feat(tables): per-table mutation locks (schema/insert/update/delete)

apps/sim/app/api/table/[tableId]/columns/route.ts

@@ -19,7 +19,13 @@ import {
  updateColumnType,
 } from '@/lib/table'
 import { columnMatchesRef } from '@/lib/table/column-keys'
-import { accessError, checkAccess, normalizeColumn, rootErrorMessage } from '@/app/api/table/utils'
+import {
+ accessError,
+ checkAccess,
+ normalizeColumn,
+ rootErrorMessage,
+ tableLockErrorResponse,
+} from '@/app/api/table/utils'
 
 const logger = createLogger('TableColumnsAPI')
 
@@ -61,6 +67,8 @@ export const POST = withRouteHandler(async (request: NextRequest, context: Colum
  },
  })
  } catch (error) {
+ const lockError = tableLockErrorResponse(error)
+ if (lockError) return lockError
  if (isZodError(error)) {
  return validationErrorResponse(error, 'Invalid request data')
  }
@@ -190,6 +198,8 @@ export const PATCH = withRouteHandler(async (request: NextRequest, context: Colu
  },
  })
  } catch (error) {
+ const lockError = tableLockErrorResponse(error)
+ if (lockError) return lockError
  if (isZodError(error)) {
  return validationErrorResponse(error, 'Invalid request data')
  }
@@ -255,6 +265,8 @@ export const DELETE = withRouteHandler(
  },
  })
  } catch (error) {
+ const lockError = tableLockErrorResponse(error)
+ if (lockError) return lockError
  if (isZodError(error)) {
  return validationErrorResponse(error, 'Invalid request data')
  }

apps/sim/app/api/table/[tableId]/delete-async/route.ts

@@ -10,6 +10,7 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { markTableDeleteFailed, runTableDelete } from '@/lib/table/delete-runner'
 import { markTableJobRunning, releaseJobClaim } from '@/lib/table/jobs/service'
+import { assertRowDelete } from '@/lib/table/mutation-locks'
 import type { TableDeleteJobPayload } from '@/lib/table/types'
 import { accessError, checkAccess, tableFilterError } from '@/app/api/table/utils'
 
@@ -55,6 +56,11 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
  return NextResponse.json({ error: 'Cannot delete from an archived table' }, { status: 400 })
  }
 
+ // Gate the delete lock at enqueue: an admitted job runs to completion, so the
+ // lock must be checked before the job is created (the worker is a trusted
+ // continuation and does not re-check).
+ assertRowDelete(table)
+
  // Validate the filter up front so the caller gets immediate feedback (the worker reuses it).
  const filterError = tableFilterError(filter, table.schema.columns)
  if (filterError) return filterError

apps/sim/app/api/table/[tableId]/groups/route.ts

@@ -15,7 +15,12 @@ import {
  deleteWorkflowGroup,
  updateWorkflowGroup,
 } from '@/lib/table/workflow-groups/service'
-import { accessError, checkAccess, normalizeColumn } from '@/app/api/table/utils'
+import {
+ accessError,
+ checkAccess,
+ normalizeColumn,
+ tableLockErrorResponse,
+} from '@/app/api/table/utils'
 
 const logger = createLogger('TableWorkflowGroupsAPI')
 
@@ -47,6 +52,8 @@ async function validateWorkflowInWorkspace(
  * share this mapper instead of repeating the if-chain three times.
  */
 function mapWorkflowGroupError(error: unknown, fallbackMessage: string): NextResponse {
+ const lockError = tableLockErrorResponse(error)
+ if (lockError) return lockError
  if (error instanceof Error) {
  const msg = error.message
  if (msg === 'Table not found' || msg.includes('not found')) {

apps/sim/app/api/table/[tableId]/import-async/route.ts

@@ -10,6 +10,7 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { runTableImport, type TableImportPayload } from '@/lib/table/import-runner'
 import { markTableJobRunning, releaseJobClaim } from '@/lib/table/jobs/service'
+import { assertRowDelete, assertRowInsert, assertSchemaMutable } from '@/lib/table/mutation-locks'
 import { getUserSettings } from '@/lib/users/queries'
 import { accessError, checkAccess } from '@/app/api/table/utils'
 
@@ -53,6 +54,12 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
  return NextResponse.json({ error: 'Cannot import into an archived table' }, { status: 400 })
  }
 
