fix(tables): refuse to delete a table's last saved view

The sibling check and the delete share the views advisory lock, so
racing deletes cannot drop a live table to zero views and regress it to
the legacy "All"-only state. Views of a hard-deleted table are removed
by the FK cascade, which this guard never sees.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: j15z

apps/sim/app/api/table/[tableId]/views/[viewId]/route.ts

@@ -99,6 +99,9 @@ export const DELETE = withRouteHandler(
 
       return NextResponse.json({ success: true, data: { deleted: true } })
     } catch (error) {
+      if (error instanceof TableViewValidationError) {
+        return NextResponse.json({ error: error.message }, { status: 400 })
+      }
       logger.error(`[${requestId}] Error deleting table view:`, error)
       return NextResponse.json({ error: 'Failed to delete view' }, { status: 500 })
     }

apps/sim/lib/table/application/views.ts

@@ -180,9 +180,13 @@ export const deleteTableViewUseCase = defineAuthorizedTableUseCase({
       context.workspaceId
     )
     if (!existing) throw new OrchestrationError('not_found', 'View not found')
-    const deleted = await deleteTableView(input.viewId, context.table.id, context.workspaceId)
-    if (!deleted) throw new OrchestrationError('not_found', 'View not found')
-    return { viewId: input.viewId, viewName: existing.name, table: context.table }
+    try {
+      const deleted = await deleteTableView(input.viewId, context.table.id, context.workspaceId)
+      if (!deleted) throw new OrchestrationError('not_found', 'View not found')
+      return { viewId: input.viewId, viewName: existing.name, table: context.table }
+    } catch (error) {
+      rethrowViewError(error)
+    }
   },
   projectAudit({ result }) {
     return {

apps/sim/lib/table/views/service.test.ts

@@ -227,6 +227,7 @@ describe('table-view mutations signal collaborators', () => {
   })
 
   it('deleteTableView signals when a row was actually deleted', async () => {
+    queueTableRows(tableViews, [{ id: 'view-1' }, { id: 'view-2' }]) // the in-lock sibling check
     dbChainMockFns.returning.mockResolvedValueOnce([{ id: 'view-1' }])
 
     const deleted = await deleteTableView('view-1', 'table-1')
@@ -237,11 +238,22 @@ describe('table-view mutations signal collaborators', () => {
   })
 
   it('deleteTableView does NOT signal when nothing was deleted', async () => {
-    dbChainMockFns.returning.mockResolvedValueOnce([])
+    queueTableRows(tableViews, [{ id: 'view-1' }])
 
     const deleted = await deleteTableView('missing', 'table-1')
 
     expect(deleted).toBe(false)
+    expect(dbChainMockFns.delete).not.toHaveBeenCalled()
+    expect(mockSignalTableViewsChanged).not.toHaveBeenCalled()
+  })
+
+  it('deleteTableView refuses to delete the last remaining view', async () => {
+    queueTableRows(tableViews, [{ id: 'view-1' }])
+
+    await expect(deleteTableView('view-1', 'table-1')).rejects.toThrow(
+      'A table must keep at least one saved view'
+    )
+    expect(dbChainMockFns.delete).not.toHaveBeenCalled()
     expect(mockSignalTableViewsChanged).not.toHaveBeenCalled()
   })
 })

apps/sim/lib/table/views/service.ts

@@ -621,27 +621,50 @@ export async function updateTableView(data: UpdateTableViewData): Promise<TableV
   return toTableView(outcome.row, data.columns)
 }
 
-/** Deleting the default simply leaves the table on "All". */
+/**
+ * Deleting the default while siblings remain simply leaves the table on "All".
+ * The last remaining view is not deletable: a table that has views keeps at
+ * least one, so it can never regress to the legacy zero-view state. Views of a
+ * hard-deleted table are removed by the FK cascade, never through this path.
+ * The sibling check and the delete share the views lock, so two racing deletes
+ * cannot both observe a sibling and drop the table to zero.
+ */
 export async function deleteTableView(
   viewId: string,
   tableId: string,
   workspaceId?: string
 ): Promise<boolean> {
-  const deleted = await db
-    .delete(tableViews)
-    .where(
-      and(
-        eq(tableViews.id, viewId),
-        eq(tableViews.tableId, tableId),
-        workspaceId ? eq(tableViews.workspaceId, workspaceId) : undefined
+  const deleted = await withTableViewsLock(tableId, async (trx) => {
+    const siblings = await trx
+      .select({ id: tableViews.id })
+      .from(tableViews)
+      .where(
+        and(
+          eq(tableViews.tableId, tableId),
+          workspaceId ? eq(tableViews.workspaceId, workspaceId) : undefined
+        )
       )
-    )
-    .returning({ id: tableViews.id })
+    if (!siblings.some((view) => view.id === viewId)) return false
+    if (siblings.length === 1) {
+      throw new TableViewValidationError('A table must keep at least one saved view')
+    }
+    const result = await trx
+      .delete(tableViews)
+      .where(
+        and(
+          eq(tableViews.id, viewId),
+          eq(tableViews.tableId, tableId),
+          workspaceId ? eq(tableViews.workspaceId, workspaceId) : undefined
+        )
+      )
+      .returning({ id: tableViews.id })
+    return result.length > 0
+  })
 
-  if (deleted.length > 0) {
+  if (deleted) {
     logger.info('Deleted table view', { tableId, viewId })
     // Only signal a real deletion — a missing view (nothing deleted) changed nothing.
     signalTableViewsChanged(tableId)
   }
-  return deleted.length > 0
+  return deleted
 }