fix(workspaces): fix critical regression from the opt-in flag refactor

The previous commit's `if (!options.provisionFallbackForStrandedMembers) { return [] }`
returned from the ENTIRE transaction callback, not just the stranded-member
check — silently skipping every archival write (workspace.archivedAt,
apiKey deletion, mcpServers, workflowSchedule, etc.) whenever the flag
wasn't set. That's every caller except the interactive DELETE route,
including the ban flow: banning a user would report `{ archived: true }`
while leaving the workspace and all its resources fully live.

Also moves the audit-log call for auto-provisioned fallback workspaces
outside the transaction. recordAudit is fire-and-forget and doesn't
participate in the transaction, so recording it before the transaction
commits could leave a phantom audit entry pointing at a fallback
workspace that got rolled back (e.g. on a serialization failure).

Added a test asserting archival writes still run when the flag is off
(the exact gap that let the regression through undetected), and a test
proving no audit entry is recorded when the transaction subsequently
fails.

Both caught by Greptile review before merge.

Author: waleedlatif1

apps/sim/lib/workspaces/lifecycle.test.ts

@@ -206,6 +206,37 @@ describe('workspace lifecycle', () => {
     expect(auditMockFns.mockRecordAudit).not.toHaveBeenCalled()
   })
 
+  it('does not record an audit entry for a fallback workspace whose transaction subsequently fails', async () => {
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Workspace 1',
+      ownerId: 'user-1',
+      archivedAt: null,
+    })
+    mockListAccessibleWorkspaceRowsForUser.mockResolvedValue([
+      accessibleWorkspaceRow('workspace-1'),
+    ])
+
+    const tx = createTx([{ userId: 'user-victim' }])
+    mockTransaction.mockImplementation(async (callback: (trx: typeof tx) => Promise<void>) => {
+      await callback(tx)
+      throw new Error('serialization_failure')
+    })
+
+    await expect(
+      archiveWorkspace('workspace-1', {
+        requestId: 'req-1',
+        provisionFallbackForStrandedMembers: true,
+        actorId: 'admin-1',
+      })
+    ).rejects.toThrow('serialization_failure')
+
+    // recordAudit must only ever be called after the transaction has committed — otherwise a
+    // failed transaction (e.g. a serialization abort) would leave a phantom audit entry pointing
+    // at a fallback workspace that was rolled back.
+    expect(auditMockFns.mockRecordAudit).not.toHaveBeenCalled()
+  })
+
   it('only provisions a fallback for the one member who would actually be stranded', async () => {
     mockGetWorkspaceWithOwner.mockResolvedValue({
       id: 'workspace-1',
@@ -327,6 +358,11 @@ describe('workspace lifecycle', () => {
     expect(mockListAccessibleWorkspaceRowsForUser).not.toHaveBeenCalled()
     expect(mockCreateWorkspaceRecord).not.toHaveBeenCalled()
     expect(mockTransaction).toHaveBeenCalledWith(expect.any(Function), undefined)
+    // The archival writes must still run even when fallback provisioning is skipped entirely —
+    // this is the exact regression a prior version of this fix introduced (an early return that
+    // skipped all archival writes whenever the flag was off).
+    expect(tx.update).toHaveBeenCalledTimes(8)
+    expect(tx.delete).toHaveBeenCalledTimes(1)
   })
 
   it('is idempotent for already archived workspaces', async () => {

apps/sim/lib/workspaces/lifecycle.ts

@@ -120,37 +120,23 @@ export async function archiveWorkspace(
     ? ({ isolationLevel: 'serializable' } as const)
     : undefined
 
-  const provisionedWorkspaceUserIds = await db.transaction(async (tx) => {
-    if (!options.provisionFallbackForStrandedMembers) {
-      return []
-    }
-
-    const strandedUserIds = await findMembersStrandedByArchival(tx, workspaceId)
-    for (const userId of strandedUserIds) {
-      // Intentionally bypasses getWorkspaceCreationPolicy: this is a system-provisioned safety
-      // net (never blocked by "who can create a workspace" rules), not user self-service.
-      const fallbackWorkspace = await createWorkspaceRecord({
-        userId,
-        name: FALLBACK_WORKSPACE_NAME,
-        organizationId: null,
-        workspaceMode: WORKSPACE_MODE.PERSONAL,
-        billedAccountUserId: userId,
-        executor: tx,
-      })
-
-      if (options.actorId) {
-        recordAudit({
-          workspaceId: fallbackWorkspace.id,
-          actorId: options.actorId,
-          actorName: options.actorName,
-          actorEmail: options.actorEmail,
-          action: AuditAction.WORKSPACE_CREATED,
-          resourceType: AuditResourceType.WORKSPACE,
-          resourceId: fallbackWorkspace.id,
-          resourceName: fallbackWorkspace.name,
-          description: `Auto-created replacement workspace "${fallbackWorkspace.name}" for a member left with no workspace after deleting "${workspaceRecord.name}"`,
-          metadata: { deletedWorkspaceId: workspaceId, recipientUserId: userId },
+  const provisionedFallbacks = await db.transaction(async (tx) => {
+    const fallbacks: Array<{ userId: string; workspaceId: string; name: string }> = []
+
+    if (options.provisionFallbackForStrandedMembers) {
+      const strandedUserIds = await findMembersStrandedByArchival(tx, workspaceId)
+      for (const userId of strandedUserIds) {
+        // Intentionally bypasses getWorkspaceCreationPolicy: this is a system-provisioned safety
+        // net (never blocked by "who can create a workspace" rules), not user self-service.
+        const fallbackWorkspace = await createWorkspaceRecord({
+          userId,
+          name: FALLBACK_WORKSPACE_NAME,
+          organizationId: null,
+          workspaceMode: WORKSPACE_MODE.PERSONAL,
+          billedAccountUserId: userId,
+          executor: tx,
         })
+        fallbacks.push({ userId, workspaceId: fallbackWorkspace.id, name: fallbackWorkspace.name })
       }
     }
 
@@ -276,9 +262,31 @@ export async function archiveWorkspace(
       })
       .where(and(eq(workspace.id, workspaceId), isNull(workspace.archivedAt)))
 
-    return strandedUserIds
+    return fallbacks
   }, transactionConfig)
 
+  // Recorded only after the transaction commits — recordAudit is fire-and-forget and doesn't
+  // participate in the transaction, so recording it earlier could leave a phantom audit entry
+  // pointing at a fallback workspace that got rolled back (e.g. on a serialization failure).
+  if (options.actorId) {
+    for (const fallback of provisionedFallbacks) {
+      recordAudit({
+        workspaceId: fallback.workspaceId,
+        actorId: options.actorId,
+        actorName: options.actorName,
+        actorEmail: options.actorEmail,
+        action: AuditAction.WORKSPACE_CREATED,
+        resourceType: AuditResourceType.WORKSPACE,
+        resourceId: fallback.workspaceId,
+        resourceName: fallback.name,
+        description: `Auto-created replacement workspace "${fallback.name}" for a member left with no workspace after deleting "${workspaceRecord.name}"`,
+        metadata: { deletedWorkspaceId: workspaceId, recipientUserId: fallback.userId },
+      })
+    }
+  }
+
+  const provisionedWorkspaceUserIds = provisionedFallbacks.map((fallback) => fallback.userId)
+
   await archiveWorkflowsForWorkspace(workspaceId, options)
 
   logger.info(`[${options.requestId}] Archived workspace ${workspaceId}`)