fix(inbox): stop an unattributed sender inheriting owner write authority

resolveInboxExecutionActor refuses to name a raw-secret actor when the sender
matches no workspace member, then hands the run ws.ownerId for everything else.
That identity also supplies userPermission, which is what executeTool gates on,
so the owner's admin satisfied every requiredPermission check.

In headless mode the client-routed workflow tools fall back to their registered
server handlers (see the comment in tool-executor/executor.ts), so create_workflow,
edit_workflow and run_workflow — all requiredPermission 'write' — were reachable.
runWorkflowFromCopilot then executes with enforceCredentialAccess and the owner as
actor, which resolves the owner's workspace and personal secrets. An allowlisted
external correspondent could therefore reach, through a workflow it had the agent
build and run, exactly what the null secret actor refuses for a direct mount.

Cap the run's tool permission at read when no member owns the message. An
attributed message is unchanged and still uses the sender's own permission, so a
read-only member emailing the inbox still cannot run or edit anything. Read rather
than none because answering an external correspondent from workspace context is
the point of the inbox; only mutation and execution are withheld.

The owner identity itself stays: billing attribution and workspace reads need a
real user. This separates that need from the authority that came with it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/lib/mothership/inbox/executor.test.ts

@@ -119,7 +119,7 @@ const WORKSPACE = {
   inboxMountedSecrets: ['INBOX_KEY'],
 }
 
-describe('Inbox raw-secret actor', () => {
+describe('Inbox execution actor', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()
@@ -150,6 +150,8 @@ describe('Inbox raw-secret actor', () => {
       expect.objectContaining({
         userId: 'member-1',
         secretActorUserId: 'member-1',
+        /** Their own, so an emailed request reaches exactly what they could in the app. */
+        userPermission: 'write',
         secretMountPolicy: {
           secretScope: 'selected',
           mountedSecrets: ['INBOX_KEY'],
@@ -158,10 +160,33 @@ describe('Inbox raw-secret actor', () => {
     )
   })
 
-  it('keeps owner execution fallback but removes raw-secret authority for an external sender', async () => {
+  it('does not lend a read-only member write authority', async () => {
+    queueTableRows(schemaMock.mothershipInboxTask, [INBOX_TASK])
+    queueTableRows(schemaMock.workspace, [WORKSPACE])
+    queueTableRows(schemaMock.user, [{ id: 'member-1' }])
+    mockCheckWorkspaceAccess.mockResolvedValue({ permission: 'read' })
+    mockGetUserEntityPermissions.mockResolvedValue('read')
+
+    await executeInboxTask('task-1')
+
+    expect(mockRunHeadlessCopilotLifecycle).toHaveBeenCalledWith(
+      expect.any(Object),
+      expect.objectContaining({ userId: 'member-1', userPermission: 'read' })
+    )
+  })
+
+  /**
+   * The owner identity is there for billing and workspace reads, not to lend an unknown
+   * sender the owner's authority. Without the read ceiling the write-gated workflow tools
+   * would let an allowlisted external correspondent build and run a workflow as the owner,
+   * which resolves the owner's workspace and personal secrets — the same reach the null
+   * secret actor already refuses for a direct mount.
+   */
+  it('caps an external sender at read even when the owner is an admin', async () => {
     queueTableRows(schemaMock.mothershipInboxTask, [INBOX_TASK])
     queueTableRows(schemaMock.workspace, [WORKSPACE])
     queueTableRows(schemaMock.user, [])
+    mockCheckWorkspaceAccess.mockResolvedValue({ permission: 'admin' })
 
     await executeInboxTask('task-1')
 
