PR Summary

Medium Risk
Adds new restore endpoints and database mutations for workflows/tables/knowledge bases/files, which can impact data integrity and permissions if mis-scoped. Also refactors workflow notifications to use a new global toast provider, changing user-visible messaging behavior.

Overview
Adds a Recently Deleted settings section that lists archived workflows, tables, knowledge bases, and files (with search + type tabs) and allows restoring them, showing a toast with a View action on success.

Introduces new POST .../restore API routes for each resource with permission checks, and implements corresponding restore operations in services/hooks (including restoring workflow-related child records and KB/table/file archived/deleted flags while blocking restores into archived workspaces).

Replaces the custom in-workflow notification UI/animations with a shared ToastProvider/toast() system and updates delete confirmation copy across the app to reflect that items can be restored.

^{Written by Cursor Bugbot for commit aab1381. This will update automatically on new commits. Configure here.}

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Mar 14, 2026 1:49am

Greptile Summary

This PR adds a "Recently Deleted" feature, allowing users to restore soft-deleted workflows, tables, knowledge bases, and workspace files from a new Settings section. It introduces four new POST /restore API endpoints, corresponding service-layer restore functions, React Query mutation hooks, a RecentlyDeleted settings page component, and a custom ToastProvider for in-app notifications.

Key changes and issues found:

• Security gap in workflow restore endpoint (apps/sim/app/api/workflows/[id]/restore/route.ts): When a workflow has no workspaceId (personal workflow), there is no ownership check — any authenticated user who knows the workflow ID can restore it. The knowledge base endpoint correctly handles this with an else if (kb.userId !== auth.userId) guard, but the workflow endpoint is missing the equivalent.
• Inaccurate "Deleted" timestamps in the UI: Workflows display lastModified (mapped from updatedAt) and knowledge bases display updatedAt as their deletion date — neither is the actual archivedAt / deletedAt timestamp, so the shown date can be misleading.
• Restore errors are silently swallowed: handleRestore has onSuccess and onSettled callbacks but no onError — if a restore call fails, the spinner disappears but the user receives no feedback.
• AUTO_DISMISS_MS = 0 in toast.tsx: All toasts persist indefinitely until manually dismissed, which will accumulate and clutter the UI for transient success messages.
• globals.css modified for toast keyframes (rule violation): The @keyframes toast-enter / @keyframes toast-exit animations should be scoped to the toast component, not added to the global stylesheet.
• restorableTypes Set allocated on every render in delete-modal.tsx — a minor inefficiency that is easily resolved by moving it outside the component.

Confidence Score: 2/5

• Not safe to merge — the workflow restore endpoint is missing an ownership check for personal workflows, and inaccurate deletion timestamps in the UI are misleading.
• The service-layer restore logic is solid (transactions, workspace-archived guards, correct child-entity handling), but the workflow API route has a missing authorization branch that could allow any authenticated user to restore another user's personal workflow. Additionally, the "Deleted" date shown in the UI for workflows and knowledge bases is unreliable, and restore failures give the user no error feedback. These issues should be resolved before merging.
• Pay close attention to apps/sim/app/api/workflows/[id]/restore/route.ts (missing ownership check) and apps/sim/app/workspace/[workspaceId]/settings/components/recently-deleted/recently-deleted.tsx (incorrect deletion timestamps, missing error handling).

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant U as User (Recently Deleted UI)
    participant RD as RecentlyDeleted Component
    participant Q as React Query Hooks
    participant API as REST API Routes
    participant SVC as Service Layer (lib/)
    participant DB as Database

    U->>RD: Visit Settings → Recently Deleted
    RD->>Q: useWorkflows(scope: archived)
    RD->>Q: useTablesList(archived)
    RD->>Q: useKnowledgeBasesQuery(scope: archived)
    RD->>Q: useWorkspaceFiles(archived)
    Q->>API: GET /api/workflows?scope=archived
    Q->>API: GET /api/tables?scope=archived
    Q->>API: GET /api/knowledge?scope=archived
    Q->>API: GET /api/workspaces/{id}/files?scope=archived
    API-->>Q: Archived resource lists
    Q-->>RD: Merged & sorted DeletedResource[]

    U->>RD: Click "Restore" on an item
    RD->>Q: mutate(resourceId) via useRestoreWorkflow / useRestoreTable / useRestoreKnowledgeBase / useRestoreWorkspaceFile
    Q->>API: POST /api/workflows/{id}/restore
    Note over API: Auth check + permission check
    API->>SVC: restoreWorkflow(id, requestId)
    SVC->>DB: BEGIN TRANSACTION
    SVC->>DB: UPDATE workflow SET archivedAt = NULL
    SVC->>DB: UPDATE schedules, webhooks, chats, forms, mcp_tools, a2a_agents SET archivedAt = NULL
    DB-->>SVC: OK
    SVC-->>API: { restored: true }
    API-->>Q: 200 { success: true }
    Q->>Q: invalidateQueries(workflowKeys.lists())
    Q-->>RD: onSuccess → toast.success("Workflow restored")
    RD-->>U: Toast shown + item removed from list

_{Last reviewed commit: 87c36c7}