feat(chat): soft-delete sidebar chats with restore from Recently Deleted

apps/sim/app/api/copilot/chat/delete/route.ts

@@ -35,6 +35,16 @@ export const DELETE = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.json({ success: true })
     }
 
+    // Mothership (sidebar) chats are soft-deleted through their own route so
+    // they land in Recently Deleted — this legacy hard-delete must not bypass
+    // that.
+    if (chat.type === 'mothership') {
+      return NextResponse.json(
+        { success: false, error: 'Use the mothership chat delete endpoint' },
+        { status: 400 }
+      )
+    }
+
     const [deleted] = await db
       .delete(copilotChats)
       .where(and(eq(copilotChats.id, parsed.chatId), eq(copilotChats.userId, session.user.id)))

apps/sim/app/api/copilot/chat/queries.ts

@@ -3,7 +3,7 @@ import { copilotChats } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { authorizeWorkflowByWorkspacePermission } from '@sim/platform-authz/workflow'
 import { toError } from '@sim/utils/errors'
-import { and, desc, eq } from 'drizzle-orm'
+import { and, desc, eq, isNull } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { getLatestRunForStream } from '@/lib/copilot/async-runs/repository'
 import { buildEffectiveChatTranscript } from '@/lib/copilot/chat/effective-transcript'
@@ -189,7 +189,13 @@ export async function GET(req: NextRequest) {
         updatedAt: copilotChats.updatedAt,
       })
       .from(copilotChats)
-      .where(and(eq(copilotChats.userId, authenticatedUserId), scopeFilter))
+      .where(
+        and(
+          eq(copilotChats.userId, authenticatedUserId),
+          isNull(copilotChats.deletedAt),
+          scopeFilter
+        )
+      )
       .orderBy(desc(copilotChats.updatedAt))
 
     const scope = workflowId ? `workflow ${workflowId}` : `workspace ${workspaceId}`

apps/sim/app/api/copilot/chat/resources/route.ts

@@ -1,7 +1,7 @@
 import { db } from '@sim/db'
 import { copilotChats } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, eq, sql } from 'drizzle-orm'
+import { and, eq, isNull, sql } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import {
   addCopilotChatResourceContract,
@@ -64,7 +64,13 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
     const [chat] = await db
       .select({ resources: copilotChats.resources })
       .from(copilotChats)
-      .where(and(eq(copilotChats.id, chatId), eq(copilotChats.userId, userId)))
+      .where(
+        and(
+          eq(copilotChats.id, chatId),
+          eq(copilotChats.userId, userId),
+          isNull(copilotChats.deletedAt)
+        )
+      )
       .limit(1)
 
     if (!chat) {
@@ -91,7 +97,13 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
     await db
       .update(copilotChats)
       .set({ resources: sql`${JSON.stringify(merged)}::jsonb`, updatedAt: new Date() })
-      .where(and(eq(copilotChats.id, chatId), eq(copilotChats.userId, userId)))
+      .where(
+        and(
+          eq(copilotChats.id, chatId),
+          eq(copilotChats.userId, userId),
+          isNull(copilotChats.deletedAt)
+        )
+      )
 
     logger.info('Added resource to chat', { chatId, resource })
 
@@ -124,7 +136,13 @@ export const PATCH = withRouteHandler(async (req: NextRequest) => {
     const [chat] = await db
       .select({ resources: copilotChats.resources })
       .from(copilotChats)
-      .where(and(eq(copilotChats.id, chatId), eq(copilotChats.userId, userId)))
+      .where(
+        and(
+          eq(copilotChats.id, chatId),
+          eq(copilotChats.userId, userId),
+          isNull(copilotChats.deletedAt)
+        )
+      )
       .limit(1)
 
     if (!chat) {
@@ -142,7 +160,13 @@ export const PATCH = withRouteHandler(async (req: NextRequest) => {
     await db
       .update(copilotChats)
       .set({ resources: sql`${JSON.stringify(newOrder)}::jsonb`, updatedAt: new Date() })
-      .where(and(eq(copilotChats.id, chatId), eq(copilotChats.userId, userId)))
+      .where(
+        and(
+          eq(copilotChats.id, chatId),
+          eq(copilotChats.userId, userId),
+          isNull(copilotChats.deletedAt)
+        )
+      )
 
     logger.info('Reordered resources for chat', { chatId, count: newOrder.length })
 
