feat(admin): move a workspace between organizations

The admin workspace move was restricted to personal/grandfathered sources;
`assertWorkspaceMovable` refused anything already owned by an organization, so
support could only re-home a workspace with manual SQL.

Relax that guard to a drift-only check and handle the source organization.
`changeWorkspaceStoragePayerInTx` already accepted an arbitrary source payer,
so the storage-ledger rebalance needed no change.

Moving a workspace between organizations is the first operation capable of
separating an artifact from the organization that owns it, so two invariants
nothing has ever had to defend are enforced here:

- A custom block and its bound workflow always share an organization.
  `getCustomBlockAuthority` resolves by the consumer's org and
  `admitCustomBlockChildExecution` skips its concurrency reservation on the
  strength of that, so a stranded row would run a foreign tenant's workflow
  under its owner's credentials, billed to the wrong payer. The move
  unpublishes those blocks through the product's own `deleteCustomBlock` and
  records the loss in the source organization's audit view.
- A fork parent and child always share an organization. `resolveForkEdge` has
  no org check at all, so the move refuses while a cross-org edge would result.

Enforcing them at move time is not enough on its own: `publishCustomBlock` and
fork creation wrote without the organization mutation lock, so either could
commit after the move's scans and produce exactly the artifact the move
refused to create. Both now take that lock, which is what actually makes the
invariants hold under concurrency.

Pending invitations block too. Re-stamping an org-scoped invitation would
convert a pending membership in the source org into one in the destination,
consuming a seat for an invitation the destination never issued.

An entitlement downgrade blocks: `isOrganizationOnEnterprisePlan` gates
permission groups, SSO domains, data retention, session revocation, forking,
and custom blocks, and losing them silently is not recoverable. That check
resolves before the transaction — it reads through the global client with no
executor seam, and a plan lapsing in the intervening seconds is recoverable by
moving the workspace back, unlike a cross-organization artifact.

Both organizations are locked, ascending by id, mirroring
`acquireOrganizationUserMutationLocks`. The source id is read optimistically
before the transaction and re-verified under the locks, retrying through the
existing loop when it moved.

Author: mzxchandra

apps/sim/ee/workspace-forking/lib/create-fork.test.ts

@@ -1,7 +1,8 @@
 /**
  * @vitest-environment node
  */
-import { dbChainMockFns, resetDbChainMock } from '@sim/testing'
+import { workspace } from '@sim/db/schema'
+import { dbChainMockFns, queueTableRows, resetDbChainMock } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
@@ -125,6 +126,12 @@ describe('createFork storage headroom gate', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()
+    /**
+     * The fork transaction re-reads the parent's organization under the lock to
+     * confirm it has not moved since `assertCanFork` captured the policy.
+     * Matches POLICY.organizationId, so the fork proceeds.
+     */
+    queueTableRows(workspace, [{ organizationId: null }])
     mockSumForkCopyBytes.mockResolvedValue(0)
     mockAssertForkStorageHeadroom.mockResolvedValue(undefined)
     mockLoadSourceDeployedStates.mockResolvedValue({
@@ -186,6 +193,24 @@ describe('createFork storage headroom gate', () => {
     expect(mockStartBackgroundWork).not.toHaveBeenCalled()
   })
 
+  it('refuses when the parent changed organizations after the policy was captured', async () => {
+    resetDbChainMock()
+    /**
+     * `assertCanFork` captures `policy.organizationId` before this transaction,
+     * so an admin workspace move committing in between would otherwise leave
+     * the fork locking the organization the parent has already left and
+     * inserting the child there — the cross-organization edge the lock exists
+     * to prevent. The parent is re-read under the lock to catch exactly this.
+     */
+    queueTableRows(workspace, [{ organizationId: 'org-moved-away' }])
+    mockSumForkCopyBytes.mockResolvedValue(0)
+
+    await expect(createFork(forkParams())).rejects.toThrow(
+      'changed organizations while this fork was being created'
+    )
+    expect(dbChainMockFns.insert).not.toHaveBeenCalled()
+  })
+
   it('proceeds under quota, summing exactly the selected files + knowledge bases', async () => {
     mockSumForkCopyBytes.mockResolvedValue(500)
 

