feat(tables): per-table mutation locks (schema/insert/update/delete) (#5960)

* feat(tables): per-table mutation locks (schema/insert/update/delete)

Adds four independent, admin-only locks to a table so a workspace can make it
append-only, read-only, or schema-frozen. Enforced at the lib/table service
layer rather than the routes, so the API, workflow blocks, and Mothership (which
calls the services directly) are all covered by one assert. Violations return
423; changing a lock requires workspace admin and returns 403.

* fix(tables): address review — CI snapshot, lock-aware jobs, UI gating

- Add the drizzle meta snapshot the hand-written migration was missing, which
  made CI regenerate the lock columns as a phantom 0271
- Stop a queued or retried delete/update job that starts after its lock is
  enabled; a run that has already committed pages still finishes, since pages
  are never rolled back and aborting would leave an uncancelled half-done state
- Map TableLockedError to 423 on the internal single-row DELETE (was a 500)
- Gate the lock settings UI behind NEXT_PUBLIC_TABLE_LOCKS so it can't open
  onto a Save that 403s against the server-side flag
- Respect the delete lock on column drops in the grid, matching
  assertColumnDestructive, instead of failing only on click

* fix(tables): close lock gaps in async import and undo/redo

- Assert insert (and delete for replace) at the start of the import worker.
  Replace deleted every row before the first insert assert, so an insert-locked
  table was wiped and then failed, leaving it empty.
- Run the delete/update worker start checks through assertRowDelete /
  assertRowUpdate instead of reading the lock flags directly, so the worker and
  its enqueue site apply identical rules — including the workflow-column
  exemption a bulk update was being cancelled despite.
- Make undo/redo verb mapping direction-aware for column ops: dropping or
  retyping a column needs the delete lock clear too, matching
  assertColumnDestructive, so those steps are skipped instead of stranded.

* fix(tables): stop locks over-blocking workflow runs, duplicate, and imports

- Run / Re-run / Stop no longer inherit the cell-edit gate: they write only
  workflow-output columns (which the update lock exempts) and Stop is a cancel
- Duplicate needs only the insert lock — it inserts a full copied row, so it
  stays available on an append-only table
- updateWorkflowGroup asserts the destructive rule only when a patch actually
  drops or remaps output columns; rename / autoRun / mapping edits need just
  the schema lock
- Gate the import-async enqueue on insert (and delete for replace) so a locked
  table 423s instead of claiming the write-job slot and failing in the worker
- Disable Import CSV under an insert lock, and wire the expanded cell editor
  and the previously-unused stable add-row handler to the lock-aware flags

* fix(tables): keep column menu usable and let locks always be cleared

- Pass the blocked-delete handler instead of undefined so ColumnOptionsMenu
  still mounts on a delete-locked table; withholding it hid the entire menu,
  including Insert column, which the delete lock must not affect
- Restore ColumnHeaderMenu readOnly to permission-only: it swaps the header for
  a static label, which was also disabling pin, column-select and open-config
- Assert the schema lock at the import-async enqueue when createColumns is set
- Allow a locks PATCH that only clears locks even when the feature flag is off,
  and keep the settings entry reachable on a locked table, so flipping the kill
  switch can't strand a table with locks nobody can remove

* fix(tables): scope the update-lock exemption and re-check locks per page

- Make the workflow-output carve-out opt-in via `computedWrite`, set only by
  the cell-write path. It was caller-agnostic, so an ordinary API caller could
  PATCH a workflow-output column on an update-locked table
- Re-read the lock before every page in the delete and update runners. The
  single worker-start check went stale immediately, so enabling a lock could
  not stop a job already deleting or overwriting rows. Committed pages still
  stay committed, exactly as with an explicit cancel. Import keeps its
  one-shot check: a half-imported table needs the deletes the lock now forbids
- Route Insert column to the locked-action modal under a schema lock instead
  of leaving it live (regular header) or hiding the whole menu (group header)

* fix(tables): revalidate locks in-transaction and unbreak backfill + partial unlock

