fix(workspaces): auto-provision a replacement workspace instead of blocking deletion

Blocking deletion when it would strand a member was the wrong UX: an
org admin doing legitimate cleanup would be stopped because some
unrelated, possibly-inactive member happened to have this as their
only workspace.

archiveWorkspace now always allows the deletion and instead
auto-provisions a personal fallback workspace, atomically in the same
transaction, for any member who would otherwise be left with zero
active workspaces. This guarantees the invariant holds regardless of
which route/link/client the affected member's next request comes
through, unlike the pre-existing client-side "no workspaces" recovery
which only covers the generic /workspace redirect page.

Extracted the workspace-creation write (insert workspace + owner
permission row + default workflow) out of the POST /api/workspaces
route into a shared lib/workspaces/create.ts so both the route and
the archival safety net use the same logic, parameterized by an
optional executor so it can run inside an existing transaction.

The ban flow (disableUserResources) keeps force: true, now meaning
"skip stranded-member handling entirely" — a banned user's owned
workspaces must still be fully disabled, and the banned user
specifically shouldn't be handed a fresh workspace as a side effect.

Author: waleedlatif1

apps/sim/app/api/workspaces/[id]/route.test.ts

@@ -61,22 +61,6 @@ describe('DELETE /api/workspaces/[id]', () => {
     expect(mockArchiveWorkspace).not.toHaveBeenCalled()
   })
 
-  it('returns 400 and does not record an audit entry when archival would strand a member', async () => {
-    mockArchiveWorkspace.mockResolvedValue({
-      archived: false,
-      workspaceName: 'Victim Workspace',
-      strandedUserIds: ['user-victim'],
-    })
-
-    const response = await callDelete()
-    const body = await response.json()
-
-    expect(response.status).toBe(400)
-    expect(body.error).toMatch(/no other workspace/i)
-    expect(auditMockFns.mockRecordAudit).not.toHaveBeenCalled()
-    expect(posthogServerMockFns.mockCaptureServerEvent).not.toHaveBeenCalled()
-  })
-
   it('returns 404 when the workspace does not exist', async () => {
     mockArchiveWorkspace.mockResolvedValue({ archived: false })
 
@@ -115,6 +99,27 @@ describe('DELETE /api/workspaces/[id]', () => {
     )
   })
 
+  it('succeeds and records which members were auto-provisioned a replacement workspace', async () => {
+    mockArchiveWorkspace.mockResolvedValue({
+      archived: true,
+      workspaceName: 'Test Workspace',
+      provisionedWorkspaceUserIds: ['user-victim'],
+    })
+
+    const response = await callDelete('workspace-1')
+    const body = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(body).toEqual({ success: true })
+    expect(auditMockFns.mockRecordAudit).toHaveBeenCalledWith(
+      expect.objectContaining({
+        metadata: expect.objectContaining({
+          provisionedWorkspaceUserIds: ['user-victim'],
+        }),
+      })
+    )
+  })
+
   it('returns 500 when archival throws unexpectedly', async () => {
     mockArchiveWorkspace.mockRejectedValue(new Error('db exploded'))
 

apps/sim/app/api/workspaces/[id]/route.ts

@@ -252,16 +252,6 @@ export const DELETE = withRouteHandler(
         requestId: `workspace-${workspaceId}`,
       })
 
-      if (archiveResult.strandedUserIds?.length) {
-        return NextResponse.json(
-          {
-            error:
-              'Cannot delete this workspace: one or more members have no other workspace to fall back to',
-          },
-          { status: 400 }
-        )
-      }
-
       if (!archiveResult.archived) {
         return NextResponse.json({ error: 'Workspace not found' }, { status: 404 })
       }
@@ -281,6 +271,9 @@ export const DELETE = withRouteHandler(
             workflows: workflowIds.length,
           },
           archived: archiveResult.archived,
+          ...(archiveResult.provisionedWorkspaceUserIds?.length && {
+            provisionedWorkspaceUserIds: archiveResult.provisionedWorkspaceUserIds,
+          }),
         },
         request,
       })

