fix(mailer): permissions entitlements for enabling/disabling by icecrasher321 · Pull Request #5312 · simstudioai/sim

icecrasher321 · 2026-07-01T03:41:38Z

Summary

Workspace admins should be able to enable/disable inboxes. AgentMail infra teardown on subscription deletion.

Type of Change

Bug fix

Testing

Tested manually

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…ership workflow edits via sockets, ui improvements

…hog upgrade

…lama fix

…ng improvements, posthog, secrets mutations

…ration, signup method feature flags, SSO improvements

* feat(posthog): Add tracking on mothership abort (#4023) Co-authored-by: Theodore Li <theo@sim.ai> * fix(login): fix captcha headers for manual login (#4025) * fix(signup): fix turnstile key loading * fix(login): fix captcha header passing * Catch user already exists, remove login form captcha

…nts, secrets performance, polling refactors, drag resources in mothership

… enterprises

…ension

…y invalidation, HITL docs

…endar triggers, docs updates, integrations/models pages improvements

…ups ui

…ions, jira forms endpoints

…mat, logs performance improvements fix(csp): add missing analytics domains, remove unsafe-eval, fix workspace CSP gap (#4179) fix(landing): return 404 for invalid dynamic route slugs (#4182) improvement(seo): optimize sitemaps, robots.txt, and core web vitals across sim and docs (#4170) fix(gemini): support structured output with tools on Gemini 3 models (#4184) feat(brightdata): add Bright Data integration with 8 tools (#4183) fix(mothership): fix superagent credentials (#4185) fix(logs): close sidebar when selected log disappears from filtered list; cleanup (#4186)

v0.6.46: mothership streaming fixes, brightdata integration

…m integration, atlassian triggers

…ration, smooth streaming, security hardening, db fixes

…x, db migrations from ci, docs updates, read replicas v0.7.3: jira oauth scope fix, read-replica client, table wire data fix, db migrations from ci, docs updates, read replicas

…uting, trigger.dev, temporal, latex, quartr, brex, convex integrations

…rovements, styling consolidation

…, db perf improvements

…nges, code hygiene

…lassian assets and google calendar tools

…d, security fixes

…richment providers, deepseek models, db performance

…nce, file sharing, scheduled tasks granularity

…t harness, sakana fugu provider v0.7.13: pii redaction, react query frontend refactor, pi coding agent harness, sakana fugu provider

…ix, settings overhaul, thrive learning integration

…extension, workspace forking, slack trigger extension, new README

vercel · 2026-07-01T03:41:43Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 1, 2026 3:54am

cursor · 2026-07-01T03:41:48Z

PR Summary

Medium Risk
Touches billing gates, inbound webhooks, and destructive inbox teardown via cron; grace logic limits accidental teardown on past_due, but wrong entitlement checks could block paying workspaces or leave infra provisioned too long.

Overview
Sim Mailer (inbox) entitlement is now evaluated per workspace billing entity instead of the signed-in user, so org-backed workspaces and external admins can manage inboxes when the workspace’s org or billed account is on Max/Enterprise.

API & billing: hasInboxAccess(userId) is replaced by hasWorkspaceInboxAccess(workspaceId) (usable subscription) and hasWorkspaceInboxGraceAccess(workspaceId) (active or past_due, fails open for teardown). Inbox GET returns an entitled flag; PATCH allows disable without a plan but gates enable/address updates on workspace entitlement. AgentMail webhooks reject mail with not_entitled when the workspace no longer qualifies.

Ops: A new cron /api/cron/reconcile-inbox-entitlement (daily in Helm) disables AgentMail for workspaces still marked enabled after a terminal plan lapse.

UI: Settings use server entitled instead of client subscription checks; admins with a stale enabled inbox can still turn it off; sidebar “Max” lock for inbox follows workspace entitlement; rejected tasks show “Plan no longer includes Sim Mailer”.

^{Reviewed by Cursor Bugbot for commit 6c1175f. Configure here.}

greptile-apps · 2026-07-01T03:43:36Z

Greptile Summary

This PR moves Sim Mailer entitlement checks to workspace billing. The main changes are:

Workspace-based entitlement helpers for inbox access and teardown grace.
API and webhook checks that reject non-entitled inbox use.
UI updates that read the new entitled inbox config field.
A daily cron job to reclaim AgentMail resources after entitlement loss.

Confidence Score: 4/5

The personal-workspace entitlement path needs a fix before merging.