- Re-assert the lock inside each page-write transaction, under the same
  advisory lock updateTableLocks takes, so check-then-write is atomic against
  a lock change. The per-page check alone still left the page-selection await
  between the assert and the write
- Pass computedWrite from the backfill runner: batchUpdateRows is the
  workflow-output backfill path, so scoping the exemption had made rebuilding
  outputs 423 on an update-locked table while live cell writes still worked
- Gate the feature flag on a lock actually going off->on rather than on an
  all-false payload. The settings UI always submits all four flags, so with
  the flag off an admin could not clear one lock while another stayed on
- Hoist the lock-kind -> flag map to lib/table/types as TABLE_LOCK_FLAGS

* fix(tables): guard import batches in-transaction and split paste by verb

- Re-assert the insert lock inside each import batch's insert transaction,
  under the same advisory lock updateTableLocks takes. Reversing the earlier
  "let the file finish" call: an admin can lift the lock to clean up a partial
  import, so honouring it beats letting the rest of the file land
- Gate paste per verb. Overwriting existing rows is an update and extending
  past the last row is a full-row insert, so a paste-append still works on an
  append-only table while an overwrite explains itself. Refuses the whole
  paste rather than applying half of it
- Space opens the same row editor as double-click, so it now follows the
  update lock instead of filling in a form that 423s on save

* fix(tables): guard the remaining import writes and explain blocked Shift+Enter

- Route the replace-mode wipe, the inferred-schema write and createColumns
  through the same guardBatch transaction as the batch inserts, so a delete or
  schema lock committed while the file is downloading or being sampled is seen
  instead of the job-start snapshot
- Shift+Enter takes the manual-add path, so it now opens the lock modal like
  the Add row button instead of returning silently

* improvement(tables): surface blocked lock actions as a toast, not a modal

- Replace TableLockedModal with a warning toast carrying a "Lock settings"
  action button for admins. Being told you can't edit shouldn't cost a dismiss
  click, and the button still routes admins straight to the panel
- Dedupe by id so repeated attempts on a locked cell replace one notice
  instead of stacking a column of them
- Move the copy into lock-copy.ts alongside the rest of the lock vocabulary
  and tighten it for toast length

* fix(tables): don't show the update-lock notice to users without write access

Double-click checked the update lock before any permission check, so a
read-only member on a locked table got "Editing rows is locked" — misleading
(the lock isn't why they can't edit) and it swallowed the expanded-cell
viewer, which is a legitimate read-only affordance.

* improvement(tables): trim the update-lock toast copy

* fix(tables): map append-import locks to 423 and stop conflating locks with permissions

- The sync append branch returns instead of rethrowing, so the outer catch's
  mapper never saw a TableLockedError and every lock violation became a 500.
  Map it in that catch, with a regression test (replace mode already rethrows)
- Stop mounting the workflow-group column menu for users without edit access:
  passing the blocked handlers unconditionally made it appear for read-only
  members and report a lock even on an unlocked table
- Enter/F2 now raises the same lock notice as double-click and Space instead
  of silently doing nothing
- guardBatch returns the freshly-read definition so addTableColumnsWithTx
  asserts live state; a schema lock cleared mid-import no longer fails the
  createColumns step. The snapshot pre-asserts now only run as the fallback
  for callers that pass no revalidator
- Append-only no longer labels a table whose schema is also locked, which
  claimed columns were mutable when they weren't
- Import dialog withholds Replace on a delete-locked table and create-column
  on a schema-locked one, instead of offering a configuration that only 423s

* fix(tables): revalidate sync imports under the advisory lock, explain every blocked key

