fix(auth): end the session on account deletion and refuse a deleted owner

Deleting an account removes the user and session rows, but the signed cookie
cache keeps authenticating that browser for up to five minutes. The settings
page then clears the query cache concurrently with signing out, every mounted
query refetches, and the workspace list finds nothing and tries to create a
default workspace for a user who no longer exists. The insert fails on the
`workspace` -> `user` foreign key and surfaces as an unhandled 500 on roughly
half of all deletions.

The deletion response now clears the session cookies itself, so no later
request from that browser carries them. The route builder keeps each cleared
cookie on its own header line. Workspace creation classifies a user foreign
key violation as `WorkspaceOwnerMissingError`, which both workspace routes
answer with 401 instead of a logged fault.

Author: waleedlatif1

apps/sim/app/api/users/me/deletion/route.test.ts

@@ -0,0 +1,81 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  defineInternalJsonRoute: vi.fn(() => vi.fn()),
+  signOut: vi.fn(),
+}))
+
+vi.mock('@/lib/api/server/routes', () => ({
+  defineInternalJsonRoute: mocks.defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy: { project: vi.fn(), unhandled: vi.fn() },
+  internalRateLimits: { none: vi.fn(() => ({ kind: 'none' })) },
+  internalSessionAuth: { authenticate: vi.fn() },
+}))
+
+vi.mock('@/lib/auth', () => ({
+  auth: { api: { signOut: mocks.signOut } },
+  getSession: vi.fn(),
+}))
+
+vi.mock('@/lib/users/application/delete-account', () => ({
+  deleteAccountUseCase: { execute: vi.fn() },
+  previewAccountDeletionUseCase: { execute: vi.fn() },
+}))
+
+vi.mock('@/lib/users/application/operations', () => ({
+  userAccountOperations: { delete: { id: 'user.delete' }, previewDeletion: { id: 'user.preview' } },
+}))
+
+import '@/app/api/users/me/deletion/route'
+
+type RouteOptions = {
+  finalizeResponse?: (args: { request: Request }) => Promise<{ headers?: HeadersInit }>
+}
+
+/** Captured at import time; the route registers itself once when the module loads. */
+const routeOptions = mocks.defineInternalJsonRoute.mock.calls.map((call) => call[0] as RouteOptions)
+
+describe('POST /api/users/me/deletion', () => {
+  beforeEach(() => {
+    mocks.signOut.mockReset()
+  })
+
+  /**
+   * The session row is deleted with the account, but the signed cookie cache
+   * still authenticates the browser for its TTL; the response must clear it.
+   */
+  it('clears the session cookies on the deletion response', async () => {
+    const options = routeOptions.find(
+      (candidate) => typeof candidate.finalizeResponse === 'function'
+    )
+    expect(options?.finalizeResponse).toBeDefined()
+
+    const cleared = new Headers([['set-cookie', 'better-auth.session_token=; Max-Age=0']])
+    mocks.signOut.mockResolvedValue({ headers: cleared, response: { success: true } })
+    const request = new Request('http://localhost/api/users/me/deletion', {
+      method: 'POST',
+      headers: { cookie: 'better-auth.session_token=abc' },
+    })
+
+    const finalization = await options!.finalizeResponse!({ request })
+
+    expect(mocks.signOut).toHaveBeenCalledWith({ headers: request.headers, returnHeaders: true })
+    expect(finalization.headers).toBe(cleared)
+  })
+
+  it('never fails a completed deletion because the cookies could not be cleared', async () => {
+    const options = routeOptions.find(
+      (candidate) => typeof candidate.finalizeResponse === 'function'
+    )
+    mocks.signOut.mockRejectedValue(new Error('sign-out unavailable'))
+
+    await expect(
+      options!.finalizeResponse!({
+        request: new Request('http://localhost/api/users/me/deletion', { method: 'POST' }),
+      })
+    ).resolves.toEqual({})
+  })
+})

apps/sim/app/api/users/me/deletion/route.ts

@@ -1,16 +1,20 @@
+import { createLogger } from '@sim/logger'
 import { deleteAccountContract, getAccountDeletionPlanContract } from '@/lib/api/contracts'
 import {
   defineInternalJsonRoute,
   internalOrchestrationErrorPolicy,
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
+import { auth } from '@/lib/auth'
 import {
   deleteAccountUseCase,
   previewAccountDeletionUseCase,
 } from '@/lib/users/application/delete-account'
 import { userAccountOperations } from '@/lib/users/application/operations'
 
