Clarify authorization readiness states

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx

@@ -75,7 +75,11 @@ export function SettingsSidebar({
   const forkingAvailable = useForkingAvailable(workspaceId)
   const { userPermissions } = useWorkspacePermissionsContext()
   const { canAdmin: canAdminWorkspace } = userPermissions
-  const permissionsReadinessBusy = userPermissions.isLoading || !userPermissions.canRead
+  const authorizationState = userPermissions.isLoading
+    ? 'loading'
+    : userPermissions.canRead
+      ? 'granted'
+      : 'denied'
 
   const userId = session?.user?.id
 
@@ -290,7 +294,8 @@ export function SettingsSidebar({
       <div
         role='navigation'
         aria-label='Workspace settings sections'
-        aria-busy={permissionsReadinessBusy}
+        aria-busy={authorizationState === 'loading'}
+        data-authorization-state={authorizationState}
         ref={isCollapsed ? undefined : scrollContainerRef}
         className={cn(
           'flex flex-1 flex-col overflow-y-auto overflow-x-hidden border-t pt-1.5 transition-colors duration-150',

apps/sim/e2e/settings/authorization/contract-integrity.spec.ts

@@ -227,6 +227,17 @@ test('mutation contracts declare every required section and role boundary', () =
         pathTemplate.endsWith('/settings/access-control')
     )
   ).toBe(true)
+
+  expect(
+    mutationControlCases
+      .filter(
+        ({ pathTemplate, controls }) =>
+          pathTemplate.startsWith('/organization/') &&
+          controls.some(({ expectation }) => expectation === 'absent')
+      )
+      .map(({ caseId }) => caseId),
+    'organization absence probes must use the Members readiness barrier'
+  ).toEqual(['organization-member-members-controls'])
 })
 
 test('Step 4 paths stay canonical and separate from Step 3 special paths', () => {

apps/sim/e2e/settings/authorization/mutation-controls.spec.ts

@@ -143,12 +143,14 @@ async function expectAuthorizationReadiness(
 async function expectMutationPermissionsReady(page: Page, pathTemplate: string): Promise<void> {
   if (pathTemplate.startsWith('/workspace/')) {
     const sidebar = page.getByRole('complementary', { name: 'Workspace sidebar' })
-    await expect(
-      sidebar.getByRole('navigation', { name: 'Workspace settings sections' })
-    ).toHaveAttribute('aria-busy', 'false')
+    const navigation = sidebar.getByRole('navigation', { name: 'Workspace settings sections' })
+    await expect(navigation).toHaveAttribute('aria-busy', 'false')
+    await expect(navigation).toHaveAttribute('data-authorization-state', 'granted')
     return
   }
 
+  // Members is the only organization route with an absent-control probe; the
+  // integrity spec requires any future organization absence case to add a barrier.
   if (pathTemplate.endsWith('/settings/members')) {
     await expect(page.getByRole('region', { name: 'Organization members' })).toHaveAttribute(
       'aria-busy',