54am

[cursor]

PR Summary

Medium Risk
Touches billing gates, inbound webhooks, and destructive inbox teardown via cron; grace logic limits accidental teardown on past_due, but wrong entitlement checks could block paying workspaces or leave infra provisioned too long.

Overview
Sim Mailer (inbox) entitlement is now evaluated per workspace billing entity instead of the signed-in user, so org-backed workspaces and external admins can manage inboxes when the workspace’s org or billed account is on Max/Enterprise.

API & billing: hasInboxAccess(userId) is replaced by hasWorkspaceInboxAccess(workspaceId) (usable subscription) and hasWorkspaceInboxGraceAccess(workspaceId) (active or past_due, fails open for teardown). Inbox GET returns an entitled flag; PATCH allows disable without a plan but gates enable/address updates on workspace entitlement. AgentMail webhooks reject mail with not_entitled when the workspace no longer qualifies.

Ops: A new cron /api/cron/reconcile-inbox-entitlement (daily in Helm) disables AgentMail for workspaces still marked enabled after a terminal plan lapse.

UI: Settings use server entitled instead of client subscription checks; admins with a stale enabled inbox can still turn it off; sidebar “Max” lock for inbox follows workspace entitlement; rejected tasks show “Plan no longer includes Sim Mailer”.

^{Reviewed by Cursor Bugbot for commit 6c1175f. Configure here.}

[greptile-apps]

Greptile Summary

This PR moves Sim Mailer entitlement checks to workspace billing. The main changes are:

• Workspace-based entitlement helpers for inbox access and teardown grace.
• API and webhook checks that reject non-entitled inbox use.
• UI updates that read the new entitled inbox config field.
• A daily cron job to reclaim AgentMail resources after entitlement loss.

Confidence Score: 4/5

The personal-workspace entitlement path needs a fix before merging.

• Personal workspaces can gain inbox access through unrelated organization memberships.
• The cleanup cron can keep personal inbox infrastructure for the same reason.
• The API, UI, webhook, and cron wiring otherwise follows the intended workspace-based flow.

apps/sim/lib/billing/core/subscription.ts

Security Review

Personal workspaces can inherit Sim Mailer entitlement from unrelated organization memberships because the new personal-workspace path uses the broad highest-priority subscription lookup.

Important Files Changed

Filename	Overview
apps/sim/lib/billing/core/subscription.ts	Adds workspace-scoped inbox entitlement helpers, but the personal-workspace branch can use unrelated organization subscriptions.
apps/sim/app/api/workspaces/[id]/inbox/route.ts	Returns entitlement in the inbox config and allows admins to disable an inbox after entitlement loss.
apps/sim/app/api/webhooks/agentmail/route.ts	Rejects inbound AgentMail messages when the workspace entitlement helper returns false.
apps/sim/app/api/cron/reconcile-inbox-entitlement/route.ts	Adds an authenticated cron route that disables enabled inboxes after grace entitlement is lost.
apps/sim/app/workspace/[workspaceId]/settings/components/inbox/inbox.tsx	Updates inbox settings rendering to use the config-level entitlement flag.
apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx	Locks the Inbox sidebar item based on inbox config entitlement instead of generic Max access.

_{Reviews (1): Last reviewed commit: "fix lifecycle for agentmail infra" | Re-trigger Greptile}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6c1175f. Configure here.}