fix(settings): decouple access settings from usage analytics

Author: waleedlatif1

apps/sim/app/api/billing/route.ts

@@ -10,6 +10,7 @@ import { and, desc, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { getBillingContract } from '@/lib/api/contracts/subscription'
 import { parseRequest } from '@/lib/api/server'
+import { internalBillingReadErrorPolicy } from '@/lib/api/server/routes/billing-read'
 import { getSession } from '@/lib/auth'
 import { getOrganizationSubscription, getPersonalBillingSummary } from '@/lib/billing/core/billing'
 import { getOrganizationBillingData } from '@/lib/billing/core/organization'
@@ -125,6 +126,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       getOrganizationBillingData(organizationId, dbReplica, {
         limit: memberLimit,
         offset: memberOffset,
+        includeMemberUsageCounts: false,
       }),
       getOrganizationSubscription(organizationId, { executor: dbReplica, onError: 'throw' }),
       dbReplica
@@ -218,6 +220,13 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       error,
     })
 
+    const recoverable = internalBillingReadErrorPolicy.project(error)
+    if (recoverable)
+      return NextResponse.json(recoverable.body, {
+        status: recoverable.status,
+        headers: recoverable.headers,
+      })
+
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
   }
 })

apps/sim/app/api/organizations/[id]/billing-plan/route.ts

@@ -0,0 +1,24 @@
+import { getOrganizationPlanSeatsContract } from '@/lib/api/contracts/organization'
+import {
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalBillingReadErrorPolicy } from '@/lib/api/server/routes/billing-read'
+import { getOrganizationPlanSeats } from '@/lib/billing/application/organization-billing/get-organization-plan-seats'
+import { organizationBillingOperations } from '@/lib/billing/application/organization-billing/operations'
+
+export const dynamic = 'force-dynamic'
+
+export const GET = defineInternalJsonRoute({
+  contract: getOrganizationPlanSeatsContract,
+  auth: internalSessionAuth,
+  operation: organizationBillingOperations.planSeats,
+  rateLimit: internalRateLimits.none({
+    reason: 'Small organization plan and seat read restricted to current admins and owners',
+  }),
+  errorPolicy: internalBillingReadErrorPolicy,
+  mapInput: ({ params }) => ({ organizationId: params.id }),
+  useCase: getOrganizationPlanSeats,
+  present: (data) => ({ success: true, data }),
+})

apps/sim/app/api/organizations/[id]/billing-summary/route.test.ts

@@ -6,15 +6,12 @@ const { mockReadBillingSummary } = vi.hoisted(() => ({
   mockReadBillingSummary: vi.fn(),
 }))
 
-vi.mock(
-  '@/lib/billing/application/organization-billing-summary/get-organization-billing-summary',
-  () => ({
-    getOrganizationBillingSummary: {
-      operation: { id: 'organization_billing.summary.read' },
-      execute: mockReadBillingSummary,
-    },
-  })
-)
+vi.mock('@/lib/billing/application/organization-billing/get-organization-billing-summary', () => ({
+  getOrganizationBillingSummary: {
+    operation: { id: 'organization_billing.summary.read' },
+    execute: mockReadBillingSummary,
+  },
+}))
 
 import { GET } from '@/app/api/organizations/[id]/billing-summary/route'
 

apps/sim/app/api/organizations/[id]/billing-summary/route.ts

@@ -1,23 +1,23 @@
 import { getOrganizationBillingSummaryContract } from '@/lib/api/contracts/organization'
 import {
   defineInternalJsonRoute,
-  internalOrchestrationErrorPolicy,
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import { getOrganizationBillingSummary } from '@/lib/billing/application/organization-billing-summary/get-organization-billing-summary'
-import { organizationBillingSummaryOperations } from '@/lib/billing/application/organization-billing-summary/operations'
+import { internalBillingReadErrorPolicy } from '@/lib/api/server/routes/billing-read'
+import { getOrganizationBillingSummary } from '@/lib/billing/application/organization-billing/get-organization-billing-summary'
+import { organizationBillingOperations } from '@/lib/billing/application/organization-billing/operations'
 
