Say which attached resources stopped running and why

The agent and workflow reads now return resource_states to people who may
edit them: every attached tool, source and prompt (and workflow node tool
and source) with active or stopped and the reason: deleted,
owner_lost_access, the sponsor reasons, connection_needs_reconnect,
connection_removed or connector_disabled. Each entry names the sponsor,
someone other than the reader who can fix it, the service for a connection
reason, and whether the reader may take it over or reconnect it. When
something can be taken over, sponsor_audience says who it would reach.

The state comes from the checks the run itself uses (ref_access,
resolve_holder_tool and the tool's connection as the run resolves it), so
the page and the run can't disagree. A run that leaves a resource out logs
resource_stopped with the holder, type, id and reason.

The workflow read gives sponsor details, run state and node resource names
only to people who may edit it, and names only resources the workflow runs,
someone sponsored, or the reader can see. Owner saves and new workflows
now refuse node tools and sources the owner can't use, like editor saves.

docsgpt/agents/workflows/workflow_engine.py

@@ -407,6 +407,7 @@ class WorkflowEngine:
             "tool_ids": node_config.tools,
             "tool_owner": self._workflow_owner_id(),
             "tool_principals": self._node_tool_principals(node_config.tools),
+            "tool_holder": getattr(self.agent, "workflow_row", None),
             "prompt": node_prompt,
             "chat_history": self.agent.chat_history,
             "decoded_token": self.agent.decoded_token,
@@ -1407,25 +1408,21 @@ class WorkflowEngine:
             logger.warning("Workflow node sources dropped: no owner to authorize.")
             return []
 
-        from docsgpt.api.user.resource_access import active_sponsor
-        from docsgpt.api.user.team_sharing import can_access
+        from docsgpt.api.user.resource_access import log_stopped, ref_access
         from docsgpt.storage.db.session import db_readonly
 
-        workflow_row = getattr(self.agent, "workflow_row", None)
+        # The same check the workflow page's run state uses: the owner, else
+        # the editor who attached it while they still qualify.
+        holder = {**(getattr(self.agent, "workflow_row", None) or {}), "user_id": owner}
         allowed = []
         try:
             with db_readonly() as conn:
                 for sid in ids:
-                    if sid and (
-                        can_access(conn, "source", str(sid), owner)
-                        or active_sponsor(conn, "workflow", workflow_row, "source", str(sid))
-                    ):
+                    access = ref_access(conn, "workflow", holder, "source", str(sid)) if sid else None
+                    if access is not None and access.principal:
                         allowed.append(sid)
                     else:
-                        logger.warning(
-                            "Workflow node source %s dropped: %s has no access.",
-                            sid, owner,
-                        )
+                        log_stopped("workflow", holder, "source", sid, access.reason if access else None)
         except Exception:
             logger.exception("Workflow node source authorization failed; dropping all.")
             return []