fix(access-control): keep the settings page open while an organization is governed (#7890)

* fix(access-control): keep the settings page open while an organization is governed

Permission groups keep applying through a failing payment, but the page
that edits them was hidden with the rest of the Enterprise sections — so
an organization could be governed by rules nobody could see or loosen
until the invoice cleared. Access Control now follows the governance
reader rather than the plan gate, on the page, in the navigation, and at
the management API, which had already been left behind the plan gate to
match the page.

Also drops a stray "Open localhost" line from the README's self-hosted
quick start; the walkthrough below it already says where to look.

* fix(access-control): read the active permission regime, not the raw plan

- Resolve the navigation flag rather than reject it: the organization
  surface is shared by every page, so a failed billing read would have
  taken home, chat and search down with the settings sidebar
- Read the regime helper everywhere instead of the governance reader, so
  a deployment with Access Control switched off manages nothing
- Give the workspace-scoped page the same treatment as the organization
  one, which was still plan-gated
- Read one lookup per section rather than both, since Access Control's
  availability never consults the plan
- Refresh the navigation flag from the billing summary alongside the plan
  it sits next to, so the item cannot linger after billing changes

Author: waleedlatif1

README.md

@@ -30,8 +30,6 @@
 npx sim-setup
 ```
 
-Open [http://localhost:3000](http://localhost:3000)
-
 ### Desktop: [macOS](https://sim.ai/api/desktop/update/download)
 
 <a href="https://sim.ai/api/desktop/update/download" target="_blank" rel="noopener noreferrer"><img src="https://img.shields.io/badge/Download-macOS-3B3B3B?logo=apple&logoColor=white&labelColor=1A1A1A" alt="Download Sim for macOS"></a>

apps/sim/app/api/organizations/[id]/permission-groups/utils.test.ts

@@ -4,13 +4,15 @@
 import { resetDbChainMock } from '@sim/testing'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockIsOrganizationAdminOrOwner, mockIsOrganizationOnEnterprisePlan } = vi.hoisted(() => ({
-  mockIsOrganizationAdminOrOwner: vi.fn<() => Promise<boolean>>(),
-  mockIsOrganizationOnEnterprisePlan: vi.fn<() => Promise<boolean>>(),
-}))
+const { mockIsOrganizationAdminOrOwner, mockIsOrganizationPermissionRegimeActive } = vi.hoisted(
+  () => ({
+    mockIsOrganizationAdminOrOwner: vi.fn<() => Promise<boolean>>(),
+    mockIsOrganizationPermissionRegimeActive: vi.fn<() => Promise<boolean>>(),
+  })
+)
 
-vi.mock('@/lib/billing', () => ({
-  isOrganizationOnEnterprisePlan: mockIsOrganizationOnEnterprisePlan,
+vi.mock('@/lib/permission-groups/resolve.server', () => ({
+  isOrganizationPermissionRegimeActive: mockIsOrganizationPermissionRegimeActive,
 }))
 
 vi.mock('@/lib/workspaces/permissions/utils', () => ({
@@ -29,20 +31,20 @@ describe('authorizeOrgAccessControl', () => {
 
   it('returns a 403 when the user is not an organization admin/owner', async () => {
     mockIsOrganizationAdminOrOwner.mockResolvedValue(false)
-    mockIsOrganizationOnEnterprisePlan.mockResolvedValue(true)
+    mockIsOrganizationPermissionRegimeActive.mockResolvedValue(true)
 
     const response = await authorizeOrgAccessControl('user-1', 'org-1')
 
     expect(response).not.toBeNull()
     expect(response?.status).toBe(403)
     await expect(response?.json()).resolves.toEqual({ error: 'Admin permissions required' })
     // Entitlement is only checked after the admin gate passes.
-    expect(mockIsOrganizationOnEnterprisePlan).not.toHaveBeenCalled()
+    expect(mockIsOrganizationPermissionRegimeActive).not.toHaveBeenCalled()
   })
 
   it('returns a 403 when the organization is not on an enterprise plan', async () => {
     mockIsOrganizationAdminOrOwner.mockResolvedValue(true)
-    mockIsOrganizationOnEnterprisePlan.mockResolvedValue(false)
+    mockIsOrganizationPermissionRegimeActive.mockResolvedValue(false)
 
     const response = await authorizeOrgAccessControl('user-1', 'org-1')
 
@@ -54,7 +56,7 @@ describe('authorizeOrgAccessControl', () => {
 
   it('returns null when the user is an admin and the org is entitled', async () => {
     mockIsOrganizationAdminOrOwner.mockResolvedValue(true)
-    mockIsOrganizationOnEnterprisePlan.mockResolvedValue(true)
+    mockIsOrganizationPermissionRegimeActive.mockResolvedValue(true)
 
     const response = await authorizeOrgAccessControl('user-1', 'org-1')
 

