fix(tables): map append-import locks to 423 and stop conflating locks with permissions

- The sync append branch returns instead of rethrowing, so the outer catch's
  mapper never saw a TableLockedError and every lock violation became a 500.
  Map it in that catch, with a regression test (replace mode already rethrows)
- Stop mounting the workflow-group column menu for users without edit access:
  passing the blocked handlers unconditionally made it appear for read-only
  members and report a lock even on an unlocked table
- Enter/F2 now raises the same lock notice as double-click and Space instead
  of silently doing nothing
- guardBatch returns the freshly-read definition so addTableColumnsWithTx
  asserts live state; a schema lock cleared mid-import no longer fails the
  createColumns step. The snapshot pre-asserts now only run as the fallback
  for callers that pass no revalidator
- Append-only no longer labels a table whose schema is also locked, which
  claimed columns were mutable when they weren't
- Import dialog withholds Replace on a delete-locked table and create-column
  on a schema-locked one, instead of offering a configuration that only 423s

Author: TheodoreSpeaks

apps/sim/app/api/table/[tableId]/import/route.test.ts

@@ -31,13 +31,18 @@ vi.mock('@sim/utils/id', () => ({
 
 vi.mock('@/app/api/table/utils', async () => {
   const { NextResponse } = await import('next/server')
+  const { TableLockedError } = await import('@/lib/table/mutation-locks')
   return {
     checkAccess: mockCheckAccess,
     accessError: (result: { status: number }) => {
       const message = result.status === 404 ? 'Table not found' : 'Access denied'
       return NextResponse.json({ error: message }, { status: result.status })
     },
     csvProxyBodyCapResponse: () => null,
+    tableLockErrorResponse: (error: unknown) =>
+      error instanceof TableLockedError
+        ? NextResponse.json({ error: error.message, lock: error.lock }, { status: 423 })
+        : null,
     multipartErrorResponse: (error: { code: string; message: string }) =>
       NextResponse.json(
         { error: error.message },
@@ -74,6 +79,7 @@ vi.mock('@/lib/table/billing', () => ({
     limit >= 0 && current + added > limit,
 }))
 
+import { TableLockedError } from '@/lib/table/mutation-locks'
 import { POST } from '@/app/api/table/[tableId]/import/route'
 
 function createCsvFile(contents: string, name = 'data.csv', type = 'text/csv'): File {
@@ -377,6 +383,21 @@ describe('POST /api/table/[tableId]/import', () => {
     expect(data.data?.insertedCount).toBe(0)
   })
 
+  it('maps a lock violation from importAppendRows to 423, not 500', async () => {
+    // The append branch returns instead of rethrowing, so it must map the lock
+    // error itself — the outer catch's mapper never sees it.
+    mockImportAppendRows.mockRejectedValueOnce(new TableLockedError('insert'))
+    const response = await callPost(
+      createFormData(createCsvFile('name,age\nAlice,30'), { mode: 'append' })
+    )
+    expect(response.status).toBe(423)
+    const data = await response.json()
+    expect(data.lock).toBe('insert')
+    // A `details` array would make the client treat it as a validation error
+    // and swallow the toast.
+    expect(data.details).toBeUndefined()
+  })
+
   it('accepts TSV files', async () => {
     const response = await callPost(
       createFormData(

apps/sim/app/api/table/[tableId]/import/route.ts

@@ -337,6 +337,12 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
           },
         })
       } catch (err) {
+        // This branch returns rather than rethrowing, so the outer catch's
+        // mapper is unreachable from here — map the lock error first or a 423
+        // degrades into a generic 500 (replace mode rethrows and maps fine).
+        const lockError = tableLockErrorResponse(err)
+        if (lockError) return lockError
+
         const message = toError(err).message
         logger.warn(`[${requestId}] Append failed for table ${tableId}`, {
           total: coerced.length,

apps/sim/app/workspace/[workspaceId]/tables/[tableId]/components/table-grid/table-grid.tsx

@@ -2277,8 +2277,15 @@ export function TableGrid({
       }
 
       if (e.key === 'Enter' || e.key === 'F2') {
-        if (!canEditCellRef.current) return
+        if (!canEditRef.current) return
         e.preventDefault()
+        // The primary keyboard edit path — same lock notice as double-click and
+        // Space, rather than a keypress that silently does nothing.
+        if (updateLockedRef.current) {
+          onBlockedActionRef.current('edit-cell')
+          return
+        }
+        if (!canEditCellRef.current) return
         const col = cols[anchor.colIndex]
         if (!col) return
 