- The sync append/replace paths asserted only the request-start snapshot, so a
  lock committed while the CSV was parsed still let the write through. Both now
  re-read under the schema advisory lock at the top of their own transaction,
  taken before acquireRowOrderLock so the order stays advisory -> rows_pos ->
  definitions
- Delete/Backspace, Cmd+D, typeahead and cut raised no notice on an
  update-locked table; they now explain the lock, and stay silent for users
  without write access
- The multipart import fetch threw a plain Error, dropping the 423 status, so
  the lock self-heal never ran and the stale detail cache survived. It throws
  ApiClientError now and both import-into-table hooks call
  handleTableLockRejection
- Force append at submit when the delete lock landed while the dialog was open
  with Replace already selected

* fix(tables): restore the workspace ownership check on copilot row deletes

Switching deleteRow/deleteRowsByIds to take a TableDefinition dropped the
workspaceId argument that previously scoped the query, and the two branches
I added loaded the table without the ownership comparison every other
operation in the tool performs — letting a caller delete rows from a table
in another workspace. Both now reject a foreign table as not found.

Author: TheodoreSpeaks

apps/sim/app/api/table/[tableId]/columns/route.ts

@@ -19,7 +19,13 @@ import {
   updateColumnType,
 } from '@/lib/table'
 import { columnMatchesRef } from '@/lib/table/column-keys'
-import { accessError, checkAccess, normalizeColumn, rootErrorMessage } from '@/app/api/table/utils'
+import {
+  accessError,
+  checkAccess,
+  normalizeColumn,
+  rootErrorMessage,
+  tableLockErrorResponse,
+} from '@/app/api/table/utils'
 
 const logger = createLogger('TableColumnsAPI')
 
@@ -61,6 +67,8 @@ export const POST = withRouteHandler(async (request: NextRequest, context: Colum
       },
     })
   } catch (error) {
+    const lockError = tableLockErrorResponse(error)
+    if (lockError) return lockError
     if (isZodError(error)) {
       return validationErrorResponse(error, 'Invalid request data')
     }
@@ -190,6 +198,8 @@ export const PATCH = withRouteHandler(async (request: NextRequest, context: Colu
       },
     })
   } catch (error) {
+    const lockError = tableLockErrorResponse(error)
+    if (lockError) return lockError
     if (isZodError(error)) {
       return validationErrorResponse(error, 'Invalid request data')
     }
@@ -255,6 +265,8 @@ export const DELETE = withRouteHandler(
         },
       })
     } catch (error) {
+      const lockError = tableLockErrorResponse(error)
+      if (lockError) return lockError
       if (isZodError(error)) {
         return validationErrorResponse(error, 'Invalid request data')
       }

apps/sim/app/api/table/[tableId]/delete-async/route.ts

@@ -10,6 +10,7 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { markTableDeleteFailed, runTableDelete } from '@/lib/table/delete-runner'
 import { markTableJobRunning, releaseJobClaim } from '@/lib/table/jobs/service'
+import { assertRowDelete } from '@/lib/table/mutation-locks'
 import type { TableDeleteJobPayload } from '@/lib/table/types'
 import { accessError, checkAccess, tableFilterError } from '@/app/api/table/utils'
 
@@ -55,6 +56,11 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
     return NextResponse.json({ error: 'Cannot delete from an archived table' }, { status: 400 })
   }
 
+  // Gate the delete lock at enqueue: an admitted job runs to completion, so the
+  // lock must be checked before the job is created (the worker is a trusted
+  // continuation and does not re-check).
+  assertRowDelete(table)
+
   // Validate the filter up front so the caller gets immediate feedback (the worker reuses it).
   const filterError = tableFilterError(filter, table.schema.columns)
   if (filterError) return filterError

apps/sim/app/api/table/[tableId]/groups/route.ts

@@ -15,7 +15,12 @@ import {
   deleteWorkflowGroup,
   updateWorkflowGroup,
 } from '@/lib/table/workflow-groups/service'
-import { accessError, checkAccess, normalizeColumn } from '@/app/api/table/utils'
+import {
+  accessError,
+  checkAccess,
+  normalizeColumn,
+  tableLockErrorResponse,
+} from '@/app/api/table/utils'
 
 const logger = createLogger('TableWorkflowGroupsAPI')
 
