fix(projects): close lifecycle races and surface rollout conflicts

Author: mzxchandra

apps/sim/app/api/folders/[id]/duplicate/route.ts

@@ -13,7 +13,7 @@ import { getSession } from '@/lib/auth'
 import { asOrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import type { DbOrTx } from '@/lib/db/types'
+import type { DbOrTx, DbTransaction } from '@/lib/db/types'
 import { deduplicateFolderName } from '@/lib/folders/naming'
 import { nextFolderSortOrder } from '@/lib/folders/orchestration'
 import { assertFolderCollectionHasRoom, toFolderApi } from '@/lib/folders/queries'
@@ -409,7 +409,7 @@ async function duplicateFolderStructure(
 }
 
 async function duplicateWorkflowsInFolderTree(
-  tx: DbOrTx,
+  tx: DbTransaction,
   sourceWorkspaceId: string,
   targetWorkspaceId: string,
   folderMapping: Map<string, string>,

apps/sim/app/api/superuser/import-workflow/route.ts

@@ -136,17 +136,19 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       null
     )
 
-    await db.insert(workflow).values(
-      await buildNewWorkflowRow(db, {
-        id: newWorkflowId,
-        userId: session.user.id,
-        workspaceId: targetWorkspaceId,
-        folderId: null,
-        name: dedupedName,
-        description: sourceWorkflow.description,
-        variables: sourceWorkflow.variables || {},
-      })
-    )
+    await db.transaction(async (tx) => {
+      await tx.insert(workflow).values(
+        await buildNewWorkflowRow(tx, {
+          id: newWorkflowId,
+          userId: session.user.id,
+          workspaceId: targetWorkspaceId,
+          folderId: null,
+          name: dedupedName,
+          description: sourceWorkflow.description,
+          variables: sourceWorkflow.variables || {},
+        })
+      )
+    })
 
     // Save using existing persistence logic
     const saveResult = await saveWorkflowToNormalizedTables(newWorkflowId, importedData, {

apps/sim/app/api/v1/admin/workflows/import/route.ts

@@ -115,16 +115,18 @@ export const POST = withRouteHandler(
       const workflowId = generateId()
       const dedupedName = await deduplicateWorkflowName(workflowName, workspaceId, folderId || null)
 
-      await db.insert(workflow).values(
-        await buildNewWorkflowRow(db, {
-          id: workflowId,
-          userId: workspaceData.ownerId,
-          workspaceId,
-          folderId: folderId || null,
-          name: dedupedName,
-          description: workflowDescription,
-        })
-      )
+      await db.transaction(async (tx) => {
+        await tx.insert(workflow).values(
+          await buildNewWorkflowRow(tx, {
+            id: workflowId,
+            userId: workspaceData.ownerId,
+            workspaceId,
+            folderId: folderId || null,
+            name: dedupedName,
+            description: workflowDescription,
+          })
+        )
+      })
 
       /**
        * Same normalization the editor and the v1 import API run, via the one

apps/sim/app/api/v1/admin/workspaces/[id]/import/route.ts

@@ -350,16 +350,18 @@ async function importSingleWorkflow(
     const workflowId = generateId()
     const dedupedName = await deduplicateWorkflowName(workflowName, workspaceId, targetFolderId)
 
-    await db.insert(workflow).values(
-      await buildNewWorkflowRow(db, {
-        id: workflowId,
-        userId: ownerId,
-        workspaceId,
-        folderId: targetFolderId,
-        name: dedupedName,
-        description: workflowData.metadata?.description || 'Imported via Admin API',
-      })
-    )
+    await db.transaction(async (tx) => {
+      await tx.insert(workflow).values(
+        await buildNewWorkflowRow(tx, {
+          id: workflowId,
+          userId: ownerId,
+          workspaceId,
+          folderId: targetFolderId,
+          name: dedupedName,
+          description: workflowData.metadata?.description || 'Imported via Admin API',
+        })
+      )
+    })
 
     /**
      * Same normalization the editor, the v1 import API and the single-workflow

apps/sim/app/api/workspaces/[id]/route.ts

@@ -7,6 +7,7 @@ import { deleteWorkspaceBodySchema, updateWorkspaceContract } from '@/lib/api/co
 import { parseRequest, validationErrorResponse } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { changeWorkspaceStoragePayerInTx } from '@/lib/billing/storage/payer-transfer'
+import { OrchestrationError, statusForOrchestrationError } from '@/lib/core/orchestration/types'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { archiveWorkspace } from '@/lib/workspaces/lifecycle'
 
