perf(server): memoize the request-scoped workspace and entitlement reads

The workspace row was read ~3x per workspace route and ~5x on settings, and the
same Max-tier entitlement was resolved twice on one render.

Memoization is deliberately partial. getWorkspaceWithOwner accepts a
transaction and forUpdate, and live callers use both, so only the plain
no-options read routes through the memo; a row read inside one caller's
transaction or under a lock it alone holds can never be served to a later
caller. includeArchived is part of the key so the two variants cannot alias.

Three substitutions were considered and rejected as behavior changes, not
optimizations: hostContext.ownerBilling resolves subscriptions differently from
hasWorkspaceTierAccess and exposes no Max tier, so it cannot answer the
Inbox/Sandbox gates; isOrganizationOnEnterprisePlan carries self-host
short-circuits ownerBilling has no equivalent for; and widening
WorkspaceHostContext to carry the full row would push owner and org ids onto
the wire for every viewer to save a server-side read, since that type is a
response contract rather than an internal struct.

Author: waleedlatif1

apps/sim/lib/billing/core/subscription.ts

@@ -1,3 +1,4 @@
+import { cache } from 'react'
 import { db } from '@sim/db'
 import { member, organization, subscription, user } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
@@ -429,11 +430,7 @@ export async function isEnterpriseOrgAdminOrOwner(userId: string): Promise<boole
   }
 }
 
-/**
- * Check if an organization has an enterprise plan
- * Used for Access Control (Permission Groups) feature gating
- */
-export async function isOrganizationOnEnterprisePlan(organizationId: string): Promise<boolean> {
+async function resolveOrganizationEnterprisePlan(organizationId: string): Promise<boolean> {
   try {
     if (!isBillingEnabled) {
       return true
@@ -456,6 +453,17 @@ export async function isOrganizationOnEnterprisePlan(organizationId: string): Pr
   }
 }
 
+/**
+ * Check if an organization has an enterprise plan
+ * Used for Access Control (Permission Groups) feature gating
+ *
+ * Request-memoized: settings renders gate several sections on the same
+ * organization's plan, and the plan cannot change mid-render. Outside a Server
+ * Component render React evaluates the resolver normally, so routes, tools, and
+ * background work re-read exactly as before.
+ */
+export const isOrganizationOnEnterprisePlan = cache(resolveOrganizationEnterprisePlan)
+
 /**
  * Entitlement for a single org-scoped enterprise feature.
  *
@@ -612,10 +620,16 @@ async function hasWorkspaceTierAccess(
  * Whether the workspace's payer is on a usable Max-or-Enterprise subscription.
  * Shared by the inbox (Sim Mailer), live sync, and custom sandboxes, which all
  * sit on the same entitlement tier.
+ *
+ * Request-memoized because those features are gated side by side on the same
+ * settings render, each otherwise repeating the identical workspace and
+ * subscription reads. The per-feature deployment and env short-circuits live in
+ * the exported wrappers and still run per call. Outside a Server Component
+ * render React evaluates this normally.
  */
-async function hasMaxTierWorkspaceAccess(workspaceId: string): Promise<boolean> {
-  return hasWorkspaceTierAccess(workspaceId, isMaxTier)
-}
+const hasMaxTierWorkspaceAccess = cache(
+  (workspaceId: string): Promise<boolean> => hasWorkspaceTierAccess(workspaceId, isMaxTier)
+)
 
 /**
  * Check whether a workspace is entitled to the inbox (Sim Mailer) feature.

apps/sim/lib/permissions/super-user.ts

@@ -1,3 +1,4 @@
+import { cache } from 'react'
 import { db, dbReplica } from '@sim/db'
 import { settings, user } from '@sim/db/schema'
 import { eq } from 'drizzle-orm'
@@ -41,13 +42,17 @@ export async function verifyEffectiveSuperUser(userId: string): Promise<{
  * served from the replica: this gates features, not security-critical auth, so it
  * tolerates the replica's bounded staleness (admin role rarely changes). Falls back
  * to the primary when no replica is configured.
+ *
+ * Request-memoized: an account-settings render checks the same viewer in both
+ * the layout and the page. Outside a Server Component render React evaluates
+ * the reader normally, so routes and feature-flag lookups are unaffected.
  */
-export async function isPlatformAdmin(userId: string): Promise<boolean> {
+export const isPlatformAdmin = cache(async (userId: string): Promise<boolean> => {
   const [row] = await dbReplica
     .select({ role: user.role })
     .from(user)
     .where(eq(user.id, userId))
     .limit(1)
 
   return row?.role === 'admin'
-}
+})

apps/sim/lib/workspaces/permissions/utils.ts

@@ -1,3 +1,4 @@
+import { cache } from 'react'
 import { db } from '@sim/db'
 import { member, permissions, user, type WorkspaceMode, workspace } from '@sim/db/schema'
 import {
@@ -77,17 +78,12 @@ export async function getWorkspaceById(
   return exists ? { id: workspaceId } : null
 }
 
