fix

Author: icecrasher321

apps/sim/app/workspace/page.tsx

@@ -172,9 +172,11 @@ export default function WorkspacePage() {
       <WorkspaceStatusCard
         title='No workspace access yet'
         description={
-          blockedPolicy.workspaceMode === 'organization'
-            ? "Your account is linked to an organization, but you don't have access to any of its workspaces. Ask an organization admin for workspace access, then check again — or sign out and back in if you recently left the organization."
-            : 'Your plan has reached its workspace limit and none of your workspaces are active. Upgrade your plan to create another workspace, or contact support to restore an archived one.'
+          blockedPolicy.blockedReasonCode === 'organization-subscription-inactive'
+            ? "Your organization's subscription is inactive, so new workspaces can't be created. Ask an organization owner to reactivate it."
+            : blockedPolicy.workspaceMode === 'organization'
+              ? "Your account is linked to an organization, but you don't have access to any of its workspaces. Ask an organization admin for workspace access, then check again — or sign out and back in if you recently left the organization."
+              : 'Your plan has reached its workspace limit and none of your workspaces are active. Upgrade your plan to create another workspace, or contact support to restore an archived one.'
         }
         primaryLabel='Check again'
         onPrimary={() => window.location.reload()}

apps/sim/lib/api/contracts/workspaces.ts

@@ -38,6 +38,11 @@ export const workspaceCreationPolicySchema = z.object({
   maxWorkspaces: z.number().nullable(),
   currentWorkspaceCount: z.number(),
   reason: z.string().nullable(),
+  /**
+   * Machine-readable discriminant for blocked states whose correct user-facing
+   * copy the workspace mode alone cannot determine.
+   */
+  blockedReasonCode: z.literal('organization-subscription-inactive').optional(),
 })
 
 export type WorkspaceCreationPolicy = z.output<typeof workspaceCreationPolicySchema>

apps/sim/lib/workspaces/policy.test.ts

@@ -59,6 +59,58 @@ describe('getWorkspaceCreationPolicy', () => {
     expect(result.currentWorkspaceCount).toBe(1)
   })
 
+  it('blocks a plain member of a lapsed organization from creating anything', async () => {
+    mockGetUserOrganization.mockResolvedValue({
+      organizationId: 'org-1',
+      role: 'member',
+      memberId: 'member-1',
+    })
+    // Cancelled / past_due Team: no usable organization subscription.
+    mockGetOrganizationSubscription.mockResolvedValue({
+      id: 'sub-1',
+      plan: 'team_6000',
+      status: 'canceled',
+      referenceId: 'org-1',
+    })
+    queueTableRows(member, [{ role: 'member' }])
+
+    const result = await getWorkspaceCreationPolicy({ userId: 'user-1' })
+
+    expect(result.canCreate).toBe(false)
+    expect(result.blockedReasonCode).toBe('organization-subscription-inactive')
+    expect(result.status).toBe(403)
+  })
+
+  it('lets an owner of a lapsed organization fall back to their personal plan', async () => {
+    mockGetUserOrganization.mockResolvedValue({
+      organizationId: 'org-1',
+      role: 'owner',
+      memberId: 'member-1',
+    })
+    mockGetOrganizationSubscription.mockResolvedValue({
+      id: 'sub-1',
+      plan: 'team_6000',
+      status: 'canceled',
+      referenceId: 'org-1',
+    })
+    mockGetHighestPrioritySubscription.mockResolvedValue({
+      id: 'sub-2',
+      plan: 'pro_6000',
+      status: 'active',
+    })
+    queueTableRows(member, [{ role: 'owner' }])
+    queueTableRows(workspace, [{ value: 0 }])
+
+    const result = await getWorkspaceCreationPolicy({ userId: 'user-1' })
+
+    expect(result.canCreate).toBe(true)
+    expect(result.workspaceMode).toBe(WORKSPACE_MODE.PERSONAL)
+    expect(result.maxWorkspaces).toBe(3)
+    // The membership snapshot lets creation tell "already a member" apart from
+    // "joined mid-create", so the owner is not spuriously 409'd.
+    expect(result.observedOrganizationId).toBe('org-1')
+  })
+
   it('allows pro users to create up to three personal workspaces', async () => {
     mockGetHighestPrioritySubscription.mockResolvedValueOnce({
       id: 'sub-1',

apps/sim/lib/workspaces/policy.ts

@@ -87,6 +87,8 @@ export interface WorkspaceCreationPolicy {
    * any membership as a mid-create join.
    */
   observedOrganizationId: string | null
+  /** Discriminant for blocked states the workspace mode cannot distinguish. */
+  blockedReasonCode?: 'organization-subscription-inactive'
 }
 
 interface GetWorkspaceCreationPolicyParams {
@@ -377,6 +379,31 @@ export async function getWorkspaceCreationPolicy({
         observedOrganizationId: membership?.organizationId ?? null,
       }
     }
+
+    /**
+     * Lapsed organization (no usable Team/Enterprise plan). A plain member
+     * gets NO personal fallback: letting them create workspaces here would
+     * hand them an estate outside every admin's view purely because billing
+     * lapsed — exactly the purview escape this regime closes. Owners and
+     * admins DO fall through to the personal regime below: they sit at the top
+     * of the hierarchy, so there is no purview to escape, and after a
+     * downgrade they are usually back on a personal plan they still pay for.
+     */
+    if (!isOrgAdminRole(orgRole)) {
+      return {
+        canCreate: false,
+        workspaceMode: WORKSPACE_MODE.ORGANIZATION,
+        organizationId,
+        billedAccountUserId: (await getOrganizationOwnerId(organizationId)) ?? userId,
+        maxWorkspaces: null,
+        currentWorkspaceCount: 0,
+        reason:
+          "Your organization's subscription is inactive. Ask an organization owner to reactivate it before creating workspaces.",
+        status: 403,
+        observedOrganizationId: membership?.organizationId ?? null,
+        blockedReasonCode: 'organization-subscription-inactive',
+      }
+    }
   }
 
   const highestPrioritySubscription = await getHighestPrioritySubscription(userId)