From 5d8b1fc55ab639a8effd84907b360afdfbf33473 Mon Sep 17 00:00:00 2001
From: Pranav C <pranavxc@gmail.com>
Date: Tue, 18 Jun 2024 19:06:17 +0000
Subject: [PATCH] feat: restrict data/meta operations in gui

---
 .../nc-gui/components/cell/MultiSelect.vue    |  3 +-
 .../nc-gui/components/cell/SingleSelect.vue   |  3 +-
 .../components/cell/attachment/Modal.vue      |  3 +-
 .../components/cell/attachment/index.vue      |  3 +-
 .../dashboard/Sidebar/TopSection.vue          |  4 +-
 .../dashboard/TreeView/AddNewTableNode.vue    |  3 +-
 .../dashboard/TreeView/BaseOptions.vue        |  6 +--
 .../dashboard/TreeView/ProjectNode.vue        |  2 +-
 .../dashboard/TreeView/TableNode.vue          | 19 ++++++---
 .../settings/data-sources/CreateBase.vue      |  9 +++--
 .../settings/data-sources/EditBase.vue        |  8 ++--
 .../nc-gui/components/project/AllTables.vue   |  4 +-
 .../nc-gui/components/smartsheet/Details.vue  |  3 +-
 .../nc-gui/components/smartsheet/Form.vue     |  3 +-
 .../nc-gui/components/smartsheet/Gallery.vue  |  3 +-
 .../nc-gui/components/smartsheet/Kanban.vue   |  3 +-
 .../smartsheet/calendar/DayView/DateField.vue |  3 +-
 .../calendar/DayView/DateTimeField.vue        |  3 +-
 .../smartsheet/calendar/MonthView.vue         |  3 +-
 .../smartsheet/calendar/SideMenu.vue          |  3 +-
 .../calendar/WeekView/DateField.vue           |  3 +-
 .../calendar/WeekView/DateTimeField.vue       |  2 +-
 .../smartsheet/expanded-form/Comments.vue     |  3 +-
 .../smartsheet/expanded-form/index.vue        |  3 +-
 .../components/smartsheet/grid/Table.vue      |  2 +-
 .../components/smartsheet/header/Cell.vue     |  3 +-
 .../smartsheet/header/VirtualCell.vue         |  3 +-
 .../smartsheet/sidebar/RenameableMenuItem.vue |  3 +-
 .../toolbar/KanbanStackEditOrAdd.vue          |  4 +-
 .../smartsheet/toolbar/MoreActions.vue        |  3 +-
 .../smartsheet/toolbar/ShareView.vue          |  3 +-
 .../smartsheet/toolbar/ViewActionMenu.vue     |  3 +-
 .../smartsheet/toolbar/ViewActions.vue        |  3 +-
 .../smartsheet/topbar/SelectMode.vue          |  4 +-
 .../nc-gui/components/tabs/Smartsheet.vue     | 14 ++++++-
 .../components/virtual-cell/BelongsTo.vue     |  3 +-
 .../components/virtual-cell/HasMany.vue       |  3 +-
 .../nc-gui/components/virtual-cell/Links.vue  |  3 +-
 .../components/virtual-cell/ManyToMany.vue    |  3 +-
 .../components/virtual-cell/OneToOne.vue      |  3 +-
 .../virtual-cell/components/ItemChip.vue      |  3 +-
 .../composables/useCalendarViewStore.ts       |  3 +-
 .../composables/useExpandedFormStore.ts       |  3 +-
 .../nc-gui/composables/useKanbanViewStore.ts  |  3 +-
 .../nc-gui/composables/useMapViewDataStore.ts |  3 +-
 packages/nc-gui/composables/useRoles/index.ts | 39 ++++++++++++++++++-
 packages/nc-gui/composables/useViewColumns.ts |  3 +-
 packages/nc-gui/composables/useViewData.ts    |  3 +-
 packages/nc-gui/composables/useViewFilters.ts |  3 +-
 packages/nc-gui/composables/useViewGroupBy.ts |  3 +-
 packages/nc-gui/composables/useViewSorts.ts   |  2 +-
 packages/nc-gui/context/index.ts              |  9 ++++-
 packages/nocodb-sdk/src/lib/enums.ts          |  8 ++++
 .../src/services/public-datas.service.ts      |  7 +++-
 packages/nocodb/src/utils/acl.ts              | 16 ++++++++
 55 files changed, 202 insertions(+), 68 deletions(-)

diff --git a/packages/nc-gui/components/cell/MultiSelect.vue b/packages/nc-gui/components/cell/MultiSelect.vue
index 3a625e8c24..fee5afe43a 100644
--- a/packages/nc-gui/components/cell/MultiSelect.vue
+++ b/packages/nc-gui/components/cell/MultiSelect.vue
@@ -5,6 +5,7 @@ import type { Select as AntSelect } from 'ant-design-vue'
 import type { SelectOptionType, SelectOptionsType } from 'nocodb-sdk'
 import type { FormFieldsLimitOptionsType } from '~/lib/types'
 import MdiCloseCircle from '~icons/mdi/close-circle'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 interface Props {
   modelValue?: string | string[]
@@ -57,7 +58,7 @@ const { $api } = useNuxtApp()
 
 const { getMeta } = useMetas()
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const { isPg, isMysql } = useBase()
 
diff --git a/packages/nc-gui/components/cell/SingleSelect.vue b/packages/nc-gui/components/cell/SingleSelect.vue
index 5852a9dcbf..e61ac988dd 100644
--- a/packages/nc-gui/components/cell/SingleSelect.vue
+++ b/packages/nc-gui/components/cell/SingleSelect.vue
@@ -4,6 +4,7 @@ import { message } from 'ant-design-vue'
 import tinycolor from 'tinycolor2'
 import type { SelectOptionType } from 'nocodb-sdk'
 import type { FormFieldsLimitOptionsType } from '~/lib/types'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 interface Props {
   modelValue?: string | undefined
@@ -49,7 +50,7 @@ const searchVal = ref()
 
 const { getMeta } = useMetas()
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const { isPg, isMysql } = useBase()
 
diff --git a/packages/nc-gui/components/cell/attachment/Modal.vue b/packages/nc-gui/components/cell/attachment/Modal.vue
index 4af4ec4526..82944f27ae 100644
--- a/packages/nc-gui/components/cell/attachment/Modal.vue
+++ b/packages/nc-gui/components/cell/attachment/Modal.vue
@@ -2,8 +2,9 @@
 import { onKeyDown, useEventListener } from '@vueuse/core'
 import { useAttachmentCell } from './utils'
 import { useSortable } from './sort'
+import {useRolesWrapper} from "~/composables/useRoles";
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const {
   open,
diff --git a/packages/nc-gui/components/cell/attachment/index.vue b/packages/nc-gui/components/cell/attachment/index.vue
index a95f1c4da8..8335952e9a 100644
--- a/packages/nc-gui/components/cell/attachment/index.vue
+++ b/packages/nc-gui/components/cell/attachment/index.vue
@@ -2,6 +2,7 @@
 import { onKeyDown } from '@vueuse/core'
 import { useProvideAttachmentCell } from './utils'
 import { useSortable } from './sort'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 interface Props {
   modelValue?: string | Record<string, any>[] | null
@@ -175,7 +176,7 @@ const keydownSpace = (e: KeyboardEvent) => {
   }
 }
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 const isConfirmModalOpen = ref(false)
 const filetoDelete = reactive({
   title: '',
diff --git a/packages/nc-gui/components/dashboard/Sidebar/TopSection.vue b/packages/nc-gui/components/dashboard/Sidebar/TopSection.vue
index 28f94f6a0c..57fe869023 100644
--- a/packages/nc-gui/components/dashboard/Sidebar/TopSection.vue
+++ b/packages/nc-gui/components/dashboard/Sidebar/TopSection.vue
@@ -1,8 +1,10 @@
 <script setup lang="ts">
+import {useRolesWrapper} from "~/composables/useRoles";
+
 const workspaceStore = useWorkspace()
 const baseStore = useBase()
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const { appInfo } = useGlobal()
 
