Merge bounded authority barrier and replay review fixes

Author: mzxchandra

apps/sim/lib/projects/account-deletion.ts

@@ -3,11 +3,8 @@ import { member, permissions, project, workspace } from '@sim/db/schema'
 import { ORG_ADMIN_ROLES } from '@sim/platform-authz/workspace'
 import { and, asc, eq, inArray, ne, or, sql } from 'drizzle-orm'
 import type { DbOrTx, DbTransaction } from '@/lib/db/types'
-import {
-  lockProjectBackfillWrites,
-  lockProjects,
-  ProjectConflictError,
-} from '@/lib/projects/membership'
+import { ProjectConflictError } from '@/lib/projects/errors'
+import { lockProjectBackfillWrites, lockProjects } from '@/lib/projects/membership'
 
 /** Two indexed lookups; an `OR` around a membership subquery would scan every Project. */
 async function loadRelatedProjects(executor: DbOrTx, userId: string, doomedWorkspaceIds: string[]) {

apps/sim/lib/projects/errors.ts

@@ -0,0 +1,9 @@
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+
+/** A Project lifecycle rule or lock refused the change; callers may map it to their own error. */
+export class ProjectConflictError extends OrchestrationError {
+  constructor(message: string) {
+    super('conflict', message)
+    this.name = 'ProjectConflictError'
+  }
+}

apps/sim/lib/projects/membership.ts

@@ -3,7 +3,6 @@ import { getPostgresErrorCode } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
 import { compareStrings, truncateAtCodePoint } from '@sim/utils/string'
 import { and, asc, eq, inArray, isNull, notInArray, type SQL, sql } from 'drizzle-orm'
-import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   acquireAdvisoryXactLock,
   acquireAdvisoryXactLocks,
@@ -12,17 +11,10 @@ import {
 import { textArrayLiteral } from '@/lib/db/arrays'
 import type { DbTransaction } from '@/lib/db/types'
 import { acquirePermissionGroupOrgLock } from '@/lib/permission-groups/locks'
+import { ProjectConflictError } from '@/lib/projects/errors'
 
 const PROJECT_LOCK_TIMEOUT_MS = 5_000
 
-/** A Project lifecycle rule or lock refused the change; callers may map it to their own error. */
-export class ProjectConflictError extends OrchestrationError {
-  constructor(message: string) {
-    super('conflict', message)
-    this.name = 'ProjectConflictError'
-  }
-}
-
 /**
  * Waits in `acquire` are bounded by {@link PROJECT_LOCK_TIMEOUT_MS} and a timeout or
  * deadlock becomes a retryable Project conflict. The caller's own `lock_timeout` is

apps/sim/lib/workspaces/admin-move.ts

@@ -41,7 +41,8 @@ import type { DbOrTx } from '@/lib/db/types'
 import { getInvitationById, isInvitationExpired } from '@/lib/invitations/core'
 import { acquireInvitationMutationLocks } from '@/lib/invitations/locks'
 import { PENDING_INVITATION_UNIQUE_INDEX, sendInvitationEmail } from '@/lib/invitations/send'
-import { ProjectConflictError, transferWorkspaceProjects } from '@/lib/projects/membership'
+import { ProjectConflictError } from '@/lib/projects/errors'
+import { transferWorkspaceProjects } from '@/lib/projects/membership'
 import { invalidateWorkspaceTableLimitsCache } from '@/lib/table/billing'
 import { deleteCustomBlock } from '@/lib/workflows/custom-blocks/operations'
 import { MIGRATED_INVITATION_EMAIL_EVENT_TYPE } from '@/lib/workspaces/admin-move-event'