fix(tables): restore audit provenance and conflict status in orchestration

Moving the audits into the orchestration functions dropped three things the
routes had been carrying, and added one the orchestration now owns twice.

- The v1 and v2 column-update routes passed `request` to `recordAudit`, so
  their audit rows recorded the caller's IP and user-agent. The orchestration
  function had no way to receive it. Every table orchestration function now
  takes an optional `OrchestrationRequestContext` and every HTTP route
  forwards it; the copilot and VFS callers, which have no request, omit it.
- `classifyTableMutation` matched `TableConflictError` on "already exists"
  appearing in the message and reported it as `validation`, turning the UI
  route's 409 on a duplicate table rename into a 400. It now matches the type,
  the way `performRestoreTable` already did.
- `captureServerEvent` ran on every delete while the audit was gated on a row
  actually being archived, so a repeat delete of an archived table still
  reported `table_deleted`. Both now hang off the same evidence.
- The copilot delete path kept its own `captureServerEvent` from when the
  service did not emit one, double-counting every copilot table delete.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YGzbVDZpe2dEALbu2BUU8a

Author: TheodoreSpeaks

apps/sim/app/api/table/[tableId]/columns/route.ts

@@ -117,6 +117,7 @@ export const PATCH = withRouteHandler(async (request: NextRequest, context: Colu
       userId: authResult.userId,
       updates: validated.updates,
       requestId,
+      request,
     })
     if (!outcome.success || !outcome.table) {
       return NextResponse.json(

apps/sim/app/api/table/[tableId]/route.ts

@@ -199,6 +199,7 @@ export const PATCH = withRouteHandler(
           newName: validated.name,
           userId: authResult.userId,
           requestId,
+          request,
         })
         if (!renameOutcome.success) {
           return NextResponse.json(
@@ -224,6 +225,7 @@ export const PATCH = withRouteHandler(
           folderId: validated.folderId,
           userId: authResult.userId,
           requestId,
+          request,
         })
         if (!moveOutcome.success) {
           return NextResponse.json(
@@ -289,7 +291,12 @@ export const DELETE = withRouteHandler(
         return NextResponse.json({ error: 'Invalid workspace ID' }, { status: 400 })
       }
 
-      const outcome = await performDeleteTable({ table, userId: authResult.userId, requestId })
+      const outcome = await performDeleteTable({
+        table,
+        userId: authResult.userId,
+        requestId,
+        request,
+      })
       if (!outcome.success) {
         return NextResponse.json(
           { error: outcome.error ?? 'Failed to delete table' },

apps/sim/app/api/v1/tables/[tableId]/columns/route.ts

@@ -151,6 +151,7 @@ export const PATCH = withRouteHandler(async (request: NextRequest, context: Colu
       userId,
       updates: validated.updates,
       requestId,
+      request,
     })
     if (!outcome.success || !outcome.table) {
       return NextResponse.json(

apps/sim/app/api/v1/tables/[tableId]/route.ts

@@ -140,7 +140,7 @@ export const DELETE = withRouteHandler(async (request: NextRequest, context: Tab
       return NextResponse.json({ error: 'Invalid workspace ID' }, { status: 400 })
     }
 
-    const outcome = await performDeleteTable({ table: result.table, userId, requestId })
+    const outcome = await performDeleteTable({ table: result.table, userId, requestId, request })
     if (!outcome.success) {
       return NextResponse.json(
         { error: outcome.error ?? 'Failed to delete table' },

apps/sim/app/api/v2/tables/[tableId]/columns/route.ts

@@ -138,6 +138,7 @@ export const PATCH = withRouteHandler(async (request: NextRequest, context: Colu
       userId,
       updates: validated.updates,
       requestId,
+      request,
     })
     if (!outcome.success || !outcome.table) {
       return v2ErrorForOrchestration(outcome.errorCode, outcome.error ?? 'Failed to update column')

apps/sim/app/api/v2/tables/[tableId]/route.ts

@@ -100,7 +100,7 @@ export const DELETE = withRouteHandler(async (request: NextRequest, context: Tab
       return v2Error('NOT_FOUND', 'Table not found')
     }
 
