Function getCredentialActorContext

apps/sim/lib/credentials/access.ts:56–107

(
  credentialId: string,
  userId: string,
  options?: { workspaceAccess?: WorkspaceAccess }
)

 * redundant lookup; it is reused only when it matches the credential's workspace.
 */
export async function getCredentialActorContext(
  credentialId: string,
  userId: string,
  options?: { workspaceAccess?: WorkspaceAccess }
): Promise<CredentialActorContext> {
  const [credentialRow] = await db
    .select()
    .from(credential)
    .where(eq(credential.id, credentialId))
    .limit(1)

  if (!credentialRow) {
    return {
      credential: null,
      member: null,
      hasWorkspaceAccess: false,
      canWriteWorkspace: false,
      isAdmin: false,
    }
  }

  const providedAccess = options?.workspaceAccess
  const workspaceAccess =
    providedAccess && providedAccess.workspace?.id === credentialRow.workspaceId
      ? providedAccess
      : await checkWorkspaceAccess(credentialRow.workspaceId, userId)
  const [memberRow] = await db
    .select()
    .from(credentialMember)
    .where(
      and(
        eq(credentialMember.credentialId, credentialId),
        eq(credentialMember.userId, userId),
        eq(credentialMember.status, 'active')
      )
    )
    .limit(1)

  const isAdmin = deriveCredentialAdmin({
    credentialType: credentialRow.type,
    memberRole: memberRow?.role,
    workspaceCanAdmin: workspaceAccess.canAdmin,
  })

  return {
    credential: credentialRow,
    member: memberRow ?? null,
    hasWorkspaceAccess: workspaceAccess.hasAccess,
    canWriteWorkspace: workspaceAccess.canWrite,
    isAdmin,
  }
}

/**
 * Revokes all credential memberships for a user across one or more workspaces.