fix(sim-links): hold the creator's membership while creating a link

Author: waleedlatif1

apps/sim/lib/core/application/organization-authorization.ts

@@ -47,6 +47,8 @@ export interface OrganizationMembershipContext extends OrganizationAuthorization
 export interface OrganizationAuthorizationOptions {
   executor?: DbOrTx
   forUpdate?: boolean
+  /** Holds the membership row until commit, so a concurrent removal waits for this write. */
+  forShare?: boolean
 }
 
 /** Rechecks routed organization membership; owning a workspace is irrelevant to this grant. */
@@ -83,7 +85,11 @@ export async function requireOrganizationSubjectMembership(
     .select({ role: member.role })
     .from(member)
     .where(and(eq(member.organizationId, organizationId), eq(member.userId, userId)))
-  const [membership] = options.forUpdate ? await query.for('update').limit(1) : await query.limit(1)
+  const [membership] = options.forUpdate
+    ? await query.for('update').limit(1)
+    : options.forShare
+      ? await query.for('share').limit(1)
+      : await query.limit(1)
   const parsedRole = organizationRoleSchema.safeParse(membership?.role)
   if (!parsedRole.success) throw new OrganizationMembershipNotFoundError()
   if (minimumRole === 'admin' && !isOrgAdminRole(parsedRole.data)) {

apps/sim/lib/sim-links/application/create-membership.integration.ts

@@ -0,0 +1,101 @@
+import { db } from '@sim/db'
+import { member, organization, simLink, user } from '@sim/db/schema'
+import { readTestDatabaseUrl } from '@sim/db/testing/test-infrastructure'
+import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
+import { createDeferred } from '@sim/testing/helpers/deferred'
+import { featureFlagsMock, featureFlagsMockFns } from '@sim/testing/mocks/feature-flags.mock'
+import { generateId } from '@sim/utils/id'
+import { eq, inArray } from 'drizzle-orm'
+import { afterAll, expect, it, vi } from 'vitest'
+import { removeUserFromOrganization } from '@/lib/billing/organizations/membership'
+import { createSimLink } from '@/lib/sim-links/application/use-cases'
+
+vi.mock('@/lib/core/config/feature-flags', () => featureFlagsMock)
+
+readTestDatabaseUrl()
+
+const ownerId = generateId()
+const creatorId = generateId()
+const organizationId = generateId()
+const creatorMemberId = generateId()
+
+afterAll(async () => {
+  await db.delete(organization).where(eq(organization.id, organizationId))
+  await db.delete(user).where(inArray(user.id, [ownerId, creatorId]))
+})
+
+it('refuses a link whose creator is removed after authorization but before the insert', async () => {
+  await db.insert(user).values(
+    [ownerId, creatorId].map((id) => ({
+      id,
+      name: 'Sim link fixture',
+      email: `${id}@example.test`,
+      emailVerified: true,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    }))
+  )
+  await db.insert(organization).values({
+    id: organizationId,
+    name: 'Sim link organization',
+    slug: organizationId,
+    createdAt: new Date(),
+  })
+  await db.insert(member).values([
+    { id: generateId(), organizationId, userId: ownerId, role: 'owner', createdAt: new Date() },
+    {
+      id: creatorMemberId,
+      organizationId,
+      userId: creatorId,
+      role: 'member',
+      createdAt: new Date(),
+    },
+  ])
+
+  const authorized = createDeferred<void>()
+  const proceed = createDeferred<void>()
+  featureFlagsMockFns.mockIsFeatureEnabled.mockImplementation(async (flag) => {
+    if (flag !== 'sim-links') return false
+    authorized.resolve()
+    await proceed.promise
+    return true
+  })
+
+  const creation = createSimLink.execute({
+    principal: createSessionPrincipal({ userId: creatorId }),
+    input: {
+      organizationId,
+      name: 'handbook',
+      url: 'https://example.test/handbook',
+      defaultUrl: null,
+      description: null,
+      unlisted: true,
+      restrictEdit: true,
+    },
+  })
+  const settled = creation.then(
+    () => null,
+    (error: unknown) => error
+  )
+  await authorized.promise
+  expect(
+    (
+      await removeUserFromOrganization({
+        organizationId,
+        userId: creatorId,
+        memberId: creatorMemberId,
+        skipBillingLogic: true,
+        onError: 'throw',
+      })
+    ).success
+  ).toBe(true)
+  proceed.resolve()
+
+  expect(await settled).toMatchObject({ message: 'Organization not found' })
+  expect(
+    await db
+      .select({ id: simLink.id })
+      .from(simLink)
+      .where(eq(simLink.organizationId, organizationId))
+  ).toEqual([])
+})

apps/sim/lib/sim-links/application/use-cases.ts

@@ -9,7 +9,10 @@ import {
   type OrganizationUseCaseContext,
 } from '@/lib/core/application/authorized-organization-use-case'
 import type { WorkspaceUseCaseAuditEntry } from '@/lib/core/application/authorized-workspace-use-case'
-import type { OrganizationMembershipContext } from '@/lib/core/application/organization-authorization'
+import {
+  type OrganizationMembershipContext,
+  requireOrganizationSubjectMembership,
+} from '@/lib/core/application/organization-authorization'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { defineAuthorizedCredentialUserUseCase } from '@/lib/credentials/application/authorized-user-use-case'
 import type { DbTransaction } from '@/lib/db/types'
@@ -170,6 +173,18 @@ export const createSimLink = defineAuthorizedOrganizationUseCase({
     const { organizationId, ...fields } = input
     return withUniqueName(organizationId, fields.name, () =>
       db.transaction(async (tx) => {
+        /** A removal deletes this row before handing off the member's links, so it waits for this insert. */
+        await requireOrganizationSubjectMembership(
+          context.userId,
+          organizationId,
+          'member',
+          'none',
+          undefined,
+          {
+            executor: tx,
+            forShare: true,
+          }
+        )
         const linkId = await repository.insertSimLink(tx, organizationId, context.userId, fields)
         return readView(tx, organizationId, linkId, viewerOf(context))
       })