@@ -47,6 +52,8 @@ async function validateWorkflowInWorkspace(
  * share this mapper instead of repeating the if-chain three times.
  */
 function mapWorkflowGroupError(error: unknown, fallbackMessage: string): NextResponse {
+  const lockError = tableLockErrorResponse(error)
+  if (lockError) return lockError
   if (error instanceof Error) {
     const msg = error.message
     if (msg === 'Table not found' || msg.includes('not found')) {

apps/sim/app/api/table/[tableId]/import-async/route.ts

@@ -10,6 +10,7 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { runTableImport, type TableImportPayload } from '@/lib/table/import-runner'
 import { markTableJobRunning, releaseJobClaim } from '@/lib/table/jobs/service'
+import { assertRowDelete, assertRowInsert, assertSchemaMutable } from '@/lib/table/mutation-locks'
 import { getUserSettings } from '@/lib/users/queries'
 import { accessError, checkAccess } from '@/app/api/table/utils'
 
@@ -53,6 +54,12 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
     return NextResponse.json({ error: 'Cannot import into an archived table' }, { status: 400 })
   }
 
+  // Gate the locks before claiming the single write-job slot, so a locked table
+  // reports 423 here instead of holding the slot and failing inside the worker.
+  assertRowInsert(table)
+  if (mode === 'replace') assertRowDelete(table)
+  if (createColumns && createColumns.length > 0) assertSchemaMutable(table)
+
   const ext = fileName.split('.').pop()?.toLowerCase()
   if (ext !== 'csv' && ext !== 'tsv') {
     return NextResponse.json({ error: 'Only CSV and TSV files are supported' }, { status: 400 })

apps/sim/app/api/table/[tableId]/import/route.test.ts

@@ -31,13 +31,18 @@ vi.mock('@sim/utils/id', () => ({
 
 vi.mock('@/app/api/table/utils', async () => {
   const { NextResponse } = await import('next/server')
+  const { TableLockedError } = await import('@/lib/table/mutation-locks')
   return {
     checkAccess: mockCheckAccess,
     accessError: (result: { status: number }) => {
       const message = result.status === 404 ? 'Table not found' : 'Access denied'
       return NextResponse.json({ error: message }, { status: result.status })
     },
     csvProxyBodyCapResponse: () => null,
+    tableLockErrorResponse: (error: unknown) =>
+      error instanceof TableLockedError
+        ? NextResponse.json({ error: error.message, lock: error.lock }, { status: 423 })
+        : null,
     multipartErrorResponse: (error: { code: string; message: string }) =>
       NextResponse.json(
         { error: error.message },
@@ -74,6 +79,7 @@ vi.mock('@/lib/table/billing', () => ({
     limit >= 0 && current + added > limit,
 }))
 
+import { TableLockedError } from '@/lib/table/mutation-locks'
 import { POST } from '@/app/api/table/[tableId]/import/route'
 
 function createCsvFile(contents: string, name = 'data.csv', type = 'text/csv'): File {
@@ -377,6 +383,21 @@ describe('POST /api/table/[tableId]/import', () => {
     expect(data.data?.insertedCount).toBe(0)
   })
 
+  it('maps a lock violation from importAppendRows to 423, not 500', async () => {
+    // The append branch returns instead of rethrowing, so it must map the lock
+    // error itself — the outer catch's mapper never sees it.
+    mockImportAppendRows.mockRejectedValueOnce(new TableLockedError('insert'))
+    const response = await callPost(
+      createFormData(createCsvFile('name,age\nAlice,30'), { mode: 'append' })
+    )
+    expect(response.status).toBe(423)
+    const data = await response.json()
+    expect(data.lock).toBe('insert')
+    // A `details` array would make the client treat it as a validation error
+    // and swallow the toast.
+    expect(data.details).toBeUndefined()
+  })
+
   it('accepts TSV files', async () => {
     const response = await callPost(
       createFormData(

