fix(organizations): atomic admin workspace sweep, removal-impact status in dialog, and preview-unavailable disclosure

Review round 1: the v1 admin add-member now commits membership and the
workspace sweep in one transaction; the remove-member dialog holds confirm
while the credential-impact check loads and shows a caution when it fails;
a failed join preview flags joinPreviewUnavailable so the accept screen
falls back to a generic migration notice. Also aligns the invite test's
react-query mock and repairs two pre-existing docs type errors.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: icecrasher321

apps/docs/app/[lang]/[[...slug]]/page.tsx

@@ -121,7 +121,7 @@ export default async function Page(props: { params: Promise<{ slug?: string[]; l
     const urlParts = page.url.split('/').filter(Boolean)
     let currentPath = ''
 
-    urlParts.forEach((part, index) => {
+    urlParts.forEach((part: string, index: number) => {
       if (index === 0 && SUPPORTED_LANGUAGES.has(part)) {
         currentPath = `/${part}`
         return
@@ -131,7 +131,7 @@ export default async function Page(props: { params: Promise<{ slug?: string[]; l
 
       const name = part
         .split('-')
-        .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
+        .map((word: string) => word.charAt(0).toUpperCase() + word.slice(1))
         .join(' ')
 
       if (index === urlParts.length - 1) {

apps/docs/app/api/chat/route.ts

@@ -1,7 +1,13 @@
 import { openai } from '@ai-sdk/openai'
-import { convertToModelMessages, stepCountIs, streamText, tool, type UIMessage } from 'ai'
+import {
+  convertToModelMessages,
+  jsonSchema,
+  stepCountIs,
+  streamText,
+  tool,
+  type UIMessage,
+} from 'ai'
 import { sql } from 'drizzle-orm'
-import { z } from 'zod'
 import { db, docsEmbeddings } from '@/lib/db'
 import { generateSearchEmbedding } from '@/lib/embeddings'
 
@@ -332,8 +338,21 @@ export async function POST(req: Request) {
       searchDocs: tool({
         description:
           'Search the Sim documentation for relevant content. Use this before answering any question about Sim.',
-        inputSchema: z.object({
-          query: z.string().describe('A focused natural-language search query.'),
+        /**
+         * The SDK's own schema helper instead of a zod schema: the `ai`
+         * package's zod-v4 typings lag the workspace zod version, so a zod
+         * object here fails the tool() overloads whenever the two drift.
+         */
+        inputSchema: jsonSchema<{ query: string }>({
+          type: 'object',
+          properties: {
+            query: {
+              type: 'string',
+              description: 'A focused natural-language search query.',
+            },
+          },
+          required: ['query'],
+          additionalProperties: false,
         }),
         execute: async ({ query }) => searchDocs(query, locale),
       }),

apps/sim/app/api/invitations/[id]/route.ts

@@ -66,14 +66,18 @@ export const GET = withRouteHandler(
 
       /**
        * Disclosure-only: a preview failure must never block viewing or
-       * accepting the invitation itself. Expired-but-still-pending rows get
-       * no preview — acceptance deterministically rejects them.
+       * accepting the invitation itself — but it also must not read as
+       * "nothing moves", so failures are flagged for the client to show a
+       * generic migration notice. Expired-but-still-pending rows get no
+       * preview — acceptance deterministically rejects them.
        */
       let joinPreview = null
+      let joinPreviewUnavailable = false
       if (isInvitee && inv.status === 'pending' && !isInvitationExpired(inv)) {
         try {
           joinPreview = await getInvitationJoinPreview(session.user.id, inv)
         } catch (previewError) {
+          joinPreviewUnavailable = true
           logger.warn('Failed to compute invitation join preview', {
             invitationId: id,
             error: previewError,
@@ -83,6 +87,7 @@ export const GET = withRouteHandler(
 
       return NextResponse.json({
         joinPreview,
+        joinPreviewUnavailable,
         invitation: {
           id: inv.id,
           kind: inv.kind,

