fix(tables): resolve the lock flag with the same context on both gates

The page passed userId/orgId while the PATCH gate resolved the flag with no
context, so an org- or user-targeted rollout would show the settings panel and
then 403 on save — the rollout path the previous commit exists to enable.

Both now key on the workspace's host organization rather than the viewer's
active one, matching the convention getWorkspaceHostContextForViewer
documents: active-org describes the account, not the workspace host. The
route's lookup runs only when a lock is actually being turned on.

Author: TheodoreSpeaks

apps/sim/app/api/table/[tableId]/route.ts

@@ -18,6 +18,7 @@ import {
 } from '@/lib/table'
 import { getWorkspaceTableLimits } from '@/lib/table/billing'
 import { TABLE_LOCK_FLAGS, TABLE_LOCK_KINDS } from '@/lib/table/types'
+import { getWorkspaceWithOwner } from '@/lib/workspaces/permissions/utils'
 import {
   accessError,
   checkAccess,
@@ -154,8 +155,20 @@ export const PATCH = withRouteHandler(
           const flag = TABLE_LOCK_FLAGS[kind]
           return validated.locks?.[flag] === true && !table.locks[flag]
         })
-        if (enablesALock && !(await isFeatureEnabled('table-locks'))) {
-          return NextResponse.json({ error: 'Table locks are not enabled' }, { status: 403 })
+        if (enablesALock) {
+          // Resolve with the same context the page uses to decide whether to
+          // show the panel — keyed on the workspace's host organization, not
+          // the viewer's active one. Without it an org- or user-targeted
+          // rollout would open the panel and then 403 on save. Looked up only
+          // on the enabling path, so an unlock never pays for it.
+          const workspace = await getWorkspaceWithOwner(table.workspaceId)
+          const enabled = await isFeatureEnabled('table-locks', {
+            userId: authResult.userId,
+            orgId: workspace?.organizationId ?? undefined,
+          })
+          if (!enabled) {
+            return NextResponse.json({ error: 'Table locks are not enabled' }, { status: 403 })
+          }
         }
         const adminResult = await checkAccess(tableId, authResult.userId, 'admin')
         if (!adminResult.ok) {

apps/sim/app/workspace/[workspaceId]/tables/[tableId]/page.tsx

@@ -1,30 +1,39 @@
 import { Suspense } from 'react'
 import type { Metadata } from 'next'
 import { getSession } from '@/lib/auth'
-import { getActiveOrganizationId } from '@/lib/auth/session-response'
 import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
+import { getWorkspaceHostContextForViewer } from '@/lib/workspaces/host-context'
 import TableLoading from '@/app/workspace/[workspaceId]/tables/[tableId]/loading'
 import { Table } from './table'
 
 export const metadata: Metadata = {
   title: 'Table',
 }
 
+interface TablePageProps {
+  params: Promise<{ workspaceId: string }>
+}
+
 /**
  * Table-detail page entry. `Table` reads URL query params via nuqs (which uses
  * `useSearchParams` internally), so it must sit under a Suspense boundary. The
  * fallback renders the real chrome so a suspend never shows a blank frame.
  *
  * The lock flag is resolved here rather than mirrored into a `NEXT_PUBLIC_` var:
  * gating lives in AppConfig, which has no client counterpart, so resolving it
- * server-side is the only way its org/user clauses reach the UI. `getSession`
- * is request-cached, so this reuses the layout's read.
+ * server-side is the only way its org/user clauses reach the UI. The org is the
+ * workspace's host organization, not the viewer's active one — the same key the
+ * PATCH gate uses, so the panel can't open onto a Save that 403s. Both
+ * `getSession` and the host context are request-memoized, so this reuses the
+ * layout's reads.
  */
-export default async function TablePage() {
-  const session = await getSession()
+export default async function TablePage({ params }: TablePageProps) {
+  const [{ workspaceId }, session] = await Promise.all([params, getSession()])
+  const userId = session?.user?.id
+  const host = userId ? await getWorkspaceHostContextForViewer(workspaceId, userId) : null
   const tableLocksEnabled = await isFeatureEnabled('table-locks', {
-    userId: session?.user?.id,
-    orgId: getActiveOrganizationId(session) ?? undefined,
+    userId,
+    orgId: host?.hostOrganizationId ?? undefined,
   })
 
   return (