fix(tables): stop auditing no-op deletes on v1 and v2

deleteTable records TABLE_DELETED itself, but only when a row was actually
archived and an actingUserId was passed — omitting the actor is how rollback
callers opt out. v1 and v2 called it without the actor and then hand-rolled
recordAudit outside the `if (deleted)` check, so deleting an already-archived
table emitted a TABLE_DELETED event for a delete that did nothing. The UI and
copilot paths pass the actor and behave correctly.

Both now pass the actor and drop the local audit. v2 also gains lock handling,
so a delete-locked table returns 423 instead of a 500.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: TheodoreSpeaks

apps/sim/app/api/v1/tables/[tableId]/route.ts

@@ -1,4 +1,3 @@
-import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
 import { v1DeleteTableContract, v1GetTableContract } from '@/lib/api/contracts/v1/tables'
@@ -139,18 +138,10 @@ export const DELETE = withRouteHandler(async (request: NextRequest, context: Tab
       return NextResponse.json({ error: 'Invalid workspace ID' }, { status: 400 })
     }
 
-    await deleteTable(tableId, requestId)
-
-    recordAudit({
-      workspaceId,
-      actorId: userId,
-      action: AuditAction.TABLE_DELETED,
-      resourceType: AuditResourceType.TABLE,
-      resourceId: tableId,
-      resourceName: result.table.name,
-      description: `Archived table "${result.table.name}"`,
-      request,
-    })
+    // The actor makes the service audit the delete — and only when a row was
+    // actually archived. Auditing out here emitted TABLE_DELETED for a no-op
+    // delete of an already-archived table.
+    await deleteTable(tableId, requestId, userId)
 
     return NextResponse.json({
       success: true,

apps/sim/app/api/v2/tables/[tableId]/route.test.ts

@@ -0,0 +1,99 @@
+/**
+ * @vitest-environment node
+ *
+ * Public v2 table delete: the actor is handed to the service so the audit is
+ * emitted there — and only for a delete that actually archived a row.
+ */
+import { NextRequest } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  mockCheckRateLimit,
+  mockResolveWorkspaceScope,
+  mockCheckAccess,
+  mockDeleteTable,
+  mockRecordAudit,
+} = vi.hoisted(() => ({
+  mockCheckRateLimit: vi.fn(),
+  mockResolveWorkspaceScope: vi.fn(),
+  mockCheckAccess: vi.fn(),
+  mockDeleteTable: vi.fn(),
+  mockRecordAudit: vi.fn(),
+}))
+
+vi.mock('@sim/audit', () => ({
+  AuditAction: { TABLE_DELETED: 'table.deleted', TABLE_UPDATED: 'table.updated' },
+  AuditResourceType: { TABLE: 'table' },
+  recordAudit: mockRecordAudit,
+}))
+
+vi.mock('@/app/api/v1/middleware', () => ({
+  checkRateLimit: mockCheckRateLimit,
+  resolveWorkspaceScope: mockResolveWorkspaceScope,
+}))
+
+vi.mock('@/app/api/table/utils', () => ({
+  checkAccess: mockCheckAccess,
+  normalizeColumn: (col: Record<string, unknown>) => col,
+  rootErrorMessage: (error: unknown) => String(error),
+  rowWriteErrorResponse: () => null,
+}))
+
+vi.mock('@/lib/table', async () => {
+  const actual = await import('@/lib/table/column-keys')
+  return { ...actual, deleteTable: mockDeleteTable, updateTable: vi.fn(), getTableById: vi.fn() }
+})
+
+vi.mock('@/app/api/v2/lib/gate', () => ({
+  v2ApiGateError: vi.fn().mockResolvedValue(null),
+}))
+
+import { TableLockedError } from '@/lib/table/mutation-locks'
+import { DELETE } from '@/app/api/v2/tables/[tableId]/route'
+
+const TABLE = { id: 'table-1', name: 'Tasks', workspaceId: 'ws-1', schema: { columns: [] } }
+
+function callDelete() {
+  const req = new NextRequest('http://localhost:3000/api/v2/tables/table-1?workspaceId=ws-1', {
+    method: 'DELETE',
+  })
+  return DELETE(req, { params: Promise.resolve({ tableId: 'table-1' }) })
+}
+
+describe('DELETE /api/v2/tables/[tableId]', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockCheckRateLimit.mockResolvedValue({
+      allowed: true,
+      userId: 'user-1',
+      keyType: 'workspace',
+      workspaceId: 'ws-1',
+      limit: 100,
+      remaining: 99,
+      resetAt: new Date('2026-01-01T01:00:00Z'),
+    })
+    mockResolveWorkspaceScope.mockResolvedValue(null)
+    mockCheckAccess.mockResolvedValue({ ok: true, table: TABLE })
+  })
+
+  it('passes the actor so the service owns the audit', async () => {
+    mockDeleteTable.mockResolvedValue(undefined)
+
+    const res = await callDelete()
+
+    expect(res.status).toBe(200)
+    expect(mockDeleteTable).toHaveBeenCalledWith('table-1', expect.any(String), 'user-1')
+    // The route no longer audits: doing so out here fired TABLE_DELETED even
+    // when the delete was a no-op on an already-archived table.
+    expect(mockRecordAudit).not.toHaveBeenCalled()
+  })
+
+  it('returns 423 LOCKED for a delete-locked table instead of a 500', async () => {
+    mockDeleteTable.mockRejectedValue(new TableLockedError('delete'))
+
+    const res = await callDelete()
+
+    expect(res.status).toBe(423)
+    expect((await res.json()).error.code).toBe('LOCKED')
+  })
+})

apps/sim/app/api/v2/tables/[tableId]/route.ts

@@ -1,4 +1,3 @@
-import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import type { NextRequest } from 'next/server'
@@ -17,7 +16,7 @@ import {
   v2ValidationError,
   v2WorkspaceAccessError,
 } from '@/app/api/v2/lib/response'
-import { toApiTable, v2TableAccessError } from '@/app/api/v2/tables/utils'
+import { toApiTable, v2TableAccessError, v2TableLockError } from '@/app/api/v2/tables/utils'
 
 const logger = createLogger('V2TableDetailAPI')
 
@@ -100,21 +99,15 @@ export const DELETE = withRouteHandler(async (request: NextRequest, context: Tab
       return v2Error('NOT_FOUND', 'Table not found')
     }
 
-    await deleteTable(tableId, requestId)
-
-    recordAudit({
-      workspaceId,
-      actorId: userId,
-      action: AuditAction.TABLE_DELETED,
-      resourceType: AuditResourceType.TABLE,
-      resourceId: tableId,
-      resourceName: result.table.name,
-      description: `Archived table "${result.table.name}"`,
-      request,
-    })
+    // The actor makes the service audit the delete — and only when a row was
+    // actually archived. Auditing out here emitted TABLE_DELETED for a no-op
+    // delete of an already-archived table.
+    await deleteTable(tableId, requestId, userId)
 
     return v2Data({ id: tableId }, { rateLimit })
   } catch (error) {
+    const lockError = v2TableLockError(error)
+    if (lockError) return lockError
     logger.error(`[${requestId}] Error deleting table`, {
       error: getErrorMessage(error, 'Unknown error'),
     })