diff --git a/packages/nc-gui/components/dashboard/TreeView/AddNewTableNode.vue b/packages/nc-gui/components/dashboard/TreeView/AddNewTableNode.vue
index 7bdb041814..38c06f0e55 100644
--- a/packages/nc-gui/components/dashboard/TreeView/AddNewTableNode.vue
+++ b/packages/nc-gui/components/dashboard/TreeView/AddNewTableNode.vue
@@ -4,6 +4,7 @@ import { storeToRefs } from 'pinia'
 import { toRef } from '@vue/reactivity'
 import { resolveComponent } from '@vue/runtime-core'
 import { ref } from 'vue'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const props = withDefaults(
   defineProps<{
@@ -19,7 +20,7 @@ const emit = defineEmits<{
   openTableCreateDialog: () => void
 }>()
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const base = toRef(props, 'base')
 
diff --git a/packages/nc-gui/components/dashboard/TreeView/BaseOptions.vue b/packages/nc-gui/components/dashboard/TreeView/BaseOptions.vue
index b1ba78dfb3..75aeff3fde 100644
--- a/packages/nc-gui/components/dashboard/TreeView/BaseOptions.vue
+++ b/packages/nc-gui/components/dashboard/TreeView/BaseOptions.vue
@@ -68,7 +68,7 @@ function openQuickImportDialog(type: string) {
     <template #expandIcon></template>
 
     <NcMenuItem
-      v-if="isUIAllowed('airtableImport', { roles: baseRole })"
+      v-if="isUIAllowed('airtableImport', { roles: baseRole, source })"
       key="quick-import-airtable"
       @click="openAirtableImportDialog(source.base_id, source.id)"
     >
@@ -86,7 +86,7 @@ function openQuickImportDialog(type: string) {
     </NcMenuItem>
 
     <NcMenuItem
-      v-if="isUIAllowed('jsonImport', { roles: baseRole })"
+      v-if="isUIAllowed('jsonImport', { roles: baseRole, source })"
       key="quick-import-json"
       @click="openQuickImportDialog('json')"
     >
@@ -97,7 +97,7 @@ function openQuickImportDialog(type: string) {
     </NcMenuItem>
 
     <NcMenuItem
-      v-if="isUIAllowed('excelImport', { roles: baseRole })"
+      v-if="isUIAllowed('excelImport', { roles: baseRole, source })"
       key="quick-import-excel"
       @click="openQuickImportDialog('excel')"
     >
diff --git a/packages/nc-gui/components/dashboard/TreeView/ProjectNode.vue b/packages/nc-gui/components/dashboard/TreeView/ProjectNode.vue
index 0d5476079d..8893e2da0d 100644
--- a/packages/nc-gui/components/dashboard/TreeView/ProjectNode.vue
+++ b/packages/nc-gui/components/dashboard/TreeView/ProjectNode.vue
@@ -823,7 +823,7 @@ const onTableIdCopy = async () => {
                             </NcDropdown>
 
                             <NcButton
-                              v-if="isUIAllowed('tableCreate', { roles: baseRole })"
+                              v-if="isUIAllowed('tableCreate', { roles: baseRole, source })"
                               v-e="['c:source:add-table']"
                               type="text"
                               size="xxsmall"
diff --git a/packages/nc-gui/components/dashboard/TreeView/TableNode.vue b/packages/nc-gui/components/dashboard/TreeView/TableNode.vue
index ef3e11ea30..8f0cb52f27 100644
--- a/packages/nc-gui/components/dashboard/TreeView/TableNode.vue
+++ b/packages/nc-gui/components/dashboard/TreeView/TableNode.vue
@@ -213,6 +213,10 @@ const refreshViews = async () => {
   await nextTick()
   isExpanded.value = true
 }
+
+const source = computed(() => {
+  return base.value?.sources?.[sourceIndex.value]
+})
 </script>
 
 <template>
@@ -331,15 +335,16 @@ const refreshViews = async () => {
               <template
                 v-if="
                   !isSharedBase &&
-                  (isUIAllowed('tableRename', { roles: baseRole }) || isUIAllowed('tableDelete', { roles: baseRole }))
+                  (isUIAllowed('tableRename', { roles: baseRole, source }) ||
+                    isUIAllowed('tableDelete', { roles: baseRole, source }))
                 "
               >
                 <NcDivider />
                 <NcMenuItem
-                  v-if="isUIAllowed('tableRename', { roles: baseRole })"
+                  v-if="isUIAllowed('tableRename', { roles: baseRole, source })"
                   :data-testid="`sidebar-table-rename-${table.title}`"
                   class="nc-table-rename"
-                  @click="openRenameTableDialog(table, base.sources[sourceIndex].id)"
+                  @click="openRenameTableDialog(table, source.id)"
                 >
                   <div v-e="['c:table:rename']" class="flex gap-2 items-center">
                     <GeneralIcon icon="rename" class="text-gray-700" />
@@ -349,9 +354,11 @@ const refreshViews = async () => {
 
                 <NcMenuItem
                   v-if="
-                    isUIAllowed('tableDuplicate') &&
+                    isUIAllowed('tableDuplicate', {
+                      source,
+                    }) &&
                     base.sources?.[sourceIndex] &&
-                    (base.sources[sourceIndex].is_meta || base.sources[sourceIndex].is_local)
+                    (source.is_meta || source.is_local)
                   "
                   :data-testid="`sidebar-table-duplicate-${table.title}`"
                   @click="duplicateTable(table)"
@@ -364,7 +371,7 @@ const refreshViews = async () => {
 
                 <NcDivider />
                 <NcMenuItem
-                  v-if="isUIAllowed('tableDelete', { roles: baseRole })"
+                  v-if="isUIAllowed('tableDelete', { roles: baseRole, source })"
                   :data-testid="`sidebar-table-delete-${table.title}`"
                   class="!text-red-500 !hover:bg-red-50 nc-table-delete"
                   @click="deleteTable"
diff --git a/packages/nc-gui/components/dashboard/settings/data-sources/CreateBase.vue b/packages/nc-gui/components/dashboard/settings/data-sources/CreateBase.vue
index 854ccdbaf8..45c88308d8 100644
--- a/packages/nc-gui/components/dashboard/settings/data-sources/CreateBase.vue
+++ b/packages/nc-gui/components/dashboard/settings/data-sources/CreateBase.vue
@@ -10,6 +10,7 @@ import {
   SSLUsage,
   clientTypes as _clientTypes,
 } from '#imports'
+import {SourceRestriction} from "nocodb-sdk";
 
 const props = defineProps<{ open: boolean; connectionType?: ClientType }>()
 
