fix(v2-tables): route single-row delete through the service

The v2 handler did a raw db.delete on user_table_rows, skipping assertRowDelete
and deleteOrderedRow — so a delete-locked table returned 200 and the row-count
and order bookkeeping never ran. v1 carries a comment warning against exactly
this. Routes through deleteRow like v1, and adds v2TableLockError so a lock
renders as the 423 LOCKED envelope instead of a 500.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: TheodoreSpeaks

apps/sim/app/api/v2/tables/[tableId]/rows/[rowId]/route.test.ts

@@ -0,0 +1,104 @@
+/**
+ * @vitest-environment node
+ *
+ * Public v2 single-row delete: goes through the row service so the delete lock
+ * and row-count bookkeeping are enforced, and renders lock/not-found in the v2
+ * error envelope.
+ */
+import { NextRequest } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockCheckRateLimit, mockResolveWorkspaceScope, mockCheckAccess, mockDeleteRow } =
+  vi.hoisted(() => ({
+    mockCheckRateLimit: vi.fn(),
+    mockResolveWorkspaceScope: vi.fn(),
+    mockCheckAccess: vi.fn(),
+    mockDeleteRow: vi.fn(),
+  }))
+
+vi.mock('@/app/api/v1/middleware', () => ({
+  checkRateLimit: mockCheckRateLimit,
+  resolveWorkspaceScope: mockResolveWorkspaceScope,
+}))
+
+vi.mock('@/app/api/table/utils', () => ({
+  checkAccess: mockCheckAccess,
+  normalizeColumn: (col: Record<string, unknown>) => col,
+  rootErrorMessage: (error: unknown) => String(error),
+  rowWriteErrorResponse: () => null,
+}))
+
+vi.mock('@/lib/table', async () => {
+  const actual = await import('@/lib/table/column-keys')
+  return {
+    ...actual,
+    deleteRow: mockDeleteRow,
+    updateRow: vi.fn(),
+    rowDataNameToId: vi.fn(),
+    buildIdByName: vi.fn(),
+  }
+})
+
+vi.mock('@/app/api/v2/lib/gate', () => ({
+  v2ApiGateError: vi.fn().mockResolvedValue(null),
+}))
+
+import { TableLockedError } from '@/lib/table/mutation-locks'
+import { DELETE } from '@/app/api/v2/tables/[tableId]/rows/[rowId]/route'
+
+const TABLE = { id: 'table-1', workspaceId: 'ws-1', schema: { columns: [] } }
+
+function callDelete() {
+  const req = new NextRequest(
+    'http://localhost:3000/api/v2/tables/table-1/rows/row-1?workspaceId=ws-1',
+    { method: 'DELETE' }
+  )
+  return DELETE(req, { params: Promise.resolve({ tableId: 'table-1', rowId: 'row-1' }) })
+}
+
+describe('DELETE /api/v2/tables/[tableId]/rows/[rowId]', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockCheckRateLimit.mockResolvedValue({
+      allowed: true,
+      userId: 'user-1',
+      keyType: 'workspace',
+      workspaceId: 'ws-1',
+      limit: 100,
+      remaining: 99,
+      resetAt: new Date('2026-01-01T01:00:00Z'),
+    })
+    mockResolveWorkspaceScope.mockResolvedValue(null)
+    mockCheckAccess.mockResolvedValue({ ok: true, table: TABLE })
+  })
+
+  it('deletes through the row service rather than a raw db.delete', async () => {
+    mockDeleteRow.mockResolvedValue(undefined)
+
+    const res = await callDelete()
+
+    expect(res.status).toBe(200)
+    expect((await res.json()).data).toEqual({ deletedCount: 1, deletedRowIds: ['row-1'] })
+    // The service applies the delete lock and the row-count decrement; the raw
+    // delete this replaced skipped both.
+    expect(mockDeleteRow).toHaveBeenCalledWith(TABLE, 'row-1', expect.any(String))
+  })
+
+  it('returns 423 LOCKED when the table forbids deletes', async () => {
+    mockDeleteRow.mockRejectedValue(new TableLockedError('Table is locked for deletes'))
+
+    const res = await callDelete()
+
+    expect(res.status).toBe(423)
+    expect((await res.json()).error.code).toBe('LOCKED')
+  })
+
+  it('returns 404 for a missing row', async () => {
+    mockDeleteRow.mockRejectedValue(new Error('Row not found'))
+
+    const res = await callDelete()
+
+    expect(res.status).toBe(404)
+    expect((await res.json()).error.code).toBe('NOT_FOUND')
+  })
+})