apps/sim/app/api/table/[tableId]/import/route.ts

@@ -44,6 +44,7 @@ import {
   checkAccess,
   csvProxyBodyCapResponse,
   multipartErrorResponse,
+  tableLockErrorResponse,
 } from '@/app/api/table/utils'
 
 const logger = createLogger('TableImportCSVExisting')
@@ -336,6 +337,12 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
           },
         })
       } catch (err) {
+        // This branch returns rather than rethrowing, so the outer catch's
+        // mapper is unreachable from here — map the lock error first or a 423
+        // degrades into a generic 500 (replace mode rethrows and maps fine).
+        const lockError = tableLockErrorResponse(err)
+        if (lockError) return lockError
+
         const message = toError(err).message
         logger.warn(`[${requestId}] Append failed for table ${tableId}`, {
           total: coerced.length,
@@ -408,6 +415,8 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
       throw err
     }
   } catch (error) {
+    const lockError = tableLockErrorResponse(error)
+    if (lockError) return lockError
     if (isMultipartError(error)) return multipartErrorResponse(error)
 
     const message = toError(error).message

apps/sim/app/api/table/[tableId]/route.ts

@@ -1,15 +1,29 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
-import { getTableQuerySchema, renameTableContract } from '@/lib/api/contracts/tables'
+import { getTableQuerySchema, updateTableContract } from '@/lib/api/contracts/tables'
 import { isZodError, parseRequest, validationErrorResponse } from '@/lib/api/server/validation'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
+import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { captureServerEvent } from '@/lib/posthog/server'
-import { deleteTable, renameTable, TableConflictError, type TableSchema } from '@/lib/table'
+import {
+  deleteTable,
+  getTableById,
+  renameTable,
+  TableConflictError,
+  type TableSchema,
+  updateTableLocks,
+} from '@/lib/table'
 import { getWorkspaceTableLimits } from '@/lib/table/billing'
-import { accessError, checkAccess, normalizeColumn } from '@/app/api/table/utils'
+import { TABLE_LOCK_FLAGS, TABLE_LOCK_KINDS } from '@/lib/table/types'
+import {
+  accessError,
+  checkAccess,
+  normalizeColumn,
+  tableLockErrorResponse,
+} from '@/app/api/table/utils'
 
 const logger = createLogger('TableDetailAPI')
 
@@ -65,6 +79,7 @@ export const GET = withRouteHandler(async (request: NextRequest, { params }: Tab
           metadata: table.metadata ?? null,
           rowCount: table.rowCount,
           maxRows: maxRowsPerTable,
+          locks: table.locks,
           createdAt:
             table.createdAt instanceof Date
               ? table.createdAt.toISOString()
@@ -104,7 +119,7 @@ export const PATCH = withRouteHandler(
       }
 
       const parsed = await parseRequest(
-        renameTableContract,
+        updateTableContract,
         request,
         { params },
         {
@@ -116,6 +131,8 @@ export const PATCH = withRouteHandler(
       const { tableId } = parsed.data.params
       const validated = parsed.data.body
 
+      // `write` is the floor for either operation; a `locks` change additionally
+      // requires `admin` (checked below), matching the workflow-lock precedent.
       const result = await checkAccess(tableId, authResult.userId, 'write')
       if (!result.ok) return accessError(result, requestId, tableId)
 
@@ -125,20 +142,56 @@ export const PATCH = withRouteHandler(
         return NextResponse.json({ error: 'Invalid workspace ID' }, { status: 400 })
       }
 