@@ -316,6 +317,12 @@ export const DELETE = withRouteHandler(
 
       return NextResponse.json({ success: true })
     } catch (error) {
+      if (error instanceof OrchestrationError) {
+        return NextResponse.json(
+          { error: error.message },
+          { status: statusForOrchestrationError(error.code) }
+        )
+      }
       logger.error(`Error deleting workspace ${workspaceId}:`, error)
       return NextResponse.json({ error: 'Failed to delete workspace' }, { status: 500 })
     }

apps/sim/ee/access-control/components/project-issue-restrictions.tsx

@@ -1,6 +1,7 @@
 'use client'
 
 import { Checkbox, Chip } from '@sim/emcn'
+import { isApiClientError } from '@/lib/api/client/errors'
 import { useProjects } from '@/hooks/queries/projects'
 
 interface ProjectIssueRestrictionsProps {
@@ -16,6 +17,9 @@ export function ProjectIssueRestrictions({
   onChange,
 }: ProjectIssueRestrictionsProps) {
   const projects = useProjects(organizationId)
+  if (projects.isPending || (isApiClientError(projects.error) && projects.error.status === 503)) {
+    return null
+  }
   const selected = new Set(value)
   return (
     <div className='flex flex-col gap-2'>
@@ -24,7 +28,6 @@ export function ProjectIssueRestrictions({
         For selected Projects, teammates governed by this group need access to every active
         environment to use Issues.
       </p>
-      {projects.isPending && <p className='text-small'>Loading Projects…</p>}
       {projects.error && (
         <p className='text-[var(--text-error)] text-small'>{projects.error.message}</p>
       )}

apps/sim/ee/workspace-forking/lib/create-fork.ts

@@ -233,6 +233,7 @@ export async function createFork(params: CreateForkParams): Promise<CreateForkRe
       )
     }
     const parentProject = await requireForkProject(tx, source.id)
+    await setForkLockTimeout(tx)
     if (admission) {
       await lockForkRevision(tx, { sourceWorkspaceId: source.id })
       await assertForkPreviewFresh(tx, { sourceWorkspaceId: source.id }, admission)

apps/sim/hooks/queries/projects.ts

@@ -1,4 +1,5 @@
 import { useInfiniteQuery } from '@tanstack/react-query'
+import { isApiClientError } from '@/lib/api/client/errors'
 import { requestJson } from '@/lib/api/client/request'
 import { listProjectsContract } from '@/lib/api/contracts/projects'
 
@@ -20,6 +21,8 @@ export function useProjects(organizationId: string) {
       }),
     getNextPageParam: (page) => page.nextCursor,
     staleTime: PROJECT_LIST_STALE_TIME,
+    retry: (failureCount, error) =>
+      !(isApiClientError(error) && error.status === 503) && failureCount < 3,
     enabled: Boolean(organizationId),
   })
 }

apps/sim/lib/api/contracts/user.ts

@@ -477,6 +477,7 @@ export const accountDeletionBlockerSchema = z.object({
     'shared_workspace',
     'organization_workspace',
     'data_drain_owner',
+    'project_lifecycle',
   ]),
   /** A sentence naming both the obstacle and the way out. */
   message: z.string(),

apps/sim/lib/projects/__integration__/foundation.integration.ts

@@ -42,10 +42,13 @@ import {
 import { archiveProjectInTransaction } from '@/lib/projects/lifecycle'
 import {
   createProjectForWorkspace,
+  lockProject,
   lockWorkspaceProject,
+  splitForkProject,
   transferWorkspaceProjects,
 } from '@/lib/projects/membership'
-import { restoreWorkflow } from '@/lib/workflows/lifecycle'
+import { getAccountDeletionPlan } from '@/lib/users/account-deletion'
+import { disableUserResources, restoreWorkflow } from '@/lib/workflows/lifecycle'
 import { buildNewWorkflowRow } from '@/lib/workflows/persistence/new-workflow-row'
 import { createWorkspaceInTransaction } from '@/lib/workspaces/create'
 import { archiveWorkspace } from '@/lib/workspaces/lifecycle'
@@ -1083,6 +1086,148 @@ describe('Project foundation at the database and application boundary', () => {
     }
   )
 
