refactor(tables): take capability from grants, not the permission context

Step 4, and the step where a mistake would actually change who can do what.
45 permission reads converted:

- 38 `userPermissions.canEdit` -> `grants.write`. Mechanically, with no
  exceptions: `grants.run` is `canEdit || canRead`, so a single slip on one of
  the run/stop controls would have handed a read-only member the ability to
  trigger workflow runs from the panel. Verified zero `grants.run` references
  survive in the tables tree outside one TSDoc that explains the hazard.
- 4 `userPermissions.canAdmin` -> `grants.manage`, all of them lock settings.
- 2 `userPermissions.isLoading` -> `!grants.settled`. This is the one that
  needed the axis extension: the lock notice is a one-shot latched on
  `announcedLockTableIdRef`, so firing it before capabilities resolve
  permanently yields a toast whose "Lock settings" action is missing.

`page.tsx` is a Server Component and cannot read a React context, so the table
route gains a ~40-line client shell (`table-route.tsx`) that resolves the axes
and mounts the view — the same shape as `fullscreen-file-view.tsx`. Reading
`useParams()` there is legitimate where it was not inside the table: a route
shell exists exactly once per page by definition, which is precisely the
property the table lost when the panel started mounting it too.

The panel already computed `grants` for its file and log branches; the table
branch now passes the same value.

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/resource-content.tsx

@@ -314,6 +314,7 @@ export const ResourceContent = memo(function ResourceContent({
         <Table
           key={resource.id}
           host='panel'
+          grants={grants}
           workspaceId={workspaceId}
           tableId={resource.id}
           viewsEnabled={tableViewsEnabled}

apps/sim/app/workspace/[workspaceId]/tables/[tableId]/components/table-grid/table-grid.tsx

@@ -63,7 +63,6 @@ import type {
 import { getColumnId } from '@/lib/table/column-keys'
 import { columnTypeOf } from '@/lib/table/column-types'
 import { TABLE_LIMITS } from '@/lib/table/constants'
-import { useUserPermissionsContext } from '@/app/workspace/[workspaceId]/providers/workspace-permissions-provider'
 import type { BlockedTableAction } from '@/app/workspace/[workspaceId]/tables/[tableId]/lock-copy'
 import { useTimezone } from '@/hooks/queries/general-settings'
 import {
@@ -83,6 +82,7 @@ import {
 import { useAddToChat } from '@/hooks/use-add-to-chat'
 import { useInlineRename } from '@/hooks/use-inline-rename'
 import { extractCreatedRowId, useTableUndo } from '@/hooks/use-table-undo'
+import type { ResourceGrants } from '@/resources'
 import type { ChatContext } from '@/stores/panel'
 import type { DeletedRowSnapshot } from '@/stores/table/types'
 import { useContextMenu, useTable } from '../../hooks'
@@ -171,6 +171,12 @@ interface TableGridProps {
    */
   workspaceId: string
   tableId: string
+  /**
+   * What this viewer may do. `grants.write` replaces every `canEdit` read: it is
+   * `canEdit` exactly, and deliberately NOT `grants.run`, which is
+   * `canEdit || canRead` and would hand a read-only member the run controls.
+   */
+  grants: ResourceGrants
   embedded?: boolean
   /** Remote collaborators' cell selections, rendered as presence overlays. */
   remoteSelections: RemoteTableSelection[]
@@ -425,6 +431,7 @@ async function chunkBatchUpdates(
 export function TableGrid({
   workspaceId,
   tableId,
+  grants,
   embedded,
   remoteSelections,
   emitCellSelection,
@@ -651,27 +658,26 @@ export function TableGrid({
     if (measured > 0 && Math.abs(measured - rowHeight) >= 0.5) setRowHeight(measured)
   }, [isLoadingTable, isLoadingRows, rowHeight])
 
-  const userPermissions = useUserPermissionsContext()
-  const canEditRef = useRef(userPermissions.canEdit)
-  canEditRef.current = userPermissions.canEdit
+  const canEditRef = useRef(grants.write)
+  canEditRef.current = grants.write
 
