fix(table): carry the acting person into the backfill's downstream cascade

An output backfill writes cells that satisfy downstream groups' deps, and
`batchUpdateRows` starts those groups. The write passed an explicit null
governed subject, so a cascade started by a person's schema change ran its
tools ungated. The subject now rides the backfill payload beside
`actorUserId` — a billing attribution that names the workspace billed
account when the change carried no human.

Author: waleedlatif1

apps/sim/lib/table/application/groups.test.ts

@@ -290,6 +290,29 @@ describe('workflow and enrichment Table application commands', () => {
     expect(mocks.signal).toHaveBeenCalledWith(table.id)
   })
 
+  /**
+   * Adding an output backfills it from saved runs, and a backfilled cell can
+   * satisfy a downstream group's deps and start it. That cascade is gated on
+   * the acting person, which is not the billing attribution beside it.
+   */
+  it('names the acting person, not the billing actor, as the backfill cascade subject', async () => {
+    await addWorkflowTableGroupOutput.execute({
+      principal,
+      input: {
+        tableId: table.id,
+        workspaceId: table.workspaceId,
+        groupId: group.id,
+        blockId: 'block-2',
+        path: 'score',
+      },
+    })
+
+    expect(mocks.addOutput).toHaveBeenCalledWith(
+      expect.objectContaining({ capabilityGovernedUserId: 'user-1' }),
+      'request-1'
+    )
+  })
+
   it('persists disabled auto-run on a newly created workflow group', async () => {
     const result = await createWorkflowTableGroup.execute({
       principal,

apps/sim/lib/table/application/groups.ts

@@ -1149,6 +1149,7 @@ export const addWorkflowTableGroupOutput = defineAuthorizedTableUseCase({
         actorUserId: resolvePrincipalAttribution(principal, {
           workspaceBillingOwnerUserId: context.billedAccountUserId,
         }).attributedUserId,
+        capabilityGovernedUserId: capabilityGovernedPrincipalUserId(principal),
         resolvedOutput: {
           workflowId: resolvedWorkflow.workflowId,
           columnType: columnTypeForLeaf(output.leafType),

