fix(table): govern CSV-import auto-fire by the person the route already gated

A synchronous CSV import passed an explicit null governed subject, so the
workflow and enrichment cells the appended rows auto-fire ran with no
per-tool gate — including when a session member with a restricting
permission group started the import. The subject now comes from the same
`TableAccessPrincipal` `checkAccess` gated `tables.use` against, so a
route cannot gate one subject and dispatch under another.

Author: waleedlatif1

apps/sim/app/api/table/[tableId]/import/route.ts

@@ -21,9 +21,11 @@ import { performTableCsvImport } from '@/lib/table/orchestration'
 import { getUserSettings } from '@/lib/users/queries'
 import {
   accessError,
+  capabilityGovernedUserId,
   checkAccess,
   csvProxyBodyCapResponse,
   multipartErrorResponse,
+  type TableAccessPrincipal,
 } from '@/app/api/table/utils'
 
 const logger = createLogger('TableImportCSVExisting')
@@ -96,11 +98,8 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
       )
     }
 
-    const accessResult = await checkAccess(
-      tableId,
-      { kind: 'user', userId: authResult.userId },
-      'write'
-    )
+    const principal: TableAccessPrincipal = { kind: 'user', userId: authResult.userId }
+    const accessResult = await checkAccess(tableId, principal, 'write')
     if (!accessResult.ok) return accessError(accessResult, requestId, tableId)
 
     const { table } = accessResult
@@ -160,6 +159,13 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
       createColumns,
       timezone,
       requestId,
+      /**
+       * An append starts the table's workflow columns on every row it lands, so
+       * those cells are governed by the same person `checkAccess` just gated —
+       * not left ungoverned, which would let an import run tools this member's
+       * permission group withholds.
+       */
+      capabilityGovernedUserId: capabilityGovernedUserId(principal),
     })
 
     if (!outcome.success) {

apps/sim/app/api/table/import-csv/route.ts

@@ -131,6 +131,14 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       folderId,
       timezone,
       requestId,
+      /**
+       * The session or internal-JWT person this route already gated
+       * `tables.create` against. A table created here has no workflow columns
+       * yet, so nothing auto-fires today; naming the subject anyway keeps the
+       * rule "the id the surface gated is the id the write dispatches under"
+       * with no producer-specific exception to re-argue.
+       */
+      capabilityGovernedUserId: userId,
     })
 
     if (!outcome.success) {

apps/sim/app/api/table/utils.ts

@@ -268,8 +268,14 @@ function roleSubjectUserId(principal: TableAccessPrincipal): string {
 /**
  * The id whose permission group governs the request, or `null` when no group
  * does. Only a `user` principal has one — see {@link TableAccessPrincipal}.
+ *
+ * Exported because the gate is not the only thing that needs the subject: a
+ * write that lands rows auto-fires the table's workflow and enrichment cells,
+ * and those cells must run under the same person this check just gated, not
+ * under whatever id the surface had nearest. One statement of the rule, so a
+ * route cannot gate one subject and dispatch another.
  */
-function capabilityGovernedUserId(principal: TableAccessPrincipal): string | null {
+export function capabilityGovernedUserId(principal: TableAccessPrincipal): string | null {
   return principal.kind === 'user' ? principal.userId : null
 }
 

apps/sim/lib/table/import-data.ts

@@ -265,7 +265,14 @@ export async function importAppendRows(
   table: TableDefinition,
   additions: { id?: string; name: string; type: string; required?: boolean; unique?: boolean }[],
   rows: RowData[],
-  ctx: { workspaceId: string; userId?: string; requestId: string }
+  ctx: {
+    workspaceId: string
+    userId?: string
+    requestId: string
+    /** Gate subject for cells the appended rows auto-fire — the subject the
+     *  importing surface resolved from its principal, or `null` for none. */
+    capabilityGovernedUserId: string | null
+  }
 ): Promise<{ inserted: TableRow[]; table: TableDefinition }> {
   // Gate capacity before opening the tx — the lookup is a separate pool read.
   const rowLimit = await assertRowCapacity({
@@ -294,8 +301,7 @@ export async function importAppendRows(
           rows: batch,
           workspaceId: ctx.workspaceId,
           userId: ctx.userId,
-          /** CSV import is auto-fire: no acting person governs the rows it lands. */
-          capabilityGovernedUserId: null,
+          capabilityGovernedUserId: ctx.capabilityGovernedUserId,
           secretProvenance: batch.map(createExactEmptyTableRowSecretProvenance),
         },
         working,

apps/sim/lib/table/orchestration/import.test.ts

@@ -91,6 +91,7 @@ function importParams(overrides: Record<string, unknown> = {}) {
     mode: 'append' as const,
     timezone: 'UTC',
     requestId: 'req-1',
+    capabilityGovernedUserId: 'user-1' as string | null,
     ...overrides,
   }
 }
@@ -133,6 +134,43 @@ describe('performTableCsvImport', () => {
     expect(mockSignalSchemaChanged).toHaveBeenCalledWith('table-1')
   })
 
