From bdcd42ac0ad699c56e46edb882c6868f14f4a10f Mon Sep 17 00:00:00 2001
From: Diego Imbert <diego@windmill.dev>
Date: Fri, 4 Sep 2026 16:02:09 +0200
Subject: [PATCH] fix(datatables): only the app that would name the data table
 is refused
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A caller who may run as none of a permissioned data table's roles could not
start anything: the refusal ignored whether the app was going to name it at all.
With table creation off nothing saves the data table, and an app that never
touches it is not theirs to be stopped over — so the buttons look at that, and
the hint says what the way out is.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S5arH3G2Sa1Qqm32veJQ1n
---
 .../components/raw_apps/RawAppTemplatePicker.svelte  | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte b/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
index 04a85e5792..ff690d99f6 100644
--- a/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
@@ -144,6 +144,10 @@
 			roles.current.permissioned &&
 			loadedRoles.length === 0
 	)
+	// Only the app that will name the data table is refused: with table creation
+	// off nothing saves it, and an app that does not touch it is not this caller's
+	// problem to be stopped over.
+	const blockedByRole = $derived(noUsableRole && tableCreationEnabled)
 	const accessSettled = $derived(
 		hasNoDatatables ||
 			(rolesSettled &&
@@ -362,7 +366,9 @@
 											/>
 											{#if noUsableRole}
 												<span class="text-xs text-red-600 dark:text-red-400">
-													no role you can use
+													{tableCreationEnabled
+														? 'no role you can use — pick another data table, or turn off table creation'
+														: 'no role you can use'}
 												</span>
 											{/if}
 											{#if showRolePicker}
@@ -545,7 +551,7 @@
 						newSchemaAlreadyExists ||
 						!rolesSettled ||
 						!accessSettled ||
-						noUsableRole}
+						blockedByRole}
 				>
 					{$copilotInfo.workspaceDisabled ? 'Start' : 'Start without AI'}
 				</Button>
@@ -555,7 +561,7 @@
 						on:click={() => start(true)}
 						disabled={!rolesSettled ||
 							!accessSettled ||
-							noUsableRole ||
+							blockedByRole ||
 							!templates[selectedTemplateIndex] ||
 							!initialPrompt.trim() ||
 							newSchemaAlreadyExists}