test(v1): pin the workspace-actor projection

requireWorkspaceRequestActor is the only place the 'no billed account for this
workspace' case is turned into a response, and the table route tests mock the
middleware wholesale, so the projection itself needs its own pin.

Author: waleedlatif1

apps/sim/app/api/v1/middleware.test.ts

@@ -29,13 +29,15 @@ const {
   mockGetRateLimit,
   mockGetUserEntityPermissions,
   mockGetWorkspaceBillingSettings,
+  mockGetWorkspaceBilledAccountUserId,
 } = vi.hoisted(() => ({
   mockAuthenticateV1Request: vi.fn(),
   mockGetSubscription: vi.fn(),
   mockCheckRateLimit: vi.fn(),
   mockGetRateLimit: vi.fn(),
   mockGetUserEntityPermissions: vi.fn(),
   mockGetWorkspaceBillingSettings: vi.fn(),
+  mockGetWorkspaceBilledAccountUserId: vi.fn(),
 }))
 
 vi.mock('@/app/api/v1/auth', () => ({
@@ -61,7 +63,7 @@ vi.mock('@/lib/workspaces/permissions/utils', () => ({
 
 vi.mock('@/lib/workspaces/utils', () => ({
   getWorkspaceBillingSettings: mockGetWorkspaceBillingSettings,
-  getWorkspaceBilledAccountUserId: vi.fn(async () => 'billed-user'),
+  getWorkspaceBilledAccountUserId: mockGetWorkspaceBilledAccountUserId,
 }))
 
 import { DEFAULT_PERMISSION_GROUP_CONFIG } from '@/lib/permission-groups/fields'
@@ -70,6 +72,7 @@ import {
   checkRateLimit,
   checkWorkspaceScope,
   createRateLimitResponse,
+  requireWorkspaceRequestActor,
   v1ValidationErrorResponse,
 } from '@/app/api/v1/middleware'
 
@@ -421,3 +424,47 @@ describe('checkWorkspaceScope', () => {
     expect(response?.status).toBe(403)
   })
 })
+
+describe('requireWorkspaceRequestActor', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockGetWorkspaceBilledAccountUserId.mockResolvedValue('billed-user')
+  })
+
+  it('substitutes the billed account as the system actor for a workspace key', async () => {
+    const actor = await requireWorkspaceRequestActor(
+      { allowed: true, keyType: 'workspace', userId: 'key-creator' } as never,
+      'workspace-1'
+    )
+
+    expect(actor).toEqual({ ok: true, actorUserId: 'billed-user' })
+  })
+
+  it('keeps the owner for a personal key', async () => {
+    const actor = await requireWorkspaceRequestActor(
+      { allowed: true, keyType: 'personal', userId: 'user-1' } as never,
+      'workspace-1'
+    )
+
+    expect(actor).toEqual({ ok: true, actorUserId: 'user-1' })
+  })
+
+  /**
+   * An archived or deleted workspace has no billed account to stand in. That is
+   * a reachable request about an unreachable workspace, not a server fault: the
+   * call sites used to throw, and the routes' catch-all reported it as a 500.
+   */
+  it('projects an unresolvable actor onto a 400 rather than throwing', async () => {
+    mockGetWorkspaceBilledAccountUserId.mockResolvedValue(null)
+
+    const actor = await requireWorkspaceRequestActor(
+      { allowed: true, keyType: 'workspace', userId: 'key-creator' } as never,
+      'workspace-gone'
+    )
+
+    expect(actor.ok).toBe(false)
+    if (actor.ok) throw new Error('expected a refusal')
+    expect(actor.response.status).toBe(400)
+    await expect(actor.response.json()).resolves.toEqual({ error: 'Invalid workspace ID' })
+  })
+})