 export const dynamic = 'force-dynamic'
 
 export const GET = defineInternalJsonRoute({
   contract: getOrganizationBillingSummaryContract,
   auth: internalSessionAuth,
-  operation: organizationBillingSummaryOperations.read,
+  operation: organizationBillingOperations.read,
   rateLimit: internalRateLimits.none({
     reason: 'Authenticated organization billing read, restricted to organization admins and owners',
   }),
-  errorPolicy: internalOrchestrationErrorPolicy,
+  errorPolicy: internalBillingReadErrorPolicy,
   mapInput: ({ params }) => ({ organizationId: params.id }),
   useCase: getOrganizationBillingSummary,
   present: (data) => ({ success: true, data }),

apps/sim/app/api/usage/route.ts

@@ -8,6 +8,7 @@ import {
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
+import { internalBillingReadErrorPolicy } from '@/lib/api/server/routes/billing-read'
 import {
   readUsageLimit,
   type UsageLimitResult,
@@ -48,7 +49,7 @@ export const GET = defineInternalJsonRoute({
   auth: internalSessionAuth,
   operation: usageLimitOperations.read,
   rateLimit,
-  errorPolicy,
+  errorPolicy: internalBillingReadErrorPolicy,
   mapInput: ({ query }) => query,
   useCase: readUsageLimit,
   present,

apps/sim/app/o/[organizationId]/settings/settings-query-warmers.ts

@@ -4,11 +4,11 @@ import type {
   OrganizationSettingsSection,
 } from '@/components/settings/navigation'
 import {
-  organizationBillingQueryOptions,
   organizationDetailQueryOptions,
   organizationRosterQueryOptions,
 } from '@/hooks/queries/organization'
 import { organizationBillingSummaryOptions } from '@/hooks/queries/organization-billing-summary'
+import { organizationPlanSeatsOptions } from '@/hooks/queries/organization-plan-seats'
 import { prefetchQueryOnIntent } from '@/hooks/queries/utils/prefetch-query-on-intent'
 
 interface OrganizationSettingsQueryWarmContext {
@@ -28,7 +28,7 @@ export function warmOrganizationSettingsSectionQuery(
     prefetchQueryOnIntent(queryClient, organizationDetailQueryOptions(organizationId))
     prefetchQueryOnIntent(queryClient, organizationRosterQueryOptions(organizationId))
     if (isAdmin) {
-      prefetchQueryOnIntent(queryClient, organizationBillingQueryOptions(organizationId))
+      prefetchQueryOnIntent(queryClient, organizationPlanSeatsOptions(organizationId))
     }
   }
   if (section === 'billing' && isAdmin) {

apps/sim/app/workspace/[workspaceId]/components/invite-modal/invite-modal.tsx

@@ -21,7 +21,7 @@ import { quickValidateEmail } from '@/lib/messaging/email/validation'
 import type { PermissionType } from '@/lib/workspaces/permissions/utils'
 import { useOptionalWorkspaceHostContext } from '@/app/workspace/[workspaceId]/providers/workspace-host-provider'
 import { useSendWorkspaceInvitations } from '@/hooks/queries/invitations'
-import { useOrganizationBilling } from '@/hooks/queries/organization'
+import { useOrganizationPlanSeats } from '@/hooks/queries/organization-plan-seats'
 import { useAdminWorkspaces } from '@/hooks/queries/workspace'
 
 const logger = createLogger('InviteModal')
@@ -193,7 +193,7 @@ export function InviteModal({
   )
   const canViewOrganizationBilling = canGrantOrganizationAdmin
 
