make it workspace admin level

Author: icecrasher321

apps/sim/app/api/workspaces/[id]/fork/lineage/route.ts

@@ -7,7 +7,7 @@ import { getForkLineageContract } from '@/lib/api/contracts/workspace-fork'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { assertWorkspaceReadAccess } from '@/lib/workspaces/fork/lineage/authz'
+import { assertWorkspaceAdminAccess } from '@/lib/workspaces/fork/lineage/authz'
 import { getForkLineage } from '@/lib/workspaces/fork/lineage/lineage'
 import { getUndoableRunForTarget } from '@/lib/workspaces/fork/promote/promote-run-store'
 
@@ -22,7 +22,7 @@ export const GET = withRouteHandler(
     if (!parsed.success) return parsed.response
     const { id: workspaceId } = parsed.data.params
 
-    await assertWorkspaceReadAccess(workspaceId, session.user.id)
+    await assertWorkspaceAdminAccess(workspaceId, session.user.id)
 
     const [{ parent, children }, run] = await Promise.all([
       getForkLineage(workspaceId),

apps/sim/app/api/workspaces/[id]/fork/resources/route.ts

@@ -4,7 +4,7 @@ import { getForkResourcesContract } from '@/lib/api/contracts/workspace-fork'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { assertWorkspaceReadAccess } from '@/lib/workspaces/fork/lineage/authz'
+import { assertWorkspaceAdminAccess } from '@/lib/workspaces/fork/lineage/authz'
 import { listForkCopyableResources } from '@/lib/workspaces/fork/mapping/resources'
 
 export const GET = withRouteHandler(
@@ -18,7 +18,7 @@ export const GET = withRouteHandler(
     if (!parsed.success) return parsed.response
     const { id } = parsed.data.params
 
-    await assertWorkspaceReadAccess(id, session.user.id)
+    await assertWorkspaceAdminAccess(id, session.user.id)
 
     const resources = await listForkCopyableResources(db, id)
     return NextResponse.json(resources)

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/use-forking-available.ts

@@ -1,18 +1,28 @@
-import { isEnterprise } from '@/lib/billing/plan-helpers'
+import { getSubscriptionAccessState } from '@/lib/billing/client'
 import { getEnv, isTruthy } from '@/lib/core/config/env'
-import { useSubscriptionData } from '@/hooks/queries/subscription'
+import { useWorkspaceOwnerBilling } from '@/hooks/queries/workspace'
 
 const isBillingEnabledClient = isTruthy(getEnv('NEXT_PUBLIC_BILLING_ENABLED'))
 const isForkingEnabledClient = isTruthy(getEnv('NEXT_PUBLIC_FORKING_ENABLED'))
 
 /**
- * Client mirror of the server fork EE gate (`assertForkingEnabled`): the
- * Enterprise plan on Sim Cloud, or the `NEXT_PUBLIC_FORKING_ENABLED` override on
- * self-hosted. Used to hide the fork UI (and skip the lineage query) for
- * workspaces that cannot fork. The server gate remains the security boundary.
+ * Client mirror of the server fork EE gate (`assertForkingEnabled`): on Sim Cloud
+ * the active workspace's billed account (its owner's rolled-up plan) must be
+ * Enterprise; on self-hosted it's the `NEXT_PUBLIC_FORKING_ENABLED` override. Used
+ * to hide the fork UI (and skip the lineage query) for workspaces that cannot fork.
+ *
+ * Gating on the WORKSPACE's plan (not the viewer's) is what matches the server,
+ * which checks the workspace org's plan: a viewer who belongs to a different
+ * Enterprise org no longer sees fork UI on a non-Enterprise workspace, and a
+ * member of an Enterprise workspace isn't denied it just because their own
+ * highest plan is lower. The server gate remains the security boundary.
+ *
+ * Self-hosted relies on `NEXT_PUBLIC_FORKING_ENABLED` / `NEXT_PUBLIC_BILLING_ENABLED`
+ * mirroring the server's `FORKING_ENABLED` / `BILLING_ENABLED`; set each pair
+ * together or the UI and API will disagree.
  */
-export function useForkingAvailable(): boolean {
-  const { data } = useSubscriptionData()
+export function useForkingAvailable(workspaceId?: string): boolean {
+  const { data } = useWorkspaceOwnerBilling(isBillingEnabledClient ? workspaceId : undefined)
   if (!isBillingEnabledClient) return isForkingEnabledClient
-  return isEnterprise(data?.data?.plan)
+  return getSubscriptionAccessState(data).hasUsableEnterpriseAccess
 }

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.tsx

@@ -19,6 +19,7 @@ import {
 } from '@/components/emcn'
 import { ManageWorkspace, PanelLeft, Rocket, Shuffle } from '@/components/emcn/icons'
 import { cn } from '@/lib/core/utils/cn'
+import { useUserPermissionsContext } from '@/app/workspace/[workspaceId]/providers/workspace-permissions-provider'
 import { isBillingEnabled } from '@/app/workspace/[workspaceId]/settings/navigation'
 import { ContextMenu } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/context-menu/context-menu'
 import { DeleteModal } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/delete-modal/delete-modal'
@@ -128,8 +129,14 @@ function WorkspaceHeaderImpl({
   }, [])
 
   const { navigateToSettings } = useSettingsNavigation()
-  const forkingAvailable = useForkingAvailable()
-  const { data: forkLineage } = useForkLineage(workspaceId, forkingAvailable)
+  const forkingAvailable = useForkingAvailable(workspaceId)
+  const { canAdmin } = useUserPermissionsContext()
+  // Forking and sync rewrite workflow state and deployments en masse, so they are
+  // workspace-admin only (org owners/admins derive workspace admin server-side via
+  // the resolved viewer permission). Every fork route re-checks this; gating the
+  // entry points here just keeps the UI honest. The server remains the boundary.
+  const canUseForking = forkingAvailable && canAdmin
+  const { data: forkLineage } = useForkLineage(workspaceId, canUseForking)
 
   const activeWorkspaceFull = workspaces.find((w) => w.id === workspaceId) || null
   const isWorkspaceReady = !isWorkspacesLoading && activeWorkspaceFull !== null
@@ -573,7 +580,7 @@ function WorkspaceHeaderImpl({
                   >
                     New workspace
                   </Chip>
-                  {forkingAvailable ? (
+                  {canUseForking ? (
                     <>
                       <Chip
                         leftIcon={Shuffle}

apps/sim/lib/workspaces/fork/lineage/authz.ts

@@ -95,15 +95,16 @@ export interface ForkAuthorization {
 }
 
 /**
- * Authorize forking `sourceWorkspaceId`: the caller needs read access to the
- * source and must pass the workspace-creation policy for the parent's org (the
- * child inherits the parent's org/mode; plan caps apply).
+ * Authorize forking `sourceWorkspaceId`: the caller needs admin access to the
+ * source (a fork copies its deployed workflows and resources en masse) and must
+ * pass the workspace-creation policy for the parent's org (the child inherits the
+ * parent's org/mode; plan caps apply). Org owners/admins derive workspace admin.
  */
 export async function assertCanFork(
   sourceWorkspaceId: string,
   userId: string
 ): Promise<ForkAuthorization> {
-  const source = await assertWorkspaceReadAccess(sourceWorkspaceId, userId)
+  const source = await assertWorkspaceAdminAccess(sourceWorkspaceId, userId)
   const policy = await getWorkspaceCreationPolicy({
     userId,
     activeOrganizationId: source.organizationId,