fix(settings): gate organization view with search rollout

Author: waleedlatif1

apps/sim/app/o/[organizationId]/home/page.test.tsx

@@ -99,9 +99,11 @@ describe('organization Search page gates', () => {
     expect(mocks.context).not.toHaveBeenCalled()
   })
 
-  it('keeps the organization entry in organization settings when Search is disabled', async () => {
+  it('returns the organization entry to workspace settings when Search is disabled', async () => {
     mocks.context.mockResolvedValue({ searchAccess: { memberScoped: false } })
-    await expect(OrganizationPage({ params })).rejects.toThrow('redirect:/o/org-1/settings/members')
+    await expect(OrganizationPage({ params })).rejects.toThrow(
+      'redirect:/workspace?redirect=settings'
+    )
     expect(mocks.context).toHaveBeenCalledWith('org-1', 'viewer')
   })
 

apps/sim/app/o/[organizationId]/layout.test.tsx

@@ -60,6 +60,7 @@ const mockGetSession = authMockFns.mockGetSession
 const SURFACE_CONTEXT = {
   organization: { id: 'org-1', name: 'Acme', slug: 'acme', logo: null, memberCount: 1 },
   viewer: { role: 'member', isAdmin: false },
+  searchAccess: { memberScoped: true, sourceMirrored: true },
 }
 
 describe('OrganizationLayout', () => {
@@ -111,4 +112,23 @@ describe('OrganizationLayout', () => {
     expect(html).not.toContain('Secret organization child')
     expect(mockWorkspaceChrome).not.toHaveBeenCalled()
   })
+
+  it.each(['owner', 'admin', 'member'])(
+    'returns %s viewers outside the rollout to workspace settings before rendering org chrome',
+    async (role) => {
+      mockGetOrganizationSurfaceContext.mockResolvedValue({
+        ...SURFACE_CONTEXT,
+        viewer: { role, isAdmin: role !== 'member' },
+        searchAccess: { memberScoped: false, sourceMirrored: true },
+      })
+
+      await expect(
+        OrganizationLayout({
+          children: <div>Organization settings</div>,
+          params: Promise.resolve({ organizationId: 'org-1' }),
+        })
+      ).rejects.toThrow('redirect:/workspace?redirect=settings')
+      expect(mockWorkspaceChrome).not.toHaveBeenCalled()
+    }
+  )
 })

apps/sim/app/o/[organizationId]/layout.tsx

@@ -2,7 +2,7 @@ import { dehydrate, HydrationBoundary } from '@tanstack/react-query'
 import { cookies } from 'next/headers'
 import { redirect } from 'next/navigation'
 import { getSession } from '@/lib/auth'
-import { organizationRoutes } from '@/lib/navigation/paths'
+import { organizationRoutes, WORKSPACE_SETTINGS_PATH } from '@/lib/navigation/paths'
 import { getOrganizationSurfaceContext } from '@/lib/organizations/surface'
 import { prefetchUserProfile } from '@/lib/users/prefetch-user-profile'
 import { getQueryClient } from '@/app/_shell/providers/get-query-client'
@@ -15,9 +15,9 @@ import { GlobalCommandsProvider } from '@/app/workspace/[workspaceId]/providers/
 
 /**
  * The organization surface: the viewer's own view of one organization, outside
- * any workspace. Membership in the routed organization is the whole gate — a
- * non-member gets an explicit denial rather than a redirect, so a stale link
- * never bounces someone into a different organization.
+ * any workspace. Requires membership and the organization's Search rollout.
+ * Non-members get an explicit denial; members outside the rollout retain
+ * workspace settings, including when following a saved organization link.
  */
 export default async function OrganizationLayout({
   children,
@@ -49,6 +49,7 @@ export default async function OrganizationLayout({
   if (!context) {
     return <OrganizationAccessDenied />
   }
+  if (!context.searchAccess.memberScoped) redirect(WORKSPACE_SETTINGS_PATH)
 
   const initialSidebarCollapsed = cookieStore.get('sidebar_collapsed')?.value === '1'
 

apps/sim/app/o/[organizationId]/page.tsx

@@ -1,6 +1,6 @@
 import { notFound, redirect } from 'next/navigation'
 import { getSession } from '@/lib/auth'
-import { organizationRoutes } from '@/lib/navigation/paths'
+import { organizationRoutes, WORKSPACE_SETTINGS_PATH } from '@/lib/navigation/paths'
 import { getOrganizationSurfaceContext } from '@/lib/organizations/surface'
 import { buildAuthCrossLink } from '@/app/(auth)/auth-redirect'
 
