fix(chat): gate workflow creation on write access, pin the key in schedule tests

The zero-workflow landing offered "Create workflow" to every member. Creation
navigates optimistically, so a read-only member was sent to a workflow the
server had already refused to create, with the failure never surfaced. Gate both
entry points — the empty state and the sidebar's "New workflow" row — on the
same `canEdit` check the rest of the sidebar uses, and tell read-only members
who can make one instead of offering an action that cannot succeed.

The schedule-execution tests only passed locally because vitest loads the
developer's own `.env`, which supplied COPILOT_API_KEY; CI has none, so the
prompt-job claim guard skipped the claims those cases assert on. Pin the key
through the env mock so the suite states its own preconditions.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ErcRgvi7VQBeKDQ3MBMha

Author: TheodoreSpeaks

apps/sim/app/api/schedules/execute/route.test.ts

@@ -9,6 +9,8 @@ import {
   requestUtilsMockFns,
   resetDbChainMock,
   resetEnvFlagsMock,
+  resetEnvMock,
+  setEnv,
   setEnvFlags,
 } from '@sim/testing'
 import { type NextRequest, NextResponse } from 'next/server'
@@ -275,7 +277,10 @@ function createMockRequest(): NextRequest {
   } as NextRequest
 }
 
-afterAll(resetEnvFlagsMock)
+afterAll(() => {
+  resetEnvFlagsMock()
+  resetEnvMock()
+})
 
 describe('Scheduled Workflow Execution API Route', () => {
   beforeEach(() => {
@@ -290,6 +295,9 @@ describe('Scheduled Workflow Execution API Route', () => {
     dbChainMockFns.execute.mockResolvedValue([{ acquired: true }] as never)
     requestUtilsMockFns.mockGenerateRequestId.mockReturnValue('test-request-id')
     setEnvFlags({ isTriggerDevEnabled: false, isHosted: false, isProd: false, isDev: true })
+    // Prompt-job claims are skipped without the mothership credential; pin it so
+    // these cases do not depend on whether the runner happens to have a .env.
+    setEnv({ COPILOT_API_KEY: 'test-api-key' })
     mockShouldExecuteInline.mockReturnValue(false)
     mockEnqueue.mockReset()
     mockEnqueue.mockResolvedValue('job-id-1')

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx

@@ -747,6 +747,9 @@ export const Sidebar = memo(function Sidebar({
           icon: isChatEnabled ? Home : Plus,
           href: isChatEnabled ? `/workspace/${workspaceId}/home` : undefined,
           onClick: isChatEnabled ? undefined : createWorkflow,
+          // Creation navigates optimistically, so a read-only member would land
+          // on a workflow the server declined to create.
+          hidden: !isChatEnabled && !permissionsLoading && !canEdit,
         },
         {
           id: 'search',
@@ -763,7 +766,14 @@ export const Sidebar = memo(function Sidebar({
           hidden: permissionConfig.hideIntegrationsTab,
         },
       ].filter((item) => !item.hidden),
-    [workspaceId, openSearchModal, createWorkflow, permissionConfig.hideIntegrationsTab]
+    [
+      workspaceId,
+      openSearchModal,
+      createWorkflow,
+      canEdit,
+      permissionsLoading,
+      permissionConfig.hideIntegrationsTab,
+    ]
   )
 
   const workspaceNavItems = useMemo(

apps/sim/app/workspace/[workspaceId]/w/page.tsx

@@ -5,6 +5,7 @@ import { Chip } from '@sim/emcn'
 import { createLogger } from '@sim/logger'
 import { useParams, useRouter } from 'next/navigation'
 import { ReactFlowProvider } from 'reactflow'
+import { useUserPermissionsContext } from '@/app/workspace/[workspaceId]/providers/workspace-permissions-provider'
 import { Panel, Terminal } from '@/app/workspace/[workspaceId]/w/[workflowId]/components'
 import { useWorkflowOperations } from '@/app/workspace/[workspaceId]/w/components/sidebar/hooks'
 import { useWorkflows } from '@/hooks/queries/workflows'
@@ -33,6 +34,7 @@ export default function WorkflowsPage() {
 
   const { data: workflows = [], isLoading, isError, isPlaceholderData } = useWorkflows(workspaceId)
   const { handleCreateWorkflow, isCreatingWorkflow } = useWorkflowOperations({ workspaceId })
+  const { canEdit, isLoading: permissionsLoading } = useUserPermissionsContext()
 
   // An id rather than the filtered array: `data` defaults to a fresh `[]` while
   // the query has no data, so an array dependency would re-fire this on every
@@ -60,6 +62,7 @@ export default function WorkflowsPage() {
    * longer a landing option, so it has to offer a way out rather than spin.
    */
   const isEmpty = !isResolving && !isError && !firstWorkflowId
+  const canCreate = !permissionsLoading && canEdit
 
   return (
     <div className='flex h-full w-full flex-col overflow-hidden bg-[var(--bg)]'>
@@ -81,11 +84,24 @@ export default function WorkflowsPage() {
             <div className='flex flex-col items-center gap-3 text-center text-[var(--text-secondary)]'>
               <div>
                 <p className='font-medium text-small'>No workflows yet</p>
-                <p className='mt-1 text-caption'>Create one to start building.</p>
+                <p className='mt-1 text-caption'>
+                  {canCreate
+                    ? 'Create one to start building.'
+                    : 'Ask a workspace admin to create one.'}
+                </p>
               </div>
-              <Chip variant='primary' onClick={handleCreateWorkflow} disabled={isCreatingWorkflow}>
-                {isCreatingWorkflow ? 'Creating…' : 'Create workflow'}
-              </Chip>
+              {/* The create mutation navigates optimistically, so offering it
+                  without write access would strand a read-only member on a
+                  workflow the server declined to create. */}
+              {canCreate && (
+                <Chip
+                  variant='primary'
+                  onClick={handleCreateWorkflow}
+                  disabled={isCreatingWorkflow}
+                >
+                  {isCreatingWorkflow ? 'Creating…' : 'Create workflow'}
+                </Chip>
+              )}
             </div>
           ) : (
             <Spinner />