@@ -56,8 +57,8 @@ const formState = ref<ProjectCreateForm>({
   sslUse: SSLUsage.No,
   extraParameters: [],
   meta: {
-    readOnlySchema: true,
-    readOnlyData: false,
+    [SourceRestriction.META_READONLY]: true,
+    [SourceRestriction.DATA_READONLY]: false,
   },
 })
 
@@ -515,10 +516,10 @@ const toggleModal = (val: boolean) => {
               </a-form-item>
 
               <a-form-item label="Readonly Schema">
-                <a-switch v-model:checked="formState.meta.readOnlySchema" size="small"></a-switch>
+                <a-switch v-model:checked="formState.meta[SourceRestriction.META_READONLY]" size="small"></a-switch>
               </a-form-item>
               <a-form-item label="Readonly Data">
-                <a-switch v-model:checked="formState.meta.readOnlyData" size="small"></a-switch>
+                <a-switch v-model:checked="formState.meta[SourceRestriction.DATA_READONLY]" size="small"></a-switch>
               </a-form-item>
 
               <div class="flex items-right justify-end gap-2">
diff --git a/packages/nc-gui/components/dashboard/settings/data-sources/EditBase.vue b/packages/nc-gui/components/dashboard/settings/data-sources/EditBase.vue
index fafe7fa8c2..6eb32c12b4 100644
--- a/packages/nc-gui/components/dashboard/settings/data-sources/EditBase.vue
+++ b/packages/nc-gui/components/dashboard/settings/data-sources/EditBase.vue
@@ -72,8 +72,8 @@ const customFormState = ref<ProjectCreateForm>({
   sslUse: SSLUsage.No,
   extraParameters: [],
   meta: {
-    readOnlySchema: true,
-    readOnlyData: false,
+    [SourceRestriction.META_READONLY]: true,
+    [SourceRestriction.DATA_READONLY]: false,
   },
 })
 
@@ -530,10 +530,10 @@ watch(
           </a-form-item>
 
           <a-form-item label="Readonly Schema">
-            <a-switch v-model:checked="formState.meta.readOnlySchema" size="small"></a-switch>
+            <a-switch v-model:checked="formState.meta[SourceRestriction.META_READONLY]" size="small"></a-switch>
           </a-form-item>
           <a-form-item label="Readonly Data">
-            <a-switch v-model:checked="formState.meta.readOnlyData" size="small"></a-switch>
+            <a-switch v-model:checked="formState.meta[SourceRestriction.DATA_READONLY]" size="small"></a-switch>
           </a-form-item>
 
           <!--                Use Connection URL -->
diff --git a/packages/nc-gui/components/project/AllTables.vue b/packages/nc-gui/components/project/AllTables.vue
index 41fdaeeca3..32e52c5526 100644
--- a/packages/nc-gui/components/project/AllTables.vue
+++ b/packages/nc-gui/components/project/AllTables.vue
@@ -76,7 +76,7 @@ function openTableCreateDialog(baseIndex?: number | undefined) {
       }"
     >
       <div
-        v-if="isUIAllowed('tableCreate')"
+        v-if="isUIAllowed('tableCreate', {source: openedProject?.sources?.[0]})"
         role="button"
         class="nc-base-view-all-table-btn"
         data-testid="proj-view-btn__add-new-table"
@@ -86,7 +86,7 @@ function openTableCreateDialog(baseIndex?: number | undefined) {
         <div class="label">{{ $t('general.new') }} {{ $t('objects.table') }}</div>
       </div>
       <div
-        v-if="isUIAllowed('tableCreate')"
+        v-if="isUIAllowed('tableCreate', {source: openedProject?.sources?.[0]})"
         v-e="['c:table:import']"
         role="button"
         class="nc-base-view-all-table-btn"
diff --git a/packages/nc-gui/components/smartsheet/Details.vue b/packages/nc-gui/components/smartsheet/Details.vue
index c9ac4c421d..734e1ccf22 100644
--- a/packages/nc-gui/components/smartsheet/Details.vue
+++ b/packages/nc-gui/components/smartsheet/Details.vue
@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import { LoadingOutlined } from '@ant-design/icons-vue'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const { openedViewsTab } = storeToRefs(useViewsStore())
 const { onViewsTabChange } = useViewsStore()
@@ -8,7 +9,7 @@ const { isLeftSidebarOpen } = storeToRefs(useSidebarStore())
 
 const { $e } = useNuxtApp()
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const { base } = storeToRefs(useBase())
 const meta = inject(MetaInj, ref())
diff --git a/packages/nc-gui/components/smartsheet/Form.vue b/packages/nc-gui/components/smartsheet/Form.vue
index 16c00d6191..f3dc43a342 100644
--- a/packages/nc-gui/components/smartsheet/Form.vue
+++ b/packages/nc-gui/components/smartsheet/Form.vue
@@ -15,6 +15,7 @@ import {
   isVirtualCol,
 } from 'nocodb-sdk'
 import type { ImageCropperConfig } from '~/lib/types'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 provide(IsFormInj, ref(true))
 provide(IsGalleryInj, ref(false))
@@ -52,7 +53,7 @@ const { isMobileMode, user } = useGlobal()
 
 const { $api, $e } = useNuxtApp()
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const { base } = storeToRefs(useBase())
 
diff --git a/packages/nc-gui/components/smartsheet/Gallery.vue b/packages/nc-gui/components/smartsheet/Gallery.vue
index 53260cc72e..78533301e0 100644
--- a/packages/nc-gui/components/smartsheet/Gallery.vue
+++ b/packages/nc-gui/components/smartsheet/Gallery.vue
@@ -1,6 +1,7 @@
 <script lang="ts" setup>
 import { ViewTypes, isVirtualCol } from 'nocodb-sdk'
 import type { Row as RowType } from '#imports'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 interface Attachment {
   url: string
@@ -64,7 +65,7 @@ const coverImageObjectFitClass = computed(() => {
   if (fk_cover_image_object_fit === CoverImageObjectFit.COVER) return '!object-cover'
 })
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 const hasEditPermission = computed(() => isUIAllowed('dataEdit'))
 // TODO: extract this code (which is duplicated in grid and gallery) into a separate component
 const _contextMenu = ref(false)
diff --git a/packages/nc-gui/components/smartsheet/Kanban.vue b/packages/nc-gui/components/smartsheet/Kanban.vue
index d9205cc5f9..273b6d2407 100644
--- a/packages/nc-gui/components/smartsheet/Kanban.vue
+++ b/packages/nc-gui/components/smartsheet/Kanban.vue
@@ -4,6 +4,7 @@ import Draggable from 'vuedraggable'
 import tinycolor from 'tinycolor2'
 import { ViewTypes, isVirtualCol } from 'nocodb-sdk'
 import type { Row as RowType } from '#imports'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 interface Attachment {
   url: string
@@ -73,7 +74,7 @@ const {
 
 const { isViewDataLoading } = storeToRefs(useViewsStore())
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const { appInfo, isMobileMode } = useGlobal()
 
diff --git a/packages/nc-gui/components/smartsheet/calendar/DayView/DateField.vue b/packages/nc-gui/components/smartsheet/calendar/DayView/DateField.vue
index b49663127c..a562206a72 100644
--- a/packages/nc-gui/components/smartsheet/calendar/DayView/DateField.vue
+++ b/packages/nc-gui/components/smartsheet/calendar/DayView/DateField.vue
@@ -1,6 +1,7 @@
 <script lang="ts" setup>
 import dayjs from 'dayjs'
 import type { ColumnType } from 'nocodb-sdk'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const emit = defineEmits(['expandRecord', 'newRecord'])
 