@@ -17,5 +17,5 @@ export default async function OrganizationPage({
   }
   const context = await getOrganizationSurfaceContext(organizationId, session.user.id)
   if (!context) notFound()
-  redirect(context.searchAccess.memberScoped ? routes.home : routes.settingsSection('members'))
+  redirect(context.searchAccess.memberScoped ? routes.home : WORKSPACE_SETTINGS_PATH)
 }

apps/sim/app/workspace/[workspaceId]/settings/[section]/page.test.tsx

@@ -41,7 +41,22 @@ vi.mock('@/app/workspace/[workspaceId]/settings/navigation', () => ({
   resolveSettingsSection: vi.fn((section: string) => {
     const aliases: Record<string, string> = { subscription: 'billing' }
     const id = aliases[section] ?? section
-    return ['general', 'billing', 'secrets'].includes(id) ? { id, meta: { title: id } } : null
+    return [
+      'general',
+      'billing',
+      'secrets',
+      'organization',
+      'usage',
+      'access-control',
+      'audit-logs',
+      'sso',
+      'sessions',
+      'data-retention',
+      'data-drains',
+      'whitelabeling',
+    ].includes(id)
+      ? { id, meta: { title: id } }
+      : null
   }),
 }))
 vi.mock('@/app/workspace/[workspaceId]/settings/[section]/prefetch', () => ({
@@ -51,6 +66,7 @@ vi.mock('@/app/workspace/[workspaceId]/settings/[section]/settings', () => ({
   SettingsPage: vi.fn(() => null),
 }))
 
+import { UNIFIED_TO_ORGANIZATION_SECTION } from '@/components/settings/navigation'
 import WorkspaceSettingsSectionPage from '@/app/workspace/[workspaceId]/settings/[section]/page'
 
 function pageProps(section: string) {
@@ -79,7 +95,10 @@ describe('WorkspaceSettingsSectionPage', () => {
   })
 
   it('preserves legacy organization settings query state on the canonical org destination', async () => {
-    mockGetHostContext.mockResolvedValue({ hostOrganizationId: 'org-target' })
+    mockGetHostContext.mockResolvedValue({
+      hostOrganizationId: 'org-target',
+      features: { organizationSearch: true },
+    })
     await expect(
       WorkspaceSettingsSectionPage({
         ...pageProps('subscription'),
@@ -91,6 +110,53 @@ describe('WorkspaceSettingsSectionPage', () => {
     expect(mockSectionPrefetch).not.toHaveBeenCalled()
   })
 
+  it.each(Object.entries(UNIFIED_TO_ORGANIZATION_SECTION))(
+    'keeps %s in the workspace outside the organization rollout',
+    async (section) => {
+      mockGetHostContext.mockResolvedValue({
+        hostOrganizationId: 'org-target',
+        features: { organizationSearch: false, knowledgeMemberAccess: true },
+      })
+
+      const element = await WorkspaceSettingsSectionPage(pageProps(section))
+
+      expect(element).toBeTruthy()
+      expect(mockRedirect).not.toHaveBeenCalled()
+      expect(mockAuthorizeSection).toHaveBeenCalledWith({
+        workspaceId: 'workspace-b',
+        userId: 'viewer-a',
+        section,
+      })
+    }
+  )
+
+  it.each([undefined, { credentialGroups: true, knowledgeMemberAccess: true }])(
+    'keeps settings in the workspace when older host context omits the org rollout',
+    async (features) => {
+      mockGetHostContext.mockResolvedValue({ hostOrganizationId: 'org-target', features })
+
+      await WorkspaceSettingsSectionPage(pageProps('billing'))
+
+      expect(mockRedirect).not.toHaveBeenCalled()
+      expect(mockSectionPrefetch).toHaveBeenCalledTimes(1)
+    }
+  )
+
+  it.each(Object.entries(UNIFIED_TO_ORGANIZATION_SECTION))(
+    'routes %s to organization %s only within the organization rollout',
+    async (section, organizationSection) => {
+      mockGetHostContext.mockResolvedValue({
+        hostOrganizationId: 'org-target',
+        features: { organizationSearch: true, knowledgeMemberAccess: false },
+      })
+
+      await expect(WorkspaceSettingsSectionPage(pageProps(section))).rejects.toThrow(
+        `NEXT_REDIRECT:/o/org-target/settings/${organizationSection}`
+      )
+      expect(mockSectionPrefetch).not.toHaveBeenCalled()
+    }
+  )
+
   it('conceals inaccessible workspaces and platform-only sections', async () => {
     mockAuthorizeSection.mockResolvedValue({ allowed: false, disposition: 'not-found' })
 

apps/sim/app/workspace/[workspaceId]/settings/[section]/page.tsx

@@ -60,7 +60,7 @@ export default async function WorkspaceSettingsSectionPage({
   const organizationSection = UNIFIED_TO_ORGANIZATION_SECTION[parsed]
   if (organizationSection) {
     const hostContext = await getWorkspaceHostContextForViewer(workspaceId, session.user.id)
-    if (hostContext?.hostOrganizationId) {
+    if (hostContext?.hostOrganizationId && hostContext.features?.organizationSearch) {
       const query = new URLSearchParams()
       for (const [key, value] of Object.entries((await searchParams) ?? {})) {
         for (const entry of Array.isArray(value) ? value : value === undefined ? [] : [value]) {