apps/sim/lib/table/backfill-governed-subject.test.ts

@@ -0,0 +1,112 @@
+/**
+ * @vitest-environment node
+ */
+
+import { tableRowExecutions, userTableRows, workflowExecutionLogs } from '@sim/db/schema'
+import { queueTableRows, resetDbChainMock } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { TableDefinition } from '@/lib/table/types'
+
+const { mockBatchUpdateRows, mockMaterializeExecutionData, mockGetFunctionalBlockOutput } =
+  vi.hoisted(() => ({
+    mockBatchUpdateRows: vi.fn(),
+    mockMaterializeExecutionData: vi.fn(),
+    mockGetFunctionalBlockOutput: vi.fn(),
+  }))
+
+vi.mock('@/lib/table/rows/service', () => ({
+  batchUpdateRows: mockBatchUpdateRows,
+}))
+vi.mock('@/lib/logs/execution/trace-store', () => ({
+  materializeExecutionData: mockMaterializeExecutionData,
+}))
+vi.mock('@/lib/logs/execution/functional-outputs', () => ({
+  getFunctionalBlockOutput: mockGetFunctionalBlockOutput,
+}))
+vi.mock('@/lib/table/rows/secret-provenance', () => ({
+  createTableRowSecretProvenanceFromRegistry: () => ({ complete: true, columns: {} }),
+}))
+
+import { maybeBackfillGroupOutputs } from '@/lib/table/backfill-runner'
+
+const TABLE = {
+  id: 'table-1',
+  workspaceId: 'workspace-1',
+  schema: { columns: [], workflowGroups: [] },
+} as unknown as TableDefinition
+
+/** Queues the four reads one inline backfill page makes, in the order it makes them. */
+function queueOnePage(): void {
+  queueTableRows(tableRowExecutions, [{ count: 1 }])
+  queueTableRows(tableRowExecutions, [{ rowId: 'row-1', executionId: 'execution-1' }])
+  queueTableRows(userTableRows, [{ id: 'row-1', data: {} }])
+  queueTableRows(workflowExecutionLogs, [
+    {
+      executionId: 'execution-1',
+      workflowId: 'workflow-1',
+      workspaceId: 'workspace-1',
+      executionData: {},
+    },
+  ])
+  queueTableRows(tableRowExecutions, [])
+}
+
+describe('backfill cascade governance', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+    mockMaterializeExecutionData.mockResolvedValue({})
+    mockGetFunctionalBlockOutput.mockReturnValue({ value: 'filled' })
+    mockBatchUpdateRows.mockResolvedValue({ affectedCount: 1, affectedRowIds: ['row-1'] })
+  })
+
+  /**
+   * A backfilled cell is a dependency: `batchUpdateRows` starts every downstream
+   * group whose deps it just satisfied. Passing no subject there ran those
+   * cells with no per-tool gate, which is what `null` means on this field.
+   */
+  it('cascades under the person who made the schema change', async () => {
+    queueOnePage()
+
+    await maybeBackfillGroupOutputs({
+      table: TABLE,
+      groupId: 'group-1',
+      outputs: [{ blockId: 'block-1', path: 'value', columnName: 'value' }],
+      overwrite: true,
+      requestId: 'request-1',
+      actorUserId: 'billed-owner',
+      capabilityGovernedUserId: 'member-1',
+    })
+
+    expect(mockBatchUpdateRows).toHaveBeenCalledWith(
+      expect.objectContaining({
+        actorUserId: 'billed-owner',
+        capabilityGovernedUserId: 'member-1',
+      }),
+      expect.anything(),
+      expect.anything(),
+      expect.anything()
+    )
+  })
+
+  /** A change with no acting person still names one explicitly. */
+  it('keeps an absent subject null rather than borrowing the billing actor', async () => {
+    queueOnePage()
+
+    await maybeBackfillGroupOutputs({
+      table: TABLE,
+      groupId: 'group-1',
+      outputs: [{ blockId: 'block-1', path: 'value', columnName: 'value' }],
+      overwrite: true,
+      requestId: 'request-1',
+      actorUserId: 'billed-owner',
+    })
+
+    expect(mockBatchUpdateRows).toHaveBeenCalledWith(
+      expect.objectContaining({ capabilityGovernedUserId: null }),
+      expect.anything(),
+      expect.anything(),
+      expect.anything()
+    )
+  })
+})

apps/sim/lib/table/backfill-runner.ts

@@ -56,6 +56,14 @@ export interface TableBackfillPayload {
   overwrite: boolean
   /** User who triggered the schema change, for usage attribution on the row writes. */
   actorUserId?: string | null
+  /**
+   * Person whose permission group gates any cell the backfill's writes cascade
+   * into. Separate from `actorUserId`, which is a billing attribution and names
+   * the workspace billed account when the schema change carried no human. Null
+   * when the change had no acting person; absent on payloads enqueued before
+   * this field existed, which read as null — the pre-existing behavior.
+   */
+  capabilityGovernedUserId?: string | null
 }
 
 /**
@@ -136,8 +144,11 @@ async function processBackfillPage(opts: {
   execs: Array<{ rowId: string; executionId: string | null }>
   requestId: string
   actorUserId?: string | null
+  /** See {@link TableBackfillPayload.capabilityGovernedUserId}. */
+  capabilityGovernedUserId?: string | null
 }): Promise<number> {
-  const { table, outputs, overwrite, execs, requestId, actorUserId } = opts
+  const { table, outputs, overwrite, execs, requestId, actorUserId, capabilityGovernedUserId } =
+    opts
 
