fix(tables): reject the multiple flag on non-select columns

A create/add payload could persist multiple: true on a string column, where
it sits inert until updateColumnType inherits it via `data.multiple ??
column.multiple` — silently turning an intended single-select into a
multiselect and rewriting every cell as an array. Rejected now in both the
service validator and the shared contract refine, which the internal and v1
column routes both consume.

Author: TheodoreSpeaks

apps/sim/lib/api/contracts/tables.ts

@@ -39,11 +39,15 @@ export const selectOptionsSchema = z
 
 /**
  * Cross-field rule: a `select` column must declare a non-empty option set;
- * other types must not carry options. Skipped when `type` is absent (an
- * options-only update on an existing select column).
+ * other types must not carry options or `multiple`. Skipped when `type` is
+ * absent (an options-only update on an existing select column).
  */
 function refineColumnOptions(
-  data: { type?: (typeof COLUMN_TYPES)[number]; options?: z.infer<typeof selectOptionsSchema> },
+  data: {
+    type?: (typeof COLUMN_TYPES)[number]
+    options?: z.infer<typeof selectOptionsSchema>
+    multiple?: boolean
+  },
   ctx: z.RefinementCtx
 ): void {
   if (data.type === 'select') {
@@ -54,13 +58,25 @@ function refineColumnOptions(
         message: 'A select column must define at least one option',
       })
     }
-  } else if (data.type !== undefined && data.options && data.options.length > 0) {
+    return
+  }
+  if (data.type === undefined) return
+  if (data.options && data.options.length > 0) {
     ctx.addIssue({
       code: 'custom',
       path: ['options'],
       message: 'options are only allowed on select columns',
     })
   }
+  // `multiple` stored on a non-select column is inert until a later
+  // convert-to-select inherits it, silently producing a multiselect.
+  if (data.multiple) {
+    ctx.addIssue({
+      code: 'custom',
+      path: ['multiple'],
+      message: 'multiple is only allowed on select columns',
+    })
+  }
 }
 
 /**

apps/sim/lib/table/__tests__/validation.test.ts

@@ -87,6 +87,27 @@ describe('Validation', () => {
       }
     })
 
+    it('rejects select-only fields on a non-select column', () => {
+      // Both are inert on a string column, but `updateColumnType` inherits them
+      // on a later convert-to-select — options would be silently replaced and
+      // `multiple` would turn an intended single-select into a multiselect.
+      const withOptions = validateColumnDefinition({
+        name: 'status',
+        type: 'string',
+        options: [{ id: 'opt_a', name: 'Open' }],
+      })
+      expect(withOptions.valid).toBe(false)
+      expect(withOptions.errors[0]).toContain('cannot define options')
+
+      const withMultiple = validateColumnDefinition({
+        name: 'status',
+        type: 'string',
+        multiple: true,
+      })
+      expect(withMultiple.valid).toBe(false)
+      expect(withMultiple.errors[0]).toContain('cannot be multiple')
+    })
+
     it('should reject empty column name', () => {
       const result = validateColumnDefinition({ name: '', type: 'string' })
       expect(result.valid).toBe(false)

apps/sim/lib/table/validation.ts

@@ -775,8 +775,17 @@ export function validateColumnDefinition(column: ColumnDefinition): ValidationRe
     if (column.unique) {
       errors.push(`Column "${column.name}" of type "select" cannot be unique`)
     }
-  } else if (column.options !== undefined) {
-    errors.push(`Column "${column.name}" cannot define options for type "${column.type}"`)
+  } else {
+    if (column.options !== undefined) {
+      errors.push(`Column "${column.name}" cannot define options for type "${column.type}"`)
+    }
+    // A stored `multiple` on a non-select column is inert until the column is
+    // converted, at which point `updateColumnType` inherits it — silently
+    // turning an intended single-select into a multiselect and rewriting every
+    // cell as an array.
+    if (column.multiple) {
+      errors.push(`Column "${column.name}" cannot be multiple for type "${column.type}"`)
+    }
   }
 
   return { valid: errors.length === 0, errors }