-      const updated = await renameTable(tableId, validated.name, requestId, authResult.userId)
+      if (validated.locks !== undefined) {
+        // With the flag off you may still CLEAR locks — otherwise flipping the
+        // kill switch would strand an already-locked table with no way to
+        // unlock it, while enforcement of those stored locks keeps running.
+        // Only a lock actually transitioning off→on needs the feature enabled;
+        // comparing against the stored state (rather than "every value is
+        // false") is what lets the settings UI, which always submits the full
+        // four-flag draft, clear one lock while another stays on.
+        const enablesALock = TABLE_LOCK_KINDS.some((kind) => {
+          const flag = TABLE_LOCK_FLAGS[kind]
+          return validated.locks?.[flag] === true && !table.locks[flag]
+        })
+        if (enablesALock && !(await isFeatureEnabled('table-locks'))) {
+          return NextResponse.json({ error: 'Table locks are not enabled' }, { status: 403 })
+        }
+        const adminResult = await checkAccess(tableId, authResult.userId, 'admin')
+        if (!adminResult.ok) {
+          return NextResponse.json(
+            { error: 'Admin access required to change table locks' },
+            { status: 403 }
+          )
+        }
+        await updateTableLocks(tableId, validated.locks, authResult.userId, requestId)
+      }
+
+      if (validated.name !== undefined) {
+        await renameTable(tableId, validated.name, requestId, authResult.userId)
+      }
+
+      // Re-read so the response reflects both a rename and a lock change.
+      const updated = await getTableById(tableId)
+      if (!updated) {
+        return NextResponse.json({ error: 'Table not found' }, { status: 404 })
+      }
 
       return NextResponse.json({
         success: true,
         data: { table: updated },
       })
     } catch (error) {
+      const lockError = tableLockErrorResponse(error)
+      if (lockError) return lockError
+
       if (error instanceof TableConflictError) {
         return NextResponse.json({ error: error.message }, { status: 409 })
       }
 
-      logger.error(`[${requestId}] Error renaming table:`, error)
+      logger.error(`[${requestId}] Error updating table:`, error)
       return NextResponse.json(
-        { error: getErrorMessage(error, 'Failed to rename table') },
+        { error: getErrorMessage(error, 'Failed to update table') },
         { status: 500 }
       )
     }
@@ -188,6 +241,8 @@ export const DELETE = withRouteHandler(
         },
       })
     } catch (error) {
+      const lockError = tableLockErrorResponse(error)
+      if (lockError) return lockError
       if (isZodError(error)) {
         return validationErrorResponse(error)
       }

apps/sim/app/api/table/[tableId]/rows/[rowId]/route.ts

@@ -21,6 +21,7 @@ import {
   checkAccess,
   rootErrorMessage,
   rowWriteErrorResponse,
+  tableLockErrorResponse,
 } from '@/app/api/table/utils'
 
 const logger = createLogger('TableRowAPI')
@@ -211,7 +212,7 @@ export const DELETE = withRouteHandler(async (request: NextRequest, context: Row
       return NextResponse.json({ error: 'Invalid workspace ID' }, { status: 400 })
     }
 
-    await deleteRow(tableId, rowId, validated.workspaceId, requestId)
+    await deleteRow(table, rowId, requestId)
 
     return NextResponse.json({
       success: true,
@@ -221,6 +222,9 @@ export const DELETE = withRouteHandler(async (request: NextRequest, context: Row
       },
     })
   } catch (error) {
+    const lockError = tableLockErrorResponse(error)
+    if (lockError) return lockError
+
     const errorMessage = toError(error).message
 
     if (errorMessage === 'Row not found') {

apps/sim/app/api/table/[tableId]/rows/route.ts

@@ -433,6 +433,7 @@ export const DELETE = withRouteHandler(
 
       if (validated.rowIds) {
         const result = await deleteRowsByIds(
+          table,
           { tableId, rowIds: validated.rowIds, workspaceId: validated.workspaceId },
           requestId
         )

apps/sim/app/api/table/route.ts

@@ -127,6 +127,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           },
           rowCount: table.rowCount,
           maxRows: table.maxRows,
+          locks: table.locks,
           createdAt:
             table.createdAt instanceof Date
               ? table.createdAt.toISOString()
@@ -206,6 +207,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
         },
         rowCount: t.rowCount,
         maxRows: t.maxRows,
+        locks: t.locks,
         workspaceId: t.workspaceId,
         createdBy: t.createdBy,
         createdAt: t.createdAt instanceof Date ? t.createdAt.toISOString() : String(t.createdAt),