chore: import upstream snapshot with attribution

apps/sim/lib/auth/credential-access.ts

@@ -0,0 +1,295 @@
+import { db } from '@sim/db'
+import { account, credential, credentialMember, workflow as workflowTable } from '@sim/db/schema'
+import { and, eq } from 'drizzle-orm'
+import type { NextRequest } from 'next/server'
+import { AuthType, checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+
+export interface CredentialAccessResult {
+  ok: boolean
+  error?: string
+  authType?: typeof AuthType.SESSION | typeof AuthType.INTERNAL_JWT
+  requesterUserId?: string
+  credentialOwnerUserId?: string
+  workspaceId?: string
+  resolvedCredentialId?: string
+  credentialType?: 'oauth' | 'service_account'
+}
+
+/**
+ * Centralizes auth + credential membership checks for OAuth usage.
+ * - Workspace-scoped credential IDs enforce active credential_member access.
+ * - Legacy account IDs are resolved to workspace-scoped credentials when workflowId is provided.
+ * - Direct legacy account-ID access without workflowId is restricted to account owners only.
+ */
+export async function authorizeCredentialUse(
+  request: NextRequest,
+  params: {
+    credentialId: string
+    workflowId?: string
+    requireWorkflowIdForInternal?: boolean
+    callerUserId?: string
+  }
+): Promise<CredentialAccessResult> {
+  const { credentialId, workflowId, requireWorkflowIdForInternal = true, callerUserId } = params
+
+  const auth = await checkSessionOrInternalAuth(request, {
+    requireWorkflowId: requireWorkflowIdForInternal,
+  })
+  if (!auth.success || !auth.userId) {
+    return { ok: false, error: auth.error || 'Authentication required' }
+  }
+
+  if (
+    auth.authType === AuthType.INTERNAL_JWT &&
+    callerUserId !== undefined &&
+    callerUserId !== auth.userId
+  ) {
+    return { ok: false, error: 'Caller user does not match internal token subject' }
+  }
+
+  const actingUserId = auth.userId
+
+  const [workflowContext] = workflowId
+    ? await db
+        .select({ workspaceId: workflowTable.workspaceId })
+        .from(workflowTable)
+        .where(eq(workflowTable.id, workflowId))
+        .limit(1)
+    : [null]
+
+  if (workflowId && (!workflowContext || !workflowContext.workspaceId)) {
+    return { ok: false, error: 'Workflow not found' }
+  }
+
+  const [platformCredential] = await db
+    .select({
+      id: credential.id,
+      workspaceId: credential.workspaceId,
+      type: credential.type,
+      accountId: credential.accountId,
+    })
+    .from(credential)
+    .where(eq(credential.id, credentialId))
+    .limit(1)
+
+  if (platformCredential) {
+    if (platformCredential.type === 'service_account') {
+      if (workflowContext && workflowContext.workspaceId !== platformCredential.workspaceId) {
+        return { ok: false, error: 'Credential is not accessible from this workflow workspace' }
+      }
+
+      const requesterPerm = await getUserEntityPermissions(
+        actingUserId,
+        'workspace',
+        platformCredential.workspaceId
+      )
+
+      const [membership] = await db
+        .select({ id: credentialMember.id })
+        .from(credentialMember)
+        .where(
+          and(
+            eq(credentialMember.credentialId, platformCredential.id),
+            eq(credentialMember.userId, actingUserId),
+            eq(credentialMember.status, 'active')
+          )
+        )
+        .limit(1)
+
+      if (requesterPerm === null) {
+        return { ok: false, error: 'You do not have access to this workspace.' }
+      }
+      if (!membership && requesterPerm !== 'admin') {
+        return {
+          ok: false,
+          error:
+            'You do not have access to this credential. Ask the credential admin to add you as a member.',
+        }
+      }
+
+      return {
+        ok: true,
+        authType: auth.authType as CredentialAccessResult['authType'],
+        requesterUserId: auth.userId,
+        credentialOwnerUserId: actingUserId,
+        workspaceId: platformCredential.workspaceId,
+        resolvedCredentialId: platformCredential.id,
+        credentialType: 'service_account',
+      }
+    }
+
+    if (platformCredential.type !== 'oauth' || !platformCredential.accountId) {
+      return { ok: false, error: 'Unsupported credential type for OAuth access' }
+    }
+
+    if (workflowContext && workflowContext.workspaceId !== platformCredential.workspaceId) {
+      return { ok: false, error: 'Credential is not accessible from this workflow workspace' }
+    }
+
+    const [accountRow] = await db
+      .select({ userId: account.userId })
