diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx
index c2d9284665c..c9ca98d100c 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx
@@ -23,6 +23,7 @@ import { SidebarTooltip } from '@/app/workspace/[workspaceId]/w/components/sideb
import { useSSOProviders } from '@/ee/sso/hooks/sso'
import { prefetchWorkspaceCredentials } from '@/hooks/queries/credentials'
import { prefetchGeneralSettings, useGeneralSettings } from '@/hooks/queries/general-settings'
+import { useInboxConfig } from '@/hooks/queries/inbox'
import { useOrganizations } from '@/hooks/queries/organization'
import { prefetchSubscriptionData, useSubscriptionData } from '@/hooks/queries/subscription'
import { usePermissionConfig } from '@/hooks/use-permission-config'
@@ -63,6 +64,7 @@ export function SettingsSidebar({
enabled: isBillingEnabled,
staleTime: 5 * 60 * 1000,
})
+ const { data: inboxConfig } = useInboxConfig(workspaceId)
const { data: ssoProvidersData, isLoading: isLoadingSSO } = useSSOProviders({
enabled: !isHosted,
})
@@ -78,6 +80,7 @@ export function SettingsSidebar({
const isAdmin = userRole === 'admin'
const isOrgAdminOrOwner = isOwner || isAdmin
const subscriptionAccess = getSubscriptionAccessState(subscriptionData?.data)
+ const inboxEntitled = inboxConfig?.entitled ?? false
const hasTeamPlan = subscriptionAccess.hasUsableTeamAccess
const hasEnterprisePlan = subscriptionAccess.hasUsableEnterpriseAccess
const isEnterprisePlan = isEnterprise(subscriptionData?.data?.plan)
@@ -296,7 +299,11 @@ export function SettingsSidebar({
{sectionItems.map((item) => {
const Icon = item.icon
const active = activeSection === item.id
- const isLocked = item.requiresMax && !subscriptionAccess.hasUsableMaxAccess
+ const isLocked =
+ item.requiresMax &&
+ (item.id === 'inbox'
+ ? !inboxEntitled
+ : !subscriptionAccess.hasUsableMaxAccess)
const itemClassName = chipVariants({ active, fullWidth: true })
const content = (
<>
diff --git a/apps/sim/lib/api/contracts/inbox.ts b/apps/sim/lib/api/contracts/inbox.ts
index c24304a5eae..34152f3346b 100644
--- a/apps/sim/lib/api/contracts/inbox.ts
+++ b/apps/sim/lib/api/contracts/inbox.ts
@@ -17,6 +17,7 @@ export const inboxTaskStatusSchema = z.enum([
export const inboxConfigSchema = z.object({
enabled: z.boolean(),
address: z.string().nullable(),
+ entitled: z.boolean(),
taskStats: z.object({
total: z.number(),
completed: z.number(),
diff --git a/apps/sim/lib/billing/core/subscription.ts b/apps/sim/lib/billing/core/subscription.ts
index 6829a773e0a..5084ce91081 100644
--- a/apps/sim/lib/billing/core/subscription.ts
+++ b/apps/sim/lib/billing/core/subscription.ts
@@ -10,6 +10,7 @@ import {
} from '@/lib/billing/core/plan'
import {
getPlanTierCredits,
+ isEnterprise as isPlanEnterprise,
isPro as isPlanPro,
isTeam as isPlanTeam,
} from '@/lib/billing/plan-helpers'
@@ -518,34 +519,94 @@ export async function isWorkspaceOnEnterprisePlan(workspaceId: string): Promise<
}
}
+const MAX_PLAN_CREDITS = 25000
+
+/**
+ * Whether a plan tier entitles the inbox (Sim Mailer) feature: a Max tier
+ * (credits >= 25000, covering `pro_25000` and `team_25000`) or any enterprise
+ * plan. Subscription status (usable vs entitled) is gated by callers before this
+ * runs — the predicate is tier-only.
+ */
+function isInboxEntitledPlan(plan: string): boolean {
+ return getPlanTierCredits(plan) >= MAX_PLAN_CREDITS || isPlanEnterprise(plan)
+}
+
/**
- * Check if user has access to inbox (Sim Mailer) feature
+ * Check whether a workspace is entitled to the inbox (Sim Mailer) feature.
+ * Entitlement follows the workspace's billing entity — not the acting user — so
+ * any workspace admin (including an external member) can manage the inbox when
+ * the workspace's organization, or its billed account for personal workspaces,
+ * is on a Max or enterprise plan.
+ *
* Returns true if:
- * - INBOX_ENABLED env var is set, OR
- * - Non-production environment, OR
- * - User has a Max plan (credits >= 25000) or enterprise plan
+ * - INBOX_ENABLED env var is set (self-hosted override), OR
+ * - billing is disabled, OR
+ * - the workspace belongs to an organization on a Max/enterprise plan (org-mode), OR
+ * - the billed user has an individual Max/enterprise subscription (personal workspace).
