improvement(tables): resolve the lock flag server-side and record lock changes fully

- Drop NEXT_PUBLIC_TABLE_LOCKS. A feature flag's gating lives in AppConfig,
  which has no client counterpart, so mirroring it into a public env var meant
  AppConfig couldn't control the UI at all and org/user clauses could never
  reach the client — only global on/off. The page now resolves the flag with
  session context and passes it down, per the add-feature-flag skill. Embedded
  renders default to false, failing closed; enforcement of stored locks is
  unaffected either way
- Record the previous locks alongside the new ones and name the transitions in
  the audit description, so the log answers who locked what without expanding
  metadata. Forward the request for IP / user-agent capture

Author: TheodoreSpeaks

apps/sim/app/api/table/[tableId]/route.ts

@@ -164,7 +164,7 @@ export const PATCH = withRouteHandler(
             { status: 403 }
           )
         }
-        await updateTableLocks(tableId, validated.locks, authResult.userId, requestId)
+        await updateTableLocks(tableId, validated.locks, authResult.userId, requestId, request)
       }
 
       if (validated.name !== undefined) {

apps/sim/app/workspace/[workspaceId]/tables/[tableId]/page.tsx

@@ -1,5 +1,8 @@
 import { Suspense } from 'react'
 import type { Metadata } from 'next'
+import { getSession } from '@/lib/auth'
+import { getActiveOrganizationId } from '@/lib/auth/session-response'
+import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
 import TableLoading from '@/app/workspace/[workspaceId]/tables/[tableId]/loading'
 import { Table } from './table'
 
@@ -11,11 +14,22 @@ export const metadata: Metadata = {
  * Table-detail page entry. `Table` reads URL query params via nuqs (which uses
  * `useSearchParams` internally), so it must sit under a Suspense boundary. The
  * fallback renders the real chrome so a suspend never shows a blank frame.
+ *
+ * The lock flag is resolved here rather than mirrored into a `NEXT_PUBLIC_` var:
+ * gating lives in AppConfig, which has no client counterpart, so resolving it
+ * server-side is the only way its org/user clauses reach the UI. `getSession`
+ * is request-cached, so this reuses the layout's read.
  */
-export default function TablePage() {
+export default async function TablePage() {
+  const session = await getSession()
+  const tableLocksEnabled = await isFeatureEnabled('table-locks', {
+    userId: session?.user?.id,
+    orgId: getActiveOrganizationId(session) ?? undefined,
+  })
+
   return (
     <Suspense fallback={<TableLoading />}>
-      <Table />
+      <Table tableLocksEnabled={tableLocksEnabled} />
     </Suspense>
   )
 }

apps/sim/app/workspace/[workspaceId]/tables/[tableId]/table.tsx

@@ -8,7 +8,6 @@ import { useParams, useRouter } from 'next/navigation'
 import { useQueryStates } from 'nuqs'
 import { usePostHog } from 'posthog-js/react'
 import type { RunLimit, RunMode } from '@/lib/api/contracts/tables'
-import { getEnv, isTruthy } from '@/lib/core/config/env'
 import { captureEvent } from '@/lib/posthog/client'
 import type {
   ColumnDefinition,
@@ -78,14 +77,6 @@ import { generateColumnName } from './utils'
 
 const logger = createLogger('Table')
 
-/**
- * Client mirror of the server's `table-locks` flag. Hides the settings entry
- * point when locks can't be set, so the panel never opens onto a Save that
- * 403s. An already-locked table still shows its state regardless, so the
- * gating stays legible if the flag is turned off after locks were applied.
- */
-const tableLocksEnabled = isTruthy(getEnv('NEXT_PUBLIC_TABLE_LOCKS'))
-
 /** Blocked-action toasts carry a button, so they linger past the 5s default. */
 const BLOCKED_TOAST_MS = 8000
 
@@ -96,6 +87,13 @@ interface TableProps {
   /** Identifiers — only set in embedded mode. Page mode reads from `useParams()`. */
   workspaceId?: string
   tableId?: string
+  /**
+   * Whether an admin may CHANGE locks, resolved server-side by the page (the
+   * flag's gating lives in AppConfig and has no client counterpart). Defaults
+   * to false so embedded renders, which have no server resolution, fail closed
+   * — enforcement of stored locks is unaffected either way.
+   */
+  tableLocksEnabled?: boolean
 }
 