-  const { data: organizationBillingData } = useOrganizationBilling(organizationId ?? '', {
+  const { data: organizationBillingData } = useOrganizationPlanSeats(organizationId ?? '', {
     enabled: open && billingEnabled && canViewOrganizationBilling,
   })
 

apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx

@@ -29,11 +29,11 @@ import {
   useCreateOrganization,
   useMemberRemovalImpact,
   useOrganization,
-  useOrganizationBilling,
   useOrganizationRoster,
   useRemoveMember,
   useTransferOwnership,
 } from '@/hooks/queries/organization'
+import { useOrganizationPlanSeats } from '@/hooks/queries/organization-plan-seats'
 import { useOpenBillingPortal, useSubscriptionData } from '@/hooks/queries/subscription'
 import { usePermissionConfig } from '@/hooks/use-permission-config'
 
@@ -92,7 +92,7 @@ export function TeamManagement({
     isFetchedAfterMount: isOrganizationBillingFetchedAfterMount,
     isFetching: isOrganizationBillingFetching,
     refetch: refetchOrganizationBilling,
-  } = useOrganizationBilling(organizationId, { enabled: billingEnabled && adminOrOwner })
+  } = useOrganizationPlanSeats(organizationId, { enabled: billingEnabled && adminOrOwner })
 
   const {
     data: roster,
@@ -175,7 +175,7 @@ export function TeamManagement({
    * subscriptions.
    */
   const orgBilling = billingEnabled ? (organizationBillingData?.data ?? null) : null
-  const orgSubscription = orgBilling
+  const orgSubscription = orgBilling?.subscriptionPlan
     ? {
         id: orgBilling.organizationId,
         plan: orgBilling.subscriptionPlan,

apps/sim/ee/access-control/components/access-control.tsx

@@ -18,8 +18,6 @@ import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { useParams } from 'next/navigation'
 import { useQueryState } from 'nuqs'
-import { isEnterprise } from '@/lib/billing/plan-helpers'
-import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
 import {
   groupIdParam,
   groupIdUrlKeys,
@@ -47,9 +45,7 @@ import {
   useCreatePermissionGroup,
   useOrganizationWorkspaces,
   usePermissionGroups,
-  useUserPermissionConfig,
 } from '@/ee/access-control/hooks/permission-groups'
-import { useOrganizationBilling } from '@/hooks/queries/organization'
 
 const logger = createLogger('AccessControl')
 
@@ -65,57 +61,21 @@ export function AccessControl({
   requestsHref,
 }: AccessControlProps) {
   const params = useParams()
-  const { features } = useDeploymentShape()
   const workspaceId = typeof params?.workspaceId === 'string' ? params.workspaceId : undefined
 
-  /**
-   * Access control is governed by the workspace's OWNING organization, which may
-   * differ from the caller's active org (e.g. external members). Resolve the org
-   * id and the caller's admin status server-side from the workspace so gating is
-   * never keyed off the session's active org.
-   */
-  const {
-    data: userPermissionConfig,
-    isPending: entitlementLoading,
-    error: entitlementError,
-  } = useUserPermissionConfig(workspaceId)
-  const {
-    data: organizationBillingData,
-    isPending: organizationBillingLoading,
-    error: organizationBillingError,
-  } = useOrganizationBilling(organizationId, {
-    enabled: !features.accessControl && !userPermissionConfig?.entitled,
-  })
-  const currentUserIsOrgAdmin = isOrganizationAdmin
-
   const {
-    data: permissionGroups = [],
+    data: permissionGroupsData,
     isPending: groupsLoading,
     error: groupsError,
     isFetching: groupsFetching,
     refetch: refetchGroups,
-  } = usePermissionGroups(organizationId, !!organizationId && currentUserIsOrgAdmin)
+  } = usePermissionGroups(organizationId, !!organizationId && isOrganizationAdmin)
+  const permissionGroups = permissionGroupsData ?? []
   const { data: organizationWorkspaces = [], isPending: workspacesLoading } =
-    useOrganizationWorkspaces(organizationId, !!organizationId && currentUserIsOrgAdmin)
+    useOrganizationWorkspaces(organizationId, !!organizationId && isOrganizationAdmin)
 