apps/sim/app/api/v2/tables/[tableId]/rows/[rowId]/route.ts

@@ -13,7 +13,7 @@ import { isZodError, parseRequest } from '@/lib/api/server'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import type { RowData, TableSchema } from '@/lib/table'
-import { buildIdByName, rowDataNameToId, updateRow } from '@/lib/table'
+import { buildIdByName, deleteRow, rowDataNameToId, updateRow } from '@/lib/table'
 import { namedRowMapper } from '@/lib/table/cell-format'
 import { checkAccess } from '@/app/api/table/utils'
 import { checkRateLimit, resolveWorkspaceScope } from '@/app/api/v1/middleware'
@@ -25,7 +25,7 @@ import {
   v2ValidationError,
   v2WorkspaceAccessError,
 } from '@/app/api/v2/lib/response'
-import { toApiRow, v2TableAccessError } from '@/app/api/v2/tables/utils'
+import { toApiRow, v2TableAccessError, v2TableLockError } from '@/app/api/v2/tables/utils'
 
 const logger = createLogger('V2TableRowAPI')
 
@@ -214,22 +214,19 @@ export const DELETE = withRouteHandler(async (request: NextRequest, context: Row
       return v2Error('NOT_FOUND', 'Table not found')
     }
 
-    const [deletedRow] = await db
-      .delete(userTableRows)
-      .where(
-        and(
-          eq(userTableRows.id, rowId),
-          eq(userTableRows.tableId, tableId),
-          eq(userTableRows.workspaceId, workspaceId)
-        )
-      )
-      .returning({ id: userTableRows.id })
-
-    if (!deletedRow) return v2Error('NOT_FOUND', 'Row not found')
+    // Route through the service (not a raw `db.delete`) so the delete lock is
+    // enforced and the row-count/order bookkeeping runs — the raw path returned
+    // 200 on a locked table and left the count stale.
+    await deleteRow(result.table, rowId, requestId)
 
     // v2 mirrors the bulk delete shape: always returns `deletedRowIds`.
-    return v2Data({ deletedCount: 1, deletedRowIds: [deletedRow.id] }, { rateLimit })
+    return v2Data({ deletedCount: 1, deletedRowIds: [rowId] }, { rateLimit })
   } catch (error) {
+    const lockError = v2TableLockError(error)
+    if (lockError) return lockError
+    if (error instanceof Error && error.message === 'Row not found') {
+      return v2Error('NOT_FOUND', 'Row not found')
+    }
     logger.error(`[${requestId}] Error deleting row`, {
       error: getErrorMessage(error, 'Unknown error'),
     })

apps/sim/app/api/v2/tables/utils.ts

@@ -1,5 +1,6 @@
 import type { NextResponse } from 'next/server'
 import type { RowData, TableDefinition, TablePredicate, TableSchema } from '@/lib/table'
+import { TableLockedError } from '@/lib/table/mutation-locks'
 import { predicateToFilter } from '@/lib/table/query-builder/converters'
 import {
   validatePredicateShape,
@@ -95,6 +96,16 @@ export function v2TableAccessError(result: { ok: false; status: 404 | 403 }): Ne
     : v2Error('FORBIDDEN', 'Access denied')
 }
 
+/**
+ * Maps a delete/write rejected by a table lock to the v2 `LOCKED` envelope,
+ * mirroring v1's {@link tableLockErrorResponse}. Returns `null` for anything
+ * else so the caller falls through to its own classification.
+ */
+export function v2TableLockError(error: unknown): NextResponse | null {
+  if (error instanceof TableLockedError) return v2Error('LOCKED', error.message)
+  return null
+}
+
 /**
  * Maps a known user-facing row-write failure (schema/size/unique/limit) to a v2
  * `BAD_REQUEST`, reusing v1's {@link rowWriteErrorResponse} classifier as the