fix(tables): stage only the Table Security rows an admin moves

The modal reset its draft only when it opened, so a lock another admin changed
while it sat open went stale behind it: the controls kept rendering the old
values and Save submitted all four flags, overwriting the newer state.

Only the rows this admin moves are staged now. Every other row keeps rendering
the authoritative value, so a concurrent change shows up in the open modal
instead of hiding behind it, and Save sends just that patch — the route already
takes a partial — so an untouched row can't carry a stale flag over someone
else's change. A row both admins moved is the one real conflict, and there the
explicit choice wins.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: j15z

apps/sim/app/workspace/[workspaceId]/tables/[tableId]/components/lock-settings-modal/lock-settings-modal.test.tsx

@@ -91,19 +91,46 @@ describe('Table Security', () => {
     )
   })
 
-  it('saves the denied actions as locks', () => {
+  it('saves only the rows the admin moved', () => {
     render()
     selectPermission('Inserting Rows', 'Deny')
     selectPermission('Changing Table Schema', 'Deny')
     expect(getSave().disabled).toBe(false)
     save()
 
+    // A partial patch: the untouched rows are absent, so a concurrent change to
+    // one of them survives this save.
     expect(mutateAsync.mock.calls[0][0]).toEqual({
       tableId: 'table-1',
-      locks: { insertLocked: true, updateLocked: false, deleteLocked: false, schemaLocked: true },
+      locks: { insertLocked: true, schemaLocked: true },
     })
   })
 
+  it('follows a lock changed elsewhere while open without staging it', () => {
+    render()
+    selectPermission('Inserting Rows', 'Deny')
+
+    // Another admin denies updates while this modal is open; the realtime
+    // refetch lands as a new `locks` prop.
+    render({ ...UNLOCKED_TABLE_LOCKS, updateLocked: true })
+    expect(getPermission('Updating Rows', 'Deny').getAttribute('aria-checked')).toBe('true')
+    expect(getPermission('Inserting Rows', 'Deny').getAttribute('aria-checked')).toBe('true')
+
+    save()
+    expect(mutateAsync.mock.calls[0][0]).toEqual({
+      tableId: 'table-1',
+      locks: { insertLocked: true },
+    })
+  })
+
+  it('treats a row already matching the server as nothing to save', () => {
+    render({ ...UNLOCKED_TABLE_LOCKS, deleteLocked: true })
+    selectPermission('Deleting Rows', 'Allow')
+    expect(getSave().disabled).toBe(false)
+    selectPermission('Deleting Rows', 'Deny')
+    expect(getSave().disabled).toBe(true)
+  })
+
   it('keeps the modal open when the save fails and discards the draft on reopen', async () => {
     mutateAsync.mockRejectedValueOnce(new Error('Admin access required to change table locks'))
     render()

apps/sim/app/workspace/[workspaceId]/tables/[tableId]/components/lock-settings-modal/lock-settings-modal.tsx

@@ -16,8 +16,17 @@ import type { TableLocks } from '@/lib/table/types'
 import { LOCK_FIELDS } from '@/app/workspace/[workspaceId]/tables/[tableId]/lock-copy'
 import { useUpdateTableLocks } from '@/hooks/queries/tables'
 
-function locksEqual(a: TableLocks, b: TableLocks): boolean {
-  return LOCK_FIELDS.every((field) => a[field.key] === b[field.key])
+/**
+ * The rows the admin actually moved, relative to the locks the server holds
+ * right now. Everything absent from this patch is left alone by the save.
+ */
+function changedLocks(overrides: Partial<TableLocks>, locks: TableLocks): Partial<TableLocks> {
+  const changed: Partial<TableLocks> = {}
+  for (const field of LOCK_FIELDS) {
+    const next = overrides[field.key]
+    if (next !== undefined && next !== locks[field.key]) changed[field.key] = next
+  }
+  return changed
 }
 
 interface LockSettingsModalProps {
@@ -32,9 +41,16 @@ interface LockSettingsModalProps {
  * Admin-only panel that sets a table's four mutation locks, one Allow/Deny row
  * each. The rows mirror the server flags exactly — `Deny` is a set lock — so a
  * table nobody has configured opens on four `Allow`s and every viewer sees the
- * same state. Changes are staged locally and applied on Save (one request); the
- * server re-checks admin and rejects a `write`-only caller with a 403 surfaced
- * as a toast. Gated at the call site on `canAdmin`.
+ * same state.
+ *
+ * Only the rows this admin moved are staged; every other row keeps rendering
+ * the authoritative value, so a lock another admin changes while this modal is
+ * open shows up here instead of going stale behind it. Save sends just that
+ * patch (the route takes a partial), so it can't carry a stale flag over
+ * someone else's newer change — a row both admins moved is the only real
+ * conflict, and there this admin's explicit choice wins. The server re-checks
+ * admin and rejects a `write`-only caller with a 403 surfaced as a toast.
+ * Gated at the call site on `canAdmin`.
  */
 export function LockSettingsModal({
   isOpen,
@@ -45,23 +61,24 @@ export function LockSettingsModal({
 }: LockSettingsModalProps) {
   const updateLocks = useUpdateTableLocks(workspaceId)
 
-  // Stage edits locally; reset to the server value each time the modal opens.
-  const [draft, setDraft] = useState<TableLocks>(locks)
+  // Stage only the rows this admin moved; clear them each time the modal opens.
+  const [overrides, setOverrides] = useState<Partial<TableLocks>>({})
   const [prevOpen, setPrevOpen] = useState(isOpen)
   if (prevOpen !== isOpen) {
     setPrevOpen(isOpen)
-    if (isOpen) setDraft(locks)
+    if (isOpen) setOverrides({})
   }
 
-  const dirty = !locksEqual(draft, locks)
+  const changed = changedLocks(overrides, locks)
+  const dirty = Object.keys(changed).length > 0
 
   const handleSave = async () => {
     if (!dirty) {
       onClose()
       return
     }
     try {
-      await updateLocks.mutateAsync({ tableId, locks: draft })
+      await updateLocks.mutateAsync({ tableId, locks: changed })
     } catch {
       return
     }
@@ -102,10 +119,10 @@ export function LockSettingsModal({
             <ChipButtonGroup
               aria-label={field.label}
               className='shrink-0'
-              value={draft[field.key] ? 'deny' : 'allow'}
+              value={(overrides[field.key] ?? locks[field.key]) ? 'deny' : 'allow'}
               disabled={updateLocks.isPending}
               onValueChange={(value) =>
-                setDraft((prev) => ({ ...prev, [field.key]: value === 'deny' }))
+                setOverrides((prev) => ({ ...prev, [field.key]: value === 'deny' }))
               }
             >
               <ChipButtonGroupItem value='deny'>Deny</ChipButtonGroupItem>