+  check(
+    'account deletion preview reports a surviving Project losing its last active environment',
+    async () => {
+      const f = await fixture(false)
+      await db
+        .delete(permissions)
+        .where(and(eq(permissions.entityId, f.ids[0]), eq(permissions.userId, f.teammateId)))
+      await db
+        .delete(permissions)
+        .where(and(eq(permissions.entityId, f.ids[1]), eq(permissions.userId, f.ownerId)))
+      await db.insert(permissions).values({
+        id: generateId(),
+        entityId: f.ids[1],
+        entityType: 'workspace',
+        userId: f.teammateId,
+        permissionType: 'admin',
+      })
+      await db
+        .update(workspace)
+        .set({ archivedAt: new Date(), ownerId: f.teammateId, billedAccountUserId: f.teammateId })
+        .where(eq(workspace.id, f.ids[1]))
+      const plan = await getAccountDeletionPlan(f.ownerId)
+      expect(plan.workspacesToDelete.map((row) => row.id)).toEqual([f.ids[0]])
+      expect(plan.blockers).toEqual([
+        { code: 'project_lifecycle', message: expect.stringContaining('Archive') },
+      ])
+      await expect(
+        db.transaction((tx) => prepareProjectsForAccountDeletion(tx, f.ownerId, [f.ids[0]]))
+      ).rejects.toMatchObject({ code: 'conflict' })
+      await db.transaction((tx) => archiveProjectInTransaction(tx, f.projectId))
+      expect((await getAccountDeletionPlan(f.ownerId)).blockers).toEqual([])
+    }
+  )
+
+  check(
+    'account teardown can choose an organization admin without per-environment grants',
+    async () => {
+      const f = await fixture()
+      if (!f.organizationId) throw new Error('Missing organization fixture')
+      await db.insert(member).values({
+        id: generateId(),
+        organizationId: f.organizationId,
+        userId: f.teammateId,
+        role: 'admin',
+        createdAt: new Date(),
+      })
+      await db.transaction((tx) => prepareProjectsForAccountDeletion(tx, f.ownerId, []))
+      const [record] = await db.select().from(project).where(eq(project.id, f.projectId))
+      expect(record.ownerId).toBe(f.teammateId)
+    }
+  )
+
+  check(
+    'account teardown re-reads Projects created by an unlink while waiting for the old Project',
+    async () => {
+      const f = await fixture(false)
+      const held = createDeferred<number>()
+      const release = createDeferred<void>()
+      let detachedProjectId: string | null = null
+      const unlink = db.transaction(async (tx) => {
+        await lockProject(tx, f.projectId)
+        const [connection] = await tx.execute<{ pid: number }>(sql`SELECT pg_backend_pid() AS pid`)
+        held.resolve(connection.pid)
+        await release.promise
+        detachedProjectId = await splitForkProject(tx, f.ids[1])
+        await tx
+          .update(workspace)
+          .set({ forkedFromWorkspaceId: null })
+          .where(eq(workspace.id, f.ids[1]))
+      })
+      const blocker = await held.promise
+      const deletion = db.transaction((tx) =>
+        prepareProjectsForAccountDeletion(tx, f.ownerId, [f.ids[1]])
+      )
+      try {
+        let waiting = false
+        for (let attempt = 0; attempt < 100; attempt++) {
+          const rows = await db.execute(
+            sql`SELECT 1 FROM pg_stat_activity WHERE ${blocker} = ANY(pg_blocking_pids(pid))`
+          )
+          if (rows.length) {
+            waiting = true
+            break
+          }
+          await sleep(10)
+        }
+        expect(waiting).toBe(true)
+      } finally {
+        release.resolve()
+        await unlink
+      }
+      await deletion
+      if (!detachedProjectId) throw new Error('Unlink did not create a Project')
+      expect(await db.select().from(project).where(eq(project.id, detachedProjectId))).toEqual([])
+    }
+  )
+
+  check(
+    'banning a former owner cannot archive environments transferred while waiting for the Project',
+    async () => {
+      const f = await fixture(false)
+      const held = createDeferred<number>()
+      const release = createDeferred<void>()
+      const transfer = db.transaction(async (tx) => {
+        await lockProject(tx, f.projectId)
+        const [connection] = await tx.execute<{ pid: number }>(sql`SELECT pg_backend_pid() AS pid`)
+        held.resolve(connection.pid)
+        await release.promise
+        await tx
+          .update(workspace)
+          .set({ ownerId: f.teammateId })
+          .where(inArray(workspace.id, f.ids))
+      })
+      const blocker = await held.promise
+      const ban = disableUserResources(f.ownerId)
+      try {
+        let waiting = false
+        for (let attempt = 0; attempt < 100; attempt++) {
+          const rows = await db.execute(
+            sql`SELECT 1 FROM pg_stat_activity WHERE ${blocker} = ANY(pg_blocking_pids(pid))`
+          )
+          if (rows.length) {
+            waiting = true
+            break
+          }
+          await sleep(10)
+        }
+        expect(waiting).toBe(true)
+      } finally {
+        release.resolve()
+        await transfer
+      }
+      await ban
+      const rows = await db.select().from(workspace).where(inArray(workspace.id, f.ids))
+      expect(rows.every((row) => row.archivedAt === null && row.ownerId === f.teammateId)).toBe(
+        true
+      )
+      const [record] = await db.select().from(project).where(eq(project.id, f.projectId))
+      expect(record.archivedAt).toBeNull()
+    }
+  )
+
   check(
     'account teardown transfers surviving Projects and atomically removes wholly private Projects',
     async () => {