refactor(tables): drop the Table Security switch and its device-local store

"Enable Table Security" had no server representation: enabled-with-everything-
allowed and never-configured both save four `false` flags, so the difference
lived only in the browser that set it. Anyone else — another device, another
admin — saw the table as unconfigured, and the per-action choices behind the
switch were remembered per device too.

The modal now always shows the four Allow/Deny rows, mapped one-to-one onto
the server flags, so an unconfigured table opens on four `Allow`s and every
viewer sees the same state. That removes the reason for the preference store,
which is deleted along with its helpers and test. Stale
`table-security-preferences` keys are left where they are; nothing reads them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: j15z

apps/sim/app/workspace/[workspaceId]/tables/[tableId]/components/lock-settings-modal/lock-settings-modal.test.tsx

@@ -6,7 +6,6 @@ import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { type TableLocks, UNLOCKED_TABLE_LOCKS } from '@/lib/table/types'
 import { LockSettingsModal } from '@/app/workspace/[workspaceId]/tables/[tableId]/components/lock-settings-modal/lock-settings-modal'
-import { useTableSecurityStore } from '@/stores/table/security/store'
 
 const { mutateAsync } = vi.hoisted(() => ({ mutateAsync: vi.fn() }))
 vi.mock('@/hooks/queries/tables', () => ({
@@ -32,18 +31,6 @@ function render(locks: TableLocks = UNLOCKED_TABLE_LOCKS, isOpen = true) {
   })
 }
 
-function getSwitch(label: string): HTMLButtonElement {
-  const element = document.querySelector<HTMLButtonElement>(
-    `button[role="switch"][aria-label="${label}"]`
-  )
-  if (!element) throw new Error(`Missing switch: ${label}`)
-  return element
-}
-
-function clickSwitch(label: string) {
-  act(() => getSwitch(label).click())
-}
-
 function getPermission(label: string, choice: 'Deny' | 'Allow'): HTMLButtonElement {
   const group = document.querySelector(`[role="radiogroup"][aria-label="${label}"]`)
   const button = [
@@ -57,19 +44,22 @@ function selectPermission(label: string, choice: 'Deny' | 'Allow') {
   act(() => getPermission(label, choice).click())
 }
 
-function save() {
+function getSave(): HTMLButtonElement {
   const button = [...document.querySelectorAll<HTMLButtonElement>('button')].find(
     (element) => element.textContent === 'Save'
   )
   if (!button) throw new Error('Missing Save button')
-  act(() => button.click())
+  return button
+}
+
+function save() {
+  act(() => getSave().click())
 }
 
 beforeEach(() => {
   globalThis.IS_REACT_ACT_ENVIRONMENT = true
   vi.clearAllMocks()
   mutateAsync.mockReturnValue(new Promise(() => {}))
-  useTableSecurityStore.getState().reset()
   container = document.createElement('div')
   document.body.appendChild(container)
   root = createRoot(container)
@@ -81,75 +71,51 @@ afterEach(() => {
 })
 
 describe('Table Security', () => {
-  it('hides permissions while disabled and enables all four backend locks by default', () => {
+  it('always shows the four rows and starts an unconfigured table on Allow', () => {
     render()
-    expect(getSwitch('Enable Table Security').getAttribute('aria-checked')).toBe('false')
-    expect(document.querySelector('[role="radiogroup"]')).toBeNull()
-
-    clickSwitch('Enable Table Security')
     for (const label of LABELS) {
-      expect(getPermission(label, 'Deny').disabled).toBe(false)
-      expect(getPermission(label, 'Allow').disabled).toBe(false)
-      expect(getPermission(label, 'Deny').getAttribute('aria-checked')).toBe('true')
-      expect(getPermission(label, 'Allow').getAttribute('aria-checked')).toBe('false')
+      expect(getPermission(label, 'Allow').getAttribute('aria-checked')).toBe('true')
+      expect(getPermission(label, 'Deny').getAttribute('aria-checked')).toBe('false')
     }
-    save()
-
-    expect(mutateAsync.mock.calls[0][0]).toEqual({
-      tableId: 'table-1',
-      locks: { insertLocked: true, updateLocked: true, deleteLocked: true, schemaLocked: true },
-    })
+    // Nothing staged yet, so there is nothing to save.
+    expect(getSave().disabled).toBe(true)
   })
 