+ // Gate the locks before claiming the single write-job slot, so a locked table
+ // reports 423 here instead of holding the slot and failing inside the worker.
+ assertRowInsert(table)
+ if (mode === 'replace') assertRowDelete(table)
+ if (createColumns && createColumns.length > 0) assertSchemaMutable(table)
+
  const ext = fileName.split('.').pop()?.toLowerCase()
  if (ext !== 'csv' && ext !== 'tsv') {
  return NextResponse.json({ error: 'Only CSV and TSV files are supported' }, { status: 400 })

apps/sim/app/api/table/[tableId]/import/route.test.ts

@@ -31,13 +31,18 @@ vi.mock('@sim/utils/id', () => ({
 
 vi.mock('@/app/api/table/utils', async () => {
  const { NextResponse } = await import('next/server')
+ const { TableLockedError } = await import('@/lib/table/mutation-locks')
  return {
  checkAccess: mockCheckAccess,
  accessError: (result: { status: number }) => {
  const message = result.status === 404 ? 'Table not found' : 'Access denied'
  return NextResponse.json({ error: message }, { status: result.status })
  },
  csvProxyBodyCapResponse: () => null,
+ tableLockErrorResponse: (error: unknown) =>
+ error instanceof TableLockedError
+ ? NextResponse.json({ error: error.message, lock: error.lock }, { status: 423 })
+ : null,
  multipartErrorResponse: (error: { code: string; message: string }) =>
  NextResponse.json(
  { error: error.message },
@@ -74,6 +79,7 @@ vi.mock('@/lib/table/billing', () => ({
  limit >= 0 && current + added > limit,
 }))
 
+import { TableLockedError } from '@/lib/table/mutation-locks'
 import { POST } from '@/app/api/table/[tableId]/import/route'
 
 function createCsvFile(contents: string, name = 'data.csv', type = 'text/csv'): File {
@@ -377,6 +383,21 @@ describe('POST /api/table/[tableId]/import', () => {
  expect(data.data?.insertedCount).toBe(0)
  })
 
+ it('maps a lock violation from importAppendRows to 423, not 500', async () => {
+ // The append branch returns instead of rethrowing, so it must map the lock
+ // error itself — the outer catch's mapper never sees it.
+ mockImportAppendRows.mockRejectedValueOnce(new TableLockedError('insert'))
+ const response = await callPost(
+ createFormData(createCsvFile('name,age\nAlice,30'), { mode: 'append' })
+ )
+ expect(response.status).toBe(423)
+ const data = await response.json()
+ expect(data.lock).toBe('insert')
+ // A `details` array would make the client treat it as a validation error
+ // and swallow the toast.
+ expect(data.details).toBeUndefined()
+ })
+
  it('accepts TSV files', async () => {
  const response = await callPost(
  createFormData(

apps/sim/app/api/table/[tableId]/import/route.ts

@@ -44,6 +44,7 @@ import {
  checkAccess,
  csvProxyBodyCapResponse,
  multipartErrorResponse,
+ tableLockErrorResponse,
 } from '@/app/api/table/utils'
 
 const logger = createLogger('TableImportCSVExisting')
@@ -336,6 +337,12 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
  },
  })
  } catch (err) {
+ // This branch returns rather than rethrowing, so the outer catch's
+ // mapper is unreachable from here — map the lock error first or a 423
+ // degrades into a generic 500 (replace mode rethrows and maps fine).
+ const lockError = tableLockErrorResponse(err)
+ if (lockError) return lockError
+
  const message = toError(err).message
  logger.warn(`[${requestId}] Append failed for table ${tableId}`, {
  total: coerced.length,
@@ -408,6 +415,8 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
  throw err
  }
  } catch (error) {
+ const lockError = tableLockErrorResponse(error)
+ if (lockError) return lockError
  if (isMultipartError(error)) return multipartErrorResponse(error)
 
  const message = toError(error).message

apps/sim/app/api/table/[tableId]/route.ts

@@ -1,15 +1,29 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
-import { getTableQuerySchema, renameTableContract } from '@/lib/api/contracts/tables'
+import { getTableQuerySchema, updateTableContract } from '@/lib/api/contracts/tables'
 import { isZodError, parseRequest, validationErrorResponse } from '@/lib/api/server/validation'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
+import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { captureServerEvent } from '@/lib/posthog/server'
-import { deleteTable, renameTable, TableConflictError, type TableSchema } from '@/lib/table'
+import {
+ deleteTable,
+ getTableById,
+ renameTable,
+ TableConflictError,
+ type TableSchema,
+ updateTableLocks,
+} from '@/lib/table'
 import { getWorkspaceTableLimits } from '@/lib/table/billing'
-import { accessError, checkAccess, normalizeColumn } from '@/app/api/table/utils'
+import { TABLE_LOCK_FLAGS, TABLE_LOCK_KINDS } from '@/lib/table/types'
+import {
+ accessError,
+ checkAccess,
+ normalizeColumn,
+ tableLockErrorResponse,
+} from '@/app/api/table/utils'
 
 const logger = createLogger('TableDetailAPI')
 
@@ -65,6 +79,7 @@ export const GET = withRouteHandler(async (request: NextRequest, { params }: Tab
  metadata: table.metadata ?? null,
  rowCount: table.rowCount,
  maxRows: maxRowsPerTable,
+ locks: table.locks,
  createdAt:
  table.createdAt instanceof Date
  ? table.createdAt.toISOString()
@@ -104,7 +119,7 @@ export const PATCH = withRouteHandler(
  }
 
  const parsed = await parseRequest(
-renameTableContract,
+updateTableContract,
  request,
  { params },
  {
@@ -116,6 +131,8 @@ export const PATCH = withRouteHandler(
  const { tableId } = parsed.data.params
  const validated = parsed.data.body
 