Personal workspaces can gain inbox access through unrelated organization memberships.
The cleanup cron can keep personal inbox infrastructure for the same reason.
The API, UI, webhook, and cron wiring otherwise follows the intended workspace-based flow.

apps/sim/lib/billing/core/subscription.ts

Security Review

Personal workspaces can inherit Sim Mailer entitlement from unrelated organization memberships because the new personal-workspace path uses the broad highest-priority subscription lookup.

Important Files Changed

Filename	Overview
apps/sim/lib/billing/core/subscription.ts	Adds workspace-scoped inbox entitlement helpers, but the personal-workspace branch can use unrelated organization subscriptions.
apps/sim/app/api/workspaces/[id]/inbox/route.ts	Returns entitlement in the inbox config and allows admins to disable an inbox after entitlement loss.
apps/sim/app/api/webhooks/agentmail/route.ts	Rejects inbound AgentMail messages when the workspace entitlement helper returns false.
apps/sim/app/api/cron/reconcile-inbox-entitlement/route.ts	Adds an authenticated cron route that disables enabled inboxes after grace entitlement is lost.
apps/sim/app/workspace/[workspaceId]/settings/components/inbox/inbox.tsx	Updates inbox settings rendering to use the config-level entitlement flag.
apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx	Locks the Inbox sidebar item based on inbox config entitlement instead of generic Max access.

_{Reviews (1): Last reviewed commit: "fix lifecycle for agentmail infra" | Re-trigger Greptile}

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6c1175f. Configure here.}

Resolve conflict in scripts/check-api-validation-contracts.ts: staging deleted the contact route (removed from allowlists) while this branch added the reconcile-inbox-entitlement cron. Net route count is unchanged at 881, so the baseline is set to 881 (both allowlist edits kept). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