+const logger = createLogger('AccountDeletionRoute')
+
 export const dynamic = 'force-dynamic'
 
 export const GET = defineInternalJsonRoute({
@@ -39,4 +43,19 @@ export const POST = defineInternalJsonRoute({
   mapInput: ({ body }) => ({ confirmEmail: body.confirmEmail }),
   useCase: deleteAccountUseCase,
   present: () => ({ success: true as const }),
+  /**
+   * The session row is gone, but the signed cookie cache authenticates this
+   * browser for up to five more minutes. Clear the cookies on the deletion
+   * response itself so nothing the page does afterwards can carry them.
+   */
+  finalizeResponse: async ({ request }) => {
+    try {
+      const { headers } = await auth.api.signOut({ headers: request.headers, returnHeaders: true })
+      return { headers }
+    } catch (error) {
+      /** The account is gone either way; the client's own sign-out and full reload still drop the cookie. */
+      logger.warn('Could not clear session cookies after account deletion', { error })
+      return {}
+    }
+  },
 })

apps/sim/app/api/workspaces/route.test.ts

@@ -47,15 +47,21 @@ vi.mock('@sim/audit', () => ({
 vi.mock('@/lib/workspaces/policy', async () => {
   class WorkspaceCreationCapabilityWithheldError extends Error {}
   class WorkspaceCreationContextChangedError extends Error {}
+  class WorkspaceOwnerMissingError extends Error {}
   return {
     getWorkspaceCreationPolicy: mockGetWorkspaceCreationPolicy,
     WorkspaceCreationCapabilityWithheldError,
     WorkspaceCreationContextChangedError,
+    WorkspaceOwnerMissingError,
   }
 })
 
-import { WorkspaceCreationCapabilityWithheldError } from '@/lib/workspaces/policy'
-import { POST } from '@/app/api/workspaces/route'
+import { listWorkspacesForViewer } from '@/lib/workspaces/list'
+import {
+  WorkspaceCreationCapabilityWithheldError,
+  WorkspaceOwnerMissingError,
+} from '@/lib/workspaces/policy'
+import { GET, POST } from '@/app/api/workspaces/route'
 
 function createRequest() {
   return createMockRequest('POST', { name: 'New workspace' })
@@ -116,4 +122,27 @@ describe('POST /api/workspaces capability refusal', () => {
     expect(body.error).toBe('Your organization subscription is inactive.')
     expect(body.details).toBeUndefined()
   })
+
+  /**
+   * After account deletion the browser's cached session cookie stays valid for
+   * a few minutes, and the next list load finds no workspaces and tries to
+   * create the default one for a user who no longer exists.
+   */
+  it('answers a default-workspace insert for a deleted user with 401', async () => {
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1', name: 'Gone' } })
+    vi.mocked(listWorkspacesForViewer).mockResolvedValue({
+      workspaces: [],
+      lastActiveWorkspaceId: null,
+      pinnedWorkspaceIds: [],
+      creationPolicy: { canCreate: true, organizationId: null, billedAccountUserId: 'user-1' },
+    } as never)
+    mockCreateWorkspace.mockRejectedValue(new WorkspaceOwnerMissingError('user-1'))
+
+    const response = await GET(
+      createMockRequest('GET', undefined, undefined, 'http://localhost/api/workspaces?scope=active')
+    )
+
+    expect(response.status).toBe(401)
+    await expect(response.json()).resolves.toEqual({ error: 'Unauthorized' })
+  })
 })

apps/sim/app/api/workspaces/route.ts

@@ -19,6 +19,7 @@ import {
   getWorkspaceCreationPolicy,
   WorkspaceCreationCapabilityWithheldError,
   WorkspaceCreationContextChangedError,
+  WorkspaceOwnerMissingError,
 } from '@/lib/workspaces/policy'
 
 const logger = createLogger('Workspaces')
@@ -87,6 +88,10 @@ export const GET = withRouteHandler(async (request: Request) => {
         })
         return NextResponse.json(refreshedPayload)
       }
+      /** A cached session cookie outlived the account it belongs to. */
+      if (error instanceof WorkspaceOwnerMissingError) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+      }
       throw error
     }
 
@@ -207,6 +212,10 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
         { status: 409 }
       )
     }
+    /** A cached session cookie outlived the account it belongs to. */
+    if (error instanceof WorkspaceOwnerMissingError) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
     /**
      * A lock timeout is contention, not a fault: creation serializes on the
      * organization's mutation locks and now also on `permission_group:<org>`,

apps/sim/lib/api/server/routes/internal-json-route.test.ts

@@ -492,6 +492,37 @@ describe('defineInternalJsonRoute', () => {
     })
   })
 
+  it('keeps every cookie a finalizer clears on its own header line', async () => {
+    const handler = defineInternalJsonRoute({
+      contract,
+      auth,
+      operation,
+      rateLimit: internalRateLimits.none({ reason: 'Unit test' }),
+      errorPolicy: internalOrchestrationErrorPolicy,
+      mapInput: () => undefined,
+      useCase: {
+        operation,
+        async execute() {
+          return { value: 'ok' }
+        },
+      },
+      finalizeResponse: () => ({
+        headers: new Headers([
+          ['set-cookie', 'session_token=; Max-Age=0; Path=/'],
+          ['set-cookie', 'session_data=; Max-Age=0; Path=/'],
+        ]),
+      }),
+    })
+
+    const response = await handler(new NextRequest('http://localhost/api/test/internal-json-route'))
+
+    expect(response.status).toBe(200)
+    expect(response.headers.getSetCookie()).toEqual([
+      'session_token=; Max-Age=0; Path=/',
+      'session_data=; Max-Age=0; Path=/',
+    ])
+  })
+
   it('selects a declared success status from the application result', async () => {
     const replayableContract = defineRouteContract({
       method: 'POST',