apps/sim/app/api/organizations/[id]/permission-groups/utils.ts

@@ -2,12 +2,12 @@ import { db } from '@sim/db'
 import { permissionGroup, permissionGroupWorkspace, workspace } from '@sim/db/schema'
 import { and, asc, eq, inArray } from 'drizzle-orm'
 import { NextResponse } from 'next/server'
-import { isOrganizationOnEnterprisePlan } from '@/lib/billing'
 import type { DbOrTx } from '@/lib/db/types'
 import type {
   AllMembersConflict,
   ScopeConflict,
 } from '@/lib/permission-groups/application/group-membership'
+import { isOrganizationPermissionRegimeActive } from '@/lib/permission-groups/resolve.server'
 import { isOrganizationAdminOrOwner } from '@/lib/workspaces/permissions/utils'
 
 /** A workspace reference (id + display name). */
@@ -32,13 +32,12 @@ export async function authorizeOrgAccessControl(
   }
 
   /**
-   * The feature gate, deliberately, not the governance reader: the Access Control settings page is
-   * gated on the same plan check, so reading governance here would open the API for a past-due
-   * organization whose page still 404s. Restrictions keep applying through a dunning window —
-   * that is what the governance reader is for — but managing them follows the page.
+   * The active permission regime, which is what the Access Control page now reads too: an
+   * organization whose restrictions still apply has to be able to see and loosen them, and a
+   * deployment with Access Control switched off governs nobody, so neither should manage anything.
    */
-  const entitled = await isOrganizationOnEnterprisePlan(organizationId)
-  if (!entitled) {
+  const governed = await isOrganizationPermissionRegimeActive(organizationId)
+  if (!governed) {
     return NextResponse.json({ error: 'Access Control is an Enterprise feature' }, { status: 403 })
   }
 

apps/sim/app/o/[organizationId]/settings/navigation.test.ts

@@ -18,6 +18,7 @@ import {
 const enterprise: OrganizationSettingsFeatures = {
   billingEnabled: true,
   hasEnterprisePlan: true,
+  governanceActive: true,
   hosted: true,
   selfHosted: {},
 }
@@ -46,12 +47,27 @@ describe('organization settings navigation', () => {
     expect(
       organizationSettingsNavigation(
         true,
-        { ...enterprise, hasEnterprisePlan: false },
+        { ...enterprise, hasEnterprisePlan: false, governanceActive: false },
         available
       ).map(({ id }) => id)
     ).toEqual(['billing', 'members', 'recently-deleted', 'search-mcp'])
   })
 
+  /**
+   * A failing payment closes the plan gate while the organization's permission groups keep
+   * applying, so the page that edits them has to stay listed — otherwise its members are governed
+   * by rules nobody can reach until the invoice clears.
+   */
+  it('keeps Access Control listed while the organization is still governed', () => {
+    expect(
+      organizationSettingsNavigation(
+        true,
+        { ...enterprise, hasEnterprisePlan: false, governanceActive: true },
+        available
+      ).map(({ id }) => id)
+    ).toEqual(['billing', 'members', 'recently-deleted', 'access-control', 'search-mcp'])
+  })
+
   it('honors individual self-hosted feature flags and hides billing when disabled', () => {
     expect(
       organizationSettingsNavigation(

apps/sim/app/o/[organizationId]/settings/organization-settings-sidebar.tsx

@@ -6,7 +6,10 @@ import { ORGANIZATION_SETTINGS_GROUPS } from '@/components/settings/navigation'
 import { SettingsSidebar } from '@/components/settings/settings-sidebar'
 import { isApiClientError } from '@/lib/api/client/errors'
 import { isEnterprise } from '@/lib/billing/plan-helpers'
-import { hasUsableSubscriptionAccess } from '@/lib/billing/subscriptions/utils'
+import {
+  hasPaidSubscriptionStatus,
+  hasUsableSubscriptionAccess,
+} from '@/lib/billing/subscriptions/utils'
 import { organizationRoutes, WORKSPACE_SETTINGS_PATH } from '@/lib/navigation/paths'
 import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
 import {
@@ -42,6 +45,16 @@ export function OrganizationSettingsSidebar(props: OrganizationSettingsSidebarPr
           isEnterprise(summary.data.subscriptionPlan) &&
           hasUsableSubscriptionAccess(summary.data.subscriptionStatus, summary.data.billingBlocked)
         : settingsFeatures.hasEnterprisePlan,
+    /**
+     * Refreshed from the same summary, or the item the plan gate just hid would reappear only on
+     * reload. Governance keeps its own rule — an entitled status, block state ignored — because a
+     * failing payment does not stop the organization's permission groups from applying.
+     */
+    governanceActive:
+      refreshPlan && summary
+        ? isEnterprise(summary.data.subscriptionPlan) &&
+          hasPaidSubscriptionStatus(summary.data.subscriptionStatus)
+        : settingsFeatures.governanceActive,
   }
 
   const routes = organizationRoutes(organization.id)

apps/sim/components/settings/navigation.test.ts

@@ -231,6 +231,7 @@ describe('settings navigation boundaries', () => {
     ).toEqual({
       billingEnabled: false,
       hasEnterprisePlan: true,
+      governanceActive: true,
       hosted: false,
       selfHosted: {
         'connected-accounts': true,
@@ -492,6 +493,7 @@ describe('settings navigation boundaries', () => {
     const hostedFree = {
       billingEnabled: true,
       hasEnterprisePlan: false,
+      governanceActive: false,
       hosted: true,
       selfHosted: {},
     }

apps/sim/components/settings/navigation.ts

@@ -1014,18 +1014,27 @@ export function resolveOrganizationSectionAccess({
 export interface OrganizationSettingsFeatures {
   billingEnabled: boolean
   hasEnterprisePlan: boolean
+  /**
+   * Whether the organization's permission-group regime is in force, which outlives the plan gate
+   * through a failing payment — see `isOrganizationGovernanceActive`. Only Access Control reads
+   * it, because only that section edits something that keeps applying while the gate is closed.
+   */
+  governanceActive: boolean
   hosted: boolean
   selfHosted: Partial<Record<OrganizationSettingsSection, boolean>>
 }
 
 export function getOrganizationSettingsFeatures(
   hasEnterprisePlan: boolean,
-  deployment: DeploymentShape
+  deployment: DeploymentShape,
+  /** Defaults to the plan gate, so a caller with no reason to distinguish the two keeps its behavior. */
+  governanceActive: boolean = hasEnterprisePlan
 ): OrganizationSettingsFeatures {
   const { features } = deployment
   return {
     billingEnabled: deployment.billingEnabled,
     hasEnterprisePlan,
+    governanceActive,
     hosted: deployment.hosted,
     selfHosted: {
       'connected-accounts': true,
@@ -1055,6 +1064,12 @@ export function isOrganizationSettingsSectionAvailable(
   /* Sim Search itself is enterprise on the hosted product; self-hosted gates it by flag, not by section. */
   if (section === 'integrations' || section === 'search-slack')
     return !features.hosted || features.hasEnterprisePlan
+  /**
+   * Access Control follows governance rather than the plan gate: its restrictions keep applying
+   * through a failing payment, so hiding the page that edits them would leave an organization
+   * governed by rules it cannot see or loosen until the invoice clears.
+   */
+  if (section === 'access-control' && features.hosted) return features.governanceActive
   if (features.hosted) return features.hasEnterprisePlan
   return features.selfHosted[section] ?? false
 }

apps/sim/lib/organizations/surface.test.ts

@@ -16,6 +16,8 @@ vi.mock('@/lib/credential-groups/scoped-availability', () => ({
 
 vi.mock('@/lib/permission-groups/resolve.server', () => ({
   getUserPermissionConfigForOrganization: mockPermissionConfig,
+  /** The nav lists Access Control on the regime; these tests drive it from the plan knob. */
+  isOrganizationPermissionRegimeActive: mockEnterprisePlan,
 }))
 vi.mock('@/lib/billing/core/subscription', () => ({
   isOrganizationOnEnterprisePlan: mockEnterprisePlan,

apps/sim/lib/organizations/surface.ts

@@ -18,7 +18,10 @@ import {
 } from '@/lib/knowledge/access/availability'
 import { getOrganizationSettingsAccess } from '@/lib/organizations/settings-access'
 import { capabilityDeniedBy } from '@/lib/permission-groups/capability-assertions'
-import { getUserPermissionConfigForOrganization } from '@/lib/permission-groups/resolve.server'
+import {
+  getUserPermissionConfigForOrganization,
+  isOrganizationPermissionRegimeActive,
+} from '@/lib/permission-groups/resolve.server'
 
 export interface OrganizationSurfaceOrganization {
   id: string
@@ -77,19 +80,36 @@ async function resolveOrganizationSurfaceContext(
   if (!row) return null
 
   const deployment = getDeploymentShape()
-  const [config, [{ memberCount }], connectedAccountsAvailable, searchAccess, hasEnterprisePlan] =
-    await Promise.all([
-      getUserPermissionConfigForOrganization(organizationId),
-      db
-        .select({ memberCount: count() })
-        .from(member)
-        .where(eq(member.organizationId, organizationId)),
-      isScopedCredentialGroupsAvailable({ kind: 'organization', organizationId }),
-      resolveKnowledgeAccessAvailability({ organizationId }),
-      deployment.hosted && access.isAdmin