@@ -8,7 +9,7 @@ const meta = inject(MetaInj, ref())
 
 const container = ref()
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const { selectedDate, formattedData, formattedSideBarData, calendarRange, updateRowProperty } = useCalendarViewStoreOrThrow()
 
diff --git a/packages/nc-gui/components/smartsheet/calendar/DayView/DateTimeField.vue b/packages/nc-gui/components/smartsheet/calendar/DayView/DateTimeField.vue
index 5701131615..004a80a1e3 100644
--- a/packages/nc-gui/components/smartsheet/calendar/DayView/DateTimeField.vue
+++ b/packages/nc-gui/components/smartsheet/calendar/DayView/DateTimeField.vue
@@ -1,6 +1,7 @@
 <script lang="ts" setup>
 import dayjs from 'dayjs'
 import type { ColumnType } from 'nocodb-sdk'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const emit = defineEmits(['expandRecord', 'newRecord'])
 
@@ -20,7 +21,7 @@ const { $e } = useNuxtApp()
 
 const container = ref<null | HTMLElement>(null)
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const meta = inject(MetaInj, ref())
 
diff --git a/packages/nc-gui/components/smartsheet/calendar/MonthView.vue b/packages/nc-gui/components/smartsheet/calendar/MonthView.vue
index d6a2388cac..104f47029c 100644
--- a/packages/nc-gui/components/smartsheet/calendar/MonthView.vue
+++ b/packages/nc-gui/components/smartsheet/calendar/MonthView.vue
@@ -2,6 +2,7 @@
 import dayjs from 'dayjs'
 import type { ColumnType } from 'nocodb-sdk'
 import { UITypes } from 'nocodb-sdk'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const emit = defineEmits(['newRecord', 'expandRecord'])
 
@@ -23,7 +24,7 @@ const { $e } = useNuxtApp()
 
 const isMondayFirst = ref(true)
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const meta = inject(MetaInj, ref())
 
diff --git a/packages/nc-gui/components/smartsheet/calendar/SideMenu.vue b/packages/nc-gui/components/smartsheet/calendar/SideMenu.vue
index cdaa03a3ba..5c7f33c9ed 100644
--- a/packages/nc-gui/components/smartsheet/calendar/SideMenu.vue
+++ b/packages/nc-gui/components/smartsheet/calendar/SideMenu.vue
@@ -2,6 +2,7 @@
 import type { VNodeRef } from '@vue/runtime-core'
 import { UITypes } from 'nocodb-sdk'
 import dayjs from 'dayjs'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const props = defineProps<{
   visible: boolean
@@ -15,7 +16,7 @@ interface Attachment {
 
 const INFINITY_SCROLL_THRESHOLD = 100
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const { $e } = useNuxtApp()
 
diff --git a/packages/nc-gui/components/smartsheet/calendar/WeekView/DateField.vue b/packages/nc-gui/components/smartsheet/calendar/WeekView/DateField.vue
index 8071b26605..3c41660603 100644
--- a/packages/nc-gui/components/smartsheet/calendar/WeekView/DateField.vue
+++ b/packages/nc-gui/components/smartsheet/calendar/WeekView/DateField.vue
@@ -2,6 +2,7 @@
 import dayjs from 'dayjs'
 import type { ColumnType } from 'nocodb-sdk'
 import type { Row } from '~/lib/types'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const emits = defineEmits(['expandRecord', 'newRecord'])
 
@@ -24,7 +25,7 @@ const container = ref<null | HTMLElement>(null)
 
 const { width: containerWidth } = useElementSize(container)
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const meta = inject(MetaInj, ref())
 
diff --git a/packages/nc-gui/components/smartsheet/calendar/WeekView/DateTimeField.vue b/packages/nc-gui/components/smartsheet/calendar/WeekView/DateTimeField.vue
index 248156e071..b5c03c22ca 100644
--- a/packages/nc-gui/components/smartsheet/calendar/WeekView/DateTimeField.vue
+++ b/packages/nc-gui/components/smartsheet/calendar/WeekView/DateTimeField.vue
@@ -28,7 +28,7 @@ const { width: containerWidth } = useElementSize(container)
 
 const isPublic = inject(IsPublicInj, ref(false))
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const meta = inject(MetaInj, ref())
 
diff --git a/packages/nc-gui/components/smartsheet/expanded-form/Comments.vue b/packages/nc-gui/components/smartsheet/expanded-form/Comments.vue
index aca4c7b6f2..dc03bd801a 100644
--- a/packages/nc-gui/components/smartsheet/expanded-form/Comments.vue
+++ b/packages/nc-gui/components/smartsheet/expanded-form/Comments.vue
@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import { type CommentType, ProjectRoles } from 'nocodb-sdk'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const props = defineProps<{
   loading: boolean
@@ -45,7 +46,7 @@ const isExpandedFormLoading = computed(() => props.loading)
 
 const tab = ref<'comments' | 'audits'>('comments')
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const router = useRouter()
 
diff --git a/packages/nc-gui/components/smartsheet/expanded-form/index.vue b/packages/nc-gui/components/smartsheet/expanded-form/index.vue
index fde52241f8..211aacde82 100644
--- a/packages/nc-gui/components/smartsheet/expanded-form/index.vue
+++ b/packages/nc-gui/components/smartsheet/expanded-form/index.vue
@@ -12,6 +12,7 @@ import type { Ref } from 'vue'
 import { Drawer } from 'ant-design-vue'
 import NcModal from '../../nc/Modal.vue'
 import MdiChevronDown from '~icons/mdi/chevron-down'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 interface Props {
   modelValue?: boolean
@@ -73,7 +74,7 @@ const isUnsavedDuplicatedRecordExist = ref(false)
 
 const isRecordLinkCopied = ref(false)
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const readOnly = computed(() => !isUIAllowed('dataEdit') || isPublic.value)
 
diff --git a/packages/nc-gui/components/smartsheet/grid/Table.vue b/packages/nc-gui/components/smartsheet/grid/Table.vue
index 6f28a12c13..9c995a4f79 100644
--- a/packages/nc-gui/components/smartsheet/grid/Table.vue
+++ b/packages/nc-gui/components/smartsheet/grid/Table.vue
@@ -166,7 +166,7 @@ const isViewColumnsLoading = computed(() => _isViewColumnsLoading.value || !meta
 const resizingColumn = ref(false)
 