-    const outcome = await performDeleteTable({ table: result.table, userId, requestId })
+    const outcome = await performDeleteTable({ table: result.table, userId, requestId, request })
     if (!outcome.success) {
       return v2ErrorForOrchestration(outcome.errorCode, outcome.error ?? 'Failed to delete table')
     }

apps/sim/lib/copilot/tools/server/table/user-table.ts

@@ -10,7 +10,6 @@ import {
 } from '@/lib/copilot/tools/server/base-tool'
 import { isTriggerDevEnabled } from '@/lib/core/config/env-flags'
 import { runDetached } from '@/lib/core/utils/background'
-import { captureServerEvent } from '@/lib/posthog/server'
 import {
   buildAutoMapping,
   COLUMN_TYPES,
@@ -502,12 +501,6 @@ export const userTableServerTool: BaseServerTool<UserTableArgs, UserTableResult>
             if (!deleteOutcome.success) {
               return { success: false, message: deleteOutcome.error ?? 'Failed to delete table' }
             }
-            captureServerEvent(
-              context.userId,
-              'table_deleted',
-              { table_id: tableId, workspace_id: workspaceId },
-              { groups: { workspace: workspaceId } }
-            )
             deleted.push(tableId)
           }
 

apps/sim/lib/core/orchestration/types.ts

@@ -12,3 +12,12 @@ export function statusForOrchestrationError(code: OrchestrationErrorCode | undef
   if (code === 'locked') return 423
   return 500
 }
+
+/**
+ * The slice of an HTTP request the audit log reads for client IP and user-agent
+ * capture. Optional on every orchestration function so the non-HTTP callers —
+ * copilot tools, background jobs — can omit what they do not have.
+ */
+export interface OrchestrationRequestContext {
+  headers: { get(name: string): string | null }
+}

apps/sim/lib/table/orchestration/columns.ts

@@ -1,6 +1,9 @@
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { createLogger } from '@sim/logger'
-import type { OrchestrationErrorCode } from '@/lib/core/orchestration/types'
+import type {
+  OrchestrationErrorCode,
+  OrchestrationRequestContext,
+} from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { columnMatchesRef, getColumnId } from '@/lib/table/column-keys'
 import { columnTypeById } from '@/lib/table/column-types'
@@ -33,6 +36,8 @@ export interface PerformUpdateTableColumnParams {
     currencyCode?: string
   }
   requestId?: string
+  /** Forwarded to the audit record for IP / user-agent capture. */
+  request?: OrchestrationRequestContext
 }
 
 export interface PerformUpdateTableColumnResult {
@@ -96,7 +101,7 @@ function fail(error: string, errorCode: OrchestrationErrorCode): PerformUpdateTa
 export async function performUpdateTableColumn(
   params: PerformUpdateTableColumnParams
 ): Promise<PerformUpdateTableColumnResult> {
-  const { table, columnName, userId, updates } = params
+  const { table, columnName, userId, updates, request } = params
   const requestId = params.requestId ?? generateRequestId()
   const tableId = table.id
 
@@ -269,6 +274,7 @@ export async function performUpdateTableColumn(
     resourceName: table.name,
     description: `Updated column "${columnName}" in table "${table.name}"`,
     metadata: { columnName, updates },
+    ...(request ? { request } : {}),
   })
 
   return { success: true, table: updated }

apps/sim/lib/table/orchestration/tables.test.ts

@@ -4,14 +4,26 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { TableDefinition } from '@/lib/table/types'
 