+  /**
+   * The rows an import lands start the table's workflow columns, and those
+   * cells gate their tools on the governed subject. Dropping it here would run
+   * the importing member's cells with no per-tool gate at all — the one thing
+   * `null` means on this field.
+   */
+  it('dispatches the auto-fired cells under the importing person', async () => {
+    await performTableCsvImport(importParams({ capabilityGovernedUserId: 'user-9' }))
+
+    expect(mockDispatchAfterBatchInsert).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.anything(),
+      'req-1',
+      'user-1',
+      'user-9'
+    )
+    expect(mockImportAppendRows).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.anything(),
+      expect.anything(),
+      expect.objectContaining({ capabilityGovernedUserId: 'user-9' })
+    )
+  })
+
+  /** An actorless import still says so explicitly rather than by omission. */
+  it('carries a null subject through unchanged', async () => {
+    await performTableCsvImport(importParams({ capabilityGovernedUserId: null }))
+
+    expect(mockDispatchAfterBatchInsert).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.anything(),
+      'req-1',
+      'user-1',
+      null
+    )
+  })
+
   it('reports the deleted count on a replace', async () => {
     const result = await performTableCsvImport(importParams({ mode: 'replace' }))
 
@@ -344,6 +382,7 @@ describe('performCreateTableFromCsv', () => {
       folderId: null,
       timezone: 'UTC',
       requestId: 'req-1',
+      capabilityGovernedUserId: 'user-1',
     }
   }
 

apps/sim/lib/table/orchestration/import.ts

@@ -234,6 +234,15 @@ export interface PerformTableCsvImportParams {
   /** IANA zone used to read naive datetimes (Excel/Sheets exports carry no offset). */
   timezone: string
   requestId?: string
+  /**
+   * The person whose permission group gates any cell this import auto-fires,
+   * or `null` when no person is behind it. Required with an explicit `null`
+   * rather than optional, matching `insertDispatch`: an import lands rows, and
+   * landing rows starts workflow and enrichment cells on the table's workflow
+   * columns. Threaded from the surface that holds the principal rather than
+   * re-derived here — the route has already gated the same subject.
+   */
+  capabilityGovernedUserId: string | null
 }
 
 export interface TableCsvImportData extends ImportRejectionFields {
@@ -271,8 +280,17 @@ export interface PerformTableCsvImportResult {
 export async function performTableCsvImport(
   params: PerformTableCsvImportParams
 ): Promise<PerformTableCsvImportResult> {
-  const { table, workspaceId, userId, fileStream, fileName, fallbackDelimiter, mode, timezone } =
-    params
+  const {
+    table,
+    workspaceId,
+    userId,
+    fileStream,
+    fileName,
+    fallbackDelimiter,
+    mode,
+    timezone,
+    capabilityGovernedUserId,
+  } = params
   const requestId = params.requestId ?? generateRequestId()
 
   if (table.archivedAt) return fail('Cannot import into an archived table', 'validation')
@@ -367,11 +385,11 @@ export async function performTableCsvImport(
         workspaceId,
         userId,
         requestId,
+        capabilityGovernedUserId,
       })
       // Fire trigger + scheduler AFTER the tx commits — both read through the
       // global db connection and would otherwise see no rows.
-      /** CSV import is auto-fire: no acting person governs the rows it lands. */
-      dispatchAfterBatchInsert(finalTable, inserted, requestId, userId, null)
+      dispatchAfterBatchInsert(finalTable, inserted, requestId, userId, capabilityGovernedUserId)
 
       logger.info(`[${requestId}] Append CSV imported`, {
         tableId: table.id,
@@ -419,6 +437,16 @@ export async function performTableCsvImport(
 export interface PerformCreateTableFromCsvParams {
   workspaceId: string
   userId: string
+  /**
+   * The person whose permission group gates any cell this import auto-fires,
+   * or `null` when no person is behind it. Required with an explicit `null`
+   * rather than optional, matching `insertDispatch`: an import lands rows, and
+   * landing rows starts workflow and enrichment cells on the table's workflow
+   * columns. Threaded from the surface that holds the principal rather than
+   * re-derived here — the route has already gated the same subject.
+   */
+  capabilityGovernedUserId: string | null
+
   /** Multipart file stream. The caller still owns destroying it. */
   fileStream: Readable
   fileName: string
@@ -462,8 +490,16 @@ export interface PerformCreateTableFromCsvResult {
 export async function performCreateTableFromCsv(
   params: PerformCreateTableFromCsvParams
 ): Promise<PerformCreateTableFromCsvResult> {
-  const { workspaceId, userId, fileStream, fileName, fallbackDelimiter, folderId, timezone } =
-    params
+  const {
+    workspaceId,
+    userId,
+    fileStream,
+    fileName,
+    fallbackDelimiter,
+    folderId,
+    timezone,
+    capabilityGovernedUserId,
+  } = params
   const requestId = params.requestId ?? generateRequestId()
 
   const { delimiter, stream } = await sniffCsvDelimiterFromStream(fileStream, fallbackDelimiter)
@@ -508,8 +544,7 @@ export async function performCreateTableFromCsv(
         rows: coerced as RowData[],
         workspaceId,
         userId,
-        /** CSV import is auto-fire: no acting person governs the rows it lands. */
-        capabilityGovernedUserId: null,
+        capabilityGovernedUserId,
         secretProvenance: coerced.map(createExactEmptyTableRowSecretProvenance),
       },
       // The created table's rowCount is frozen at 0; pass the running total so the