fix: show the data table ACL as read-only when there is no planner

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DsU2Lf6wYQJ9o8ASKRgCmK

backend/windmill-api-workspaces/src/datatable_acl.rs

@@ -223,7 +223,8 @@ pub struct DatatableAclInfo {
     /// The roles a change may name: `admin`, then every role of the instance catalog. Only for a
     /// caller who may change anything, as the catalog is in the permissions drawer.
     pub roles: Vec<String>,
-    /// Whether this caller may plan and apply changes.
+    /// Whether this caller may plan and apply changes: they administer the data table, on an
+    /// edition that has the planner.
     pub editable: bool,
     /// Whether the server is Postgres 17 or later, which added the `MAINTAIN` table privilege.
     pub supports_maintain: bool,
@@ -574,9 +575,10 @@ async fn get_datatable_acl(
     ensure_reaches_datatable(&db, &w_id, &datatable_name, &authed).await?;
     let governing = resolve_governing_datatable(&db, &w_id, &datatable_name).await?;
     ensure_instance(&governing)?;
-    let editable = ensure_governs_datatable(&db, &authed, &w_id, &governing)
-        .await
-        .is_ok();
+    let editable = crate::datatable_acl_oss::ensure_acl_planner().is_ok()
+        && ensure_governs_datatable(&db, &authed, &w_id, &governing)
+            .await
+            .is_ok();
     let roles = if editable {
         role_names(&read_role_catalog(&db).await?)
     } else {

frontend/src/lib/components/datatableAcl/PgAclEditor.svelte

@@ -113,7 +113,8 @@
 	<div class="flex flex-col gap-4">
 		{#if !info.editable}
 			<span class="text-xs text-secondary">
-				Read only: access is changed by the admins of the workspace that governs this data table.
+				Read only: access is changed by the admins of the workspace that governs this data table, on
+				Windmill Enterprise Edition.
 			</span>
 		{/if}