-  const canEditCell = userPermissions.canEdit && !locks?.updateLocked
-  const canDeleteRow = userPermissions.canEdit && !locks?.deleteLocked
-  const canMutateSchema = userPermissions.canEdit && !locks?.schemaLocked
+  const canEditCell = grants.write && !locks?.updateLocked
+  const canDeleteRow = grants.write && !locks?.deleteLocked
+  const canMutateSchema = grants.write && !locks?.schemaLocked
   // Dropping or retyping a column rewrites every row's data, so `assertColumnDestructive`
   // requires the delete lock clear too — mirror that here or the affordance
   // stays live on an append-only table and only fails on click.
   const canDestroyColumn = canMutateSchema && !locks?.deleteLocked
   // Duplicate inserts a full copied row in one shot, so unlike the blank-row
   // paths it needs the insert lock only — it is valid on an append-only table.
-  const canInsertFullRow = userPermissions.canEdit && !locks?.insertLocked
+  const canInsertFullRow = grants.write && !locks?.insertLocked
   // Manual grid entry is "add an empty row, then type into its cells" — the
   // typing is an update. So a *useful* manual add needs BOTH insert and update
   // unlocked; on an append-only table (update locked) it would leave a blank
   // row the user can't fill. The control stays visible and explains itself via
   // `onBlockedAction`. Full-row inserts still flow through CSV import / API /
   // blocks / Mothership, which the insert lock alone governs server-side.
-  const canManualAddRow = userPermissions.canEdit && !locks?.insertLocked && !locks?.updateLocked
+  const canManualAddRow = grants.write && !locks?.insertLocked && !locks?.updateLocked
   const canEditCellRef = useRef(canEditCell)
   canEditCellRef.current = canEditCell
   const canManualAddRowRef = useRef(canManualAddRow)
@@ -4292,7 +4298,7 @@ export function TableGrid({
                                 groupName={workflowGroupById.get(g.groupId)?.name}
                                 onSelectGroup={handleGroupSelect}
                                 onOpenConfig={() => handleConfigureWorkflowGroup(g.groupId)}
-                                onRunColumn={userPermissions.canEdit ? handleRunColumn : undefined}
+                                onRunColumn={grants.write ? handleRunColumn : undefined}
                                 hasActiveFilter={Boolean(effectiveFilter)}
                                 selectedRowIds={selectedRowIds}
                                 // Every locked action passes its blocked handler rather
@@ -4301,28 +4307,28 @@ export function TableGrid({
                                 // the whole menu — and each item should explain the lock
                                 // rather than silently vanish or fail with a 423 toast.
                                 onInsertLeft={
-                                  !userPermissions.canEdit
+                                  !grants.write
                                     ? undefined
                                     : canMutateSchema
                                       ? handleInsertColumnLeft
                                       : handleBlockedAddColumn
                                 }
                                 onInsertRight={
-                                  !userPermissions.canEdit
+                                  !grants.write
                                     ? undefined
                                     : canMutateSchema
                                       ? handleInsertColumnRight
                                       : handleBlockedAddColumn
                                 }
                                 onDeleteColumn={
-                                  !userPermissions.canEdit
+                                  !grants.write
                                     ? undefined
                                     : canDestroyColumn
                                       ? handleDeleteColumn
                                       : handleBlockedDeleteColumn
                                 }
                                 onDeleteGroup={
-                                  !userPermissions.canEdit
+                                  !grants.write
                                     ? undefined
                                     : canDestroyColumn
                                       ? handleDeleteWorkflowGroup
@@ -4333,21 +4339,13 @@ export function TableGrid({
                                     ? undefined
                                     : handleViewWorkflow
                                 }
-                                readOnly={!userPermissions.canEdit}
-                                onDragStart={
-                                  userPermissions.canEdit ? handleColumnDragStart : undefined
-                                }
-                                onDragOver={
-                                  userPermissions.canEdit ? handleColumnDragOver : undefined
-                                }
-                                onDragEnd={
-                                  userPermissions.canEdit ? handleColumnDragEnd : undefined
-                                }
-                                onDragLeave={
-                                  userPermissions.canEdit ? handleColumnDragLeave : undefined
-                                }
+                                readOnly={!grants.write}
+                                onDragStart={grants.write ? handleColumnDragStart : undefined}
+                                onDragOver={grants.write ? handleColumnDragOver : undefined}
+                                onDragEnd={grants.write ? handleColumnDragEnd : undefined}
+                                onDragLeave={grants.write ? handleColumnDragLeave : undefined}
                                 isPinned={firstCol ? pinnedColumnSet.has(firstCol.key) : false}
-                                onPinToggle={userPermissions.canEdit ? handlePinToggle : undefined}
+                                onPinToggle={grants.write ? handlePinToggle : undefined}
                                 stickyLeft={stickyLeft}
                                 isLastPinned={lastCol?.key === lastPinnedColKey}
                               />
@@ -4370,7 +4368,7 @@ export function TableGrid({
                             />
                           )
                         })}
-                        {userPermissions.canEdit && (
+                        {grants.write && (
                           <th className='border-[var(--border)] border-b bg-[var(--bg)] px-2 py-[5px]' />
                         )}
                       </tr>
@@ -4394,7 +4392,7 @@ export function TableGrid({
                             // open-config — all metadata, not schema. The schema lock is
                             // enforced per-action instead (insert/delete below), and a
                             // rename attempt surfaces the server's 423 as a toast.
-                            readOnly={!userPermissions.canEdit}
+                            readOnly={!grants.write}
                             isRenaming={columnRename.editingId === column.key}
                             isColumnSelected={
                               isColumnSelection &&
@@ -4434,13 +4432,13 @@ export function TableGrid({
                             onOpenConfig={handleConfigureColumn}
                             onViewWorkflow={handleViewWorkflow}
                             isPinned={colIsPinned}
-                            onPinToggle={userPermissions.canEdit ? handlePinToggle : undefined}
+                            onPinToggle={grants.write ? handlePinToggle : undefined}
                             stickyLeft={colStickyLeft}
                             isLastPinned={column.key === lastPinnedColKey}
                           />
                         )
                       })}
-                      {userPermissions.canEdit && (
+                      {grants.write && (
                         <NewColumnDropdown
                           trigger='inline-header'
                           disabled={addColumnMutation.isPending}
@@ -4581,7 +4579,7 @@ export function TableGrid({
               </>
             )}
           </div>
-          {!isLoadingTable && !isLoadingRows && userPermissions.canEdit && (
+          {!isLoadingTable && !isLoadingRows && grants.write && (
             <AddRowButton onClick={handleAddRowClick} />
           )}
         </div>
@@ -4603,17 +4601,17 @@ export function TableGrid({
         canEditCell={!contextMenuIsWorkflowColumn}
         selectedRowCount={selectedRowCount}
         onRunWorkflows={
-          userPermissions.canEdit && hasWorkflowColumns && contextMenuStats.hasIncompleteOrFailed
+          grants.write && hasWorkflowColumns && contextMenuStats.hasIncompleteOrFailed
             ? handleRunWorkflowsOnSelection
             : undefined
         }
         onRefreshWorkflows={
-          userPermissions.canEdit && hasWorkflowColumns && contextMenuStats.hasCompleted
+          grants.write && hasWorkflowColumns && contextMenuStats.hasCompleted
             ? handleRefreshWorkflowsOnSelection
             : undefined
         }
         onStopWorkflows={
-          userPermissions.canEdit && hasWorkflowColumns ? handleStopWorkflowsOnSelection : undefined
+          grants.write && hasWorkflowColumns ? handleStopWorkflowsOnSelection : undefined
         }
         runningInSelectionCount={runningInContextSelection}
         hasWorkflowColumns={hasWorkflowColumns}