 // #Permissions
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 const hasEditPermission = computed(() => isUIAllowed('dataEdit'))
 const isAddingColumnAllowed = computed(() => !readOnly.value && !isLocked.value && isUIAllowed('fieldAdd') && !isSqlView.value)
 
diff --git a/packages/nc-gui/components/smartsheet/header/Cell.vue b/packages/nc-gui/components/smartsheet/header/Cell.vue
index cfffcd3e81..1786fcea48 100644
--- a/packages/nc-gui/components/smartsheet/header/Cell.vue
+++ b/packages/nc-gui/components/smartsheet/header/Cell.vue
@@ -1,6 +1,7 @@
 <script setup lang="ts">
 import type { ColumnReqType, ColumnType } from 'nocodb-sdk'
 import { UITypes, UITypesName } from 'nocodb-sdk'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 interface Props {
   column: ColumnType
@@ -32,7 +33,7 @@ const isDropDownOpen = ref(false)
 
 const column = toRef(props, 'column')
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 provide(ColumnInj, column)
 
diff --git a/packages/nc-gui/components/smartsheet/header/VirtualCell.vue b/packages/nc-gui/components/smartsheet/header/VirtualCell.vue
index d0bbd6437e..a3c58726d5 100644
--- a/packages/nc-gui/components/smartsheet/header/VirtualCell.vue
+++ b/packages/nc-gui/components/smartsheet/header/VirtualCell.vue
@@ -9,6 +9,7 @@ import {
   isLinksOrLTAR,
 } from 'nocodb-sdk'
 import { RelationTypes, UITypes, UITypesName, substituteColumnIdWithAliasInFormula } from 'nocodb-sdk'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const props = defineProps<{
   column: ColumnType
@@ -36,7 +37,7 @@ provide(ColumnInj, column)
 
 const { metas } = useMetas()
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const meta = inject(MetaInj, ref())
 
diff --git a/packages/nc-gui/components/smartsheet/sidebar/RenameableMenuItem.vue b/packages/nc-gui/components/smartsheet/sidebar/RenameableMenuItem.vue
index a77836ab79..2010d56cea 100644
--- a/packages/nc-gui/components/smartsheet/sidebar/RenameableMenuItem.vue
+++ b/packages/nc-gui/components/smartsheet/sidebar/RenameableMenuItem.vue
@@ -2,6 +2,7 @@
 import type { VNodeRef } from '@vue/runtime-core'
 import type { KanbanType, ViewType, ViewTypes } from 'nocodb-sdk'
 import type { WritableComputedRef } from '@vue/reactivity'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 interface Props {
   view: ViewType
@@ -30,7 +31,7 @@ const vModel = useVModel(props, 'view', emits) as WritableComputedRef<ViewType &
 
 const { $e } = useNuxtApp()
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const activeView = inject(ActiveViewInj, ref())
 
diff --git a/packages/nc-gui/components/smartsheet/toolbar/KanbanStackEditOrAdd.vue b/packages/nc-gui/components/smartsheet/toolbar/KanbanStackEditOrAdd.vue
index 157b5d79c0..22d75f7040 100644
--- a/packages/nc-gui/components/smartsheet/toolbar/KanbanStackEditOrAdd.vue
+++ b/packages/nc-gui/components/smartsheet/toolbar/KanbanStackEditOrAdd.vue
@@ -1,5 +1,7 @@
 <script setup lang="ts">
-const { isUIAllowed } = useRoles()
+import {useRolesWrapper} from "~/composables/useRoles";
+
+const { isUIAllowed } = useRolesWrapper()
 
 const { groupingFieldColumn } = useKanbanViewStoreOrThrow()
 
diff --git a/packages/nc-gui/components/smartsheet/toolbar/MoreActions.vue b/packages/nc-gui/components/smartsheet/toolbar/MoreActions.vue
index 1711bb8159..5a08f2ad44 100644
--- a/packages/nc-gui/components/smartsheet/toolbar/MoreActions.vue
+++ b/packages/nc-gui/components/smartsheet/toolbar/MoreActions.vue
@@ -3,6 +3,7 @@ import type { RequestParams } from 'nocodb-sdk'
 import { ExportTypes } from 'nocodb-sdk'
 import { saveAs } from 'file-saver'
 import * as XLSX from 'xlsx'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const { t } = useI18n()
 
@@ -32,7 +33,7 @@ const showWebhookDrawer = ref(false)
 
 const quickImportDialog = ref(false)
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const exportFile = async (exportType: ExportTypes) => {
   let offset = 0
diff --git a/packages/nc-gui/components/smartsheet/toolbar/ShareView.vue b/packages/nc-gui/components/smartsheet/toolbar/ShareView.vue
index 4acfd07706..44230175f2 100644
--- a/packages/nc-gui/components/smartsheet/toolbar/ShareView.vue
+++ b/packages/nc-gui/components/smartsheet/toolbar/ShareView.vue
@@ -2,6 +2,7 @@
 import { ViewTypes } from 'nocodb-sdk'
 import { isString } from '@vue/shared'
 import tinycolor from 'tinycolor2'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const { t } = useI18n()
 
@@ -13,7 +14,7 @@ const { $e } = useNuxtApp()
 
 const { dashboardUrl } = useDashboard()
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const { isSharedBase } = storeToRefs(useBase())
 
diff --git a/packages/nc-gui/components/smartsheet/toolbar/ViewActionMenu.vue b/packages/nc-gui/components/smartsheet/toolbar/ViewActionMenu.vue
index c26f6d8234..e8bfcfe323 100644
--- a/packages/nc-gui/components/smartsheet/toolbar/ViewActionMenu.vue
+++ b/packages/nc-gui/components/smartsheet/toolbar/ViewActionMenu.vue
@@ -2,6 +2,7 @@
 import type { TableType, ViewType } from 'nocodb-sdk'
 import { ViewTypes } from 'nocodb-sdk'
 import { LockType } from '#imports'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const props = withDefaults(
   defineProps<{
@@ -16,7 +17,7 @@ const props = withDefaults(
 
 const emits = defineEmits(['rename', 'closeModal', 'delete'])
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const isPublicView = inject(IsPublicInj, ref(false))
 
diff --git a/packages/nc-gui/components/smartsheet/toolbar/ViewActions.vue b/packages/nc-gui/components/smartsheet/toolbar/ViewActions.vue
index 491c025ced..9506d521da 100644
--- a/packages/nc-gui/components/smartsheet/toolbar/ViewActions.vue
+++ b/packages/nc-gui/components/smartsheet/toolbar/ViewActions.vue
@@ -1,6 +1,7 @@
 <script lang="ts" setup>
 import type { Ref } from '@vue/reactivity'
 import { LockType } from '#imports'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const { t } = useI18n()
 
@@ -37,7 +38,7 @@ const quickImportDialogs: Record<(typeof quickImportDialogTypes)[number], Ref<bo
   {},
 ) as Record<QuickImportDialogType, Ref<boolean>>
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 useBase()
 
diff --git a/packages/nc-gui/components/smartsheet/topbar/SelectMode.vue b/packages/nc-gui/components/smartsheet/topbar/SelectMode.vue
index 88e8f5a7ea..4d1d80557c 100644
--- a/packages/nc-gui/components/smartsheet/topbar/SelectMode.vue
+++ b/packages/nc-gui/components/smartsheet/topbar/SelectMode.vue
@@ -1,7 +1,9 @@
 <script lang="ts" setup>
+import {useRolesWrapper} from "~/composables/useRoles";
+
 const { openedViewsTab, activeView } = storeToRefs(useViewsStore())
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const { onViewsTabChange } = useViewsStore()
 
diff --git a/packages/nc-gui/components/tabs/Smartsheet.vue b/packages/nc-gui/components/tabs/Smartsheet.vue
index b1a61d4960..929818afa5 100644
--- a/packages/nc-gui/components/tabs/Smartsheet.vue
+++ b/packages/nc-gui/components/tabs/Smartsheet.vue
@@ -39,6 +39,12 @@ const reloadViewMetaEventHook = createEventHook<void | boolean>()
 
 const openNewRecordFormHook = createEventHook<void>()
 
