refactor: Forbid access to workflows when enterprise features is unavailable (#4635) (no-changelog)

* refactor: Forbid access to workflows when enterprise features is unavailable

packages/cli/src/WorkflowHelpers.ts

@@ -33,7 +33,6 @@ import {
 	ITransferNodeTypes,
 	IWorkflowErrorData,
 	IWorkflowExecutionDataProcess,
-	WhereClause,
 } from '@/Interfaces';
 import { NodeTypes } from '@/NodeTypes';
 import { WorkflowRunner } from '@/WorkflowRunner';
@@ -41,7 +40,7 @@ import { WorkflowRunner } from '@/WorkflowRunner';
 import config from '@/config';
 import { WorkflowEntity } from '@db/entities/WorkflowEntity';
 import { User } from '@db/entities/User';
-import { getWorkflowOwner } from '@/UserManagement/UserManagementHelper';
+import { getWorkflowOwner, whereClause } from '@/UserManagement/UserManagementHelper';
 
 const ERROR_TRIGGER_TYPE = config.getEnv('nodes.errorTriggerType');
 
@@ -573,40 +572,14 @@ export async function replaceInvalidCredentials(workflow: WorkflowEntity): Promi
 	return workflow;
 }
 
-/**
- * Build a `where` clause for a TypeORM entity search,
- * checking for member access if the user is not an owner.
- */
-export function whereClause({
-	user,
-	entityType,
-	entityId = '',
-}: {
-	user: User;
-	entityType: 'workflow' | 'credentials';
-	entityId?: string;
-}): WhereClause {
-	const where: WhereClause = entityId ? { [entityType]: { id: entityId } } : {};
-
-	// TODO: Decide if owner access should be restricted
-	if (user.globalRole.name !== 'owner') {
-		where.user = { id: user.id };
-	}
-
-	return where;
-}
-
 /**
  * Get the IDs of the workflows that have been shared with the user.
  * Returns all IDs if user is global owner (see `whereClause`)
  */
-export async function getSharedWorkflowIds(user: User): Promise<number[]> {
+export async function getSharedWorkflowIds(user: User, roles?: string[]): Promise<number[]> {
 	const sharedWorkflows = await Db.collections.SharedWorkflow.find({
-		relations: ['workflow'],
-		where: whereClause({
-			user,
-			entityType: 'workflow',
-		}),
+		relations: ['workflow', 'role'],
+		where: whereClause({ user, entityType: 'workflow', roles }),
 	});
 
 	return sharedWorkflows.map(({ workflow }) => workflow.id);