-  it('inverts existing locks and remembers permissions after disabling, saving, and reopening', async () => {
-    render({ insertLocked: true, updateLocked: true, deleteLocked: false, schemaLocked: true })
-    expect(getSwitch('Enable Table Security').getAttribute('aria-checked')).toBe('true')
-    expect(getPermission('Deleting Rows', 'Allow').getAttribute('aria-checked')).toBe('true')
-    expect(getPermission('Updating Rows', 'Deny').getAttribute('aria-checked')).toBe('true')
-
-    selectPermission('Inserting Rows', 'Allow')
-    clickSwitch('Enable Table Security')
-    expect(document.querySelector('[role="radiogroup"]')).toBeNull()
-    let resolveSave!: () => void
-    mutateAsync.mockReturnValueOnce(
-      new Promise<void>((resolve) => {
-        resolveSave = resolve
-      })
+  it('mirrors the server locks, with Deny meaning a set lock', () => {
+    render({ insertLocked: true, updateLocked: false, deleteLocked: true, schemaLocked: false })
+    expect(getPermission('Inserting Rows', 'Deny').getAttribute('aria-checked')).toBe('true')
+    expect(getPermission('Deleting Rows', 'Deny').getAttribute('aria-checked')).toBe('true')
+    expect(getPermission('Updating Rows', 'Allow').getAttribute('aria-checked')).toBe('true')
+    expect(getPermission('Changing Table Schema', 'Allow').getAttribute('aria-checked')).toBe(
+      'true'
     )
-    save()
-    expect(mutateAsync.mock.calls[0][0]).toEqual({
-      tableId: 'table-1',
-      locks: UNLOCKED_TABLE_LOCKS,
-    })
-    await act(async () => resolveSave())
+  })
 
-    render(UNLOCKED_TABLE_LOCKS, false)
+  it('saves the denied actions as locks', () => {
     render()
-    expect(getSwitch('Enable Table Security').getAttribute('aria-checked')).toBe('false')
-    expect(document.querySelector('[role="radiogroup"]')).toBeNull()
-    clickSwitch('Enable Table Security')
-    expect(getPermission('Inserting Rows', 'Allow').getAttribute('aria-checked')).toBe('true')
-    expect(getPermission('Updating Rows', 'Deny').getAttribute('aria-checked')).toBe('true')
+    selectPermission('Inserting Rows', 'Deny')
+    selectPermission('Changing Table Schema', 'Deny')
+    expect(getSave().disabled).toBe(false)
     save()
-    expect(mutateAsync.mock.calls[1][0]).toEqual({
+
+    expect(mutateAsync.mock.calls[0][0]).toEqual({
       tableId: 'table-1',
-      locks: { insertLocked: false, updateLocked: true, deleteLocked: false, schemaLocked: true },
+      locks: { insertLocked: true, updateLocked: false, deleteLocked: false, schemaLocked: true },
     })
   })
 
-  it('does not remember unsuccessful changes and discards them on reopen', () => {
+  it('keeps the modal open when the save fails and discards the draft on reopen', async () => {
+    mutateAsync.mockRejectedValueOnce(new Error('Admin access required to change table locks'))
     render()
-    clickSwitch('Enable Table Security')
-    selectPermission('Inserting Rows', 'Allow')
-    save()
-    expect(useTableSecurityStore.getState().preferences['table-1']).toBeUndefined()
+    selectPermission('Updating Rows', 'Deny')
+    await act(async () => {
+      getSave().click()
+    })
     expect(onClose).not.toHaveBeenCalled()
 
     render(UNLOCKED_TABLE_LOCKS, false)
     render()
-    expect(getSwitch('Enable Table Security').getAttribute('aria-checked')).toBe('false')
-    expect(document.querySelector('[role="radiogroup"]')).toBeNull()
-    clickSwitch('Enable Table Security')
-    expect(getPermission('Inserting Rows', 'Deny').getAttribute('aria-checked')).toBe('true')
+    expect(getPermission('Updating Rows', 'Allow').getAttribute('aria-checked')).toBe('true')
+    expect(getSave().disabled).toBe(true)
   })
 })

apps/sim/app/workspace/[workspaceId]/tables/[tableId]/components/lock-settings-modal/lock-settings-modal.tsx

@@ -9,19 +9,16 @@ import {
   ChipModalField,
   ChipModalFooter,
   ChipModalHeader,
-  Switch,
   Tooltip,
 } from '@sim/emcn'
 import { CircleInfo, Lock } from '@sim/emcn/icons'
 import type { TableLocks } from '@/lib/table/types'
 import { LOCK_FIELDS } from '@/app/workspace/[workspaceId]/tables/[tableId]/lock-copy'
 import { useUpdateTableLocks } from '@/hooks/queries/tables'
-import {
-  getTableSecurityLocks,
-  getTableSecuritySettings,
-  tableSecuritySettingsEqual,
-  useTableSecurityStore,
-} from '@/stores/table/security/store'
+
+function locksEqual(a: TableLocks, b: TableLocks): boolean {
+  return LOCK_FIELDS.every((field) => a[field.key] === b[field.key])
+}
 
 interface LockSettingsModalProps {
   isOpen: boolean
@@ -32,10 +29,12 @@ interface LockSettingsModalProps {
 }
 
 /**
- * Admin-only panel that sets a table's four mutation locks. Changes are staged
- * locally and applied on Save (one request); the server re-checks admin and
- * rejects a `write`-only caller with a 403 surfaced as a toast. Gated at the
- * call site on `canAdmin`.
+ * Admin-only panel that sets a table's four mutation locks, one Allow/Deny row
+ * each. The rows mirror the server flags exactly — `Deny` is a set lock — so a
+ * table nobody has configured opens on four `Allow`s and every viewer sees the
+ * same state. Changes are staged locally and applied on Save (one request); the
+ * server re-checks admin and rejects a `write`-only caller with a 403 surfaced
+ * as a toast. Gated at the call site on `canAdmin`.
  */
 export function LockSettingsModal({
   isOpen,
@@ -45,30 +44,27 @@ export function LockSettingsModal({
   locks,
 }: LockSettingsModalProps) {
   const updateLocks = useUpdateTableLocks(workspaceId)
-  const preference = useTableSecurityStore((state) => state.preferences[tableId])
-  const setPreference = useTableSecurityStore((state) => state.setPreference)
-  const settings = getTableSecuritySettings(locks, preference)
 
