refactor: Forbid access to workflows when enterprise features is unavailable (#4635) (no-changelog)

* refactor: Forbid access to workflows when enterprise features is unavailable

packages/cli/src/UserManagement/UserManagementHelper.ts

@@ -13,6 +13,7 @@ import { Role } from '@db/entities/Role';
 import { AuthenticatedRequest } from '@/requests';
 import config from '@/config';
 import { getWebhookBaseUrl } from '../WebhookHelpers';
+import { WhereClause } from '@/Interfaces';
 
 export async function getWorkflowOwner(workflowId: string | number): Promise<User> {
 	const sharedWorkflow = await Db.collections.SharedWorkflow.findOneOrFail({
@@ -210,3 +211,31 @@ export function rightDiff<T1, T2>(
 		return acc;
 	}, []);
 }
+
+/**
+ * Build a `where` clause for a TypeORM entity search,
+ * checking for member access if the user is not an owner.
+ */
+export function whereClause({
+	user,
+	entityType,
+	entityId = '',
+	roles = [],
+}: {
+	user: User;
+	entityType: 'workflow' | 'credentials';
+	entityId?: string;
+	roles?: string[];
+}): WhereClause {
+	const where: WhereClause = entityId ? { [entityType]: { id: entityId } } : {};
+
+	// TODO: Decide if owner access should be restricted
+	if (user.globalRole.name !== 'owner') {
+		where.user = { id: user.id };
+		if (roles?.length) {
+			where.role = { name: In(roles) };
+		}
+	}
+
+	return where;
+}