fix(observability): tag org-scoped audit metadata with organizationId, guard concurrent table delete

waleedlatif1 · waleedlatif1 · commit 409676e43daa · 2026-07-08T20:17:49.000-07:00
The org-scoped self-service audit-log endpoint matches org-level rows via
metadata.organizationId (or resourceType=organization). Six recordAudit
call sites (subscription create/cancel, admin credit issuance, threshold
overage billing, charge disputes, credit purchase, invoice payment
succeeded/failed) tagged org-scoped events with a differently-named key
(referenceId/entityId/targetOrgId), making them invisible to org admins
querying their own audit trail despite being stored in the DB. Add the
missing organizationId key everywhere the pattern was missed.

Also guard deleteTable's archive UPDATE with isNull(archivedAt) so a
concurrent duplicate delete request is a no-op instead of re-archiving
and re-firing a duplicate TABLE_DELETED audit row.

Adds test coverage for the ORG_MEMBER_ADDED audit/analytics emission in
acceptInvitation, which previously had none.
diff --git a/apps/sim/app/api/v1/admin/credits/route.ts b/apps/sim/app/api/v1/admin/credits/route.ts
@@ -219,7 +219,9 @@ export const POST = withRouteHandler(
         description: `Admin API issued $${Number(amount).toFixed(2)} credits to ${entityType} ${entityId}`,
         metadata: {
           targetUserId: resolvedUserId,
-          ...(entityType === 'organization' ? { targetOrgId: entityId } : {}),
+          ...(entityType === 'organization'
+            ? { targetOrgId: entityId, organizationId: entityId }
+            : {}),
           entityType,
           amount,
           currency: 'usd',
diff --git a/apps/sim/lib/billing/threshold-billing.ts b/apps/sim/lib/billing/threshold-billing.ts
@@ -612,6 +612,7 @@ async function checkAndBillOrganizationOverageThreshold(organizationId: string):
         metadata: {
           entityType: 'organization',
           referenceId: organizationId,
+          organizationId,
           plan: orgSubscription.plan,
           amount,
           currency: 'usd',
diff --git a/apps/sim/lib/billing/webhooks/disputes.ts b/apps/sim/lib/billing/webhooks/disputes.ts
@@ -56,6 +56,7 @@ function recordDisputeInstrumentation(
     metadata: {
       entityType: entity.type,
       entityId: entity.id,
+      ...(entity.type === 'organization' ? { organizationId: entity.id } : {}),
       customerId,
       amount,
       currency: dispute.currency,
diff --git a/apps/sim/lib/billing/webhooks/invoices.ts b/apps/sim/lib/billing/webhooks/invoices.ts
@@ -750,6 +750,7 @@ async function handleCreditPurchaseSuccess(invoice: Stripe.Invoice): Promise<voi
       metadata: {
         entityType,
         entityId,
+        ...(entityType === 'organization' ? { organizationId: entityId } : {}),
         amount,
         currency: 'usd',
         purchasedBy: purchasedBy ?? null,
@@ -928,6 +929,7 @@ export async function handleInvoicePaymentSucceeded(event: Stripe.Event) {
           metadata: {
             entityType,
             referenceId: sub.referenceId,
+            ...(entityType === 'organization' ? { organizationId: sub.referenceId } : {}),
             plan: sub.plan,
             amount: amountPaid,
             currency: invoice.currency ?? 'usd',
@@ -1009,6 +1011,7 @@ export async function handleInvoicePaymentFailed(event: Stripe.Event) {
             metadata: {
               entityType: failureEntityType,
               referenceId: sub.referenceId,
+              ...(failureEntityType === 'organization' ? { organizationId: sub.referenceId } : {}),
               plan: sub.plan,
               amount: failedAmount,
               currency: invoice.currency ?? 'usd',
diff --git a/apps/sim/lib/billing/webhooks/subscription.ts b/apps/sim/lib/billing/webhooks/subscription.ts
@@ -286,6 +286,9 @@ export async function handleSubscriptionCreated(
 
         if (wasFreePreviously && isPaidPlan) {
           const actorId = await resolveSubscriptionActorId(subscriptionData.referenceId)
+          const isOrgScoped = await isSubscriptionOrgScoped({
+            referenceId: subscriptionData.referenceId,
+          })
           recordAudit({
             actorId,
             action: AuditAction.SUBSCRIPTION_CREATED,
@@ -296,6 +299,7 @@ export async function handleSubscriptionCreated(
               plan: subscriptionData.plan,
               status: subscriptionData.status,
               referenceId: subscriptionData.referenceId,
+              ...(isOrgScoped ? { organizationId: subscriptionData.referenceId } : {}),
             },
           })
           captureServerEvent(subscriptionData.referenceId, 'subscription_created', {
@@ -386,6 +390,7 @@ export async function handleSubscriptionDeleted(
             metadata: {
               plan: subscription.plan,
               referenceId: subscription.referenceId,
+              organizationId: subscription.referenceId,
               kind: 'enterprise',
             },
           })
@@ -488,7 +493,8 @@ export async function handleSubscriptionDeleted(
         let membersSynced = 0
         let workspacesDetached = 0
 
