fix(schedules-perms): use regular perm system to view/edit schedule info

[icecrasher321]

Summary

Viewing schedule info was giving 403 since it was only checking ownership of workflow. Add logging for pre-execution failures.

Type of Change

• Bug fix

Testing

Tested manually by sharing workflow and viewing on User B.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
sim	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Aug 7, 2025 9:31pm

1 Skipped Deployment

Name	Status	Preview	Comments	Updated (UTC)
docs	⬜️ Skipped (Inspect)			Aug 7, 2025 9:31pm

[greptile-apps]

Greptile Summary

This PR fixes a permissions bug in the schedule API endpoints where viewing and managing schedules was returning 403 Forbidden errors for users with workspace-level permissions. The fix implements proper authorization logic across three schedule-related API routes by adding workspace permission checks alongside the existing ownership checks.

The changes introduce a two-tier authorization system:

1. First check if the user directly owns the workflow
2. If not, check if the workflow belongs to a workspace and the user has workspace permissions

This aligns the schedule API with the broader workspace permission system used throughout the application. The fix adds the getUserEntityPermissions utility import and modifies database queries to include workspaceId fields. Each endpoint now properly handles both direct ownership and workspace-based access, ensuring users with workspace permissions (read, write, or admin) can view and manage schedules for shared workflows.

The changes are applied consistently across:

• GET /api/schedules (listing schedules)
• POST /api/schedules (creating/modifying schedules)
• GET /api/schedules/[id]/status (viewing schedule status)
• DELETE /api/schedules/[id] (deleting schedules)

This brings schedule permissions in line with other workflow-related APIs and supports the workspace collaboration features properly.

Confidence score: 4/5

• This PR is safe to merge with low risk as it fixes a clear permission bug
• Score reflects well-tested permission patterns being applied consistently across multiple endpoints
• Pay close attention to the permission logic implementation across all three modified route files

_{3 files reviewed, no comments}

_{Edit Code Review Bot Settings | Greptile}