fix(files): validate ensured folder paths

Author: TheodoreSpeaks

apps/sim/lib/uploads/contexts/workspace/workspace-file-folder-manager.test.ts

@@ -3,10 +3,12 @@
  */
 
 import { describe, expect, it } from 'vitest'
+import { MAX_FOLDER_PATH_SEGMENTS } from '@/lib/folders/paths'
 import {
   buildWorkspaceFileFolderPathMap,
+  ensureWorkspaceFileFolderPath,
   normalizeWorkspaceFileItemName,
-} from './workspace-file-folder-manager'
+} from '@/lib/uploads/contexts/workspace/workspace-file-folder-manager'
 
 describe('workspace file folder paths', () => {
   it('builds nested paths from parent relationships', () => {
@@ -30,4 +32,14 @@ describe('workspace file folder paths', () => {
       'File name cannot contain path separators or dot segments'
     )
   })
+
+  it('rejects oversized ensured paths before persisting any folders', async () => {
+    await expect(
+      ensureWorkspaceFileFolderPath({
+        workspaceId: 'workspace-1',
+        userId: 'user-1',
+        pathSegments: Array.from({ length: MAX_FOLDER_PATH_SEGMENTS + 1 }, () => 'nested'),
+      })
+    ).rejects.toThrow(`Folder paths cannot exceed ${MAX_FOLDER_PATH_SEGMENTS} segments`)
+  })
 })

apps/sim/lib/uploads/contexts/workspace/workspace-file-folder-manager.ts

@@ -9,6 +9,7 @@ import type { DbOrTx } from '@/lib/db/types'
 import { acquireFolderMutationLock } from '@/lib/folders/locks'
 import { deduplicateFolderName } from '@/lib/folders/naming'
 import {
+  buildFolderPath,
   buildFolderPathIndex,
   folderNameFromPath,
   parentFolderPath,
@@ -558,10 +559,15 @@ export async function ensureWorkspaceFileFolderPath(params: {
 }): Promise<string | null> {
   if (params.pathSegments.length === 0) return null
 
+  const pathSegments = params.pathSegments.map((segment) =>
+    normalizeWorkspaceFileItemName(segment, 'Folder')
+  )
+  buildFolderPath(pathSegments)
+
   // Fast path: the whole chain already exists (the common case for repeated
   // writes into known folders) — per-segment indexed lookups instead of
   // loading the workspace's entire folder table.
-  const existing = await findWorkspaceFileFolderIdByPath(params.workspaceId, params.pathSegments)
+  const existing = await findWorkspaceFileFolderIdByPath(params.workspaceId, pathSegments)
   if (existing) return existing
 
   // Load all active folders once and build a lookup keyed by "name|parentId"
@@ -585,8 +591,7 @@ export async function ensureWorkspaceFileFolderPath(params: {
 
   let parentId: string | null = null
 
-  for (const rawSegment of params.pathSegments) {
-    const name = normalizeWorkspaceFileItemName(rawSegment, 'Folder')
+  for (const name of pathSegments) {
     const lookupKey = `${name}|${parentId ?? ''}`
 
     const cached = folderByNameParent.get(lookupKey)