-        if (await isSubscriptionOrgScoped(subscription)) {
+        const isOrgScoped = await isSubscriptionOrgScoped(subscription)
+        if (isOrgScoped) {
           const dormantResult = await transitionOrganizationToDormantState(
             subscription.referenceId,
             subscription.id
@@ -522,6 +528,7 @@ export async function handleSubscriptionDeleted(
             plan: subscription.plan,
             referenceId: subscription.referenceId,
             totalOverage,
+            ...(isOrgScoped ? { organizationId: subscription.referenceId } : {}),
           },
         })
         captureServerEvent(subscription.referenceId, 'subscription_cancelled', {
diff --git a/apps/sim/lib/invitations/core.test.ts b/apps/sim/lib/invitations/core.test.ts
@@ -1,7 +1,7 @@
 /**
  * @vitest-environment node
  */
-import { dbChainMock, dbChainMockFns, resetDbChainMock } from '@sim/testing'
+import { auditMock, dbChainMock, dbChainMockFns, resetDbChainMock } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
@@ -72,6 +72,8 @@ vi.mock('@/lib/credentials/environment', () => ({
   syncWorkspaceEnvCredentials: mockSyncWorkspaceEnvCredentials,
 }))
 
+vi.mock('@sim/audit', () => auditMock)
+
 import { acceptInvitation } from '@/lib/invitations/core'
 
 function queueWhereResponses(responses: unknown[][]) {
@@ -319,6 +321,81 @@ describe('acceptInvitation', () => {
       actorId: 'invitee-user',
     })
     expect(mockSetActiveOrganizationForCurrentSession).toHaveBeenCalledWith('org-new')
+    expect(auditMock.recordAudit).toHaveBeenCalledWith(
+      expect.objectContaining({
+        actorId: 'invitee-user',
+        action: auditMock.AuditAction.ORG_MEMBER_ADDED,
+        resourceType: auditMock.AuditResourceType.ORGANIZATION,
+        resourceId: 'org-new',
+        metadata: expect.objectContaining({ invitationId: 'inv-1', memberRole: 'member' }),
+      })
+    )
+  })
+
+  it('does not record an ORG_MEMBER_ADDED audit for a user who is already a member', async () => {
+    mockGetWorkspaceWithOwner.mockResolvedValueOnce({
+      id: 'workspace-1',
+      name: 'Workspace',
+      ownerId: 'owner-1',
+      organizationId: 'org-1',
+      workspaceMode: 'organization',
+      billedAccountUserId: 'owner-1',
+    })
+    mockEnsureTeamOrganizationForAcceptance.mockResolvedValueOnce({
+      success: true,
+      organizationId: 'org-1',
+      fixedSeats: false,
+    })
+    mockEnsureUserInOrganization.mockResolvedValueOnce({
+      success: true,
+      alreadyMember: true,
+      billingActions: { proUsageSnapshotted: false, proCancelledAtPeriodEnd: false },
+    })
+
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'workspace',
+          email: 'invitee@example.com',
+          organizationId: 'org-1',
+          membershipIntent: 'internal',
+          inviterId: 'owner-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Acme' }],
+      [{ name: 'Owner', email: 'owner@example.com' }],
+      [{ id: 'member-1' }],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+    })
+
+    expect(result.success).toBe(true)
+    if (result.success) {
+      expect(result.membershipAlreadyExists).toBe(true)
+    }
+    expect(auditMock.recordAudit).not.toHaveBeenCalledWith(
+      expect.objectContaining({ action: auditMock.AuditAction.ORG_MEMBER_ADDED })
+    )
   })
 
   it('does not reconcile seats for an Enterprise organization (fixed seats)', async () => {
diff --git a/apps/sim/lib/table/service.ts b/apps/sim/lib/table/service.ts
@@ -653,7 +653,7 @@ export async function deleteTable(
   const result = await db
     .update(userTableDefinitions)
     .set({ archivedAt: now, updatedAt: now })
-    .where(eq(userTableDefinitions.id, tableId))
+    .where(and(eq(userTableDefinitions.id, tableId), isNull(userTableDefinitions.archivedAt)))
     .returning({
       createdBy: userTableDefinitions.createdBy,
       workspaceId: userTableDefinitions.workspaceId,
