fix(workspaces): record an audit entry for auto-provisioned fallback workspaces

Normal workspace creation gets its own WORKSPACE_CREATED audit row;
the auto-provisioned fallback for a stranded member didn't, making it
only discoverable indirectly via the deletion's audit metadata.

archiveWorkspace now accepts an optional actor (from the deleting
admin's session) and records a WORKSPACE_CREATED audit entry per
fallback workspace it provisions, attributing the action to the admin
who triggered the deletion.

Author: waleedlatif1

apps/sim/app/api/workspaces/[id]/route.test.ts

@@ -83,6 +83,9 @@ describe('DELETE /api/workspaces/[id]', () => {
     expect(body).toEqual({ success: true })
     expect(mockArchiveWorkspace).toHaveBeenCalledWith('workspace-1', {
       requestId: 'workspace-workspace-1',
+      actorId: 'user-admin',
+      actorName: 'Admin',
+      actorEmail: 'admin@example.com',
     })
     expect(auditMockFns.mockRecordAudit).toHaveBeenCalledWith(
       expect.objectContaining({

apps/sim/app/api/workspaces/[id]/route.ts

@@ -250,6 +250,9 @@ export const DELETE = withRouteHandler(
 
       const archiveResult = await archiveWorkspace(workspaceId, {
         requestId: `workspace-${workspaceId}`,
+        actorId: session.user.id,
+        actorName: session.user.name,
+        actorEmail: session.user.email,
       })
 
       if (!archiveResult.archived) {

apps/sim/lib/workspaces/lifecycle.test.ts

@@ -1,7 +1,7 @@
 /**
  * @vitest-environment node
  */
-import { permissionsMock, permissionsMockFns } from '@sim/testing'
+import { auditMock, auditMockFns, permissionsMock, permissionsMockFns } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
@@ -41,6 +41,8 @@ vi.mock('@/lib/workspaces/create', () => ({
   createWorkspaceRecord: mockCreateWorkspaceRecord,
 }))
 
+vi.mock('@sim/audit', () => auditMock)
+
 import { archiveWorkspace } from './lifecycle'
 
 function createUpdateChain() {
@@ -86,7 +88,7 @@ describe('workspace lifecycle', () => {
         where: vi.fn().mockResolvedValue([]),
       }),
     })
-    mockCreateWorkspaceRecord.mockResolvedValue({ id: 'fallback-workspace' })
+    mockCreateWorkspaceRecord.mockResolvedValue({ id: 'fallback-workspace', name: 'My Workspace' })
   })
 
   it('archives workspace and dependent resources under serializable isolation', async () => {
@@ -138,7 +140,12 @@ describe('workspace lifecycle', () => {
       callback(tx)
     )
 
-    const result = await archiveWorkspace('workspace-1', { requestId: 'req-1' })
+    const result = await archiveWorkspace('workspace-1', {
+      requestId: 'req-1',
+      actorId: 'admin-1',
+      actorName: 'Admin',
+      actorEmail: 'admin@example.com',
+    })
 
     expect(result).toEqual({
       archived: true,
@@ -155,11 +162,44 @@ describe('workspace lifecycle', () => {
         executor: tx,
       })
     )
+    expect(auditMockFns.mockRecordAudit).toHaveBeenCalledWith(
+      expect.objectContaining({
+        actorId: 'admin-1',
+        resourceId: 'fallback-workspace',
+        metadata: expect.objectContaining({
+          deletedWorkspaceId: 'workspace-1',
+          recipientUserId: 'user-victim',
+        }),
+      })
+    )
     // Deletion is never blocked — the workspace is still archived alongside the fallback creation.
     expect(tx.update).toHaveBeenCalledTimes(8)
     expect(tx.delete).toHaveBeenCalledTimes(1)
   })
 
+  it('does not record an audit entry for the fallback workspace when no actor is provided', async () => {
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Workspace 1',
+      ownerId: 'user-1',
+      archivedAt: null,
+    })
+    mockArchiveWorkflowsForWorkspace.mockResolvedValue(0)
+    mockListAccessibleWorkspaceRowsForUser.mockResolvedValue([
+      accessibleWorkspaceRow('workspace-1'),
+    ])
+
+    const tx = createTx([{ userId: 'user-victim' }])
+    mockTransaction.mockImplementation(async (callback: (trx: typeof tx) => Promise<void>) =>
+      callback(tx)
+    )
+
+    await archiveWorkspace('workspace-1', { requestId: 'req-1' })
+
+    expect(mockCreateWorkspaceRecord).toHaveBeenCalled()
+    expect(auditMockFns.mockRecordAudit).not.toHaveBeenCalled()
+  })
+
   it('only provisions a fallback for the one member who would actually be stranded', async () => {
     mockGetWorkspaceWithOwner.mockResolvedValue({
       id: 'workspace-1',

apps/sim/lib/workspaces/lifecycle.ts

@@ -1,3 +1,4 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
 import {
   apiKey,
@@ -38,6 +39,10 @@ interface ArchiveWorkspaceOptions {
    * the banned user specifically should not be handed a fresh workspace as a side effect.
    */
   force?: boolean
+  /** Attributed as the actor on the audit log entry for any auto-provisioned replacement workspace. */
+  actorId?: string
+  actorName?: string | null
+  actorEmail?: string | null
 }
 
 interface ArchiveWorkspaceResult {
@@ -119,14 +124,29 @@ export async function archiveWorkspace(
     if (!options.force) {
       const strandedUserIds = await findMembersStrandedByArchival(tx, workspaceId)
       for (const userId of strandedUserIds) {
-        await createWorkspaceRecord({
+        const fallbackWorkspace = await createWorkspaceRecord({
           userId,
           name: FALLBACK_WORKSPACE_NAME,
           organizationId: null,
           workspaceMode: WORKSPACE_MODE.PERSONAL,
           billedAccountUserId: userId,
           executor: tx,
         })
+
+        if (options.actorId) {
+          recordAudit({
+            workspaceId: fallbackWorkspace.id,
+            actorId: options.actorId,
+            actorName: options.actorName,
+            actorEmail: options.actorEmail,
+            action: AuditAction.WORKSPACE_CREATED,
+            resourceType: AuditResourceType.WORKSPACE,
+            resourceId: fallbackWorkspace.id,
+            resourceName: fallbackWorkspace.name,
+            description: `Auto-created replacement workspace "${fallbackWorkspace.name}" for a member left with no workspace after deleting "${workspaceRecord.name}"`,
+            metadata: { deletedWorkspaceId: workspaceId, recipientUserId: userId },
+          })
+        }
       }
       provisionedWorkspaceUserIds = strandedUserIds
     }