feat(ee): add enterprise edition module structure

[waleedlatif1]

Summary

• Move EE features (SSO, Access Control, Credential Sets) to dedicated ee/ directory
• Update all imports to reference @/ee/... directly
• Remove wrapper/fallback patterns - EE is now required at build time
• Follows Cal.com's open-core pattern

Type of Change

• New feature

Testing

Build passes, tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Feb 3, 2026 7:34am

[greptile-apps]

Greptile Overview

Greptile Summary

This PR moves enterprise features (SSO, access control/permission groups, credential sets) into a dedicated apps/sim/ee/ module and updates call sites across the app, API routes, copilot tools, and executor handlers to import from @/ee/... directly (removing prior wrapper/fallback patterns).

Most changes are path-only moves/renames with minimal logic churn. Notable behavior changes are limited to:

• ee/index.ts now contains documentation suggesting EE is optional, which conflicts with the new static import model.
• AccessControl’s handleOpenAddMembersModal callback dependency change may introduce a stale closure / dropped intended logic.
• A new authorizeCredentialUse helper centralizes credential authorization; its internal JWT vs owner short-circuit behavior may be stricter than the docstring implies.

Confidence Score: 3/5

• This PR is reasonably safe to merge, with a couple of small but real correctness/doc inconsistencies to address first.
• Most changes are file moves and import rewrites; however, there is at least one behavior-affecting hook dependency change in AccessControl and a new credential authorization helper that could be overly strict for internal JWT callers. There is also misleading documentation in the EE barrel export about optional loading despite static imports.
• apps/sim/ee/access-control/components/access-control.tsx, apps/sim/lib/credential-sets/credential-access.ts, apps/sim/ee/index.ts

Important Files Changed

Filename	Overview
apps/sim/app/(auth)/sso/page.tsx	Updated SSO page to import SSOForm from new EE path.
apps/sim/app/api/organizations/[id]/invitations/route.ts	Switched invitations permission-check imports to EE access-control module.
apps/sim/app/api/workspaces/invitations/route.test.ts	Updated test mock path for permission-check to new EE location.
apps/sim/app/api/workspaces/invitations/route.ts	Updated invitations route to import permission checks from EE module; removed comments only.
apps/sim/app/chat/[identifier]/chat.tsx	Moved SSOAuth import from chat components barrel to direct EE SSOAuth import.
apps/sim/app/chat/components/index.ts	Removed SSOAuth export from chat components index as it moved to EE module.
apps/sim/app/workspace/[workspaceId]/knowledge/page.tsx	Updated getUserPermissionConfig import to EE permission-check module.
apps/sim/app/workspace/[workspaceId]/templates/page.tsx	Updated getUserPermissionConfig import to EE permission-check module.
apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/credential-sets/credential-sets.tsx	Removed UI comments only; no functional changes detected.
apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/index.ts	Stopped exporting AccessControl and SSO from settings-modal components barrel; moved to EE imports.
apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/mcp/mcp.tsx	Removed comments only; no functional changes detected.
apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/settings-modal.tsx	Updated settings modal to import AccessControl/SSO + SSO hooks from EE module and removed old barrel exports.
apps/sim/ee/LICENSE	Added EE license file defining enterprise subscription and restrictions.
apps/sim/ee/README.md	Added EE readme describing required build-time EE directory and runtime env toggles.
apps/sim/ee/access-control/components/access-control.tsx	Moved AccessControl UI to EE; changed some hook imports and adjusted callback dependencies (one potential stale closure issue).
apps/sim/ee/access-control/hooks/permission-groups.ts	Moved permission-groups hooks to EE and added 'use client' directive.
apps/sim/ee/access-control/index.ts	Added access-control barrel exports for components, hooks, and permission-check utils.
apps/sim/ee/access-control/utils/permission-check.ts	Moved permission-check utilities from executor to EE access-control module (no content changes shown).
apps/sim/ee/index.ts	Added EE root barrel export; contains misleading comment about optional loading vs static imports.
apps/sim/ee/sso/components/sso-auth.tsx	Moved SSOAuth component to EE (no content changes shown).
apps/sim/ee/sso/components/sso-form.tsx	Moved SSOForm component to EE (no content changes shown).
apps/sim/ee/sso/components/sso-login-button.tsx	Added reusable SSO login button gated by NEXT_PUBLIC_SSO_ENABLED.
apps/sim/ee/sso/components/sso-settings.tsx	Moved SSO settings UI to EE; replaced local trusted providers list with shared SSO_TRUSTED_PROVIDERS and updated hook imports.
apps/sim/ee/sso/constants.ts	Moved SSO trusted providers constants to EE and added doc comment.
apps/sim/ee/sso/hooks/sso.ts	Moved SSO react-query hooks to EE and added 'use client' directive.
apps/sim/ee/sso/index.ts	Added SSO barrel exports for components/constants/hooks in EE.
apps/sim/executor/execution/block-executor.ts	Updated validateBlockType import to EE permission-check module.
apps/sim/executor/handlers/agent/agent-handler.ts	Updated permission validator imports to EE permission-check module.
apps/sim/executor/handlers/evaluator/evaluator-handler.ts	Updated validateModelProvider import to EE permission-check module.
apps/sim/executor/handlers/router/router-handler.ts	Updated validateModelProvider import to EE permission-check module.
apps/sim/hooks/queries/credential-sets.ts	Added 'use client' directive to credential-sets query hooks module.
apps/sim/hooks/use-permission-config.ts	Added 'use client' directive and switched to EE permission-groups hook import (prior thread noted duplication concerns).
apps/sim/lib/auth/auth.ts	Updated SSO trusted providers import to point at EE constants module.
apps/sim/lib/copilot/process-contents.ts	Updated getUserPermissionConfig import to EE permission-check module.
apps/sim/lib/copilot/tools/server/blocks/get-block-config.ts	Updated getUserPermissionConfig import to EE permission-check module.
apps/sim/lib/copilot/tools/server/blocks/get-block-options.ts	Updated getUserPermissionConfig import to EE permission-check module.
apps/sim/lib/copilot/tools/server/blocks/get-blocks-and-tools.ts	Updated getUserPermissionConfig import to EE permission-check module.
apps/sim/lib/copilot/tools/server/blocks/get-blocks-metadata-tool.ts	Updated getUserPermissionConfig import to EE permission-check module.
apps/sim/lib/copilot/tools/server/blocks/get-trigger-blocks.ts	Updated getUserPermissionConfig import to EE permission-check module.
apps/sim/lib/copilot/tools/server/workflow/edit-workflow.ts	Updated getUserPermissionConfig import to EE permission-check module.
apps/sim/lib/credential-sets/credential-access.ts	Added new centralized authZ helper for credential sets; internal_jwt vs owner short-circuit behavior may be overly strict.