apps/sim/ee/workspace-forking/lib/create-fork.ts

@@ -39,6 +39,7 @@ import {
 } from '@/ee/workspace-forking/lib/copy/storage-quota'
 import { buildForkWorkflowIdMap } from '@/ee/workspace-forking/lib/copy/workflow-id-map'
 import { copyForkWorkflowMcpAttachments } from '@/ee/workspace-forking/lib/copy/workflow-mcp-attachments'
+import { ForkError } from '@/ee/workspace-forking/lib/lineage/authz'
 import { setForkLockTimeout } from '@/ee/workspace-forking/lib/lineage/lineage'
 import {
   type ForkBlockPair,
@@ -161,6 +162,47 @@ export async function createFork(params: CreateForkParams): Promise<CreateForkRe
   }
   const { result, blobTasks, contentPlan, contentRefMaps } = await db.transaction(async (tx) => {
     await setForkLockTimeout(tx)
+    /**
+     * The lock alone is not enough: `policy.organizationId` was captured by
+     * `assertCanFork` BEFORE this transaction, so a move that commits in
+     * between leaves us locking the organization the parent has already left
+     * and inserting the child there — the exact cross-organization edge the
+     * lock was added to prevent. Re-read the parent under the lock and refuse
+     * if it moved; the caller can retry against the new organization.
+     */
+    const [currentSource] = await tx
+      .select({ organizationId: workspace.organizationId })
+      .from(workspace)
+      .where(eq(workspace.id, source.id))
+      /**
+       * The row lock IS the serialization, and deliberately the only one.
+       *
+       * A fork parent and child must always share an organization. Every writer
+       * that can re-home the parent takes `FOR NO KEY UPDATE` on its row — the
+       * admin workspace move, and `lockWorkspaceRowsForPayerChanges` on the
+       * organization-attach path — so locking it here makes those wait, and the
+       * comparison below then sees their committed result.
+       *
+       * An organization mutation lock was tried here and removed: it bought
+       * nothing the row lock does not already provide, could not cover a null
+       * policy organization at all, and cost three real problems — a lock-order
+       * inversion against invitation acceptance (which takes the workspace row
+       * before the organization lock), a 5s timeout overwriting this
+       * transaction's 10s one, and an organization-wide lock held across the
+       * whole content copy.
+       */
+      .for('no key update')
+      .limit(1)
+    if (!currentSource) {
+      throw new ForkError('Source workspace no longer exists', 404)
+    }
+    if ((currentSource.organizationId ?? null) !== (policy.organizationId ?? null)) {
+      throw new ForkError(
+        'The source workspace changed organizations while this fork was being created. Try again.',
+        409
+      )
+    }
+
     const now = new Date()
 
     await tx.insert(workspace).values({

apps/sim/lib/api/contracts/v1/admin/dashboard-workspaces.ts

@@ -59,13 +59,114 @@ const adminDashboardWorkspaceCandidateSchema = z.object({
   ownerEmail: z.string(),
   workspaceMode: z.string(),
   organizationId: z.string().nullable(),
+  /** Name of the organization that currently owns the workspace, if any. */
+  organizationName: z.string().nullable(),
   billedAccountUserId: z.string(),
   /** Archived workspaces are movable; the flag lets admin UIs label them. */
   archived: z.boolean(),
+  /**
+   * Non-null when the workspace cannot be moved. Ineligible rows are returned
+   * rather than filtered out so the admin learns the workspace exists and why
+   * it is stuck, instead of an empty result they cannot act on.
+   */
+  ineligibleReason: z.string().nullable().optional(),
+})
+
+/** Usage split so the UI can separate what leaves from what breaks behind. */
+const adminDashboardCustomBlockUsageSchema = z.object({
+  live: z.number().int().min(0),
+  deployed: z.number().int().min(0),
+})
+
+const adminDashboardWorkspaceSourceImpactSchema = z.object({
+  unpublishedCustomBlocks: z
+    .array(
+      z.object({
+        id: z.string(),
+        type: z.string(),
+        name: z.string(),
+        movingWorkspaceUsage: adminDashboardCustomBlockUsageSchema,
+        sourceOrgElsewhereUsage: adminDashboardCustomBlockUsageSchema,
+      })
+    )
+    .max(500),
+  /** Non-empty means the move is blocked until the fork is disconnected. */
+  blockingForkEdges: z
+    .array(
+      z.object({
+        workspaceId: z.string(),
+        name: z.string(),
+        organizationId: z.string().nullable(),
+        direction: z.enum(['parent', 'child']),
+      })
+    )
+    .max(500),
+  detachedPermissionGroups: z
+    .array(z.object({ permissionGroupId: z.string(), name: z.string() }))
+    .max(500),
+  strippedRetentionRules: z.object({
+    piiRedactionRules: z.number().int().min(0),
+    retentionOverrides: z.number().int().min(0),
+  }),
+  retainedCollaboratorCaps: z
+    .array(
+      z.object({
+        userId: z.string(),
+        email: z.string(),
+        sourceOrgLimitDollars: z.number().nullable(),
+      })
+    )
+    .max(1000),
+  brandingChanges: z.boolean(),
+  /**
+   * Rows omitted to keep the response inside the array bounds above. Non-null
+   * means the lists are incomplete and the notice says so.
+   */
+  truncated: z
+    .object({
+      customBlocks: z.number().int().min(0),
+      permissionGroups: z.number().int().min(0),
+      collaboratorCaps: z.number().int().min(0),
+      forkEdges: z.number().int().min(0),
+      credentials: z.number().int().min(0),
+      environmentVariableKeys: z.number().int().min(0),
+    })
+    .nullable(),
+})
+
+/** Secrets that travel with the workspace. Never carries secret material. */
+const adminDashboardWorkspaceCredentialsSchema = z.object({
+  items: z
+    .array(
+      z.object({
+        id: z.string(),
+        displayName: z.string(),
+        type: z.string(),
+        backedBySourceOrgMember: z.boolean(),
+      })
+    )
+    .max(1000),
+  credentialGroupCount: z.number().int().min(0),
+  /** Variable names only — values are never sent. */
+  environmentVariableKeys: z.array(z.string()).max(1000),
+  byokKeyCount: z.number().int().min(0),
+  /** Rows omitted to stay within the bounds above. */
+  truncatedCredentials: z.number().int().min(0),
+  truncatedEnvironmentVariableKeys: z.number().int().min(0),
 })
 