apps/sim/app/api/workspaces/route.ts

@@ -1,8 +1,7 @@
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
-import { permissions, settings, type WorkspaceMode, workflow, workspace } from '@sim/db/schema'
+import { settings, type WorkspaceMode, workflow } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { generateId } from '@sim/utils/id'
 import { and, eq, isNull } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { listWorkspacesQuerySchema } from '@/lib/api/contracts'
@@ -13,9 +12,7 @@ import type { PlanCategory } from '@/lib/billing/plan-helpers'
 import { PlatformEvents } from '@/lib/core/telemetry'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { captureServerEvent } from '@/lib/posthog/server'
-import { buildDefaultWorkflowArtifacts } from '@/lib/workflows/defaults'
-import { saveWorkflowToNormalizedTables } from '@/lib/workflows/persistence/utils'
-import { getRandomWorkspaceColor } from '@/lib/workspaces/colors'
+import { createWorkspaceRecord } from '@/lib/workspaces/create'
 import {
   CONTACT_OWNER_TO_UPGRADE_REASON,
   evaluateWorkspaceInvitePolicy,
@@ -283,90 +280,19 @@ async function createWorkspace({
   workspaceMode,
   billedAccountUserId,
 }: CreateWorkspaceParams) {
-  const workspaceId = generateId()
-  const workflowId = generateId()
-  const now = new Date()
-  const color = explicitColor || getRandomWorkspaceColor()
-
-  try {
-    await db.transaction(async (tx) => {
-      await tx.insert(workspace).values({
-        id: workspaceId,
-        name,
-        color,
-        ownerId: userId,
-        organizationId,
-        workspaceMode,
-        billedAccountUserId,
-        allowPersonalApiKeys: true,
-        createdAt: now,
-        updatedAt: now,
-      })
-
-      const permissionRows = [
-        {
-          id: generateId(),
-          entityType: 'workspace' as const,
-          entityId: workspaceId,
-          userId,
-          permissionType: 'admin' as const,
-          createdAt: now,
-          updatedAt: now,
-        },
-      ]
-
-      if (
-        workspaceMode === WORKSPACE_MODE.ORGANIZATION &&
-        billedAccountUserId &&
-        billedAccountUserId !== userId
-      ) {
-        permissionRows.push({
-          id: generateId(),
-          entityType: 'workspace' as const,
-          entityId: workspaceId,
-          userId: billedAccountUserId,
-          permissionType: 'admin' as const,
-          createdAt: now,
-          updatedAt: now,
-        })
-      }
-
-      await tx.insert(permissions).values(permissionRows)
-
-      if (!skipDefaultWorkflow) {
-        await tx.insert(workflow).values({
-          id: workflowId,
-          userId,
-          workspaceId,
-          folderId: null,
-          name: 'default-agent',
-          description: 'Your first workflow - start building here!',
-          lastSynced: now,
-          createdAt: now,
-          updatedAt: now,
-          isDeployed: false,
-          runCount: 0,
-          variables: {},
-        })
-
-        const { workflowState } = buildDefaultWorkflowArtifacts()
-        await saveWorkflowToNormalizedTables(workflowId, workflowState, tx)
-      }
-
-      logger.info(
-        skipDefaultWorkflow
-          ? `Created ${workspaceMode} workspace ${workspaceId} for user ${userId}`
-          : `Created ${workspaceMode} workspace ${workspaceId} with initial workflow ${workflowId} for user ${userId}`
-      )
-    })
-  } catch (error) {
-    logger.error(`Failed to create workspace ${workspaceId}:`, error)
-    throw error
-  }
+  const record = await createWorkspaceRecord({
+    userId,
+    name,
+    skipDefaultWorkflow,
+    explicitColor,
+    organizationId,
+    workspaceMode,
+    billedAccountUserId,
+  })
 
   try {
     PlatformEvents.workspaceCreated({
-      workspaceId,
+      workspaceId: record.id,
       userId,
       name,
     })
@@ -389,16 +315,7 @@ async function createWorkspace({
       : CONTACT_OWNER_TO_UPGRADE_REASON
 
   return {
-    id: workspaceId,
-    name,
-    color,
-    ownerId: userId,
-    organizationId,
-    workspaceMode,
-    billedAccountUserId,
-    allowPersonalApiKeys: true,
-    createdAt: now,
-    updatedAt: now,
+    ...record,
     role: 'owner',
     permissions: 'admin',
     inviteMembersEnabled: invitePolicy.allowed,

