chore: import upstream snapshot with attribution

apps/sim/app/api/v1/workflows/utils.ts

@@ -0,0 +1,39 @@
+import { type ActiveWorkflowRecord, getActiveWorkflowRecord } from '@sim/platform-authz/workflow'
+import { NextResponse } from 'next/server'
+import { type RateLimitResult, validateWorkspaceAccess } from '@/app/api/v1/middleware'
+
+function workflowNotFoundResponse(): NextResponse {
+  return NextResponse.json({ error: 'Workflow not found' }, { status: 404 })
+}
+
+/**
+ * Resolves the target workflow for a v1 deployment mutation: loads the active
+ * record and verifies the caller's admin permission on its workspace. Access
+ * failures are masked as 404, matching the v1 workflow read surface so
+ * unauthorized callers cannot probe workflow existence.
+ */
+export async function resolveV1DeploymentWorkflow(
+  rateLimit: RateLimitResult,
+  userId: string,
+  workflowId: string
+): Promise<
+  | { ok: true; workflow: ActiveWorkflowRecord; workspaceId: string }
+  | { ok: false; response: NextResponse }
+> {
+  const workflow = await getActiveWorkflowRecord(workflowId)
+  if (!workflow?.workspaceId) {
+    return { ok: false, response: workflowNotFoundResponse() }
+  }
+
+  const accessError = await validateWorkspaceAccess(
+    rateLimit,
+    userId,
+    workflow.workspaceId,
+    'admin'
+  )
+  if (accessError) {
+    return { ok: false, response: workflowNotFoundResponse() }
+  }
+
+  return { ok: true, workflow, workspaceId: workflow.workspaceId }
+}