fix(webhooks): scope actor reuse to inline execution only

Addresses review: a queued/Trigger.dev webhook can outlive a workspace
billed-account change, so reusing the route-resolved actor there could gate
against a stale account. Set resolvedActorUserId only on the in-process inline
payload (sub-second after resolution); queued and persisted payloads omit it,
so the background pass re-resolves the current billed account. Gates unchanged.

Author: waleedlatif1

apps/sim/background/webhook-execution.ts

@@ -241,6 +241,14 @@ export type WebhookExecutionPayload = {
   webhookReceivedAt?: number
   /** Epoch ms of the originating provider interaction (e.g. Slack x-slack-request-timestamp). */
   triggerTimestampMs?: number
+  /**
+   * Billing actor resolved by the webhook route, set ONLY for in-process inline
+   * execution that runs microseconds after resolution. The background pass reuses
+   * it to skip the redundant billed-account lookup. Deliberately absent on queued
+   * (Trigger.dev) and persisted payloads — a deferred run could outlive a
+   * billed-account change, so it re-resolves the current actor instead.
+   */
+  resolvedActorUserId?: string
 }
 
 export async function executeWebhookJob(payload: WebhookExecutionPayload) {
@@ -367,10 +375,11 @@ async function executeWebhookJobInternal(
     skipUsageLimits: true,
     workspaceId: payload.workspaceId,
     loggingSession,
-    // The webhook route already resolved the billing actor and carried it as
-    // payload.userId. Reuse it to skip the redundant billed-account lookup; the
-    // ban and archived-workflow gates still run fresh here.
-    resolvedActorUserId: payload.userId,
+    // Reuse the route-resolved actor only for inline execution (set on the
+    // in-process payload). When absent — queued/Trigger.dev runs — preprocessing
+    // re-resolves the current billed account. Either way the ban and
+    // archived-workflow gates run fresh against the resolved actor.
+    resolvedActorUserId: payload.resolvedActorUserId,
   })
 
   if (!preprocessResult.success) {

apps/sim/lib/webhooks/processor.ts

@@ -667,10 +667,16 @@ export async function queueWebhookExecution(
         `[${options.requestId}] Queued ${foundWebhook.provider} webhook execution ${jobId} via inline backend`
       )
 
+      // Inline runs in-process microseconds after the route resolved the actor,
+      // so reuse it to skip a redundant billed-account lookup. Set only on the
+      // in-process payload — the enqueued/persisted copy omits it so any deferred
+      // re-run re-resolves the current billed account.
+      const inlinePayload = { ...payload, resolvedActorUserId: actorUserId }
+
       void (async () => {
         try {
           await jobQueue.startJob(jobId)
-          const output = await executeWebhookJob(payload)
+          const output = await executeWebhookJob(inlinePayload)
           await jobQueue.completeJob(jobId, output)
         } catch (error) {
           const errorMessage = toError(error).message