*/
-export async function hasInboxAccess(userId: string): Promise {
+export async function hasWorkspaceInboxAccess(workspaceId: string): Promise {
try {
- if (isInboxEnabled) {
- return true
- }
- if (!isBillingEnabled) {
- return true
+ if (isInboxEnabled) return true
+ if (!isBillingEnabled) return true
+
+ const { getWorkspaceWithOwner } = await import('@/lib/workspaces/permissions/utils')
+ const ws = await getWorkspaceWithOwner(workspaceId, { includeArchived: true })
+ if (!ws) return false
+
+ if (ws.organizationId) {
+ if (await isOrganizationBillingBlocked(ws.organizationId)) return false
+ const orgSub = await getOrganizationSubscriptionUsable(ws.organizationId)
+ return !!orgSub && isInboxEntitledPlan(orgSub.plan)
}
- const [sub, billingStatus] = await Promise.all([
- getHighestPrioritySubscription(userId),
- getEffectiveBillingStatus(userId),
+
+ const [billedSub, billingStatus] = await Promise.all([
+ getHighestPrioritySubscription(ws.billedAccountUserId),
+ getEffectiveBillingStatus(ws.billedAccountUserId),
])
- if (!sub) return false
- if (!hasUsableSubscriptionAccess(sub.status, billingStatus.billingBlocked)) return false
- return getPlanTierCredits(sub.plan) >= 25000 || checkEnterprisePlan(sub)
+ if (!billedSub) return false
+ if (!hasUsableSubscriptionAccess(billedSub.status, billingStatus.billingBlocked)) return false
+ return isInboxEntitledPlan(billedSub.plan)
} catch (error) {
- logger.error('Error checking inbox access', { error, userId })
+ logger.error('Error checking workspace inbox access', { error, workspaceId })
return false
}
}
+/**
+ * Whether a workspace should RETAIN its provisioned inbox (Sim Mailer)
+ * infrastructure. Unlike {@link hasWorkspaceInboxAccess}, which gates active use
+ * on a *usable* (active) subscription, this uses the broader *entitled* status
+ * set (active OR `past_due`) so a transient payment failure never triggers the
+ * destructive teardown of a paying customer's inbox.
+ *
+ * Reconciliation should delete AgentMail resources only when this returns
+ * `false` — i.e. the plan is genuinely terminal (canceled, downgraded off
+ * Max/Enterprise, or gone). Fails open (returns `true`) on any error or
+ * ambiguity: never tear down on uncertainty.
+ */
+export async function hasWorkspaceInboxGraceAccess(workspaceId: string): Promise {
+ try {
+ if (isInboxEnabled) return true
+ if (!isBillingEnabled) return true
+
+ const { getWorkspaceWithOwner } = await import('@/lib/workspaces/permissions/utils')
+ const ws = await getWorkspaceWithOwner(workspaceId, { includeArchived: true })
+ if (!ws) return true
+
+ if (ws.organizationId) {
+ const { getOrganizationSubscription } = await import('@/lib/billing/core/billing')
+ const orgSub = await getOrganizationSubscription(ws.organizationId)
+ return !!orgSub && isInboxEntitledPlan(orgSub.plan)
+ }
+
+ const billedSub = await getHighestPrioritySubscription(ws.billedAccountUserId)
+ return !!billedSub && isInboxEntitledPlan(billedSub.plan)
+ } catch (error) {
+ logger.error('Error checking workspace inbox grace access', { error, workspaceId })
+ return true
+ }
+}
+
/**
* Check if user has access to live sync (every 5 minutes) for KB connectors
* Returns true if:
diff --git a/apps/sim/lib/mothership/inbox/types.ts b/apps/sim/lib/mothership/inbox/types.ts
index 764fa01a56e..02fab8a1e9a 100644
--- a/apps/sim/lib/mothership/inbox/types.ts
+++ b/apps/sim/lib/mothership/inbox/types.ts
@@ -2,7 +2,11 @@ import type { mothershipInboxTask } from '@sim/db'
export type InboxTask = typeof mothershipInboxTask.$inferSelect
export type InboxTaskStatus = 'received' | 'processing' | 'completed' | 'failed' | 'rejected'
-export type RejectionReason = 'sender_not_allowed' | 'automated_sender' | 'rate_limit_exceeded'
+export type RejectionReason =
+ | 'sender_not_allowed'
+ | 'automated_sender'
+ | 'rate_limit_exceeded'
+ | 'not_entitled'
export interface InboxConfig {
enabled: boolean
diff --git a/helm/sim/values.yaml b/helm/sim/values.yaml
index 4ddbd5bc28b..30096678aac 100644
--- a/helm/sim/values.yaml
+++ b/helm/sim/values.yaml
@@ -1276,6 +1276,18 @@ cronjobs:
successfulJobsHistoryLimit: 3
failedJobsHistoryLimit: 1
+ # Releases AgentMail inbox + webhook for workspaces whose Sim Mailer plan
+ # lapsed (canceled/downgraded off Max/Enterprise). Tolerates past_due, so a
+ # transient payment failure never tears down a paying customer's inbox.
+ reconcileInboxEntitlement:
+ enabled: true
+ name: reconcile-inbox-entitlement
+ schedule: "0 3 * * *"
+ path: "/api/cron/reconcile-inbox-entitlement"
+ concurrencyPolicy: Forbid
+ successfulJobsHistoryLimit: 3
+ failedJobsHistoryLimit: 1
+
workspaceEventsPoll:
enabled: true
name: workspace-events-poll
diff --git a/scripts/check-api-validation-contracts.ts b/scripts/check-api-validation-contracts.ts
index 66f820ff3c6..987f7f578de 100644
--- a/scripts/check-api-validation-contracts.ts
+++ b/scripts/check-api-validation-contracts.ts
@@ -64,6 +64,7 @@ const INDIRECT_ZOD_ROUTES = new Set([
'apps/sim/app/api/cron/cleanup-stale-executions/route.ts',
'apps/sim/app/api/cron/renew-subscriptions/route.ts',
'apps/sim/app/api/cron/reconcile-billing-seats/route.ts',
+ 'apps/sim/app/api/cron/reconcile-inbox-entitlement/route.ts',
'apps/sim/app/api/cron/run-data-drains/route.ts',
'apps/sim/app/api/logs/cleanup/route.ts',
'apps/sim/app/api/knowledge/connectors/sync/route.ts',