-        ? isOrganizationOnEnterprisePlan(organizationId)
-        : Promise.resolve(false),
-    ])
+  const [
+    config,
+    [{ memberCount }],
+    connectedAccountsAvailable,
+    searchAccess,
+    hasEnterprisePlan,
+    governanceActive,
+  ] = await Promise.all([
+    getUserPermissionConfigForOrganization(organizationId),
+    db
+      .select({ memberCount: count() })
+      .from(member)
+      .where(eq(member.organizationId, organizationId)),
+    isScopedCredentialGroupsAvailable({ kind: 'organization', organizationId }),
+    resolveKnowledgeAccessAvailability({ organizationId }),
+    deployment.hosted && access.isAdmin
+      ? isOrganizationOnEnterprisePlan(organizationId)
+      : Promise.resolve(false),
+    /**
+     * Access Control stays listed while a payment is failing, because its rules still apply.
+     *
+     * Resolved rather than rejected on a read failure: this value only decides whether a nav item
+     * is drawn, and it is shared by every organization page — letting it throw would take home,
+     * chat and search down with the billing table. The page and the management API read the same
+     * regime and still fail closed, so a listed item cannot be used to reach anything.
+     */
+    deployment.hosted && access.isAdmin
+      ? isOrganizationPermissionRegimeActive(organizationId).catch(() => false)
+      : Promise.resolve(false),
+  ])
   return {
     organization: {
       id: row.id,
@@ -112,7 +132,11 @@ async function resolveOrganizationSurfaceContext(
     },
     connectedAccountsAvailable,
     searchAccess,
-    settingsFeatures: getOrganizationSettingsFeatures(hasEnterprisePlan, deployment),
+    settingsFeatures: getOrganizationSettingsFeatures(
+      hasEnterprisePlan,
+      deployment,
+      governanceActive
+    ),
     deployment,
   }
 }

apps/sim/lib/settings/application/organization-section-access.test.ts

@@ -7,6 +7,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 const mocks = vi.hoisted(() => ({
   canOpen: vi.fn(),
   enterprise: vi.fn(),
+  governance: vi.fn(),
   groups: vi.fn(),
   search: vi.fn(),
 }))
@@ -21,6 +22,7 @@ vi.mock('@/lib/organizations/settings-access', () => ({
 }))
 vi.mock('@/lib/billing/core/subscription', () => ({
   isOrganizationOnEnterprisePlan: mocks.enterprise,
+  isOrganizationGovernanceActive: mocks.governance,
 }))
 
 import { authorizeOrganizationSettingsSection } from '@/lib/settings/application/organization-section-access'
@@ -31,6 +33,7 @@ describe('organization settings authorization', () => {
     setEnvFlags({ isHosted: true, isBillingEnabled: true })
     mocks.canOpen.mockResolvedValue(true)
     mocks.enterprise.mockResolvedValue(true)
+    mocks.governance.mockResolvedValue(true)
     mocks.groups.mockResolvedValue(true)
     mocks.search.mockResolvedValue(true)
   })
@@ -57,6 +60,49 @@ describe('organization settings authorization', () => {
     }
   )
 
+  /**
+   * Access Control configures restrictions that keep applying while a payment is failing, so the
+   * page that edits them has to stay reachable — otherwise an organization is governed by rules
+   * nobody can see or loosen until the invoice clears.
+   */
+  it('opens Access Control for an organization still being governed', async () => {
+    mocks.enterprise.mockResolvedValue(false)
+    mocks.governance.mockResolvedValue(true)
+
+    await expect(
+      authorizeOrganizationSettingsSection({
+        organizationId: 'target',
+        userId: 'viewer',
+        section: 'access-control',
+      })
+    ).resolves.toBe(true)
+  })
+
+  it('closes Access Control once nothing governs the organization', async () => {
+    mocks.enterprise.mockResolvedValue(false)
+    mocks.governance.mockResolvedValue(false)
+
+    await expect(
+      authorizeOrganizationSettingsSection({
+        organizationId: 'target',
+        userId: 'viewer',
+        section: 'access-control',
+      })
+    ).resolves.toBe(false)
+  })
+
+  /** Every other section keeps reading the plan gate, and pays no extra lookup for this one. */
+  it('reads governance for no section but Access Control', async () => {
+    await authorizeOrganizationSettingsSection({
+      organizationId: 'target',
+      userId: 'viewer',
+      section: 'audit-logs',
+    })
+
+    expect(mocks.governance).not.toHaveBeenCalled()
+    expect(mocks.enterprise).toHaveBeenCalledWith('target')
+  })
+
   it.each([
     { groups: false, search: false, connectedAccounts: false, integrations: false },
     { groups: true, search: false, connectedAccounts: true, integrations: false },