+const { base } = storeToRefs(useBase())
+
+const activeSource = computed(() => {
+  return meta.value?.source_id && base.value && base.value.sources?.find((source) => source.id === meta.value?.source_id)
+})
+
 useProvideKanbanViewStore(meta, activeView)
 useProvideMapViewStore(meta, activeView)
 useProvideCalendarViewStore(meta, activeView)
@@ -52,9 +58,15 @@ provide(ReloadViewMetaHookInj, reloadViewMetaEventHook)
 provide(OpenNewRecordFormHookInj, openNewRecordFormHook)
 provide(IsFormInj, isForm)
 provide(TabMetaInj, activeTab)
+provide(ActiveSourceInj, activeSource)
 provide(
   ReadonlyInj,
-  computed(() => !isUIAllowed('dataEdit')),
+  computed(
+    () =>
+      !isUIAllowed('dataEdit', {
+        source: activeSource.value,
+      }),
+  ),
 )
 useExpandedFormDetachedProvider()
 
diff --git a/packages/nc-gui/components/virtual-cell/BelongsTo.vue b/packages/nc-gui/components/virtual-cell/BelongsTo.vue
index 2930e32ecc..b2f020ec69 100644
--- a/packages/nc-gui/components/virtual-cell/BelongsTo.vue
+++ b/packages/nc-gui/components/virtual-cell/BelongsTo.vue
@@ -1,6 +1,7 @@
 <script setup lang="ts">
 import type { ColumnType } from 'nocodb-sdk'
 import type { Ref } from 'vue'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const column = inject(ColumnInj)!
 
@@ -18,7 +19,7 @@ const isForm = inject(IsFormInj, ref(false))
 
 const isUnderLookup = inject(IsUnderLookupInj, ref(false))
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const listItemsDlg = ref(false)
 
diff --git a/packages/nc-gui/components/virtual-cell/HasMany.vue b/packages/nc-gui/components/virtual-cell/HasMany.vue
index 731759575e..a2cd6c4cca 100644
--- a/packages/nc-gui/components/virtual-cell/HasMany.vue
+++ b/packages/nc-gui/components/virtual-cell/HasMany.vue
@@ -2,6 +2,7 @@
 import type { ColumnType } from 'nocodb-sdk'
 import { isSystemColumn } from 'nocodb-sdk'
 import type { Ref } from 'vue'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const column = inject(ColumnInj)!
 
@@ -25,7 +26,7 @@ const isOpen = ref(false)
 
 const hideBackBtn = ref(false)
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const { state, isNew, removeLTARRef } = useSmartsheetRowStoreOrThrow()
 
diff --git a/packages/nc-gui/components/virtual-cell/Links.vue b/packages/nc-gui/components/virtual-cell/Links.vue
index a37989055c..b3fb6acc7f 100644
--- a/packages/nc-gui/components/virtual-cell/Links.vue
+++ b/packages/nc-gui/components/virtual-cell/Links.vue
@@ -3,6 +3,7 @@ import { computed } from '@vue/reactivity'
 import type { ColumnType } from 'nocodb-sdk'
 import type { Ref } from 'vue'
 import { ref } from 'vue'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const value = inject(CellValueInj, ref(0))
 
@@ -28,7 +29,7 @@ const isOpen = ref(false)
 
 const hideBackBtn = ref(false)
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const { t } = useI18n()
 
diff --git a/packages/nc-gui/components/virtual-cell/ManyToMany.vue b/packages/nc-gui/components/virtual-cell/ManyToMany.vue
index 32ee6e3a1b..2507c26bce 100644
--- a/packages/nc-gui/components/virtual-cell/ManyToMany.vue
+++ b/packages/nc-gui/components/virtual-cell/ManyToMany.vue
@@ -1,6 +1,7 @@
 <script setup lang="ts">
 import type { ColumnType } from 'nocodb-sdk'
 import type { Ref } from 'vue'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const column = inject(ColumnInj)!
 
@@ -24,7 +25,7 @@ const isOpen = ref(false)
 
 const hideBackBtn = ref(false)
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const { state, isNew, removeLTARRef } = useSmartsheetRowStoreOrThrow()
 
diff --git a/packages/nc-gui/components/virtual-cell/OneToOne.vue b/packages/nc-gui/components/virtual-cell/OneToOne.vue
index 03bd03013d..bdc4d220a6 100644
--- a/packages/nc-gui/components/virtual-cell/OneToOne.vue
+++ b/packages/nc-gui/components/virtual-cell/OneToOne.vue
@@ -1,6 +1,7 @@
 <script setup lang="ts">
 import type { ColumnType } from 'nocodb-sdk'
 import type { Ref } from 'vue'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const column = inject(ColumnInj)!
 
@@ -18,7 +19,7 @@ const isForm = inject(IsFormInj, ref(false))
 
 const isUnderLookup = inject(IsUnderLookupInj, ref(false))
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const listItemsDlg = ref(false)
 
diff --git a/packages/nc-gui/components/virtual-cell/components/ItemChip.vue b/packages/nc-gui/components/virtual-cell/components/ItemChip.vue
index 1a2926e38c..65938e478e 100644
--- a/packages/nc-gui/components/virtual-cell/components/ItemChip.vue
+++ b/packages/nc-gui/components/virtual-cell/components/ItemChip.vue
@@ -1,6 +1,7 @@
 <script lang="ts" setup>
 import type { ColumnType } from 'nocodb-sdk'
 import { UITypes, isVirtualCol } from 'nocodb-sdk'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 interface Props {
   value: string | number | boolean
@@ -17,7 +18,7 @@ const emit = defineEmits(['unlink'])
 
 const { relatedTableMeta } = useLTARStoreOrThrow()!
 
-const { isUIAllowed } = useRoles()
+const { isUIAllowed } = useRolesWrapper()
 
 const readOnly = inject(ReadonlyInj, ref(false))
 
diff --git a/packages/nc-gui/composables/useCalendarViewStore.ts b/packages/nc-gui/composables/useCalendarViewStore.ts
index fe040d4593..bd3d6d3381 100644
--- a/packages/nc-gui/composables/useCalendarViewStore.ts
+++ b/packages/nc-gui/composables/useCalendarViewStore.ts
@@ -2,6 +2,7 @@ import type { ComputedRef, Ref } from 'vue'
 import type { Api, CalendarRangeType, CalendarType, ColumnType, PaginatedType, TableType, ViewType } from 'nocodb-sdk'
 import { UITypes } from 'nocodb-sdk'
 import dayjs from 'dayjs'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const formatData = (list: Record<string, any>[]) =>
   list.map(
@@ -33,7 +34,7 @@ const [useProvideCalendarViewStore, useCalendarViewStore] = useInjectionState(
 
     const pageDate = ref<dayjs.Dayjs>(dayjs())
 
