fix(audit-logs): present nothing when the workspace scope cannot be answered

Disabling the query was not enough. An unresolved scope drops the filter, so its
query key equals the unscoped feed's, and a disabled query still serves whatever
is cached under its key — an admin reading the organization-wide feed who then
followed a stale scoped link kept those rows on screen, with Export still armed
against them because that gate reads the same list.

The rule now has a name and a seam: `presentableAuditEntries` returns nothing
unless the feed can answer the scope the URL asks for, and the export action
states that condition where it is read rather than inheriting it through an empty
list.

Author: waleedlatif1

apps/sim/ee/audit-logs/components/audit-logs.test.ts

@@ -0,0 +1,51 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import type { AuditLogPage } from '@/lib/api/contracts/audit-logs'
+import { presentableAuditEntries } from '@/ee/audit-logs/components/audit-logs'
+
+function page(...ids: string[]): AuditLogPage {
+  return {
+    success: true,
+    data: ids.map((id) => ({
+      id,
+      workspaceId: null,
+      actorId: null,
+      actorName: null,
+      actorEmail: null,
+      action: 'organization.updated',
+      resourceType: 'organization',
+      resourceId: null,
+      resourceName: null,
+      description: null,
+      metadata: null,
+      createdAt: '2026-01-01T00:00:00.000Z',
+    })),
+  }
+}
+
+describe('presentableAuditEntries', () => {
+  it('flattens every loaded page while the scope is answerable', () => {
+    expect(presentableAuditEntries([page('a', 'b'), page('c')], true).map((e) => e.id)).toEqual([
+      'a',
+      'b',
+      'c',
+    ])
+  })
+
+  /**
+   * The case this exists for: an unresolved workspace scope drops the filter, so its
+   * query key equals the unscoped feed's. Disabling the query does not clear that
+   * cache entry, so an admin who had just been reading the organization-wide feed
+   * would have kept its rows on screen under a scoped URL — and Export, which gates
+   * on this list being non-empty, stayed armed against them.
+   */
+  it('presents nothing when the scope cannot be answered, even with pages cached', () => {
+    expect(presentableAuditEntries([page('a', 'b')], false)).toEqual([])
+  })
+
+  it('presents nothing before any page has loaded', () => {
+    expect(presentableAuditEntries(undefined, true)).toEqual([])
+  })
+})

apps/sim/ee/audit-logs/components/audit-logs.tsx

@@ -21,6 +21,7 @@ import { createLogger } from '@sim/logger'
 import { formatDateTime } from '@sim/utils/formatting'
 import { isRecordLike } from '@sim/utils/object'
 import { useQueryStates } from 'nuqs'
+import type { AuditLogPage } from '@/lib/api/contracts/audit-logs'
 import { formatDateShort } from '@/lib/core/utils/date-display'
 import { getEndDateFromTimeRange, getStartDateFromTimeRange } from '@/lib/logs/filters'
 import { SEARCH_DEBOUNCE_MS } from '@/lib/url-state'
@@ -240,6 +241,24 @@ interface AuditLogsProps {
   organizationId: string
 }
 
+/**
+ * Entries the feed is allowed to present.
+ *
+ * A disabled query still serves whatever is cached under its key, and an unresolved
+ * workspace scope resolves to the same key as the unscoped feed — so an admin looking
+ * at the organization-wide feed who then followed a stale scoped link kept those rows
+ * on screen, with Export still armed against them. The scope a link asks for is a
+ * ceiling, so when it cannot be honoured the feed presents nothing rather than
+ * whatever it happens to be holding.
+ */
+export function presentableAuditEntries(
+  pages: AuditLogPage[] | undefined,
+  isScopeAnswerable: boolean
+): EnterpriseAuditLogEntry[] {
+  if (!isScopeAnswerable || !pages) return []
+  return pages.flatMap((page) => page.data)
+}
+
 export function AuditLogs({ organizationId }: AuditLogsProps) {
   const [urlFilters, setUrlFilters] = useQueryStates(auditLogFilterParsers, auditLogFilterUrlKeys)
   const { types: selectedTypes } = urlFilters
@@ -314,6 +333,9 @@ export function AuditLogs({ organizationId }: AuditLogsProps) {
    */
   const isWorkspaceScopeUnresolved =
     Boolean(workspaceScope) && !isWorkspaceScopePending && !scopedWorkspace
+
+  /** The feed can answer the scope the URL asks for — the gate on reading or exporting. */
+  const isScopeAnswerable = !isWorkspaceScopePending && !isWorkspaceScopeUnresolved
   const {
     data,
     isLoading,
@@ -324,10 +346,10 @@ export function AuditLogs({ organizationId }: AuditLogsProps) {
     refetch,
   } = useAuditLogs(organizationId, filters, !isWorkspaceScopePending && !isWorkspaceScopeUnresolved)
 
-  const allEntries = useMemo(() => {
-    if (!data?.pages) return []
-    return data.pages.flatMap((page) => page.data)
-  }, [data])
+  const allEntries = useMemo(
+    () => presentableAuditEntries(data?.pages, isScopeAnswerable),
+    [data, isScopeAnswerable]
+  )
 
   const typeDisplayLabel =
     selectedTypes.length === 0
@@ -425,7 +447,13 @@ export function AuditLogs({ organizationId }: AuditLogsProps) {
           text: 'Export',
           icon: Download,
           onSelect: () => void handleExportCsv(),
-          disabled: allEntries.length === 0 || isExporting || isPlaceholderData,
+          /*
+            `isScopeAnswerable` explicitly, not just via the empty `allEntries` it
+            implies: the export is the action that leaves the building, so the
+            condition that makes it safe belongs where it is read.
+          */
+          disabled:
+            !isScopeAnswerable || allEntries.length === 0 || isExporting || isPlaceholderData,
         },
       ]}
     >