feat(tables): per-table mutation locks (schema/insert/update/delete)

apps/sim/app/api/table/[tableId]/columns/route.ts

@@ -19,7 +19,13 @@ import {
   updateColumnType,
 } from '@/lib/table'
 import { columnMatchesRef } from '@/lib/table/column-keys'
-import { accessError, checkAccess, normalizeColumn, rootErrorMessage } from '@/app/api/table/utils'
+import {
+  accessError,
+  checkAccess,
+  normalizeColumn,
+  rootErrorMessage,
+  tableLockErrorResponse,
+} from '@/app/api/table/utils'
 
 const logger = createLogger('TableColumnsAPI')
 
@@ -61,6 +67,8 @@ export const POST = withRouteHandler(async (request: NextRequest, context: Colum
       },
     })
   } catch (error) {
+    const lockError = tableLockErrorResponse(error)
+    if (lockError) return lockError
     if (isZodError(error)) {
       return validationErrorResponse(error, 'Invalid request data')
     }
@@ -190,6 +198,8 @@ export const PATCH = withRouteHandler(async (request: NextRequest, context: Colu
       },
     })
   } catch (error) {
+    const lockError = tableLockErrorResponse(error)
+    if (lockError) return lockError
     if (isZodError(error)) {
       return validationErrorResponse(error, 'Invalid request data')
     }
@@ -255,6 +265,8 @@ export const DELETE = withRouteHandler(
         },
       })
     } catch (error) {
+      const lockError = tableLockErrorResponse(error)
+      if (lockError) return lockError
       if (isZodError(error)) {
         return validationErrorResponse(error, 'Invalid request data')
       }

apps/sim/app/api/table/[tableId]/delete-async/route.ts

@@ -10,6 +10,7 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { markTableDeleteFailed, runTableDelete } from '@/lib/table/delete-runner'
 import { markTableJobRunning, releaseJobClaim } from '@/lib/table/jobs/service'
+import { assertRowDelete } from '@/lib/table/mutation-locks'
 import type { TableDeleteJobPayload } from '@/lib/table/types'
 import { accessError, checkAccess, tableFilterError } from '@/app/api/table/utils'
 
@@ -55,6 +56,11 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
     return NextResponse.json({ error: 'Cannot delete from an archived table' }, { status: 400 })
   }
 
+  // Gate the delete lock at enqueue: an admitted job runs to completion, so the
+  // lock must be checked before the job is created (the worker is a trusted
+  // continuation and does not re-check).
+  assertRowDelete(table)
+
   // Validate the filter up front so the caller gets immediate feedback (the worker reuses it).
   const filterError = tableFilterError(filter, table.schema.columns)
   if (filterError) return filterError

apps/sim/app/api/table/[tableId]/groups/route.ts

@@ -15,7 +15,12 @@ import {
   deleteWorkflowGroup,
   updateWorkflowGroup,
 } from '@/lib/table/workflow-groups/service'
-import { accessError, checkAccess, normalizeColumn } from '@/app/api/table/utils'
+import {
+  accessError,
+  checkAccess,
+  normalizeColumn,
+  tableLockErrorResponse,
+} from '@/app/api/table/utils'
 
 const logger = createLogger('TableWorkflowGroupsAPI')
 
@@ -47,6 +52,8 @@ async function validateWorkflowInWorkspace(
  * share this mapper instead of repeating the if-chain three times.
  */
 function mapWorkflowGroupError(error: unknown, fallbackMessage: string): NextResponse {
+  const lockError = tableLockErrorResponse(error)
+  if (lockError) return lockError
   if (error instanceof Error) {
     const msg = error.message
     if (msg === 'Table not found' || msg.includes('not found')) {

apps/sim/app/api/table/[tableId]/import-async/route.ts

@@ -10,6 +10,7 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { runTableImport, type TableImportPayload } from '@/lib/table/import-runner'
 import { markTableJobRunning, releaseJobClaim } from '@/lib/table/jobs/service'
+import { assertRowDelete, assertRowInsert, assertSchemaMutable } from '@/lib/table/mutation-locks'
 import { getUserSettings } from '@/lib/users/queries'
 import { accessError, checkAccess } from '@/app/api/table/utils'
 
@@ -53,6 +54,12 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
     return NextResponse.json({ error: 'Cannot import into an archived table' }, { status: 400 })
   }
 