-  /**
-   * Must be the resolved flag, not the raw `NEXT_PUBLIC_ACCESS_CONTROL_ENABLED`
-   * read. The settings nav decides visibility from the same resolver, so
-   * reading the bare var here let a deployment with only `ENTERPRISE_ENABLED`
-   * set show the section and then refuse to manage it.
-   */
-  const isEntitled =
-    features.accessControl ||
-    !!userPermissionConfig?.entitled ||
-    isEnterprise(organizationBillingData?.data?.subscriptionPlan)
-  const canManage = isEntitled && currentUserIsOrgAdmin && !!organizationId
-  const organizationEntitlementLoading =
-    !features.accessControl && !userPermissionConfig?.entitled && organizationBillingLoading
-
-  const isLoading =
-    (workspaceId ? entitlementLoading : false) ||
-    organizationEntitlementLoading ||
-    (!!organizationId && currentUserIsOrgAdmin && groupsLoading)
+  const canManage = isOrganizationAdmin && !!organizationId
+  const isLoading = canManage && groupsLoading
 
   const createPermissionGroup = useCreatePermissionGroup()
 
@@ -225,22 +185,24 @@ export function AccessControl({
     },
   ]
 
+  const groupsErrorState = groupsError ? (
+    <SettingsQueryErrorState
+      error={groupsError}
+      fallback={
+        permissionGroupsData === undefined
+          ? 'Failed to load permission groups'
+          : 'Failed to refresh permission groups'
+      }
+      isRetrying={groupsFetching}
+      onRetry={() => void refetchGroups()}
+      variant={permissionGroupsData === undefined ? 'fill' : 'inline'}
+    />
+  ) : null
+
   if (isLoading) {
     return <SettingsPanel search={listSearch} actions={listActions} />
   }
 
-  const entitlementLoadError = isEntitled
-    ? null
-    : ((userPermissionConfig === undefined ? entitlementError : null) ??
-      (organizationBillingData === undefined ? organizationBillingError : null))
-  if (entitlementLoadError) {
-    return (
-      <SettingsEmptyState tone='error'>
-        {getErrorMessage(entitlementLoadError, 'Failed to load Access Control access')}
-      </SettingsEmptyState>
-    )
-  }
-
   if (!canManage) {
     return (
       <SettingsEmptyState>
@@ -251,38 +213,33 @@ export function AccessControl({
     )
   }
 
-  if (groupsError) {
-    return (
-      <SettingsPanel search={listSearch}>
-        <SettingsQueryErrorState
-          error={groupsError}
-          fallback='Failed to load permission groups'
-          isRetrying={groupsFetching}
-          onRetry={() => void refetchGroups()}
-        />
-      </SettingsPanel>
-    )
+  if (groupsError && permissionGroupsData === undefined) {
+    return <SettingsPanel search={listSearch}>{groupsErrorState}</SettingsPanel>
   }
 
   if (selectedGroup && organizationId) {
     return (
-      <GroupDetail
-        key={selectedGroup.id}
-        group={selectedGroup}
-        organizationId={organizationId}
-        workspaceId={workspaceId}
-        workspaceOptions={workspaceOptions}
-        organizationWorkspaces={organizationWorkspaces}
-        workspacesLoading={workspacesLoading}
-        onBack={closeGroupDetail}
-        onDeleted={closeGroupDetail}
-      />
+      <>
+        {groupsErrorState}
+        <GroupDetail
+          key={selectedGroup.id}
+          group={selectedGroup}
+          organizationId={organizationId}
+          workspaceId={workspaceId}
+          workspaceOptions={workspaceOptions}
+          organizationWorkspaces={organizationWorkspaces}
+          workspacesLoading={workspacesLoading}
+          onBack={closeGroupDetail}
+          onDeleted={closeGroupDetail}
+        />
+      </>
     )
   }
 
   return (
     <>
       <SettingsPanel search={listSearch} actions={listActions}>
+        {groupsErrorState}
         <SettingsSection
           label={`Permission groups (${permissionGroups.length})`}
           action={<ChipLink href={requestsHref}>Review requests</ChipLink>}