-/**
- * Get a workspace with owner info by ID
- *
- * @param workspaceId - The workspace ID to look up
- * @returns The workspace with owner info if found, null otherwise
- */
-export async function getWorkspaceWithOwner(
+async function selectWorkspaceWithOwner(
   workspaceId: string,
-  options?: { includeArchived?: boolean; executor?: DbOrTx; forUpdate?: boolean }
+  includeArchived: boolean,
+  executor: DbOrTx,
+  forUpdate: boolean
 ): Promise<WorkspaceWithOwner | null> {
-  const { includeArchived = false, executor = db, forUpdate = false } = options ?? {}
   const query = executor
     .select({
       id: workspace.id,
@@ -110,6 +106,41 @@ export async function getWorkspaceWithOwner(
   return ws || null
 }
 
+/**
+ * Request-memoized plain workspace read, keyed by id and archived visibility.
+ * A single Server Component render pass resolves the same workspace row through
+ * several independent gates, so without this the row is re-read once per gate.
+ *
+ * Outside a Server Component render React evaluates this normally and retains
+ * nothing, so API routes and background work are unaffected.
+ */
+const readWorkspaceWithOwner = cache(
+  (workspaceId: string, includeArchived: boolean): Promise<WorkspaceWithOwner | null> =>
+    selectWorkspaceWithOwner(workspaceId, includeArchived, db, false)
+)
+
+/**
+ * Get a workspace with owner info by ID
+ *
+ * Transaction-scoped (`executor`) and lock-acquiring (`forUpdate`) reads
+ * deliberately bypass {@link readWorkspaceWithOwner}: a row read inside one
+ * caller's transaction, or under a row lock only that caller holds, must never
+ * be handed to a later caller that took neither.
+ *
+ * @param workspaceId - The workspace ID to look up
+ * @returns The workspace with owner info if found, null otherwise
+ */
+export function getWorkspaceWithOwner(
+  workspaceId: string,
+  options?: { includeArchived?: boolean; executor?: DbOrTx; forUpdate?: boolean }
+): Promise<WorkspaceWithOwner | null> {
+  const { includeArchived = false, executor, forUpdate = false } = options ?? {}
+  if (executor || forUpdate) {
+    return selectWorkspaceWithOwner(workspaceId, includeArchived, executor ?? db, forUpdate)
+  }
+  return readWorkspaceWithOwner(workspaceId, includeArchived)
+}
+
 /**
  * Resolve the effective workspace permission for a user under the governance
  * inheritance model: the owners/admins of the organization that owns the
@@ -131,18 +162,7 @@ export async function getEffectiveWorkspacePermission(
   return resolveEffectiveWorkspacePermission(userId, ws.id, ws.organizationId, executor)
 }
 
-/**
- * Check workspace access for a user
- *
- * Verifies the workspace exists and the user has access to it.
- * Returns access level (read/write) based on ownership, explicit permissions,
- * and organization-admin inheritance.
- *
- * @param workspaceId - The workspace ID to check
- * @param userId - The user ID to check access for
- * @returns WorkspaceAccess object with exists, hasAccess, canWrite, and workspace data
- */
-export async function checkWorkspaceAccess(
+async function resolveWorkspaceAccessForUser(
   workspaceId: string,
   userId: string
 ): Promise<WorkspaceAccess> {
@@ -167,6 +187,25 @@ export async function checkWorkspaceAccess(
   return { exists: true, hasAccess, canWrite, canAdmin, workspace: ws, permission }
 }
 
+/**
+ * Check workspace access for a user
+ *
+ * Verifies the workspace exists and the user has access to it.
+ * Returns access level (read/write) based on ownership, explicit permissions,
+ * and organization-admin inheritance.
+ *
+ * Request-memoized: a Server Component render pass authorizes the same
+ * (workspace, viewer) pair through several gates, and the answer cannot change
+ * mid-render. Outside a render React evaluates the resolver normally, so route
+ * handlers and background work re-read exactly as before. Takes no executor, so
+ * no transaction-scoped or locked read can ever be memoized here.
+ *
+ * @param workspaceId - The workspace ID to check
+ * @param userId - The user ID to check access for
+ * @returns WorkspaceAccess object with exists, hasAccess, canWrite, and workspace data
+ */
+export const checkWorkspaceAccess = cache(resolveWorkspaceAccessForUser)
+
 /**
  * Returns `provided` when it was resolved for this exact workspace, otherwise
  * resolves fresh. The id match is what keeps a caller from authorizing against