+  // Gate the locks before claiming the single write-job slot, so a locked table
+  // reports 423 here instead of holding the slot and failing inside the worker.
+  assertRowInsert(table)
+  if (mode === 'replace') assertRowDelete(table)
+  if (createColumns && createColumns.length > 0) assertSchemaMutable(table)
+
   const ext = fileName.split('.').pop()?.toLowerCase()
   if (ext !== 'csv' && ext !== 'tsv') {
     return NextResponse.json({ error: 'Only CSV and TSV files are supported' }, { status: 400 })

apps/sim/app/api/table/[tableId]/import/route.test.ts

@@ -31,13 +31,18 @@ vi.mock('@sim/utils/id', () => ({
 
 vi.mock('@/app/api/table/utils', async () => {
   const { NextResponse } = await import('next/server')
+  const { TableLockedError } = await import('@/lib/table/mutation-locks')
   return {
     checkAccess: mockCheckAccess,
     accessError: (result: { status: number }) => {
       const message = result.status === 404 ? 'Table not found' : 'Access denied'
       return NextResponse.json({ error: message }, { status: result.status })
     },
     csvProxyBodyCapResponse: () => null,
+    tableLockErrorResponse: (error: unknown) =>
+      error instanceof TableLockedError
+        ? NextResponse.json({ error: error.message, lock: error.lock }, { status: 423 })
+        : null,
     multipartErrorResponse: (error: { code: string; message: string }) =>
       NextResponse.json(
         { error: error.message },
@@ -74,6 +79,7 @@ vi.mock('@/lib/table/billing', () => ({
     limit >= 0 && current + added > limit,
 }))
 
+import { TableLockedError } from '@/lib/table/mutation-locks'
 import { POST } from '@/app/api/table/[tableId]/import/route'
 
 function createCsvFile(contents: string, name = 'data.csv', type = 'text/csv'): File {
@@ -377,6 +383,21 @@ describe('POST /api/table/[tableId]/import', () => {
     expect(data.data?.insertedCount).toBe(0)
   })
 
+  it('maps a lock violation from importAppendRows to 423, not 500', async () => {
+    // The append branch returns instead of rethrowing, so it must map the lock
+    // error itself — the outer catch's mapper never sees it.
+    mockImportAppendRows.mockRejectedValueOnce(new TableLockedError('insert'))
+    const response = await callPost(
+      createFormData(createCsvFile('name,age\nAlice,30'), { mode: 'append' })
+    )
+    expect(response.status).toBe(423)
+    const data = await response.json()
+    expect(data.lock).toBe('insert')
+    // A `details` array would make the client treat it as a validation error
+    // and swallow the toast.
+    expect(data.details).toBeUndefined()
+  })
+
   it('accepts TSV files', async () => {
     const response = await callPost(
       createFormData(

apps/sim/app/api/table/[tableId]/import/route.ts

@@ -44,6 +44,7 @@ import {
   checkAccess,
   csvProxyBodyCapResponse,
   multipartErrorResponse,
+  tableLockErrorResponse,
 } from '@/app/api/table/utils'
 
 const logger = createLogger('TableImportCSVExisting')
@@ -336,6 +337,12 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
           },
         })
       } catch (err) {
+        // This branch returns rather than rethrowing, so the outer catch's
+        // mapper is unreachable from here — map the lock error first or a 423
+        // degrades into a generic 500 (replace mode rethrows and maps fine).
+        const lockError = tableLockErrorResponse(err)
+        if (lockError) return lockError
+
         const message = toError(err).message
         logger.warn(`[${requestId}] Append failed for table ${tableId}`, {
           total: coerced.length,
@@ -408,6 +415,8 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
       throw err
     }
   } catch (error) {
+    const lockError = tableLockErrorResponse(error)
+    if (lockError) return lockError
     if (isMultipartError(error)) return multipartErrorResponse(error)
 
     const message = toError(error).message

apps/sim/app/api/table/[tableId]/route.ts

@@ -1,15 +1,29 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
-import { getTableQuerySchema, renameTableContract } from '@/lib/api/contracts/tables'
+import { getTableQuerySchema, updateTableContract } from '@/lib/api/contracts/tables'
 import { isZodError, parseRequest, validationErrorResponse } from '@/lib/api/server/validation'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
+import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { captureServerEvent } from '@/lib/posthog/server'
-import { deleteTable, renameTable, TableConflictError, type TableSchema } from '@/lib/table'
+import {
+  deleteTable,
+  getTableById,
+  renameTable,
+  TableConflictError,
+  type TableSchema,
+  updateTableLocks,
+} from '@/lib/table'
 import { getWorkspaceTableLimits } from '@/lib/table/billing'
-import { accessError, checkAccess, normalizeColumn } from '@/app/api/table/utils'
+import { TABLE_LOCK_FLAGS, TABLE_LOCK_KINDS } from '@/lib/table/types'
+import {
+  accessError,
+  checkAccess,
+  normalizeColumn,
+  tableLockErrorResponse,
+} from '@/app/api/table/utils'
 
 const logger = createLogger('TableDetailAPI')
 
@@ -65,6 +79,7 @@ export const GET = withRouteHandler(async (request: NextRequest, { params }: Tab
           metadata: table.metadata ?? null,
           rowCount: table.rowCount,
           maxRows: maxRowsPerTable,
+          locks: table.locks,
           createdAt:
             table.createdAt instanceof Date
               ? table.createdAt.toISOString()
@@ -104,7 +119,7 @@ export const PATCH = withRouteHandler(
       }
 
       const parsed = await parseRequest(
-        renameTableContract,
+        updateTableContract,
         request,
         { params },
         {
@@ -116,6 +131,8 @@ export const PATCH = withRouteHandler(
       const { tableId } = parsed.data.params
       const validated = parsed.data.body
 