apps/sim/app/workspace/[workspaceId]/tables/[tableId]/page.tsx

@@ -4,7 +4,7 @@ import { getSession } from '@/lib/auth'
 import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
 import { getWorkspaceHostContextForViewer } from '@/lib/workspaces/host-context'
 import TableLoading from '@/app/workspace/[workspaceId]/tables/[tableId]/loading'
-import { Table } from './table'
+import { TableRoute } from './table-route'
 
 export const metadata: Metadata = {
   title: 'Table',
@@ -15,7 +15,7 @@ interface TablePageProps {
 }
 
 /**
- * Table-detail page entry. `Table` reads URL query params via nuqs (which uses
+ * Table-detail page entry. The table reads URL query params via nuqs (which uses
  * `useSearchParams` internally), so it must sit under a Suspense boundary. The
  * fallback renders the real chrome so a suspend never shows a blank frame.
  *
@@ -39,13 +39,7 @@ export default async function TablePage({ params }: TablePageProps) {
 
   return (
     <Suspense fallback={<TableLoading />}>
-      <Table
-        host='page'
-        workspaceId={workspaceId}
-        tableId={tableId}
-        tableLocksEnabled={tableLocksEnabled}
-        viewsEnabled={viewsEnabled}
-      />
+      <TableRoute tableLocksEnabled={tableLocksEnabled} viewsEnabled={viewsEnabled} />
     </Suspense>
   )
 }

apps/sim/app/workspace/[workspaceId]/tables/[tableId]/table-route.tsx

@@ -0,0 +1,45 @@
+'use client'
+
+import { useMemo } from 'react'
+import { useParams } from 'next/navigation'
+import { useUserPermissionsContext } from '@/app/workspace/[workspaceId]/providers/workspace-permissions-provider'
+import { Table } from '@/app/workspace/[workspaceId]/tables/[tableId]/table'
+import { grantsFromPermissions } from '@/resources'
+
+interface TableRouteProps {
+  /** `table-locks` — resolved server-side; AppConfig has no client counterpart. */
+  tableLocksEnabled: boolean
+  /** `table-views` — same. */
+  viewsEnabled: boolean
+}
+
+/**
+ * The table page's client shell: it resolves the axes the route can supply and
+ * mounts the view.
+ *
+ * Exists because `page.tsx` is a Server Component and `grants` comes from a React
+ * context. Reading `useParams()` here is legitimate where it was not inside the
+ * table itself — a route shell exists exactly once per page by definition,
+ * whereas the table is also mounted in a panel beside it.
+ *
+ * Mirrors `files/[fileId]/view/fullscreen-file-view.tsx`.
+ */
+export function TableRoute({ tableLocksEnabled, viewsEnabled }: TableRouteProps) {
+  const params = useParams()
+  const workspaceId = typeof params?.workspaceId === 'string' ? params.workspaceId : ''
+  const tableId = typeof params?.tableId === 'string' ? params.tableId : ''
+  const permissions = useUserPermissionsContext()
+
+  const grants = useMemo(() => grantsFromPermissions(permissions), [permissions])
+
+  return (
+    <Table
+      host='page'
+      grants={grants}
+      workspaceId={workspaceId}
+      tableId={tableId}
+      tableLocksEnabled={tableLocksEnabled}
+      viewsEnabled={viewsEnabled}
+    />
+  )
+}