waleedlatif1 and others added 30 commits April 3, 2026 23:30

v0.6.23: MCP fixes, remove local state in favor of server state, moth…

0b9019d

…ership workflow edits via sockets, ui improvements

v0.6.24: copilot feedback wiring, captcha fixes

a54dcbe

v0.6.25: cloudwatch, cloudformation, live kb sync, linear fixes, post…

28af223

…hog upgrade

v0.6.26: ui improvements, multiple response blocks, docx previews, ol…

d889f32

…lama fix

v0.6.27: new triggers, mothership improvements, files archive, queuei…

316bc8c

…ng improvements, posthog, secrets mutations

v0.6.28: new docs, delete confirmation standardization, dagster integ…

3f508e4

…ration, signup method feature flags, SSO improvements

v0.6.30: slack trigger enhancements, connectors performance improveme…

d7da35b

…nts, secrets performance, polling refactors, drag resources in mothership

v0.6.31: elevenlabs voice, trigger.dev fixes, cloud whitelabeling for…

cf233bb

… enterprises

v0.6.32: BYOK fixes, ui improvements, cloudwatch tools, jsm tools ext…

f8f3758

…ension

v0.6.33: polling improvements, jsm forms tools, credentials reactquer…

3c8bb40

…y invalidation, HITL docs

v0.6.34: trigger.dev fixes, CI speedup, atlassian error extractor

d33acf4

v0.6.35: additional jira fields, HITL docs, logs cleanup efficiency

4f40c4c

v0.6.36: new chunkers, sockets state machine, google sheets/drive/cal…

cbfab1c

…endar triggers, docs updates, integrations/models pages improvements

v0.6.37: audit logs page, isolated-vm worker rotation, permission gro…

4309d06

…ups ui

v0.6.38: models page

8b57476

v0.6.39: billing fixes, tools audit, landing fix

e3d0e74

v0.6.40: mothership tool loop, new skills, agiloft, STS, IAM integrat…

0ac0539

…ions, jira forms endpoints

v0.6.41: webhooks fix, workers removal

3838b6e

v0.6.42: mothership nested file reads, search modal improvements

fc07922

v0.6.43: mothership billing idempotency, env var resolution fixes

3a1b1a8

v0.6.44: streamdown, mothership intelligence, excel extension

46ffc49

Merge pull request #4190 from simstudioai/staging

c0bc62c

v0.6.46: mothership streaming fixes, brightdata integration

v0.6.46: mothership queueing, web vitals

387cc97

v0.6.47: files focusing, documentation, opus 4.7

2dbc7fd

v0.6.48: import csv into tables, subflow fixes, CSP updates

8a50f18

v0.6.49: deploy sockets event, resolver, logs improvements, monday.co…

dcf3302

…m integration, atlassian triggers

v0.6.50: ppt/doc/pdf worker isolation, docs, chat, sidebar improvements

bc09865

v0.6.51: tables improvements, billing fixes, 404 pages, code hygiene

5f56e46

waleedlatif1 and others added 19 commits June 10, 2026 13:20

v0.7.1: chat voice mode model update, sim trigger, codepipeline integ…

7ffc495

…ration, smooth streaming, security hardening, db fixes

v0.7.2: logs export security, code hygiene, mship cost attribution

d4722f9

v0.7.3: jira oauth scope fix, read-replica client, table wire data fi…

f4d22ff

…x, db migrations from ci, docs updates, read replicas v0.7.3: jira oauth scope fix, read-replica client, table wire data fix, db migrations from ci, docs updates, read replicas

v0.7.4: round-robin byok support, table block fix, db read replica ro…

a48b4a1

…uting, trigger.dev, temporal, latex, quartr, brex, convex integrations

v0.7.5: deployments API and block, vanta integration, performance imp…

79d98b3

…rovements, styling consolidation

v0.7.6: calendar scheduled tasks, new hubspot tools, virtualized chat…

e6587ca

…, db perf improvements

v0.7.7: square, context.dev integrations, scheduled tasks styling cha…

8c3706e

…nges, code hygiene

v0.7.8: security hardening, code hygiene, MSFT oauth provider, new at…

59d9496

…lassian assets and google calendar tools

v0.7.9: agent file attachments, chat autoscroll, knowledge base uploa…

56a88a2

…d, security fixes

v0.7.10: models sorting, compress/decompress file block tools, new en…

db47da5

…richment providers, deepseek models, db performance

v0.7.11: parallel subagents, new tools, rich markdown editor, governa…

8df34a3

…nce, file sharing, scheduled tasks granularity

v0.7.12: mcp servers ui/ux fixes, nuqs for query param management

aaca750

v0.7.13: pii redaction, react query frontend refactor, pi coding agen…

ad0b867

…t harness, sakana fugu provider v0.7.13: pii redaction, react query frontend refactor, pi coding agent harness, sakana fugu provider

v0.7.14: perf improvements, code hygiene, GitLab private host support

11168f9

v0.7.15: academy, perf improvements, db attribution, kb tags filter f…

613e8ea

…ix, settings overhaul, thrive learning integration

v0.7.16: security hardening, db o11y and profiling, settings UI

38c088a

v0.7.17: emcn and workflow renderer isolated package, popular blocks …

0371856

…extension, workspace forking, slack trigger extension, new README

fix(mailer): permissions entitlements for enabling/disabling

8205b38

fix lifecycle for agentmail infra

6c1175f

greptile-apps Bot reviewed Jul 1, 2026

View reviewed changes

Comment thread apps/sim/lib/billing/core/subscription.ts

Comment thread apps/sim/lib/billing/core/subscription.ts

cursor Bot reviewed Jul 1, 2026

View reviewed changes

Comment thread apps/sim/app/api/workspaces/[id]/inbox/route.ts

Comment thread apps/sim/app/api/webhooks/agentmail/route.ts

vercel Bot deployed to Preview July 1, 2026 03:46 View deployment

vercel Bot deployed to Preview July 1, 2026 03:54 View deployment

icecrasher321 merged commit ca34301 into staging Jul 1, 2026
15 checks passed

icecrasher321 deleted the make-badge-workspace-scoped branch July 1, 2026 04:23

icecrasher321 mentioned this pull request Jul 1, 2026

v0.7.18: landing, tools depth, media embeds in md editor, sonnet 5 #5296

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(mailer): permissions entitlements for enabling/disabling#5312

fix(mailer): permissions entitlements for enabling/disabling#5312
icecrasher321 merged 108 commits into
stagingfrom
make-badge-workspace-scoped

icecrasher321 commented Jul 1, 2026

Uh oh!

vercel Bot commented Jul 1, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Jul 1, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Jul 1, 2026

Security Review

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

icecrasher321 commented Jul 1, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Jul 1, 2026

Greptile Summary

Confidence Score: 4/5

Security Review

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

vercel Bot commented Jul 1, 2026 •

edited

Loading

cursor Bot commented Jul 1, 2026 •

edited

Loading