 /**
@@ -152,6 +150,7 @@ export function Table({
   embedded,
   workspaceId: propWorkspaceId,
   tableId: propTableId,
+  tableLocksEnabled = false,
 }: TableProps = {}) {
   const params = useParams()
   const router = useRouter()

apps/sim/lib/core/config/env.ts

@@ -572,7 +572,6 @@ export const env = createEnv({
     NEXT_PUBLIC_SSO_ENABLED:               z.boolean().optional(),                   // Enable SSO login UI components
     NEXT_PUBLIC_ACCESS_CONTROL_ENABLED:    z.boolean().optional(),                   // Enable access control (permission groups) on self-hosted
     NEXT_PUBLIC_CUSTOM_BLOCKS_ENABLED:     z.boolean().optional(),                   // Enable custom blocks (deploy-as-block) settings on self-hosted
-    NEXT_PUBLIC_TABLE_LOCKS:               z.boolean().optional(),                   // Surface the per-table mutation-lock settings UI (client mirror of the server-side TABLE_LOCKS gate)
     NEXT_PUBLIC_WHITELABELING_ENABLED:     z.boolean().optional(),                   // Enable whitelabeling on self-hosted (bypasses hosted requirements)
     NEXT_PUBLIC_AUDIT_LOGS_ENABLED:        z.boolean().optional(),                   // Enable audit logs on self-hosted (bypasses hosted requirements)
     NEXT_PUBLIC_DATA_RETENTION_ENABLED:   z.boolean().optional(),                   // Enable data retention settings on self-hosted (bypasses hosted requirements)
@@ -614,7 +613,6 @@ export const env = createEnv({
     NEXT_PUBLIC_SSO_ENABLED: process.env.NEXT_PUBLIC_SSO_ENABLED,
     NEXT_PUBLIC_ACCESS_CONTROL_ENABLED: process.env.NEXT_PUBLIC_ACCESS_CONTROL_ENABLED,
     NEXT_PUBLIC_CUSTOM_BLOCKS_ENABLED: process.env.NEXT_PUBLIC_CUSTOM_BLOCKS_ENABLED,
-    NEXT_PUBLIC_TABLE_LOCKS: process.env.NEXT_PUBLIC_TABLE_LOCKS,
     NEXT_PUBLIC_WHITELABELING_ENABLED: process.env.NEXT_PUBLIC_WHITELABELING_ENABLED,
     NEXT_PUBLIC_AUDIT_LOGS_ENABLED: process.env.NEXT_PUBLIC_AUDIT_LOGS_ENABLED,
     NEXT_PUBLIC_DATA_RETENTION_ENABLED: process.env.NEXT_PUBLIC_DATA_RETENTION_ENABLED,

apps/sim/lib/table/service.ts

@@ -27,6 +27,8 @@ import type { DbTransaction } from '@/lib/table/planner'
 import { setTableTxTimeouts } from '@/lib/table/tx'
 import {
   type CreateTableData,
+  TABLE_LOCK_FLAGS,
+  TABLE_LOCK_KINDS,
   type TableDefinition,
   type TableLocks,
   type TableMetadata,
@@ -627,9 +629,13 @@ export async function updateTableLocks(
   tableId: string,
   partial: Partial<TableLocks>,
   actingUserId: string,
-  requestId: string
+  requestId: string,
+  /** Forwarded to the audit record for IP / user-agent capture. */
+  request?: { headers: { get(name: string): string | null } }
 ): Promise<TableDefinition> {
+  let previousLocks: TableLocks = UNLOCKED_TABLE_LOCKS
   const updated = await withLockedTable(tableId, async (table, trx) => {
+    previousLocks = table.locks
     const nextLocks: TableLocks = { ...table.locks, ...partial }
     const now = new Date()
     await trx
@@ -639,15 +645,28 @@ export async function updateTableLocks(
     return { ...table, locks: nextLocks, updatedAt: now }
   })
 
+  // Name the transitions in the description so the audit list is readable
+  // without expanding metadata — "who locked my production table" is the
+  // question this feature exists to answer.
+  const flipped = TABLE_LOCK_KINDS.filter(
+    (kind) => previousLocks[TABLE_LOCK_FLAGS[kind]] !== updated.locks[TABLE_LOCK_FLAGS[kind]]
+  )
+  const description = flipped.length
+    ? `Table locks changed: ${flipped
+        .map((kind) => `${kind} ${updated.locks[TABLE_LOCK_FLAGS[kind]] ? 'locked' : 'unlocked'}`)
+        .join(', ')}`
+    : 'Updated table locks (no change)'
+
   recordAudit({
     workspaceId: updated.workspaceId,
     actorId: actingUserId,
     action: AuditAction.TABLE_UPDATED,
     resourceType: AuditResourceType.TABLE,
     resourceId: tableId,
     resourceName: updated.name,
-    description: 'Updated table locks',
-    metadata: { op: 'update_locks', locks: updated.locks },
+    description,
+    metadata: { op: 'update_locks', before: previousLocks, after: updated.locks },
+    ...(request ? { request } : {}),
   })
 
   await appendTableEvent({ kind: 'definition', tableId, reason: 'locks' }).catch((error) => {