@@ -170,6 +195,7 @@ describe('Inbox raw-secret actor', () => {
       expect.objectContaining({
         userId: 'owner-1',
         secretActorUserId: null,
+        userPermission: 'read',
         secretMountPolicy: {
           secretScope: 'selected',
           mountedSecrets: ['INBOX_KEY'],
@@ -178,4 +204,16 @@ describe('Inbox raw-secret actor', () => {
     )
     expect(mockGetUserEntityPermissions).not.toHaveBeenCalled()
   })
+
+  it('leaves an external sender with no permission at none rather than promoting to read', async () => {
+    queueTableRows(schemaMock.mothershipInboxTask, [INBOX_TASK])
+    queueTableRows(schemaMock.workspace, [WORKSPACE])
+    queueTableRows(schemaMock.user, [])
+    mockCheckWorkspaceAccess.mockResolvedValue({ permission: null })
+
+    await executeInboxTask('task-1')
+
+    const [, options] = mockRunHeadlessCopilotLifecycle.mock.calls[0]
+    expect(options.userPermission).toBeUndefined()
+  })
 })

apps/sim/lib/mothership/inbox/executor.ts

@@ -27,7 +27,11 @@ import type { AgentMailAttachment } from '@/lib/mothership/inbox/types'
 import { buildStorageKeySegment } from '@/lib/uploads/core/storage-key'
 import { uploadFile } from '@/lib/uploads/core/storage-service'
 import { createFileContent, type MessageContent } from '@/lib/uploads/utils/file-utils'
-import { checkWorkspaceAccess, getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+import {
+  checkWorkspaceAccess,
+  getUserEntityPermissions,
+  type PermissionType,
+} from '@/lib/workspaces/permissions/utils'
 import { getWorkspaceBilledAccountUserId } from '@/lib/workspaces/utils'
 
 const logger = createLogger('InboxExecutor')
@@ -216,7 +220,7 @@ export async function executeInboxTask(taskId: string): Promise<void> {
     }
 
     const workspaceAccess = await checkWorkspaceAccess(ws.id, userId)
-    const userPermission = workspaceAccess.permission
+    const userPermission = inboxToolPermission(actor, workspaceAccess.permission)
     const secretMountPolicy = normalizeSecretMountPolicy({
       secretScope: ws.inboxSecretScope,
       mountedSecrets: ws.inboxMountedSecrets,
@@ -343,12 +347,47 @@ export async function executeInboxTask(taskId: string): Promise<void> {
  * Resolve the execution and raw-secret actors independently. Workspace members
  * execute and mount secrets as themselves. External senders retain the existing
  * owner execution fallback but receive no raw-secret actor.
+ *
+ * The owner fallback exists because billing attribution and workspace reads need
+ * a real user, not because an unknown sender should act as the owner. A null
+ * `secretActorUserId` is therefore the run's "no caller" signal, and callers must
+ * treat it as one everywhere authority is derived — see
+ * {@link inboxToolPermission}.
  */
 interface InboxExecutionActor {
   executionUserId: string
+  /** Null when no workspace member owns this message. */
   secretActorUserId: string | null
 }
 
+/**
+ * How far an inbox run's tools may reach.
+ *
+ * An attributed message uses the sender's own workspace permission, which makes an
+ * emailed request equivalent to that member performing it in the app — a read-only
+ * member still cannot run or edit anything.
+ *
+ * An unattributed message resolves to the workspace owner so the run has a real
+ * user for billing and workspace reads, and the owner is typically an admin. Left
+ * alone, that hands an allowlisted external correspondent the owner's write
+ * authority: `create_workflow`, `edit_workflow` and `run_workflow` all gate on
+ * `requiredPermission: 'write'`, and a workflow built and run through them executes
+ * with `enforceCredentialAccess`, resolving the owner's workspace *and personal*
+ * secrets. That is the same reach `secretActorUserId: null` already refuses for a
+ * direct mount, so refusing it here keeps one answer rather than two.
+ *
+ * Read is the ceiling rather than no permission at all because answering an
+ * external correspondent from workspace context is the point of the inbox; only
+ * mutation and execution are withheld.
+ */
+function inboxToolPermission(
+  actor: InboxExecutionActor,
+  workspacePermission: PermissionType | null
+): PermissionType | null {
+  if (actor.secretActorUserId !== null) return workspacePermission
+  return workspacePermission === null ? null : 'read'
+}
+
 async function resolveInboxExecutionActor(
   senderEmail: string,
   ws: { id: string; ownerId: string }