@@ -182,7 +206,13 @@ export const DELETE = withRouteHandler(async (req: NextRequest) => {
         ), '[]'::jsonb)`,
         updatedAt: new Date(),
       })
-      .where(and(eq(copilotChats.id, chatId), eq(copilotChats.userId, userId)))
+      .where(
+        and(
+          eq(copilotChats.id, chatId),
+          eq(copilotChats.userId, userId),
+          isNull(copilotChats.deletedAt)
+        )
+      )
       .returning({ resources: copilotChats.resources })
 
     if (!updated) {

apps/sim/app/api/copilot/chat/update-messages/route.test.ts

@@ -46,6 +46,7 @@ vi.mock('@/lib/copilot/chat/messages-store', () => ({
 vi.mock('drizzle-orm', () => ({
   and: vi.fn((...conditions: unknown[]) => ({ conditions, type: 'and' })),
   eq: vi.fn((field: unknown, value: unknown) => ({ field, value, type: 'eq' })),
+  isNull: vi.fn((field: unknown) => ({ field, type: 'isNull' })),
 }))
 
 import { POST } from '@/app/api/copilot/chat/update-messages/route'

apps/sim/app/api/copilot/chats/route.ts

@@ -62,6 +62,7 @@ export const GET = withRouteHandler(async (_request: NextRequest) => {
       .where(
         and(
           eq(copilotChats.userId, userId),
+          isNull(copilotChats.deletedAt),
           or(
             and(isNull(copilotChats.workflowId), isNull(copilotChats.workspaceId)),
             inAccessibleWorkspace

apps/sim/app/api/mothership/chats/[chatId]/fork/route.test.ts

@@ -70,15 +70,18 @@ vi.mock('@sim/db/schema', () => ({
     previewYaml: 'copilotChats.previewYaml',
     planArtifact: 'copilotChats.planArtifact',
     config: 'copilotChats.config',
+    deletedAt: 'copilotChats.deletedAt',
   },
   workspaceFiles: {
     id: 'workspaceFiles.id',
   },
 }))
 
 vi.mock('drizzle-orm', () => ({
+  and: vi.fn((...conditions: unknown[]) => ({ type: 'and', conditions })),
   eq: vi.fn((field: unknown, value: unknown) => ({ type: 'eq', field, value })),
   inArray: vi.fn((field: unknown, values: unknown) => ({ type: 'inArray', field, values })),
+  isNull: vi.fn((field: unknown) => ({ type: 'isNull', field })),
 }))
 
 vi.mock('@/lib/copilot/resources/persistence', () => ({

apps/sim/app/api/mothership/chats/[chatId]/fork/route.ts

@@ -2,7 +2,7 @@ import { db } from '@sim/db'
 import { copilotChats, workspaceFiles } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
-import { eq, inArray } from 'drizzle-orm'
+import { and, eq, inArray, isNull } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { forkMothershipChatContract } from '@/lib/api/contracts/mothership-chats'
 import { parseRequest } from '@/lib/api/server'
@@ -84,7 +84,7 @@ export const POST = withRouteHandler(
           config: copilotChats.config,
         })
         .from(copilotChats)
-        .where(eq(copilotChats.id, chatId))
+        .where(and(eq(copilotChats.id, chatId), isNull(copilotChats.deletedAt)))
         .limit(1)
 