apps/sim/app/api/v1/admin/organizations/[id]/members/route.ts

@@ -30,7 +30,7 @@
 
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
-import { member, organization, user, userStats } from '@sim/db/schema'
+import { member, organization, user, userStats, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { count, eq } from 'drizzle-orm'
 import {
@@ -39,10 +39,15 @@ import {
 } from '@/lib/api/contracts/v1/admin'
 import { parseRequest } from '@/lib/api/server'
 import { getOrgMemberLedgerByUser } from '@/lib/billing/core/organization'
-import { addUserToOrganization } from '@/lib/billing/organizations/membership'
+import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
+import { ensureUserInOrganizationTx } from '@/lib/billing/organizations/membership'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { attachOwnedWorkspacesToOrganization } from '@/lib/workspaces/organization-workspaces'
+import { acquireInvitationMutationLocks } from '@/lib/invitations/locks'
+import {
+  attachOwnedWorkspacesToOrganizationTx,
+  ownedAttachableWorkspacesWhere,
+} from '@/lib/workspaces/organization-workspaces'
 import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
 import {
   adminInvalidJsonResponse,
@@ -254,46 +259,84 @@ export const POST = withRouteHandler(
         )
       }
 
-      const result = await addUserToOrganization({
-        userId,
-        organizationId,
-        role,
-        skipBillingLogic: !isBillingEnabled,
-      })
-
-      if (!result.success) {
-        return badRequestResponse(result.error || 'Failed to add member')
-      }
-
       /**
-       * A new member's owned personal workspaces follow them into the org
-       * (collaborators stay external). Best-effort: membership is already
-       * committed, and an attach failure leaves the pre-join status quo.
+       * Membership and the workspace sweep commit or roll back together:
+       * every workspace the new member owns follows them into the org
+       * (collaborators stay external), and an attach failure aborts the whole
+       * add instead of leaving a member whose workspaces escaped the sweep.
+       * Lock order mirrors invitation acceptance: workspace advisory locks
+       * first, then the organization lock inside ensureUserInOrganizationTx.
        */
-      try {
-        const attach = await attachOwnedWorkspacesToOrganization({
+      const result = await db.transaction(async (tx) => {
+        const ownedWorkspaceIds = (
+          await tx
+            .select({ id: workspace.id })
+            .from(workspace)
+            .where(ownedAttachableWorkspacesWhere({ userId, includeArchived: true }))
+        ).map((row) => row.id)
+        if (ownedWorkspaceIds.length > 0) {
+          await acquireInvitationMutationLocks(tx, {
+            invitationIds: [],
+            workspaceIds: ownedWorkspaceIds,
+          })
+        }
+
+        const membership = await ensureUserInOrganizationTx(tx, {
+          userId,
+          organizationId,
+          role,
+          skipBillingLogic: !isBillingEnabled,
+        })
+        if (!membership.success || !membership.memberId || membership.alreadyMember) {
+          return { membership, attachedWorkspaceIds: [], usageLimitUserIds: [] }
+        }
+
+        if (ownedWorkspaceIds.length === 0) {
+          return { membership, attachedWorkspaceIds: [], usageLimitUserIds: [] }
+        }
+        const attach = await attachOwnedWorkspacesToOrganizationTx(tx, {
           ownerUserId: userId,
           organizationId,
+          workspaceIds: ownedWorkspaceIds,
           externalMemberPolicy: 'external-all',
+          ownerMatch: 'owner',
           includeArchived: true,
         })
-        if (attach.attachedWorkspaceIds.length > 0) {
-          logger.info('Attached new member workspaces to organization', {
-            userId,
-            organizationId,
-            attachedWorkspaceCount: attach.attachedWorkspaceIds.length,
-          })
+        return {
+          membership,
+          attachedWorkspaceIds: attach.attachedWorkspaceIds,
+          usageLimitUserIds: attach.usageLimitUserIds,
         }
-      } catch (attachError) {
-        logger.error('Failed to attach new member workspaces to organization', {
+      })
+
+      if (!result.membership.success || !result.membership.memberId) {
+        return badRequestResponse(result.membership.error || 'Failed to add member')
+      }
+      if (result.membership.alreadyMember) {
+        return badRequestResponse('User is already a member of this organization')
+      }
+
+      if (result.attachedWorkspaceIds.length > 0) {
+        logger.info('Attached new member workspaces to organization', {
           userId,
           organizationId,
-          error: attachError,
+          attachedWorkspaceCount: result.attachedWorkspaceIds.length,
         })
       }
+      for (const limitUserId of new Set(result.usageLimitUserIds)) {
+        try {
+          await syncUsageLimitsFromSubscription(limitUserId)
+        } catch (syncError) {
+          logger.error('Failed to sync usage limits after admin member add', {
+            userId: limitUserId,
+            organizationId,
+            error: syncError,
+          })
+        }
+      }
 