-const { mockDeleteTable, mockDeleteRow, mockCaptureServerEvent, mockRecordAudit } = vi.hoisted(
-  () => ({
-    mockDeleteTable: vi.fn(),
-    mockDeleteRow: vi.fn(),
-    mockCaptureServerEvent: vi.fn(),
-    mockRecordAudit: vi.fn(),
-  })
-)
+const {
+  mockDeleteTable,
+  mockDeleteRow,
+  mockRenameTable,
+  mockCaptureServerEvent,
+  mockRecordAudit,
+  MockTableConflictError,
+} = vi.hoisted(() => ({
+  mockDeleteTable: vi.fn(),
+  mockDeleteRow: vi.fn(),
+  mockRenameTable: vi.fn(),
+  mockCaptureServerEvent: vi.fn(),
+  mockRecordAudit: vi.fn(),
+  MockTableConflictError: class extends Error {
+    readonly code = 'TABLE_EXISTS' as const
+    constructor(name: string) {
+      super(`A table named "${name}" already exists in this workspace`)
+    }
+  },
+}))
 
 vi.mock('@sim/audit', () => ({
   AuditAction: { TABLE_DELETED: 'table.deleted', TABLE_UPDATED: 'table.updated' },
@@ -22,14 +34,19 @@ vi.mock('@sim/audit', () => ({
 vi.mock('@/lib/table/service', () => ({
   deleteTable: mockDeleteTable,
   moveTableToFolder: vi.fn(),
-  renameTable: vi.fn(),
+  renameTable: mockRenameTable,
   updateTableLocks: vi.fn(),
+  TableConflictError: MockTableConflictError,
 }))
 vi.mock('@/lib/table/rows/service', () => ({ deleteRow: mockDeleteRow }))
 vi.mock('@/lib/posthog/server', () => ({ captureServerEvent: mockCaptureServerEvent }))
 
 import { TableLockedError } from '@/lib/table/mutation-locks'
-import { performDeleteTable, performDeleteTableRow } from '@/lib/table/orchestration/tables'
+import {
+  performDeleteTable,
+  performDeleteTableRow,
+  performRenameTable,
+} from '@/lib/table/orchestration/tables'
 
 const TABLE = { id: 'table-1', name: 'Tasks', workspaceId: 'ws-1' } as unknown as TableDefinition
 
@@ -56,13 +73,23 @@ describe('performDeleteTable', () => {
     )
   })
 
-  it('does not audit a repeat delete of an already-archived table', async () => {
+  it('carries request provenance into the audit row', async () => {
+    mockDeleteTable.mockResolvedValue({ archived: { name: 'Tasks', workspaceId: 'ws-1' } })
+    const request = new Request('https://sim.ai', { headers: { 'user-agent': 'curl/8' } })
+
+    await performDeleteTable({ table: TABLE, userId: 'user-1', request })
+
+    expect(mockRecordAudit).toHaveBeenCalledWith(expect.objectContaining({ request }))
+  })
+
+  it('neither audits nor reports a repeat delete of an already-archived table', async () => {
     mockDeleteTable.mockResolvedValue({ archived: null })
 
     const result = await performDeleteTable({ table: TABLE, userId: 'user-1' })
 
     expect(result.success).toBe(true)
     expect(mockRecordAudit).not.toHaveBeenCalled()
+    expect(mockCaptureServerEvent).not.toHaveBeenCalled()
   })
 
   it('classifies a delete lock as locked and emits no telemetry', async () => {
@@ -75,6 +102,18 @@ describe('performDeleteTable', () => {
   })
 })
 
+describe('performRenameTable', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('classifies a name collision as a conflict, not bad input', async () => {
+    mockRenameTable.mockRejectedValue(new MockTableConflictError('Tasks'))
+
+    const result = await performRenameTable({ table: TABLE, newName: 'Tasks', userId: 'user-1' })
+
+    expect(result).toMatchObject({ success: false, errorCode: 'conflict' })
+  })
+})
+
 describe('performDeleteTableRow', () => {
   beforeEach(() => vi.clearAllMocks())