@@ -3773,18 +3780,32 @@ export function TableGrid({
                                 // the whole menu — and each item should explain the lock
                                 // rather than silently vanish or fail with a 423 toast.
                                 onInsertLeft={
-                                  canMutateSchema ? handleInsertColumnLeft : handleBlockedAddColumn
+                                  !userPermissions.canEdit
+                                    ? undefined
+                                    : canMutateSchema
+                                      ? handleInsertColumnLeft
+                                      : handleBlockedAddColumn
                                 }
                                 onInsertRight={
-                                  canMutateSchema ? handleInsertColumnRight : handleBlockedAddColumn
+                                  !userPermissions.canEdit
+                                    ? undefined
+                                    : canMutateSchema
+                                      ? handleInsertColumnRight
+                                      : handleBlockedAddColumn
                                 }
                                 onDeleteColumn={
-                                  canDestroyColumn ? handleDeleteColumn : handleBlockedDeleteColumn
+                                  !userPermissions.canEdit
+                                    ? undefined
+                                    : canDestroyColumn
+                                      ? handleDeleteColumn
+                                      : handleBlockedDeleteColumn
                                 }
                                 onDeleteGroup={
-                                  canDestroyColumn
-                                    ? handleDeleteWorkflowGroup
-                                    : handleBlockedDeleteColumn
+                                  !userPermissions.canEdit
+                                    ? undefined
+                                    : canDestroyColumn
+                                      ? handleDeleteWorkflowGroup
+                                      : handleBlockedDeleteColumn
                                 }
                                 onViewWorkflow={
                                   workflowGroupById.get(g.groupId)?.type === 'enrichment'
@@ -3867,6 +3888,8 @@ export function TableGrid({
                             onRenameSubmit={columnRename.submitRename}
                             onRenameCancel={columnRename.cancelRename}
                             onColumnSelect={handleColumnSelect}
+                            // Required props here, and the menu is already
+                            // suppressed for non-editors by `readOnly`.
                             onInsertLeft={
                               canMutateSchema ? handleInsertColumnLeft : handleBlockedAddColumn
                             }

apps/sim/app/workspace/[workspaceId]/tables/[tableId]/lock-copy.ts

@@ -60,7 +60,9 @@ export function describeLocks(locks: TableLocks): { name: string; detail: string
   if (locked.length === LOCK_FIELDS.length) {
     return { name: 'Read-only', detail: 'no one can change this table’s rows or columns.' }
   }
-  if (!locks.insertLocked && locks.updateLocked && locks.deleteLocked) {
+  // Only the exact three-lock shape is Append-only — with the schema locked too
+  // the chip would claim columns are mutable when they aren't.
+  if (!locks.insertLocked && locks.updateLocked && locks.deleteLocked && !locks.schemaLocked) {
     return { name: 'Append-only', detail: 'rows can be added, but not edited or deleted.' }
   }
   return { name: 'Locked', detail: `${locked.join(', ')} locked.` }

apps/sim/app/workspace/[workspaceId]/tables/components/import-csv-dialog/import-csv-dialog.tsx

@@ -175,10 +175,16 @@ export function ImportCsvDialog({
     resetState()
   }
 
+  // Replace deletes every existing row and creating columns is a schema change,
+  // so each needs its own lock clear. Withholding them here keeps the dialog
+  // from offering a configuration the server can only answer with a 423.
+  const canReplace = !table.locks?.deleteLocked
+  const canCreateColumns = !table.locks?.schemaLocked
+
   const columnOptions: ComboboxOption[] = useMemo(() => {
     const options: ComboboxOption[] = [
       { label: 'Do not import', value: SKIP_VALUE },
-      { label: '+ Create new column', value: CREATE_VALUE },
+      ...(canCreateColumns ? [{ label: '+ Create new column', value: CREATE_VALUE }] : []),
     ]
     for (const col of table.schema.columns) {
       options.push({
@@ -187,7 +193,7 @@ export function ImportCsvDialog({
       })
     }
     return options
-  }, [table.schema.columns])
+  }, [table.schema.columns, canCreateColumns])
 
   async function handleFileSelected(file: File) {
     const ext = file.name.split('.').pop()?.toLowerCase()
@@ -257,6 +263,7 @@ export function ImportCsvDialog({
 
   function handleModeChange(value: string) {
     setSubmitError(null)
+    if (value === 'replace' && !canReplace) return
     setMode(value as CsvImportMode)
   }
 