-  const [draft, setDraft] = useState(settings)
+  // Stage edits locally; reset to the server value each time the modal opens.
+  const [draft, setDraft] = useState<TableLocks>(locks)
   const [prevOpen, setPrevOpen] = useState(isOpen)
   if (prevOpen !== isOpen) {
     setPrevOpen(isOpen)
-    if (isOpen) setDraft(settings)
+    if (isOpen) setDraft(locks)
   }
 
-  const dirty = !tableSecuritySettingsEqual(draft, settings)
+  const dirty = !locksEqual(draft, locks)
 
   const handleSave = async () => {
     if (!dirty) {
       onClose()
       return
     }
     try {
-      await updateLocks.mutateAsync({ tableId, locks: getTableSecurityLocks(draft) })
+      await updateLocks.mutateAsync({ tableId, locks: draft })
     } catch {
       return
     }
-    setPreference(tableId, draft)
     onClose()
   }
 
@@ -78,59 +74,45 @@ export function LockSettingsModal({
         Table Security
       </ChipModalHeader>
       <ChipModalBody>
-        <ChipModalField
-          type='custom'
-          title='Enable Table Security'
-          className='flex-row items-center justify-between'
-        >
-          <Switch
-            aria-label='Enable Table Security'
-            checked={draft.enabled}
-            disabled={updateLocks.isPending}
-            onCheckedChange={(enabled) => setDraft((prev) => ({ ...prev, enabled }))}
-          />
-        </ChipModalField>
-        {draft.enabled &&
-          LOCK_FIELDS.map((field) => (
-            <ChipModalField
-              key={field.key}
-              type='custom'
-              className='flex-row items-center justify-between'
-              title={
-                <span className='inline-flex items-center gap-1.5'>
-                  {field.label}
-                  <Tooltip.Root>
-                    <Tooltip.Trigger
-                      type='button'
-                      aria-label={`About ${field.label.toLowerCase()}`}
-                      className='inline-flex cursor-help'
-                    >
-                      <CircleInfo className='size-[14px] text-[var(--text-icon)]' />
-                    </Tooltip.Trigger>
-                    <Tooltip.Content>
-                      <p>{field.hint}</p>
-                    </Tooltip.Content>
-                  </Tooltip.Root>
-                </span>
+        {LOCK_FIELDS.map((field) => (
+          <ChipModalField
+            key={field.key}
+            type='custom'
+            className='flex-row items-center justify-between'
+            title={
+              <span className='inline-flex items-center gap-1.5'>
+                {field.label}
+                <Tooltip.Root>
+                  {/* Not `asChild`: the hint is each row's only explanation, so
+                      the trigger must be a focusable button for keyboard users. */}
+                  <Tooltip.Trigger
+                    type='button'
+                    aria-label={`About ${field.label.toLowerCase()}`}
+                    className='inline-flex cursor-help'
+                  >
+                    <CircleInfo className='size-[14px] text-[var(--text-icon)]' />
+                  </Tooltip.Trigger>
+                  <Tooltip.Content>
+                    <p>{field.hint}</p>
+                  </Tooltip.Content>
+                </Tooltip.Root>
+              </span>
+            }
+          >
+            <ChipButtonGroup
+              aria-label={field.label}
+              className='shrink-0'
+              value={draft[field.key] ? 'deny' : 'allow'}
+              disabled={updateLocks.isPending}
+              onValueChange={(value) =>
+                setDraft((prev) => ({ ...prev, [field.key]: value === 'deny' }))
               }
             >
-              <ChipButtonGroup
-                aria-label={field.label}
-                className='shrink-0'
-                value={draft.allowedActions[field.kind] ? 'allow' : 'deny'}
-                disabled={updateLocks.isPending}
-                onValueChange={(value) =>
-                  setDraft((prev) => ({
-                    ...prev,
-                    allowedActions: { ...prev.allowedActions, [field.kind]: value === 'allow' },
-                  }))
-                }
-              >
-                <ChipButtonGroupItem value='deny'>Deny</ChipButtonGroupItem>
-                <ChipButtonGroupItem value='allow'>Allow</ChipButtonGroupItem>
-              </ChipButtonGroup>
-            </ChipModalField>
-          ))}
+              <ChipButtonGroupItem value='deny'>Deny</ChipButtonGroupItem>
+              <ChipButtonGroupItem value='allow'>Allow</ChipButtonGroupItem>
+            </ChipButtonGroup>
+          </ChipModalField>
+        ))}
       </ChipModalBody>
       <ChipModalFooter
         onCancel={onClose}