-    const { isUIAllowed } = useRoles()
+    const { isUIAllowed } = useRolesWrapper()
 
     const { isMobileMode } = useGlobal()
 
diff --git a/packages/nc-gui/composables/useExpandedFormStore.ts b/packages/nc-gui/composables/useExpandedFormStore.ts
index d2d2b02cb5..094b4f49f9 100644
--- a/packages/nc-gui/composables/useExpandedFormStore.ts
+++ b/packages/nc-gui/composables/useExpandedFormStore.ts
@@ -2,6 +2,7 @@ import type { AuditType, ColumnType, CommentType, TableType } from 'nocodb-sdk'
 import { UITypes, ViewTypes, isVirtualCol } from 'nocodb-sdk'
 import type { Ref } from 'vue'
 import dayjs from 'dayjs'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const [useProvideExpandedFormStore, useExpandedFormStore] = useInjectionState((meta: Ref<TableType>, _row: Ref<Row>) => {
   const { $e, $state, $api } = useNuxtApp()
@@ -61,7 +62,7 @@ const [useProvideExpandedFormStore, useExpandedFormStore] = useInjectionState((m
 
   const reloadTrigger = inject(ReloadRowDataHookInj, createEventHook())
 
-  const { isUIAllowed } = useRoles()
+  const { isUIAllowed } = useRolesWrapper()
 
   // getters
   const displayValue = computed(() => {
diff --git a/packages/nc-gui/composables/useKanbanViewStore.ts b/packages/nc-gui/composables/useKanbanViewStore.ts
index f33165e3ac..662b31dccd 100644
--- a/packages/nc-gui/composables/useKanbanViewStore.ts
+++ b/packages/nc-gui/composables/useKanbanViewStore.ts
@@ -1,5 +1,6 @@
 import type { ComputedRef, Ref } from 'vue'
 import type { Api, ColumnType, KanbanType, SelectOptionType, SelectOptionsType, TableType, ViewType } from 'nocodb-sdk'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 type GroupingFieldColOptionsType = SelectOptionType & { collapsed: boolean }
 
@@ -27,7 +28,7 @@ const [useProvideKanbanViewStore, useKanbanViewStore] = useInjectionState(
 
     const { sharedView, fetchSharedViewData, fetchSharedViewGroupedData } = useSharedView()
 
-    const { isUIAllowed } = useRoles()
+    const { isUIAllowed } = useRolesWrapper()
 
     const isPublic = ref(shared) || inject(IsPublicInj, ref(false))
 
diff --git a/packages/nc-gui/composables/useMapViewDataStore.ts b/packages/nc-gui/composables/useMapViewDataStore.ts
index c587aec3bf..830728ebd4 100644
--- a/packages/nc-gui/composables/useMapViewDataStore.ts
+++ b/packages/nc-gui/composables/useMapViewDataStore.ts
@@ -1,5 +1,6 @@
 import type { ComputedRef, Ref } from 'vue'
 import type { ColumnType, MapType, PaginatedType, TableType, ViewType } from 'nocodb-sdk'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const formatData = (list: Record<string, any>[]) =>
   list.map(
@@ -32,7 +33,7 @@ const [useProvideMapViewStore, useMapViewStore] = useInjectionState(
 
     const { $api } = useNuxtApp()
 
-    const { isUIAllowed } = useRoles()
+    const { isUIAllowed } = useRolesWrapper()
 
     const isPublic = ref(shared) || inject(IsPublicInj, ref(false))
 
diff --git a/packages/nc-gui/composables/useRoles/index.ts b/packages/nc-gui/composables/useRoles/index.ts
index 767866eac0..100ccd235a 100644
--- a/packages/nc-gui/composables/useRoles/index.ts
+++ b/packages/nc-gui/composables/useRoles/index.ts
@@ -1,5 +1,5 @@
 import { isString } from '@vue/shared'
-import type { Roles, RolesObj, WorkspaceUserRoles } from 'nocodb-sdk'
+import { type Roles, type RolesObj, SourceRestriction, type SourceType, type WorkspaceUserRoles } from 'nocodb-sdk'
 import { extractRolesObj } from 'nocodb-sdk'
 
 const hasPermission = (role: Exclude<Roles, WorkspaceUserRoles>, hasRole: boolean, permission: Permission | string) => {
@@ -129,7 +129,10 @@ export const useRoles = createSharedComposable(() => {
 
   const isUIAllowed = (
     permission: Permission | string,
-    args: { roles?: string | Record<string, boolean> | string[] | null } = {},
+    args: {
+      roles?: string | Record<string, boolean> | string[] | null
+      source?: SourceType & { meta?: Record<string, any> }
+    } = {},
   ) => {
     const { roles } = args
 
@@ -141,6 +144,26 @@ export const useRoles = createSharedComposable(() => {
       checkRoles = extractRolesObj(roles)
     }
 
+    // check source level restrictions
+    if (
+      sourceRestrictions[SourceRestriction.DATA_READONLY][permission] ||
+      sourceRestrictions[SourceRestriction.META_READONLY][permission]
+    ) {
+      const source = unref(args.source || null)
+
+      if (!source) {
+        console.warn('Source not found', permission, new Error().stack)
+        return false
+      }
+
+      if (source?.meta?.[SourceRestriction.DATA_READONLY] && sourceRestrictions[SourceRestriction.DATA_READONLY][permission]) {
+        return false
+      }
+      if (source?.meta?.[SourceRestriction.META_READONLY] && sourceRestrictions[SourceRestriction.META_READONLY][permission]) {
+        return false
+      }
+    }
+
     return Object.entries(checkRoles).some(([role, hasRole]) =>
       hasPermission(role as Exclude<Roles, WorkspaceUserRoles>, hasRole, permission),
     )
@@ -148,3 +171,15 @@ export const useRoles = createSharedComposable(() => {
 
   return { allRoles, orgRoles, workspaceRoles, baseRoles, loadRoles, isUIAllowed }
 })
+
+export const useRolesWrapper = () => {
+  const currentSource = inject(ActiveSourceInj, ref())
+  const useRolesRes = useRoles()
+
+  return {
+    ...useRolesRes,
+    isUIAllowed: (...args: Parameters<ReturnType<typeof useRoles>['isUIAllowed']>) => {
+      return useRolesRes.isUIAllowed(args[0], { source: currentSource, ...(args[1] || {}) })
+    },
+  }
+}
diff --git a/packages/nc-gui/composables/useViewColumns.ts b/packages/nc-gui/composables/useViewColumns.ts
index 6fc4b1acba..832cf8ffd8 100644
--- a/packages/nc-gui/composables/useViewColumns.ts
+++ b/packages/nc-gui/composables/useViewColumns.ts
@@ -1,6 +1,7 @@
 import type { ColumnType, GridColumnReqType, GridColumnType, MapType, TableType, ViewType } from 'nocodb-sdk'
 import { ViewTypes, isHiddenCol, isSystemColumn } from 'nocodb-sdk'
 import type { ComputedRef, Ref } from 'vue'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const [useProvideViewColumns, useViewColumns] = useInjectionState(
   (
@@ -17,7 +18,7 @@ const [useProvideViewColumns, useViewColumns] = useInjectionState(
 
     const { $api, $e } = useNuxtApp()
 
-    const { isUIAllowed } = useRoles()
+    const { isUIAllowed } = useRolesWrapper()
 
     const { isSharedBase } = storeToRefs(useBase())
 
diff --git a/packages/nc-gui/composables/useViewData.ts b/packages/nc-gui/composables/useViewData.ts
index be5c5a8c0b..89f9fbdc20 100644
--- a/packages/nc-gui/composables/useViewData.ts
+++ b/packages/nc-gui/composables/useViewData.ts
@@ -3,6 +3,7 @@ import axios from 'axios'
 import type { Api, ColumnType, FormColumnType, FormType, GalleryType, PaginatedType, TableType, ViewType } from 'nocodb-sdk'
 import type { ComputedRef, Ref } from 'vue'
 import { NavigateDir } from '#imports'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const formatData = (list: Record<string, any>[]) =>
   list.map((row) => ({
@@ -59,7 +60,7 @@ export function useViewData(
 
   const { sorts, nestedFilters } = useSmartsheetStoreOrThrow()
 