apps/sim/lib/workspaces/create.test.ts

@@ -0,0 +1,122 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockTransaction, mockSaveWorkflowToNormalizedTables } = vi.hoisted(() => ({
+  mockTransaction: vi.fn(),
+  mockSaveWorkflowToNormalizedTables: vi.fn(),
+}))
+
+vi.mock('@sim/db', () => ({
+  db: {
+    transaction: mockTransaction,
+  },
+}))
+
+vi.mock('@/lib/workflows/defaults', () => ({
+  buildDefaultWorkflowArtifacts: () => ({ workflowState: { blocks: {}, edges: [] } }),
+}))
+
+vi.mock('@/lib/workflows/persistence/utils', () => ({
+  saveWorkflowToNormalizedTables: (...args: unknown[]) =>
+    mockSaveWorkflowToNormalizedTables(...args),
+}))
+
+vi.mock('@/lib/workspaces/colors', () => ({
+  getRandomWorkspaceColor: () => '#123456',
+}))
+
+import { createWorkspaceRecord } from './create'
+
+function createTx() {
+  return {
+    insert: vi.fn().mockImplementation(() => ({
+      values: vi.fn().mockResolvedValue([]),
+    })),
+  }
+}
+
+describe('createWorkspaceRecord', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('opens its own transaction when no executor is provided', async () => {
+    const tx = createTx()
+    mockTransaction.mockImplementation(async (callback: (trx: typeof tx) => Promise<void>) =>
+      callback(tx)
+    )
+
+    const record = await createWorkspaceRecord({
+      userId: 'user-1',
+      name: 'My Workspace',
+      organizationId: null,
+      workspaceMode: 'personal',
+      billedAccountUserId: 'user-1',
+    })
+
+    expect(mockTransaction).toHaveBeenCalledTimes(1)
+    expect(record.name).toBe('My Workspace')
+    expect(record.ownerId).toBe('user-1')
+    expect(record.workspaceMode).toBe('personal')
+    // workspace insert, permission insert, workflow insert (default workflow not skipped)
+    expect(tx.insert).toHaveBeenCalledTimes(3)
+    expect(mockSaveWorkflowToNormalizedTables).toHaveBeenCalledTimes(1)
+  })
+
+  it('runs directly against a provided executor instead of opening a nested transaction', async () => {
+    const tx = createTx()
+
+    await createWorkspaceRecord({
+      userId: 'user-1',
+      name: 'My Workspace',
+      organizationId: null,
+      workspaceMode: 'personal',
+      billedAccountUserId: 'user-1',
+      executor: tx as never,
+    })
+
+    expect(mockTransaction).not.toHaveBeenCalled()
+    expect(tx.insert).toHaveBeenCalledTimes(3)
+  })
+
+  it('skips the default workflow insert when skipDefaultWorkflow is set', async () => {
+    const tx = createTx()
+
+    await createWorkspaceRecord({
+      userId: 'user-1',
+      name: 'My Workspace',
+      organizationId: null,
+      workspaceMode: 'personal',
+      billedAccountUserId: 'user-1',
+      skipDefaultWorkflow: true,
+      executor: tx as never,
+    })
+
+    // workspace insert, permission insert — no workflow insert
+    expect(tx.insert).toHaveBeenCalledTimes(2)
+    expect(mockSaveWorkflowToNormalizedTables).not.toHaveBeenCalled()
+  })
+
+  it('adds a second admin permission row for the billed account when it differs from the owner in org mode', async () => {
+    const tx = createTx()
+
+    await createWorkspaceRecord({
+      userId: 'user-1',
+      name: 'Org Workspace',
+      organizationId: 'org-1',
+      workspaceMode: 'organization',
+      billedAccountUserId: 'user-billing',
+      executor: tx as never,
+    })
+
+    const permissionValuesCall = tx.insert.mock.results[1].value.values as ReturnType<typeof vi.fn>
+    const insertedPermissionRows = permissionValuesCall.mock.calls[0][0]
+    expect(insertedPermissionRows).toHaveLength(2)
+    expect(insertedPermissionRows.map((row: { userId: string }) => row.userId)).toEqual([
+      'user-1',
+      'user-billing',
+    ])
+  })
+})