+      // `write` is the floor for either operation; a `locks` change additionally
+      // requires `admin` (checked below), matching the workflow-lock precedent.
       const result = await checkAccess(tableId, authResult.userId, 'write')
       if (!result.ok) return accessError(result, requestId, tableId)
 
@@ -125,20 +142,56 @@ export const PATCH = withRouteHandler(
         return NextResponse.json({ error: 'Invalid workspace ID' }, { status: 400 })
       }
 
-      const updated = await renameTable(tableId, validated.name, requestId, authResult.userId)
+      if (validated.locks !== undefined) {
+        // With the flag off you may still CLEAR locks — otherwise flipping the
+        // kill switch would strand an already-locked table with no way to
+        // unlock it, while enforcement of those stored locks keeps running.
+        // Only a lock actually transitioning off→on needs the feature enabled;
+        // comparing against the stored state (rather than "every value is
+        // false") is what lets the settings UI, which always submits the full
+        // four-flag draft, clear one lock while another stays on.
+        const enablesALock = TABLE_LOCK_KINDS.some((kind) => {
+          const flag = TABLE_LOCK_FLAGS[kind]
+          return validated.locks?.[flag] === true && !table.locks[flag]
+        })
+        if (enablesALock && !(await isFeatureEnabled('table-locks'))) {
+          return NextResponse.json({ error: 'Table locks are not enabled' }, { status: 403 })
+        }
+        const adminResult = await checkAccess(tableId, authResult.userId, 'admin')
+        if (!adminResult.ok) {
+          return NextResponse.json(
+            { error: 'Admin access required to change table locks' },
+            { status: 403 }
+          )
+        }
+        await updateTableLocks(tableId, validated.locks, authResult.userId, requestId)
+      }
+
+      if (validated.name !== undefined) {
+        await renameTable(tableId, validated.name, requestId, authResult.userId)
+      }
+
+      // Re-read so the response reflects both a rename and a lock change.
+      const updated = await getTableById(tableId)
+      if (!updated) {
+        return NextResponse.json({ error: 'Table not found' }, { status: 404 })
+      }
 
       return NextResponse.json({
         success: true,
         data: { table: updated },
       })
     } catch (error) {
+      const lockError = tableLockErrorResponse(error)
+      if (lockError) return lockError
+
       if (error instanceof TableConflictError) {
         return NextResponse.json({ error: error.message }, { status: 409 })
       }
 
-      logger.error(`[${requestId}] Error renaming table:`, error)
+      logger.error(`[${requestId}] Error updating table:`, error)
       return NextResponse.json(
-        { error: getErrorMessage(error, 'Failed to rename table') },
+        { error: getErrorMessage(error, 'Failed to update table') },
         { status: 500 }
       )
     }
@@ -188,6 +241,8 @@ export const DELETE = withRouteHandler(
         },
       })
     } catch (error) {
+      const lockError = tableLockErrorResponse(error)
+      if (lockError) return lockError
       if (isZodError(error)) {
         return validationErrorResponse(error)
       }

apps/sim/app/api/table/[tableId]/rows/[rowId]/route.ts

@@ -21,6 +21,7 @@ import {
   checkAccess,
   rootErrorMessage,
   rowWriteErrorResponse,
+  tableLockErrorResponse,
 } from '@/app/api/table/utils'
 
 const logger = createLogger('TableRowAPI')
@@ -211,7 +212,7 @@ export const DELETE = withRouteHandler(async (request: NextRequest, context: Row
       return NextResponse.json({ error: 'Invalid workspace ID' }, { status: 400 })
     }
 
-    await deleteRow(tableId, rowId, validated.workspaceId, requestId)
+    await deleteRow(table, rowId, requestId)
 
     return NextResponse.json({
       success: true,
@@ -221,6 +222,9 @@ export const DELETE = withRouteHandler(async (request: NextRequest, context: Row
       },
     })
   } catch (error) {
+    const lockError = tableLockErrorResponse(error)
+    if (lockError) return lockError
+
     const errorMessage = toError(error).message
 
     if (errorMessage === 'Row not found') {

apps/sim/app/api/table/[tableId]/rows/route.ts

@@ -433,6 +433,7 @@ export const DELETE = withRouteHandler(
 
       if (validated.rowIds) {
         const result = await deleteRowsByIds(
+          table,
           { tableId, rowIds: validated.rowIds, workspaceId: validated.workspaceId },
           requestId
         )

apps/sim/app/api/table/route.ts

@@ -127,6 +127,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           },
           rowCount: table.rowCount,
           maxRows: table.maxRows,
+          locks: table.locks,
           createdAt:
             table.createdAt instanceof Date
               ? table.createdAt.toISOString()
@@ -206,6 +207,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
         },
         rowCount: t.rowCount,
         maxRows: t.maxRows,
+        locks: t.locks,
         workspaceId: t.workspaceId,
         createdBy: t.createdBy,
         createdAt: t.createdAt instanceof Date ? t.createdAt.toISOString() : String(t.createdAt),