fix(self-host): address review findings on instance org and org delete

Drop the per-process instance-org id cache. It went stale once the
organization was deleted through the Admin API, and clearing it from the
delete handler would only heal the replica that served that request. The
lookup runs on the signup path against a single-row table, so re-reading
costs nothing and keeps every replica self-correcting.

Scope the org-delete subscription conflict to entitled statuses. Matching any
row regardless of status let a canceled subscription — which bills nobody —
permanently block deletion.

Author: icecrasher321

apps/sim/app/api/v1/admin/organizations/[id]/route.test.ts

@@ -95,6 +95,23 @@ describe('admin organization DELETE', () => {
     expect(mockDetachOrganizationWorkspaces).not.toHaveBeenCalled()
   })
 
+  it('is not blocked by a canceled subscription', async () => {
+    queueOrganization()
+    /**
+     * The status filter runs in SQL, so a canceled row never comes back — an
+     * empty result here is what an organization whose subscription already
+     * ended looks like. Without that filter the row would block deletion
+     * forever even though it bills nobody.
+     */
+    queueTableRows(schemaMock.subscription, [])
+    queueTableRows(schemaMock.member, [{ value: 1 }])
+
+    const response = await DELETE(deleteRequest('acme-inc'), routeContext)
+
+    expect(response.status).toBe(200)
+    expect(mockDetachOrganizationWorkspaces).toHaveBeenCalledWith(ORG_ID)
+  })
+
   it('detaches workspaces before deleting the organization', async () => {
     queueOrganization()
     queueTableRows(schemaMock.subscription, [])

apps/sim/app/api/v1/admin/organizations/[id]/route.ts

@@ -242,11 +242,20 @@ export const DELETE = withRouteHandler(
        * cascades. Deleting an organization out from under a live subscription
        * would strand it, and its Stripe billing, against an id that no longer
        * resolves. Refuse instead of guessing whether to cancel.
+       *
+       * Scoped to entitled statuses. A canceled or ended row bills nobody, so
+       * treating it as a blocker would make an organization that once had a
+       * subscription permanently undeletable.
        */
       const [existingSubscription] = await db
         .select({ id: subscription.id, plan: subscription.plan })
         .from(subscription)
-        .where(eq(subscription.referenceId, organizationId))
+        .where(
+          and(
+            eq(subscription.referenceId, organizationId),
+            inArray(subscription.status, ENTITLED_SUBSCRIPTION_STATUSES)
+          )
+        )
         .limit(1)
 
       if (existingSubscription) {

apps/sim/lib/organizations/instance-org.test.ts

@@ -56,7 +56,6 @@ import {
   getInstanceOrganizationConfig,
   isInstanceOrganizationMode,
   joinInstanceOrganization,
-  resetInstanceOrganizationCache,
 } from '@/lib/organizations/instance-org'
 
 const ORIGINAL_ENV = { ...process.env }
@@ -72,7 +71,6 @@ describe('instance organization', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     queuedRows.length = 0
-    resetInstanceOrganizationCache()
     setEnvFlags({ isBillingEnabled: false })
     mockSelect.mockImplementation(buildSelectChain)
     mockExecute.mockResolvedValue(undefined)
@@ -176,14 +174,25 @@ describe('instance organization', () => {
       expect(mockCreateOrganizationWithOwnerTx).not.toHaveBeenCalled()
     })
 
-    it('caches the id so repeat calls do not re-query', async () => {
+    it('re-reads the organization on every call instead of caching the id', async () => {
+      /**
+       * A per-process cache goes stale when the organization is deleted through
+       * the Admin API, and clearing it from the delete handler would only heal
+       * the replica that served that request. Re-reading keeps every replica
+       * self-correcting.
+       */
       queueRows([{ id: 'org_existing' }])
       await ensureInstanceOrganization('user-1')
       const callsAfterFirst = mockSelect.mock.calls.length
 
-      await ensureInstanceOrganization('user-2')
+      queueRows([])
+      queueRows([])
+      queueRows([])
+      mockCreateOrganizationWithOwnerTx.mockResolvedValue({ organizationId: 'org_recreated' })
+      const recreated = await ensureInstanceOrganization('user-2')
 
-      expect(mockSelect.mock.calls.length).toBe(callsAfterFirst)
+      expect(mockSelect.mock.calls.length).toBeGreaterThan(callsAfterFirst)
+      expect(recreated).toBe('org_recreated')
     })
   })
 

apps/sim/lib/organizations/instance-org.ts

@@ -32,14 +32,6 @@ const logger = createLogger('InstanceOrganization')
 /** Bounds the wait for a concurrent provisioning attempt on another replica. */
 const INSTANCE_ORG_LOCK_TIMEOUT_MS = 10_000
 
-/**
- * Once provisioned, the instance organization's id never changes, so it is
- * cached for the life of the process. `null` is deliberately not cached — a
- * miss means provisioning has not happened yet, and the next caller should
- * retry rather than be told "no org" forever.
- */
-let cachedInstanceOrganizationId: string | null = null
-
 /** Derives a slug the same way the admin organization API does. */
 function slugifyOrganizationName(name: string): string {
   return name
@@ -95,10 +87,17 @@ export function isInstanceOrganizationMode(): boolean {
 /**
  * Returns the instance organization's id without creating it, or `null` when
  * the mode is off or provisioning has not run yet.
+ *
+ * Deliberately uncached. Caching the id per process looks free — it never
+ * changes while the organization exists — but it goes stale the moment the
+ * organization is deleted (the Admin API allows this), and every later signup
+ * then tries to join an id that no longer resolves. Clearing the cache from the
+ * delete handler would only fix the replica that served the request, leaving
+ * every other replica broken until restart. The read is one lookup on a table
+ * that holds a single row in this mode, and it only runs on the signup path, so
+ * there is nothing worth caching against that failure mode.
  */
 export async function getInstanceOrganizationId(): Promise<string | null> {
-  if (cachedInstanceOrganizationId) return cachedInstanceOrganizationId
-
   const config = getInstanceOrganizationConfig()
   if (!config) return null
 
@@ -108,7 +107,6 @@ export async function getInstanceOrganizationId(): Promise<string | null> {
     .where(eq(organization.slug, config.slug))
     .limit(1)
 
-  if (row) cachedInstanceOrganizationId = row.id
   return row?.id ?? null
 }
 
@@ -221,7 +219,6 @@ export async function ensureInstanceOrganization(
       return created.organizationId
     })
 
-    if (organizationId) cachedInstanceOrganizationId = organizationId
     return organizationId
   } catch (error) {
     /**
@@ -288,8 +285,3 @@ export async function joinInstanceOrganization(userId: string): Promise<void> {
     })
   }
 }
-
-/** Clears the cached id. Exported for tests. */
-export function resetInstanceOrganizationCache(): void {
-  cachedInstanceOrganizationId = null
-}