   const executionIdsByRow = new Map<string, string>()
   for (const e of execs) {
@@ -225,11 +236,14 @@ async function processBackfillPage(opts: {
       workspaceId: table.workspaceId,
       actorUserId,
       /**
-       * A backfill replays values already produced by earlier runs; it starts
-       * no enrichment of its own and carries no acting person into this
-       * background pass.
+       * A backfill replays values already produced by earlier runs, but the
+       * cells it fills are dependencies: `batchUpdateRows` starts every
+       * downstream group whose deps just became satisfied. Those cells are
+       * governed by whoever made the schema change, carried separately from
+       * `actorUserId` — an attribution that names the workspace billed account
+       * when the change carried no human, whose denylist is nobody's to run.
        */
-      capabilityGovernedUserId: null,
+      capabilityGovernedUserId: capabilityGovernedUserId ?? null,
       secretProvenanceByRowId,
     },
     table,
@@ -248,7 +262,8 @@ async function processBackfillPage(opts: {
  * passes skip already-filled cells).
  */
 export async function runTableBackfill(payload: TableBackfillPayload): Promise<void> {
-  const { jobId, tableId, groupId, outputs, overwrite, actorUserId } = payload
+  const { jobId, tableId, groupId, outputs, overwrite, actorUserId, capabilityGovernedUserId } =
+    payload
   const requestId = generateId().slice(0, 8)
 
   try {
@@ -274,6 +289,7 @@ export async function runTableBackfill(payload: TableBackfillPayload): Promise<v
         execs,
         requestId,
         actorUserId,
+        capabilityGovernedUserId,
       })
       processed += execs.length
     }
@@ -328,8 +344,11 @@ export async function maybeBackfillGroupOutputs(opts: {
   overwrite: boolean
   requestId: string
   actorUserId?: string | null
+  /** See {@link TableBackfillPayload.capabilityGovernedUserId}. */
+  capabilityGovernedUserId?: string | null
 }): Promise<void> {
-  const { table, groupId, outputs, overwrite, requestId, actorUserId } = opts
+  const { table, groupId, outputs, overwrite, requestId, actorUserId, capabilityGovernedUserId } =
+    opts
   if (outputs.length === 0) return
 
   const [{ count: completedCount }] = await db
@@ -353,7 +372,15 @@ export async function maybeBackfillGroupOutputs(opts: {
       const execs = await selectCompletedExecPage(table.id, groupId, afterRowId, BACKFILL_PAGE_SIZE)
       if (execs.length === 0) break
       afterRowId = execs[execs.length - 1].rowId
-      await processBackfillPage({ table, outputs, overwrite, execs, requestId, actorUserId })
+      await processBackfillPage({
+        table,
+        outputs,
+        overwrite,
+        execs,
+        requestId,
+        actorUserId,
+        capabilityGovernedUserId,
+      })
     }
     return
   }
@@ -376,6 +403,7 @@ export async function maybeBackfillGroupOutputs(opts: {
     outputs,
     overwrite,
     actorUserId,
+    capabilityGovernedUserId,
   }
   if (isTriggerDevEnabled) {
     try {

apps/sim/lib/table/workflow-groups/service.ts

@@ -571,6 +571,7 @@ export async function updateWorkflowGroup(
         overwrite: false,
         requestId,
         actorUserId: data.actorUserId,
+        capabilityGovernedUserId: data.capabilityGovernedUserId,
       })
     } catch (err) {
       logger.warn(
@@ -589,6 +590,7 @@ export async function updateWorkflowGroup(
         overwrite: true,
         requestId,
         actorUserId: data.actorUserId,
+        capabilityGovernedUserId: data.capabilityGovernedUserId,
       })
     } catch (err) {
       logger.warn(
@@ -636,8 +638,12 @@ export async function addWorkflowGroupOutput(
     path: string
     /** Optional override; defaults to a slug derived from `path`. */
     columnName?: string
-    /** The member adding the output — billed/gated for any backfill-triggered re-run. */
+    /** The member adding the output — the billing attribution for the backfill's
+     *  row writes. Not the gate: see `capabilityGovernedUserId`. */
     actorUserId?: string | null
+    /** Person whose permission group gates any cell the backfill's writes
+     *  cascade into; null when the change has no acting person. */
+    capabilityGovernedUserId?: string | null
     resolvedOutput: {
       workflowId: string
       columnType: ColumnDefinition['type']
@@ -869,6 +875,7 @@ export async function addWorkflowGroupOutput(
       overwrite: false,
       requestId,
       actorUserId: data.actorUserId,
+      capabilityGovernedUserId: data.capabilityGovernedUserId,
     })
   } catch (err) {
     logger.warn(