apps/sim/lib/api/server/routes/internal-json-route.ts

@@ -327,6 +327,11 @@ function appendFinalizedHeaders(base: HeadersInit | undefined, additions?: Heade
   const headers = new Headers(base)
   if (!additions) return headers
   new Headers(additions).forEach((value, key) => {
+    /** A finalizer may clear several cookies at once; each needs its own header line. */
+    if (key === 'set-cookie') {
+      headers.append(key, value)
+      return
+    }
     if (headers.has(key)) {
       throw new Error(`Internal JSON response finalizer cannot replace header "${key}"`)
     }

apps/sim/lib/workspaces/create.test.ts

@@ -47,7 +47,7 @@ import {
   createDefaultPersonalWorkspaceInTransaction,
   createWorkspace,
 } from '@/lib/workspaces/create'
-import { WORKSPACE_MODE } from '@/lib/workspaces/policy'
+import { WORKSPACE_MODE, WorkspaceOwnerMissingError } from '@/lib/workspaces/policy'
 
 const params = {
   userId: 'creator-1',
@@ -127,6 +127,34 @@ describe('createWorkspace capability-gate placement', () => {
     })
   })
 
+  /**
+   * A cached session cookie can outlive the user row by a few minutes. The
+   * insert then fails on a `workspace` -> `user` foreign key, which the caller
+   * must be able to tell apart from a fault so it answers 401, not 500.
+   */
+  it('reports a missing owner as a typed error instead of a fault', async () => {
+    mockResolveGoverningPermissionGroupOrganization.mockResolvedValue('org-1')
+    dbChainMockFns.transaction.mockRejectedValue(
+      Object.assign(new Error('insert or update on table "workspace" violates foreign key'), {
+        code: '23503',
+        constraint_name: 'workspace_billed_account_user_id_user_id_fk',
+      })
+    )
+
+    await expect(createWorkspace(params)).rejects.toBeInstanceOf(WorkspaceOwnerMissingError)
+  })
+
+  it('rethrows other foreign key violations untouched', async () => {
+    mockResolveGoverningPermissionGroupOrganization.mockResolvedValue('org-1')
+    const failure = Object.assign(new Error('violates foreign key'), {
+      code: '23503',
+      constraint_name: 'workspace_organization_id_organization_id_fk',
+    })
+    dbChainMockFns.transaction.mockRejectedValue(failure)
+
+    await expect(createWorkspace(params)).rejects.toBe(failure)
+  })
+
   /**
    * The preflight policy resolved this value microseconds earlier in the same
    * request, and React's `cache()` memo does not span the two calls, so a

apps/sim/lib/workspaces/create.ts

@@ -1,6 +1,7 @@
 import { db } from '@sim/db'
 import { permissions, type WorkspaceMode, workflow, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
+import { getPostgresConstraintName, getPostgresErrorCode } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
 import { PlatformEvents } from '@/lib/core/telemetry'
 import type { DbOrTx } from '@/lib/db/types'
@@ -12,8 +13,15 @@ import {
   resolveGoverningPermissionGroupOrganization,
   resolveInviteFlags,
   WORKSPACE_MODE,
+  WorkspaceOwnerMissingError,
 } from '@/lib/workspaces/policy'
 
+/** Foreign keys from `workspace` to `user`; a violation means the acting user's row is gone. */
+const WORKSPACE_USER_FK_CONSTRAINTS = new Set([
+  'workspace_owner_id_user_id_fk',
+  'workspace_billed_account_user_id_user_id_fk',
+])
+
 const logger = createLogger('WorkspaceCreate')
 
 export interface CreateWorkspaceParams {
@@ -208,6 +216,13 @@ export async function createWorkspace(params: CreateWorkspaceParams) {
       createWorkspaceInTransaction(tx, { ...params, governingPermissionGroupOrganizationId })
     )
   } catch (error) {
+    if (
+      getPostgresErrorCode(error) === '23503' &&
+      WORKSPACE_USER_FK_CONSTRAINTS.has(getPostgresConstraintName(error) ?? '')
+    ) {
+      logger.warn('Workspace creation raced account deletion', { userId: params.userId })
+      throw new WorkspaceOwnerMissingError(params.userId)
+    }
     logger.error('Failed to create workspace', { userId: params.userId, error })
     throw error
   }

apps/sim/lib/workspaces/policy.ts

@@ -111,6 +111,18 @@ export interface WorkspaceCreationPolicy {
   blockedReasonCode?: 'organization-subscription-inactive' | 'permission-group-denied'
 }
 
+/**
+ * The acting user's row is gone, so no workspace can reference it. Reached
+ * when a request still carrying a cached session cookie arrives after the
+ * account was deleted; the caller should answer as unauthenticated.
+ */
+export class WorkspaceOwnerMissingError extends Error {
+  constructor(userId: string) {
+    super(`User ${userId} no longer exists`)
+    this.name = 'WorkspaceOwnerMissingError'
+  }
+}
+
 export class WorkspaceCreationContextChangedError extends Error {
   constructor(message = 'Workspace creation context changed before the workspace was inserted') {
     super(message)