 const adminDashboardWorkspacePreflightSchema = z.object({
   workspace: adminDashboardWorkspaceCandidateSchema,
+  /** `null` for a personal or grandfathered source. */
+  sourceOrganization: z
+    .object({
+      id: z.string(),
+      name: z.string(),
+      ownerId: z.string().nullable(),
+      ownerName: z.string().nullable(),
+      ownerEmail: z.string().nullable(),
+    })
+    .nullable(),
   destinationOrganization: z.object({
     id: z.string(),
     name: z.string(),
@@ -80,6 +181,8 @@ const adminDashboardWorkspacePreflightSchema = z.object({
       email: z.string(),
       permission: z.enum(['admin', 'write', 'read']),
       organizationMember: z.boolean(),
+      /** Retains access after the move, as an external collaborator. */
+      sourceOrganizationMember: z.boolean(),
     })
   ),
   invitations: z.array(
@@ -91,6 +194,17 @@ const adminDashboardWorkspacePreflightSchema = z.object({
       workspaceGrantCount: z.number().int().min(1),
     })
   ),
+  sourceOrganizationImpact: adminDashboardWorkspaceSourceImpactSchema,
+  credentials: adminDashboardWorkspaceCredentialsSchema,
+  entitlements: z.object({
+    sourceIsEnterprise: z.boolean(),
+    destinationIsEnterprise: z.boolean(),
+    capabilitiesLost: z.array(z.string()).max(50),
+  }),
+  /** Non-empty means the move will throw; the UI must not offer a confirm. */
+  blockers: z.array(z.string()).max(20),
+  /** Advisory consequences worth reading, which never block. */
+  notices: z.array(z.string()).max(20),
   warning: z.string().nullable(),
 })
 

apps/sim/lib/billing/core/subscription.ts

@@ -431,6 +431,21 @@ export async function isEnterpriseOrgAdminOrOwner(userId: string): Promise<boole
   }
 }
 
+/**
+ * Whether an organization's entitlement actually comes from its subscription
+ * row, as opposed to being granted by deployment configuration.
+ *
+ * `resolveOrganizationEnterprisePlan` short-circuits to `true` in two modes —
+ * billing disabled, and self-hosted with access control enabled — where no
+ * `subscription` row need exist at all. Anything that wants to re-verify an
+ * entitlement against the subscription table must consult this first, or it
+ * will read a missing row as a lapse and refuse work that should proceed.
+ * Exported so those callers cannot drift from the short-circuits below.
+ */
+export function isSubscriptionBackedEntitlement(): boolean {
+  return isBillingEnabled && !(isAccessControlEnabled && !isHosted)
+}
+
 async function resolveOrganizationEnterprisePlan(organizationId: string): Promise<boolean> {
   try {
     if (!isBillingEnabled) {