       const data: AdminMember = {
-        id: result.memberId!,
+        id: result.membership.memberId,
         userId,
         organizationId,
         role,
@@ -304,8 +347,9 @@ export const POST = withRouteHandler(
 
       logger.info(`Admin API: Added user ${userId} to organization ${organizationId}`, {
         role,
-        memberId: result.memberId,
-        billingActions: result.billingActions,
+        memberId: result.membership.memberId,
+        billingActions: result.membership.billingActions,
+        attachedWorkspaceCount: result.attachedWorkspaceIds.length,
       })
 
       recordAudit({
@@ -315,16 +359,21 @@ export const POST = withRouteHandler(
         resourceType: AuditResourceType.ORGANIZATION,
         resourceId: organizationId,
         description: `Admin API added member to organization as ${role}`,
-        metadata: { targetUserId: userId, role, memberId: result.memberId },
+        metadata: {
+          targetUserId: userId,
+          role,
+          memberId: result.membership.memberId,
+          attachedWorkspaceIds: result.attachedWorkspaceIds,
+        },
         request,
       })
 
       return singleResponse({
         ...data,
         action: 'created' as const,
         billingActions: {
-          proUsageSnapshotted: result.billingActions.proUsageSnapshotted,
-          proCancelledAtPeriodEnd: result.billingActions.proCancelledAtPeriodEnd,
+          proUsageSnapshotted: result.membership.billingActions.proUsageSnapshotted,
+          proCancelledAtPeriodEnd: result.membership.billingActions.proCancelledAtPeriodEnd,
         },
       })
     } catch (error) {

apps/sim/app/invite/[id]/invite.test.tsx

@@ -46,13 +46,48 @@ vi.mock('next/navigation', () => ({
   useSearchParams: () => mockSearchParams,
 }))
 
-vi.mock('@tanstack/react-query', () => ({
-  useQueryClient: () => ({
-    cancelQueries: mockCancelQueries,
-    invalidateQueries: mockInvalidateQueries,
-    setQueryData: mockSetQueryData,
-  }),
-}))
+vi.mock('@tanstack/react-query', async () => {
+  const React = await import('react')
+  return {
+    useQueryClient: () => ({
+      cancelQueries: mockCancelQueries,
+      invalidateQueries: mockInvalidateQueries,
+      setQueryData: mockSetQueryData,
+    }),
+    /**
+     * Minimal useQuery stand-in: runs the queryFn once when enabled and
+     * exposes { data, error, isPending } — enough for the invitation fetch.
+     */
+    useQuery: (options: {
+      queryFn: (context: { signal?: AbortSignal }) => Promise<unknown>
+      enabled?: boolean
+    }) => {
+      const [state, setState] = React.useState<{
+        data: unknown
+        error: unknown
+        isPending: boolean
+      }>({ data: undefined, error: null, isPending: true })
+      const enabled = options.enabled !== false
+      React.useEffect(() => {
+        if (!enabled) return
+        let cancelled = false
+        options.queryFn({}).then(
+          (data) => {
+            if (!cancelled) setState({ data, error: null, isPending: false })
+          },
+          (error) => {
+            if (!cancelled) setState({ data: undefined, error, isPending: false })
+          }
+        )
+        return () => {
+          cancelled = true
+        }
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+      }, [enabled])
+      return state
+    },
+  }
+})
 