Sequence Diagram

sequenceDiagram
  autonumber
  participant UI as UI (Next.js pages)
  participant EE as Enterprise modules (@/ee)
  participant API as Next.js Route Handlers
  participant AC as Access Control utils/hooks
  participant Auth as Auth/session
  participant Exec as Executor (blocks/handlers)

  UI->>EE: Import SSO/AccessControl/Credential Sets components
  UI->>API: Call workspace/org invitation endpoints
  API->>Auth: Resolve user/session
  API->>AC: Check permissions / permission groups
  AC-->>API: Allow/deny
  API-->>UI: Invitation response

  UI->>Exec: Trigger workflow execution
  Exec->>EE: Load EE block/tool metadata (if referenced)
  Exec-->>UI: Return execution output/status

Loading

[greptile-apps]

_{4 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

[waleedlatif1]

@greptile

[greptile-apps]

_{41 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Additional Comments (1)

apps/sim/ee/access-control/components/access-control.tsx
handleOpenAddMembersModal’s callback now has an empty dependency array, but it reads members (for existingMemberUserIds) in the previous version. If members is expected to affect modal state (e.g. to precompute/avoid re-adding existing members), removing this dependency can freeze behavior to the initial render or drop the intended logic.

If the existingMemberUserIds computation is truly unused, consider removing it entirely (including any downstream expectations). Otherwise, restore the dependency on members (and any derived values used in the callback).

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/sim/ee/access-control/components/access-control.tsx
Line: 548:553

Comment:
`handleOpenAddMembersModal`’s callback now has an empty dependency array, but it reads `members` (for `existingMemberUserIds`) in the previous version. If `members` is expected to affect modal state (e.g. to precompute/avoid re-adding existing members), removing this dependency can freeze behavior to the initial render or drop the intended logic.

If the `existingMemberUserIds` computation is truly unused, consider removing it entirely (including any downstream expectations). Otherwise, restore the dependency on `members` (and any derived values used in the callback).

How can I resolve this? If you propose a fix, please make it concise.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}