       if (!parent || parent.userId !== userId || parent.type !== 'mothership') {

apps/sim/app/api/mothership/chats/[chatId]/restore/route.test.ts

@@ -0,0 +1,163 @@
+/**
+ * @vitest-environment node
+ */
+import { copilotHttpMock, copilotHttpMockFns } from '@sim/testing'
+import { NextRequest } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  mockDbSelect,
+  mockSelectFrom,
+  mockSelectWhere,
+  mockSelectLimit,
+  mockDbUpdate,
+  mockDbSet,
+  mockUpdateWhere,
+  mockDbReturning,
+  mockAssertActiveWorkspaceAccess,
+  mockPublishStatusChanged,
+} = vi.hoisted(() => ({
+  mockDbSelect: vi.fn(),
+  mockSelectFrom: vi.fn(),
+  mockSelectWhere: vi.fn(),
+  mockSelectLimit: vi.fn(),
+  mockDbUpdate: vi.fn(),
+  mockDbSet: vi.fn(),
+  mockUpdateWhere: vi.fn(),
+  mockDbReturning: vi.fn(),
+  mockAssertActiveWorkspaceAccess: vi.fn(),
+  mockPublishStatusChanged: vi.fn(),
+}))
+
+vi.mock('@sim/db', () => ({
+  db: {
+    select: mockDbSelect,
+    update: mockDbUpdate,
+  },
+}))
+
+vi.mock('@sim/db/schema', () => ({
+  copilotChats: {
+    id: 'copilotChats.id',
+    userId: 'copilotChats.userId',
+    type: 'copilotChats.type',
+    workspaceId: 'copilotChats.workspaceId',
+    updatedAt: 'copilotChats.updatedAt',
+    lastSeenAt: 'copilotChats.lastSeenAt',
+    deletedAt: 'copilotChats.deletedAt',
+  },
+}))
+
+vi.mock('drizzle-orm', () => ({
+  and: vi.fn((...conditions: unknown[]) => ({ type: 'and', conditions })),
+  eq: vi.fn((field: unknown, value: unknown) => ({ type: 'eq', field, value })),
+  isNotNull: vi.fn((field: unknown) => ({ type: 'isNotNull', field })),
+}))
+
+vi.mock('@/lib/copilot/request/http', () => ({
+  ...copilotHttpMock,
+  createForbiddenResponse: vi.fn((message: string) => ({
+    status: 403,
+    ok: false,
+    json: async () => ({ error: message }),
+  })),
+}))
+
+vi.mock('@/lib/workspaces/permissions/utils', () => ({
+  assertActiveWorkspaceAccess: mockAssertActiveWorkspaceAccess,
+  isWorkspaceAccessDeniedError: (error: unknown) =>
+    error instanceof Error && error.message === 'ACCESS_DENIED',
+}))
+
+vi.mock('@/lib/copilot/chat-status', () => ({
+  chatPubSub: { publishStatusChanged: mockPublishStatusChanged },
+}))
+
+vi.mock('@/lib/posthog/server', () => ({
+  captureServerEvent: vi.fn(),
+}))
+
+import { POST } from '@/app/api/mothership/chats/[chatId]/restore/route'
+
+function makeRequest(chatId: string) {
+  return new NextRequest(`http://localhost:3000/api/mothership/chats/${chatId}/restore`, {
+    method: 'POST',
+  })
+}
+
+function makeContext(chatId: string) {
+  return { params: Promise.resolve({ chatId }) }
+}
+
+describe('POST /api/mothership/chats/[chatId]/restore', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    copilotHttpMockFns.mockAuthenticateCopilotRequestSessionOnly.mockResolvedValue({
+      userId: 'user-1',
+      isAuthenticated: true,
+    })
+    mockSelectLimit.mockResolvedValue([{ workspaceId: 'workspace-1' }])
+    mockSelectWhere.mockReturnValue({ limit: mockSelectLimit })
+    mockSelectFrom.mockReturnValue({ where: mockSelectWhere })
+    mockDbSelect.mockReturnValue({ from: mockSelectFrom })
+    mockDbReturning.mockResolvedValue([{ workspaceId: 'workspace-1' }])
+    mockUpdateWhere.mockReturnValue({ returning: mockDbReturning })
+    mockDbSet.mockReturnValue({ where: mockUpdateWhere })
+    mockDbUpdate.mockReturnValue({ set: mockDbSet })
+    mockAssertActiveWorkspaceAccess.mockResolvedValue(undefined)
+  })
+
+  it('returns 401 when unauthenticated', async () => {
+    copilotHttpMockFns.mockAuthenticateCopilotRequestSessionOnly.mockResolvedValueOnce({
+      userId: null,
+      isAuthenticated: false,
+    })
+
+    const response = await POST(makeRequest('chat-1'), makeContext('chat-1'))
+    expect(response.status).toBe(401)
+    expect(mockDbUpdate).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when no soft-deleted chat is owned by the caller', async () => {
+    mockSelectLimit.mockResolvedValueOnce([])
+
+    const response = await POST(makeRequest('chat-missing'), makeContext('chat-missing'))
+    expect(response.status).toBe(404)
+    expect(mockAssertActiveWorkspaceAccess).not.toHaveBeenCalled()
+    expect(mockDbUpdate).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller lost access to the workspace', async () => {
+    mockAssertActiveWorkspaceAccess.mockRejectedValueOnce(new Error('ACCESS_DENIED'))
+
+    const response = await POST(makeRequest('chat-1'), makeContext('chat-1'))
+    expect(response.status).toBe(403)
+    expect(mockDbUpdate).not.toHaveBeenCalled()
+  })
+
+  it('restores the chat, bumping updatedAt and lastSeenAt, and publishes the event', async () => {
+    const response = await POST(makeRequest('chat-1'), makeContext('chat-1'))
+
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({ success: true })
+    expect(mockAssertActiveWorkspaceAccess).toHaveBeenCalledWith('workspace-1', 'user-1')
+    expect(mockDbSet).toHaveBeenCalledWith({
+      deletedAt: null,
+      updatedAt: expect.any(Date),
+      lastSeenAt: expect.any(Date),
+    })
+    expect(mockPublishStatusChanged).toHaveBeenCalledWith({
+      workspaceId: 'workspace-1',
+      chatId: 'chat-1',
+      type: 'created',
+    })
+  })
+
+  it('returns 404 when the chat is restored concurrently before the update lands', async () => {
+    mockDbReturning.mockResolvedValueOnce([])
+
+    const response = await POST(makeRequest('chat-1'), makeContext('chat-1'))
+    expect(response.status).toBe(404)
+    expect(mockPublishStatusChanged).not.toHaveBeenCalled()
+  })
+})