 vi.mock('@/lib/api/client/request', () => ({
   requestJson: mockRequestJson,

apps/sim/app/invite/[id]/invite.tsx

@@ -237,6 +237,7 @@ export default function Invite() {
   })
   const invitation = invitationQuery.data?.invitation ?? null
   const joinPreview = invitationQuery.data?.joinPreview ?? null
+  const joinPreviewUnavailable = invitationQuery.data?.joinPreviewUnavailable === true
   const isLoading = Boolean(session?.user) && invitationQuery.isPending
 
   const fetchError = invitationQuery.error
@@ -455,7 +456,15 @@ export default function Invite() {
 
   const isOrg = invitation?.kind === 'organization'
   const organizationLabel = invitation?.organizationName || 'the organization'
-  const migrationNotice = buildWorkspaceMigrationNotice(joinPreview, organizationLabel)
+  /**
+   * When the server could not compute the preview, fall back to a generic
+   * migration notice for membership invites — a missing preview must never
+   * read as "nothing moves".
+   */
+  const migrationNotice =
+    joinPreviewUnavailable && invitation?.membershipIntent !== 'external'
+      ? ` If you own personal workspaces, accepting membership moves them into ${organizationLabel}: its admins get full access, and they stay with the organization if you leave.`
+      : buildWorkspaceMigrationNotice(joinPreview, organizationLabel)
 
   return (
     <InviteLayout>

apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/remove-member-dialog/remove-member-dialog.tsx

@@ -16,6 +16,10 @@ interface RemoveMemberDialogProps {
    * never blocking.
    */
   breakingCredentials?: string[]
+  /** The impact check is still loading — confirm is held until it resolves. */
+  credentialImpactPending?: boolean
+  /** The impact check failed — removal stays possible, with a caution shown. */
+  credentialImpactFailed?: boolean
   isSubmitting?: boolean
   error?: Error | null
   onOpenChange: (open: boolean) => void
@@ -33,6 +37,8 @@ export function RemoveMemberDialog({
   isSelfRemoval = false,
   isExternalRemoval = false,
   breakingCredentials = [],
+  credentialImpactPending = false,
+  credentialImpactFailed = false,
   isSubmitting = false,
 }: RemoveMemberDialogProps) {
   const title = isSelfRemoval
@@ -43,8 +49,9 @@ export function RemoveMemberDialog({
 
   const errorMessage = error ? getErrorMessage(error) || null : null
 
-  const credentialWarning =
-    breakingCredentials.length > 0
+  const credentialWarning = credentialImpactFailed
+    ? `Couldn't check which credentials ${isSelfRemoval ? 'you own' : 'they own'} will be affected — connected accounts backed by ${isSelfRemoval ? 'your' : 'their'} identity may stop working after removal.`
+    : breakingCredentials.length > 0
       ? `${breakingCredentials.length === 1 ? 'A credential' : `${breakingCredentials.length} credentials`} ${
           isSelfRemoval ? 'you own' : 'they own'
         } (${formatQuotedNameList(breakingCredentials, MAX_LISTED_CREDENTIALS)}) will stop working in organization workspaces until another member reconnects ${
@@ -79,7 +86,9 @@ export function RemoveMemberDialog({
       confirm={{
         label: isSelfRemoval ? 'Leave Organization' : 'Remove',
         onClick: () => onConfirmRemove(),
-        pending: isSubmitting,
+        pending: isSubmitting || credentialImpactPending,
+        pendingLabel:
+          credentialImpactPending && !isSubmitting ? 'Checking credentials…' : undefined,
       }}
     >
       {credentialWarning ? (