@@ -307,7 +314,8 @@ export function ImportCsvDialog({
   async function handleSubmit() {
     if (!parsed || !canSubmit) return
     setSubmitError(null)
-    const createColumns = createHeaders.size > 0 ? [...createHeaders] : undefined
+    const createColumns =
+      canCreateColumns && createHeaders.size > 0 ? [...createHeaders] : undefined
 
     // Large files can't be POSTed through the server (request-body cap) — upload them
     // straight to storage and import in the background instead. Seed the header tray and
@@ -426,14 +434,19 @@ export function ImportCsvDialog({
             <ChipModalField type='custom' title='Mode'>
               <ButtonGroup value={mode} onValueChange={handleModeChange}>
                 <ButtonGroupItem value='append'>Append</ButtonGroupItem>
-                <ButtonGroupItem value='replace'>Replace all rows</ButtonGroupItem>
+                {canReplace && <ButtonGroupItem value='replace'>Replace all rows</ButtonGroupItem>}
               </ButtonGroup>
             </ChipModalField>
 
             <ChipModalField type='custom' title='Column mapping'>
               {skipCount > 0 && (
                 <div className='flex justify-end'>
-                  <Button variant='ghost' size='sm' onClick={handleCreateAllUnmapped}>
+                  <Button
+                    variant='ghost'
+                    size='sm'
+                    disabled={!canCreateColumns}
+                    onClick={handleCreateAllUnmapped}
+                  >
                     Create columns for {skipCount} unmapped
                   </Button>
                 </div>

apps/sim/lib/table/delete-runner.ts

@@ -104,6 +104,7 @@ export async function runTableDelete(payload: TableDeletePayload): Promise<void>
     const revalidate = async (trx: DbTransaction) => {
       const fresh = await getTableById(tableId, { tx: trx, includeArchived: true })
       if (fresh) assertRowDelete(fresh)
+      return fresh ?? undefined
     }
 
     const filterClause = filter

apps/sim/lib/table/import-data.ts

@@ -69,7 +69,9 @@ export async function bulkInsertImportBatch(
   /** Re-asserts the insert lock inside the write transaction. See {@link guardBatch}. */
   revalidate?: MutationRevalidator
 ): Promise<{ inserted: number; lastOrderKey: string | null }> {
-  assertRowInsert(table)
+  // Superseded by the in-tx revalidation when one is supplied; asserting
+  // the caller's snapshot too would reject a since-cleared lock.
+  if (!revalidate) assertRowInsert(table)
 
   for (let i = 0; i < data.rows.length; i++) {
     const sizeValidation = validateRowSize(data.rows[i])
@@ -130,7 +132,9 @@ export async function deleteAllTableRows(
   /** Re-asserts the delete lock inside the write transaction. See {@link guardBatch}. */
   revalidate?: MutationRevalidator
 ): Promise<void> {
-  assertRowDelete(table)
+  // Superseded by the in-tx revalidation when one is supplied; asserting
+  // the caller's snapshot too would reject a since-cleared lock.
+  if (!revalidate) assertRowDelete(table)
   await db.transaction(async (trx) => {
     await guardBatch(trx, table.id, revalidate)
     await trx.delete(userTableRows).where(eq(userTableRows.tableId, table.id))
@@ -150,8 +154,11 @@ export async function addImportColumns(
   revalidate?: MutationRevalidator
 ): Promise<TableDefinition> {
   const updated = await db.transaction(async (trx) => {
-    await guardBatch(trx, table.id, revalidate)
-    return addTableColumnsWithTx(trx, table, additions, requestId)
+    // `addTableColumnsWithTx` re-asserts the schema lock, so hand it the
+    // freshly-read definition — asserting the caller's snapshot would reject a
+    // lock that has since been cleared.
+    const fresh = await guardBatch(trx, table.id, revalidate)
+    return addTableColumnsWithTx(trx, fresh ?? table, additions, requestId)
   })
   auditTableColumnsAdded(
     table,
@@ -168,7 +175,9 @@ export async function setTableSchemaForImport(
   /** Re-asserts the schema lock inside the write transaction. See {@link guardBatch}. */
   revalidate?: MutationRevalidator
 ): Promise<void> {
-  assertSchemaMutable(table)
+  // Superseded by the in-tx revalidation when one is supplied; asserting
+  // the caller's snapshot too would reject a since-cleared lock.
+  if (!revalidate) assertSchemaMutable(table)
   await db.transaction(async (trx) => {
     await guardBatch(trx, table.id, revalidate)
     await trx