-  const { isUIAllowed } = useRoles()
+  const { isUIAllowed } = useRolesWrapper()
 
   const routeQuery = computed(() => route.value.query as Record<string, string>)
 
diff --git a/packages/nc-gui/composables/useViewFilters.ts b/packages/nc-gui/composables/useViewFilters.ts
index ad61e79872..e91a0734bb 100644
--- a/packages/nc-gui/composables/useViewFilters.ts
+++ b/packages/nc-gui/composables/useViewFilters.ts
@@ -9,6 +9,7 @@ import {
 import type { ComputedRef, Ref } from 'vue'
 import type { SelectProps } from 'ant-design-vue'
 import { UITypes, isSystemColumn } from 'nocodb-sdk'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 type ColumnFilterType = FilterType & { status?: string; id?: string; children?: ColumnFilterType[]; is_group?: boolean }
 
@@ -41,7 +42,7 @@ export function useViewFilters(
 
   const { $api, $e } = useNuxtApp()
 
-  const { isUIAllowed } = useRoles()
+  const { isUIAllowed } = useRolesWrapper()
 
   const { metas, getMeta } = useMetas()
 
diff --git a/packages/nc-gui/composables/useViewGroupBy.ts b/packages/nc-gui/composables/useViewGroupBy.ts
index c8c0f7de60..ed41d11855 100644
--- a/packages/nc-gui/composables/useViewGroupBy.ts
+++ b/packages/nc-gui/composables/useViewGroupBy.ts
@@ -2,6 +2,7 @@ import type { ColumnType, LinkToAnotherRecordType, LookupType, SelectOptionsType
 import { UITypes } from 'nocodb-sdk'
 import type { Ref } from 'vue'
 import { message } from 'ant-design-vue'
+import {useRolesWrapper} from "~/composables/useRoles";
 
 const excludedGroupingUidt = [UITypes.Attachment, UITypes.QrCode, UITypes.Barcode]
 
@@ -48,7 +49,7 @@ const [useProvideViewGroupBy, useViewGroupBy] = useInjectionState(
 
     const isGroupBy = computed(() => !!groupBy.value.length)
 
-    const { isUIAllowed } = useRoles()
+    const { isUIAllowed } = useRolesWrapper()
 
     const { sorts, nestedFilters } = useSmartsheetStoreOrThrow()
 
diff --git a/packages/nc-gui/composables/useViewSorts.ts b/packages/nc-gui/composables/useViewSorts.ts
index ad39f63087..2129688cd0 100644
--- a/packages/nc-gui/composables/useViewSorts.ts
+++ b/packages/nc-gui/composables/useViewSorts.ts
@@ -8,7 +8,7 @@ export function useViewSorts(view: Ref<ViewType | undefined>, reloadData?: () =>
 
   const { $api, $e } = useNuxtApp()
 
-  const { isUIAllowed } = useRoles()
+  const { isUIAllowed } = useRolesWrapper()
 
   const { isSharedBase } = storeToRefs(useBase())
 
diff --git a/packages/nc-gui/context/index.ts b/packages/nc-gui/context/index.ts
index fcb46a2061..ffa695b952 100644
--- a/packages/nc-gui/context/index.ts
+++ b/packages/nc-gui/context/index.ts
@@ -1,4 +1,4 @@
-import type { ColumnType, FilterType, TableType, ViewType } from 'nocodb-sdk'
+import type { ColumnType, FilterType, SourceType, TableType, ViewType } from 'nocodb-sdk'
 import type { ComputedRef, InjectionKey, Ref } from 'vue'
 import type { EventHook } from '@vueuse/core'
 import type { PageSidebarNode } from '#imports'
@@ -60,3 +60,10 @@ export const JsonExpandInj: InjectionKey<Ref<boolean>> = Symbol('json-expand-inj
 export const AllFiltersInj: InjectionKey<Ref<Record<string, FilterType[]>>> = Symbol('all-filters-injection')
 
 export const IsAdminPanelInj: InjectionKey<Ref<boolean>> = Symbol('is-admin-panel-injection')
+export const ActiveSourceInj: InjectionKey<
+  ComputedRef<
+    SourceType & {
+      meta?: Record<string, any>
+    }
+  >
+> = Symbol('active-source-injection')
diff --git a/packages/nocodb-sdk/src/lib/enums.ts b/packages/nocodb-sdk/src/lib/enums.ts
index 646a3ee7b2..632d138957 100644
--- a/packages/nocodb-sdk/src/lib/enums.ts
+++ b/packages/nocodb-sdk/src/lib/enums.ts
@@ -326,3 +326,11 @@ export enum APIContext {
   FILTERS = 'filters',
   SORTS = 'sorts',
 }
+
+
+export enum SourceRestriction {
+  META_READONLY = 'metaReadOnly',
+  DATA_READONLY = 'dataReadOnly',
+}
+
+
diff --git a/packages/nocodb/src/services/public-datas.service.ts b/packages/nocodb/src/services/public-datas.service.ts
index 58c5d5dced..f0eea37ed2 100644
--- a/packages/nocodb/src/services/public-datas.service.ts
+++ b/packages/nocodb/src/services/public-datas.service.ts
@@ -1,7 +1,7 @@
 import path from 'path';
 import { Injectable } from '@nestjs/common';
 import { nanoid } from 'nanoid';
-import { populateUniqueFileName, UITypes, ViewTypes } from 'nocodb-sdk';
+import {populateUniqueFileName, SourceRestriction, UITypes, ViewTypes} from 'nocodb-sdk';
 import slash from 'slash';
 import { nocoExecute } from 'nc-help';
 
@@ -293,6 +293,11 @@ export class PublicDatasService {
     });
 
     const source = await Source.get(context, model.source_id);
+
+    if (source?.meta?.[SourceRestriction.DATA_READONLY]) {
+      NcError.forbidden('Data insert is restricted');
+    }
+
     const base = await source.getProject(context);
 
     const baseModel = await Model.getBaseModelSQL(context, {
diff --git a/packages/nocodb/src/utils/acl.ts b/packages/nocodb/src/utils/acl.ts
index d4624a8ac5..4b68dbc3ad 100644
--- a/packages/nocodb/src/utils/acl.ts
+++ b/packages/nocodb/src/utils/acl.ts
@@ -450,4 +450,20 @@ Object.values(rolePermissions).forEach((role) => {
   }
 });
 
+// excluded/restricted permissions at source level based on source restriction
+// `true` means permission is restricted and `false`/missing means permission is allowed
+export const sourceRestrictions = {
+  [SourceRestriction.DATA_READONLY]: {
+    dataInsert: true,
+    dataEdit: true,
+    dataDelete: true,
+  },
+  [SourceRestriction.META_READONLY]: {
+    tableCreate: true,
+    tableRename: true,
+    tableDelete: true,
+    tableDuplicate: true,
+  },
+}
+
 export default rolePermissions;