fix(env): give the workspace env denial its own write-access message

WorkspaceEnvAccessError reported "must be an admin of these secrets" for
both denials, so a caller lacking workspace write to ADD a key was told to
get secret-admin on a key that does not exist yet. Carry the reason and
mirror the route's two messages.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PCXbU36FwJBmtJKaH83BUm

Author: TheodoreSpeaks

apps/sim/lib/environment/utils.test.ts

@@ -61,10 +61,15 @@ describe('upsertWorkspaceEnvVars', () => {
       knownKeys: new Set(['STRIPE_KEY']),
     })
 
-    await expect(
-      upsertWorkspaceEnvVars('ws-1', { STRIPE_KEY: 'rotated' }, 'user-1')
-    ).rejects.toBeInstanceOf(WorkspaceEnvAccessError)
+    const error = await upsertWorkspaceEnvVars('ws-1', { STRIPE_KEY: 'rotated' }, 'user-1').catch(
+      (e) => e
+    )
 
+    expect(error).toBeInstanceOf(WorkspaceEnvAccessError)
+    expect(error).toMatchObject({
+      reason: 'not-secret-admin',
+      message: 'You must be an admin of these secrets to edit them',
+    })
     expect(encryptionMockFns.mockEncryptSecret).not.toHaveBeenCalled()
     expect(mockRecordAudit).not.toHaveBeenCalled()
   })
@@ -76,10 +81,17 @@ describe('upsertWorkspaceEnvVars', () => {
       knownKeys: new Set<string>(),
     })
 
-    await expect(
-      upsertWorkspaceEnvVars('ws-1', { NEW_KEY: 'value' }, 'user-1')
-    ).rejects.toBeInstanceOf(WorkspaceEnvAccessError)
+    const error = await upsertWorkspaceEnvVars('ws-1', { NEW_KEY: 'value' }, 'user-1').catch(
+      (e) => e
+    )
 
+    expect(error).toBeInstanceOf(WorkspaceEnvAccessError)
+    // Distinct from the secret-admin denial: the route answers this case with a
+    // write-access message, and the agent surfaces whatever we throw verbatim.
+    expect(error).toMatchObject({
+      reason: 'write-access-required',
+      message: 'Write access is required to add new secrets',
+    })
     expect(encryptionMockFns.mockEncryptSecret).not.toHaveBeenCalled()
   })
 

apps/sim/lib/environment/utils.ts

@@ -24,10 +24,21 @@ const WORKSPACE_ENV_LOCK_TIMEOUT_MS = 5_000
 const EFFECTIVE_ENVIRONMENT_CACHE_TTL_MS = 2_000
 const EFFECTIVE_ENVIRONMENT_CACHE_MAX_ENTRIES = 1_000
 
+type WorkspaceEnvDenialReason = 'not-secret-admin' | 'write-access-required'
+
+/** Mirrors the messages the workspace environment route returns for the same denials. */
+const WORKSPACE_ENV_DENIAL_MESSAGES: Record<WorkspaceEnvDenialReason, string> = {
+  'not-secret-admin': 'You must be an admin of these secrets to edit them',
+  'write-access-required': 'Write access is required to add new secrets',
+}
+
 /** Thrown when the acting user may not write one of the requested env keys. */
 export class WorkspaceEnvAccessError extends Error {
-  constructor(readonly keys: string[]) {
-    super('You must be an admin of these secrets to edit them')
+  constructor(
+    readonly reason: WorkspaceEnvDenialReason,
+    readonly keys: string[]
+  ) {
+    super(WORKSPACE_ENV_DENIAL_MESSAGES[reason])
     this.name = 'WorkspaceEnvAccessError'
   }
 }
@@ -365,7 +376,7 @@ export async function upsertWorkspaceEnvVars(
       reason: 'not-secret-admin',
       keys: forbidden,
     })
-    throw new WorkspaceEnvAccessError(forbidden)
+    throw new WorkspaceEnvAccessError('not-secret-admin', forbidden)
   }
   const addingNew = updatedKeys.some((key) => !knownKeys.has(key))
   if (addingNew && permission !== 'admin' && permission !== 'write') {
@@ -375,7 +386,10 @@ export async function upsertWorkspaceEnvVars(
       reason: 'write-access-required',
       keys: updatedKeys.filter((key) => !knownKeys.has(key)),
     })
-    throw new WorkspaceEnvAccessError(updatedKeys.filter((key) => !knownKeys.has(key)))
+    throw new WorkspaceEnvAccessError(
+      'write-access-required',
+      updatedKeys.filter((key) => !knownKeys.has(key))
+    )
   }
 
   const newlyEncrypted: Record<string, string> = {}