fix(api): handle FK violation in version restore endpoint (#1115)

The restore endpoint (POST /api/pages/[pageId]/versions/[versionId])
was missing isForeignKeyViolationError handling when inserting a
snapshot into page_versions. If the page was deleted between auth
check and insert (race condition during E2E teardown or concurrent
user sessions), the FK constraint violation was sent to Sentry
instead of returning 404.

The sibling creation endpoint already handled this correctly.

Closes #1114

Co-authored-by: Ona <no-reply@ona.com>

Author: sw-factory-automations

src/app/api/pages/[pageId]/versions/[versionId]/route.test.ts

@@ -56,6 +56,9 @@ const captureApiErrorMock = vi.fn();
 vi.mock("@/lib/sentry", () => ({
   captureApiError: (...args: unknown[]) => captureApiErrorMock(...args),
   captureSupabaseError: vi.fn(),
+  isForeignKeyViolationError: (err: Error & { code?: string }) =>
+    err.code === "23503" ||
+    err.message?.includes("violates foreign key constraint"),
   isInsufficientPrivilegeError: (err: Error & { code?: string }) =>
     err.code === "42501" ||
     err.message?.includes("violates row-level security policy"),
@@ -320,4 +323,31 @@ describe("POST /api/pages/[pageId]/versions/[versionId] (restore)", () => {
       "Version restore temporarily unavailable, please try again",
     );
   });
+
+  it("returns 404 when snapshot insert hits FK violation (page deleted, #1114)", async () => {
+    mockGetUser.mockReset();
+    mockGetUser.mockResolvedValue({ data: { user: { id: "user-1" } } });
+    getVersionResult = { data: { content: { root: {} } }, error: null };
+    getPageResult = { data: { content: { root: {} } }, error: null };
+    insertVersionResult = {
+      data: null,
+      error: {
+        code: "23503",
+        message: 'insert or update on table "page_versions" violates foreign key constraint "page_versions_page_id_fkey"',
+        details: "Key (page_id)=(40cd1f0a-63a0-4b11-aee6-6fc5b6dab600) is not present in table \"pages\".",
+        hint: null,
+      },
+    };
+
+    const res = await POST(
+      makeRequest("/api/pages/page-123/versions/version-456", {
+        method: "POST",
+        body: JSON.stringify({ action: "restore" }),
+      }),
+      { params: mockParams },
+    );
+    expect(res.status).toBe(404);
+    const body = await res.json();
+    expect(body.error).toBe("Page not found");
+  });
 });

src/app/api/pages/[pageId]/versions/[versionId]/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse, type NextRequest } from "next/server";
 import { createClient } from "@/lib/supabase/server";
-import { captureApiError, captureSupabaseError, isInsufficientPrivilegeError, isTransientNetworkError } from "@/lib/sentry";
+import { captureApiError, captureSupabaseError, isForeignKeyViolationError, isInsufficientPrivilegeError, isTransientNetworkError } from "@/lib/sentry";
 import { retryOnNetworkError } from "@/lib/retry";
 import { withRateLimit, getClientIp } from "@/lib/rate-limit";
 
@@ -158,6 +158,9 @@ async function postHandler(
     );
 
     if (snapshotError) {
+      if (isForeignKeyViolationError(snapshotError)) {
+        return NextResponse.json({ error: "Page not found" }, { status: 404 });
+      }
       captureSupabaseError(snapshotError, "page-versions:restore-snapshot");
       return NextResponse.json(
         { error: "Failed to save current version before restore" },
@@ -185,6 +188,9 @@ async function postHandler(
     if (error instanceof Error && isInsufficientPrivilegeError(error)) {
       return NextResponse.json({ error: "Forbidden" }, { status: 403 });
     }
+    if (error instanceof Error && isForeignKeyViolationError(error)) {
+      return NextResponse.json({ error: "Page not found" }, { status: 404 });
+    }
     captureApiError(error, "page-versions:restore");
 
     const isTransient =