fix(mcp): wrap POST upsert delete+update in transaction

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/app/api/mcp/servers/route.ts

@@ -166,8 +166,35 @@ export const POST = withRouteHandler(
           const oauthCredsChanged = clientIdChanged || clientSecretChanged
 
           const isRevival = existingServer.deletedAt !== null
-          if (urlChanged || oauthCredsChanged || isRevival) {
-            await db.delete(mcpServerOauth).where(eq(mcpServerOauth.mcpServerId, serverId))
+          const shouldClearOauth = urlChanged || oauthCredsChanged || isRevival
+
+          await db.transaction(async (tx) => {
+            if (shouldClearOauth) {
+              await tx.delete(mcpServerOauth).where(eq(mcpServerOauth.mcpServerId, serverId))
+            }
+            await tx
+              .update(mcpServers)
+              .set({
+                name: body.name,
+                description: body.description,
+                transport: body.transport,
+                url: body.url,
+                authType: resolvedAuthType,
+                oauthClientId,
+                oauthClientSecret: oauthClientSecretEncrypted,
+                headers: body.headers || {},
+                timeout: body.timeout || 30000,
+                retries: body.retries || 3,
+                enabled: body.enabled !== false,
+                connectionStatus: resolvedAuthType === 'oauth' ? 'disconnected' : 'connected',
+                lastConnected: resolvedAuthType === 'oauth' ? null : new Date(),
+                updatedAt: new Date(),
+                deletedAt: null,
+              })
+              .where(eq(mcpServers.id, serverId))
+          })
+
+          if (shouldClearOauth) {
             const reason = isRevival
               ? 'server revival'
               : urlChanged
@@ -178,27 +205,6 @@ export const POST = withRouteHandler(
             )
           }
 
-          await db
-            .update(mcpServers)
-            .set({
-              name: body.name,
-              description: body.description,
-              transport: body.transport,
-              url: body.url,
-              authType: resolvedAuthType,
-              oauthClientId,
-              oauthClientSecret: oauthClientSecretEncrypted,
-              headers: body.headers || {},
-              timeout: body.timeout || 30000,
-              retries: body.retries || 3,
-              enabled: body.enabled !== false,
-              connectionStatus: resolvedAuthType === 'oauth' ? 'disconnected' : 'connected',
-              lastConnected: resolvedAuthType === 'oauth' ? null : new Date(),
-              updatedAt: new Date(),
-              deletedAt: null,
-            })
-            .where(eq(mcpServers.id, serverId))
-
           await mcpService.clearCache(workspaceId)
 
           logger.info(