apps/sim/lib/table/import-runner.ts

@@ -114,16 +114,19 @@ export async function runTableImport(payload: TableImportPayload): Promise<void>
     const revalidateInsert = async (trx: DbTransaction) => {
       const fresh = await getTableById(tableId, { tx: trx, includeArchived: true })
       if (fresh) assertRowInsert(fresh)
+      return fresh ?? undefined
     }
     /** Same guard for the replace-mode wipe, which lands before the first batch. */
     const revalidateDelete = async (trx: DbTransaction) => {
       const fresh = await getTableById(tableId, { tx: trx, includeArchived: true })
       if (fresh) assertRowDelete(fresh)
+      return fresh ?? undefined
     }
     /** Same guard for the inferred-schema write and `createColumns`. */
     const revalidateSchema = async (trx: DbTransaction) => {
       const fresh = await getTableById(tableId, { tx: trx, includeArchived: true })
       if (fresh) assertSchemaMutable(fresh)
+      return fresh ?? undefined
     }
 
     // Total byte size for the progress estimate — a cheap HEAD, no download. May be null on

apps/sim/lib/table/rows/ordering.ts

@@ -15,7 +15,7 @@ import type { MutationProof } from '@/lib/table/mutation-locks'
 import { keyBetween, nKeysBetween } from '@/lib/table/order-key'
 import { type DbExecutor, type DbTransaction, withSeqscanOff } from '@/lib/table/planner'
 import { setTableTxTimeouts } from '@/lib/table/tx'
-import type { RowData } from '@/lib/table/types'
+import type { RowData, TableDefinition } from '@/lib/table/types'
 
 /**
  * Starting `position` for an append import — `max(position) + 1`, or 0 when empty. Read once,
@@ -399,7 +399,7 @@ export async function selectRowDataPage(params: {
  * Re-verifies the table's locks from inside a write transaction. Supplied by
  * the background runners; see {@link deletePageByIds}.
  */
-export type MutationRevalidator = (trx: DbTransaction) => Promise<void>
+export type MutationRevalidator = (trx: DbTransaction) => Promise<TableDefinition | undefined>
 
 /**
  * Takes the table's schema advisory lock and runs `revalidate` inside the
@@ -408,17 +408,20 @@ export type MutationRevalidator = (trx: DbTransaction) => Promise<void>
  * a lock committed before this call is seen and throws; one committed after it
  * waits for this batch to finish. Without it, the caller's proof would only
  * describe the lock state at some earlier point in the run.
+ *
+ * Returns the freshly-read definition so tx-bound helpers can act on live state
+ * instead of the caller's snapshot.
  */
 export async function guardBatch(
   trx: DbTransaction,
   tableId: string,
   revalidate: MutationRevalidator | undefined
-): Promise<void> {
-  if (!revalidate) return
+): Promise<TableDefinition | undefined> {
+  if (!revalidate) return undefined
   await trx.execute(
     sql`SELECT pg_advisory_xact_lock(hashtextextended(${`user_table_schema:${tableId}`}, 0))`
   )
-  await revalidate(trx)
+  return revalidate(trx)
 }
 
 /**

apps/sim/lib/table/update-runner.ts

@@ -112,6 +112,7 @@ export async function runTableUpdate(payload: TableUpdatePayload): Promise<void>
     const revalidate = async (trx: DbTransaction) => {
       const fresh = await getTableById(tableId, { tx: trx, includeArchived: true })
       if (fresh) assertRowUpdate(fresh, patchColumnIds(data))
+      return fresh ?? undefined
     }
 
     const filterClause = buildFilterClause(filter, USER_TABLE_ROWS_SQL_NAME, table.schema.columns)