Function checkWorkspaceScope

apps/sim/app/api/v1/middleware.ts:168–194

(
  rateLimit: RateLimitResult,
  requestedWorkspaceId: string
)

 *   surface in `app/api/workflows/middleware.ts`.
 */
export async function checkWorkspaceScope(
  rateLimit: RateLimitResult,
  requestedWorkspaceId: string
): Promise<NextResponse | null> {
  if (
    rateLimit.keyType === 'workspace' &&
    rateLimit.workspaceId &&
    rateLimit.workspaceId !== requestedWorkspaceId
  ) {
    return NextResponse.json(
      { error: 'API key is not authorized for this workspace' },
      { status: 403 }
    )
  }

  if (rateLimit.keyType === 'personal') {
    const settings = await getWorkspaceBillingSettings(requestedWorkspaceId)
    if (!settings?.allowPersonalApiKeys) {
      return NextResponse.json(
        { error: 'Personal API keys are not allowed for this workspace' },
        { status: 403 }
      )
    }
  }

  return null
}

/**
 * Validates workspace-scoped API key bounds and the user's workspace permission.