+ // `write` is the floor for either operation; a `locks` change additionally
+ // requires `admin` (checked below), matching the workflow-lock precedent.
  const result = await checkAccess(tableId, authResult.userId, 'write')
  if (!result.ok) return accessError(result, requestId, tableId)
 
@@ -125,20 +142,56 @@ export const PATCH = withRouteHandler(
  return NextResponse.json({ error: 'Invalid workspace ID' }, { status: 400 })
  }
 
- const updated = await renameTable(tableId, validated.name, requestId, authResult.userId)
+ if (validated.locks !== undefined) {
+ // With the flag off you may still CLEAR locks — otherwise flipping the
+ // kill switch would strand an already-locked table with no way to
+ // unlock it, while enforcement of those stored locks keeps running.
+ // Only a lock actually transitioning off→on needs the feature enabled;
+ // comparing against the stored state (rather than "every value is
+ // false") is what lets the settings UI, which always submits the full
+ // four-flag draft, clear one lock while another stays on.
+ const enablesALock = TABLE_LOCK_KINDS.some((kind) => {
+ const flag = TABLE_LOCK_FLAGS[kind]
+ return validated.locks?.[flag] === true && !table.locks[flag]
+ })
+ if (enablesALock && !(await isFeatureEnabled('table-locks'))) {
+ return NextResponse.json({ error: 'Table locks are not enabled' }, { status: 403 })
+ }
+ const adminResult = await checkAccess(tableId, authResult.userId, 'admin')
+ if (!adminResult.ok) {
+ return NextResponse.json(
+ { error: 'Admin access required to change table locks' },
+ { status: 403 }
+ )
+ }
+ await updateTableLocks(tableId, validated.locks, authResult.userId, requestId)
+ }
+
+ if (validated.name !== undefined) {
+ await renameTable(tableId, validated.name, requestId, authResult.userId)
+ }
+
+ // Re-read so the response reflects both a rename and a lock change.
+ const updated = await getTableById(tableId)
+ if (!updated) {
+ return NextResponse.json({ error: 'Table not found' }, { status: 404 })
+ }
 
  return NextResponse.json({
  success: true,
  data: { table: updated },
  })
  } catch (error) {
+ const lockError = tableLockErrorResponse(error)
+ if (lockError) return lockError
+
  if (error instanceof TableConflictError) {
  return NextResponse.json({ error: error.message }, { status: 409 })
  }
 
- logger.error(`[${requestId}] Error renaming table:`, error)
+ logger.error(`[${requestId}] Error updating table:`, error)
  return NextResponse.json(
- { error: getErrorMessage(error, 'Failed to rename table') },
+ { error: getErrorMessage(error, 'Failed to update table') },
  { status: 500 }
  )
  }
@@ -188,6 +241,8 @@ export const DELETE = withRouteHandler(
  },
  })
  } catch (error) {
+ const lockError = tableLockErrorResponse(error)
+ if (lockError) return lockError
  if (isZodError(error)) {
  return validationErrorResponse(error)
  }

apps/sim/app/api/table/[tableId]/rows/[rowId]/route.ts

@@ -21,6 +21,7 @@ import {
  checkAccess,
  rootErrorMessage,
  rowWriteErrorResponse,
+ tableLockErrorResponse,
 } from '@/app/api/table/utils'
 
 const logger = createLogger('TableRowAPI')
@@ -211,7 +212,7 @@ export const DELETE = withRouteHandler(async (request: NextRequest, context: Row
  return NextResponse.json({ error: 'Invalid workspace ID' }, { status: 400 })
  }
 
- await deleteRow(tableId, rowId, validated.workspaceId, requestId)
+ await deleteRow(table, rowId, requestId)
 
  return NextResponse.json({
  success: true,
@@ -221,6 +222,9 @@ export const DELETE = withRouteHandler(async (request: NextRequest, context: Row
  },
  })
  } catch (error) {
+ const lockError = tableLockErrorResponse(error)
+ if (lockError) return lockError
+
  const errorMessage = toError(error).message
 
  if (errorMessage === 'Row not found') {

apps/sim/app/api/table/[tableId]/rows/route.ts

@@ -433,6 +433,7 @@ export const DELETE = withRouteHandler(
 
  if (validated.rowIds) {
  const result = await deleteRowsByIds(
+ table,
  { tableId, rowIds: validated.rowIds, workspaceId: validated.workspaceId },
  requestId
  )

apps/sim/app/api/table/route.ts

@@ -127,6 +127,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
  },
  rowCount: table.rowCount,
  maxRows: table.maxRows,
+ locks: table.locks,
  createdAt:
  table.createdAt instanceof Date
  ? table.createdAt.toISOString()
@@ -206,6 +207,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
  },
  rowCount: t.rowCount,
  maxRows: t.maxRows,
+ locks: t.locks,
  workspaceId: t.workspaceId,
  createdBy: t.createdBy,
  createdAt: t.createdAt instanceof Date ? t.createdAt.toISOString() : String(t.createdAt),