Function validateWorkspaceAccess

apps/sim/app/api/v1/middleware.ts:200–214

(
  rateLimit: RateLimitResult,
  userId: string,
  workspaceId: string,
  level: PermissionType = 'read'
)

 * Returns null on success, NextResponse on failure.
 */
export async function validateWorkspaceAccess(
  rateLimit: RateLimitResult,
  userId: string,
  workspaceId: string,
  level: PermissionType = 'read'
): Promise<NextResponse | null> {
  const scopeError = await checkWorkspaceScope(rateLimit, workspaceId)
  if (scopeError) return scopeError

  const permission = await getUserEntityPermissions(userId, 'workspace', workspaceId)
  if (!permissionSatisfies(permission, level)) {
    return NextResponse.json({ error: 'Access denied' }, { status: 403 })
  }
  return null
}