+      .from(account)
+      .where(eq(account.id, platformCredential.accountId))
+      .limit(1)
+
+    if (!accountRow) {
+      return { ok: false, error: 'Credential account not found' }
+    }
+
+    const requesterPerm = await getUserEntityPermissions(
+      actingUserId,
+      'workspace',
+      platformCredential.workspaceId
+    )
+
+    const [membership] = await db
+      .select({ id: credentialMember.id })
+      .from(credentialMember)
+      .where(
+        and(
+          eq(credentialMember.credentialId, platformCredential.id),
+          eq(credentialMember.userId, actingUserId),
+          eq(credentialMember.status, 'active')
+        )
+      )
+      .limit(1)
+
+    if (requesterPerm === null) {
+      return {
+        ok: false,
+        error: 'You do not have access to this workspace.',
+      }
+    }
+    if (!membership && requesterPerm !== 'admin') {
+      return {
+        ok: false,
+        error: `You do not have access to this credential. Ask the credential admin to add you as a member.`,
+      }
+    }
+
+    const ownerPerm = await getUserEntityPermissions(
+      accountRow.userId,
+      'workspace',
+      platformCredential.workspaceId
+    )
+    if (ownerPerm === null) {
+      return { ok: false, error: 'Unauthorized' }
+    }
+
+    return {
+      ok: true,
+      authType: auth.authType as CredentialAccessResult['authType'],
+      requesterUserId: auth.userId,
+      credentialOwnerUserId: accountRow.userId,
+      workspaceId: platformCredential.workspaceId,
+      resolvedCredentialId: platformCredential.accountId,
+      credentialType: 'oauth',
+    }
+  }
+
+  if (workflowContext?.workspaceId) {
+    const [workspaceCredential] = await db
+      .select({
+        id: credential.id,
+        workspaceId: credential.workspaceId,
+        accountId: credential.accountId,
+      })
+      .from(credential)
+      .where(
+        and(
+          eq(credential.type, 'oauth'),
+          eq(credential.workspaceId, workflowContext.workspaceId),
+          eq(credential.accountId, credentialId)
+        )
+      )
+      .limit(1)
+
+    if (!workspaceCredential?.accountId) {
+      return { ok: false, error: 'Credential not found' }
+    }
+
+    const [accountRow] = await db
+      .select({ userId: account.userId })
+      .from(account)
+      .where(eq(account.id, workspaceCredential.accountId))
+      .limit(1)
+
+    if (!accountRow) {
+      return { ok: false, error: 'Credential account not found' }
+    }
+
+    const [membership] = await db
+      .select({ id: credentialMember.id })
+      .from(credentialMember)
+      .where(
+        and(
+          eq(credentialMember.credentialId, workspaceCredential.id),
+          eq(credentialMember.userId, actingUserId),
+          eq(credentialMember.status, 'active')
+        )
+      )
+      .limit(1)
+
+    if (!membership) {
+      const requesterPerm = await getUserEntityPermissions(
+        actingUserId,
+        'workspace',
+        workflowContext.workspaceId
+      )
+      if (requesterPerm !== 'admin') {
+        return {
+          ok: false,
+          error:
+            'You do not have access to this credential. Ask the credential admin to add you as a member.',
+        }
+      }
+    }
+
+    const ownerPerm = await getUserEntityPermissions(
+      accountRow.userId,
+      'workspace',
+      workflowContext.workspaceId
+    )
+    if (ownerPerm === null) {
+      return { ok: false, error: 'Unauthorized' }
+    }
+
+    return {
+      ok: true,
+      authType: auth.authType as CredentialAccessResult['authType'],
+      requesterUserId: auth.userId,
+      credentialOwnerUserId: accountRow.userId,
+      workspaceId: workflowContext.workspaceId,
+      resolvedCredentialId: workspaceCredential.accountId,
+      credentialType: 'oauth',
+    }
+  }
+
+  const [legacyAccount] = await db
+    .select({ userId: account.userId })
+    .from(account)
+    .where(eq(account.id, credentialId))
+    .limit(1)
+
+  if (!legacyAccount) {
+    return { ok: false, error: 'Credential not found' }
+  }
+
+  if (auth.authType === AuthType.INTERNAL_JWT) {
+    return { ok: false, error: 'workflowId is required' }
+  }
+
+  if (auth.userId !== legacyAccount.userId) {
+    return { ok: false, error: 'Unauthorized' }
+  }
+
+  return {
+    ok: true,
+    authType: auth.authType as CredentialAccessResult['authType'],
+    requesterUserId: auth.userId,
+    credentialOwnerUserId: legacyAccount.userId,
+    resolvedCredentialId: credentialId,
+    credentialType: 'oauth',
+  }
+}