fix(folders): comprehensive final audit — cycle-check gap, dead code, unbounded arrays

Real bugs found and fixed (independently confirmed by two separate audits):

- performUpdateFolder's knowledge_base/table branch had no cycle check when
  reparenting a folder (only self-parent + existence checks) -- unlike
  workflow/file, which already guard against it. A folder could be dragged
  into its own descendant, corrupting the tree (detaching a subtree from the
  root; getFolderLockStatus's visited-Set keeps this from infinite-looping,
  but the tree becomes unrenderable). Extracted the workflow-only
  checkForCircularReference into a generic, resourceType-agnostic
  checkFolderCircularReference in folders/parent-validation.ts (folder ids
  are globally unique, so no resourceType filter is needed) and wired it into
  the missing branch. Added dedicated unit tests.

- performReorderFolders' existing-folder lookup didn't filter deletedAt, so a
  soft-deleted folder id could still be reordered/reparented via a stale or
  direct API request (Greptile P1).

- The generic folder-restore route always returned 400, even for "not found"
  -- threaded a proper errorCode through all three resourceType-specific
  restore implementations and mapped to 404 (Cursor finding).

- Bulk file move/delete and folder reorder request bodies had no array
  bounds, letting a single request move/delete/reorder an unbounded number
  of items. Capped at 100 (matches this codebase's existing convention for
  chunkIds/documentIds) and 1000 respectively.

Cleanup (all independently verified against actual usage before removing):

- Deleted createFolderRecord/updateFolderRecord/deleteFolderRecord from
  workflows/utils.ts -- zero real callers since the copilot handler migrated
  to the generic performCreateFolder/performUpdateFolder/performDeleteFolder,
  only referenced by now-equally-dead mock scaffolding.
- Removed the isWorkflowEffectivelyLocked deprecated alias and migrated its
  4 call sites to the canonical isResourceEffectivelyLocked name.
- Removed the WorkflowFolder deprecated type alias and migrated its 6 call
  sites to the canonical Folder type.

Author: waleedlatif1

apps/sim/app/api/folders/[id]/route.test.ts

@@ -11,12 +11,10 @@ import {
   permissionsMock,
   permissionsMockFns,
   workflowsOrchestrationMockFns,
-  workflowsUtilsMock,
-  workflowsUtilsMockFns,
 } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockLogger, mockDbRef } = vi.hoisted(() => {
+const { mockLogger, mockDbRef, mockCheckFolderCircularReference } = vi.hoisted(() => {
   const logger = {
     info: vi.fn(),
     warn: vi.fn(),
@@ -29,6 +27,10 @@ const { mockLogger, mockDbRef } = vi.hoisted(() => {
   return {
     mockLogger: logger,
     mockDbRef: { current: null as any },
+    // Stands in for the real cycle-check the mocked performUpdateFolder below
+    // hand-simulates -- not tied to a real module export, just an internal
+    // test-double control lever for exercising the route's error handling.
+    mockCheckFolderCircularReference: vi.fn(),
   }
 })
 
@@ -53,7 +55,6 @@ vi.mock('@/lib/folders/orchestration', () => ({
   performDeleteFolder: workflowsOrchestrationMockFns.mockPerformDeleteFolder,
   performUpdateFolder: workflowsOrchestrationMockFns.mockPerformUpdateFolder,
 }))
-vi.mock('@/lib/workflows/utils', () => workflowsUtilsMock)
 
 import { DELETE, PUT } from '@/app/api/folders/[id]/route'
 
@@ -163,10 +164,7 @@ describe('Individual Folder API Route', () => {
       }
       if (
         params.parentId &&
-        (await workflowsUtilsMockFns.mockCheckForCircularReference(
-          params.folderId,
-          params.parentId
-        ))
+        (await mockCheckFolderCircularReference(params.folderId, params.parentId))
       ) {
         return {
           success: false,
@@ -186,7 +184,7 @@ describe('Individual Folder API Route', () => {
         },
       }
     })
-    workflowsUtilsMockFns.mockCheckForCircularReference.mockResolvedValue(false)
+    mockCheckFolderCircularReference.mockResolvedValue(false)
   })
 
   describe('PUT /api/folders/[id]', () => {
@@ -392,7 +390,7 @@ describe('Individual Folder API Route', () => {
         },
       })
 
-      workflowsUtilsMockFns.mockCheckForCircularReference.mockResolvedValue(true)
+      mockCheckFolderCircularReference.mockResolvedValue(true)
 
       const req = createMockRequest('PUT', {
         name: 'Updated Folder 3',
@@ -406,10 +404,7 @@ describe('Individual Folder API Route', () => {
 
       const data = await response.json()
       expect(data).toHaveProperty('error', 'Cannot create circular folder reference')
-      expect(workflowsUtilsMockFns.mockCheckForCircularReference).toHaveBeenCalledWith(
-        'folder-3',
-        'folder-1'
-      )
+      expect(mockCheckFolderCircularReference).toHaveBeenCalledWith('folder-3', 'folder-1')
     })
   })
 

apps/sim/app/workspace/[workspaceId]/settings/components/recently-deleted/recently-deleted.tsx

@@ -28,7 +28,7 @@ import { useRestoreTable, useTablesList } from '@/hooks/queries/tables'
 import { useRestoreWorkflow, useWorkflows } from '@/hooks/queries/workflows'
 import { useRestoreWorkspaceFile, useWorkspaceFiles } from '@/hooks/queries/workspace-files'
 import { useFolderStore } from '@/stores/folders/store'
-import type { WorkflowFolder } from '@/stores/folders/types'
+import type { Folder as FolderType } from '@/stores/folders/types'
 
 type ResourceType =
   | 'all'
@@ -385,10 +385,10 @@ export function RecentlyDeleted() {
   function handleView(resource: DeletedResource) {
     if (resource.type === 'folder') {
       const setExpanded = useFolderStore.getState().setExpanded
-      const byId = new Map<string, WorkflowFolder>()
+      const byId = new Map<string, FolderType>()
       for (const folder of foldersQuery.data ?? []) byId.set(folder.id, folder)
       for (const folder of activeFoldersQuery.data ?? []) byId.set(folder.id, folder)
-      let current: WorkflowFolder | undefined = byId.get(resource.id)
+      let current: FolderType | undefined = byId.get(resource.id)
       const seen = new Set<string>()
       while (current && !seen.has(current.id)) {
         seen.add(current.id)

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/editor.tsx

@@ -52,7 +52,7 @@ import { PreviewWorkflow } from '@/app/workspace/[workspaceId]/w/components/prev
 import { getTileIconColorClass } from '@/blocks/icon-color'
 import { getBlock } from '@/blocks/registry'
 import { useFolderMap } from '@/hooks/queries/folders'
-import { isWorkflowEffectivelyLocked } from '@/hooks/queries/utils/folder-tree'
+import { isResourceEffectivelyLocked } from '@/hooks/queries/utils/folder-tree'
 import { useWorkflowMap, useWorkflowState } from '@/hooks/queries/workflows'
 import { useCollaborativeWorkflow } from '@/hooks/use-collaborative-workflow'
 import { usePanelEditorSearchStore, usePanelEditorStore } from '@/stores/panel'
@@ -128,7 +128,7 @@ export function Editor() {
   const { data: workflows = {} } = useWorkflowMap(workspaceId)
   const { data: folders = {} } = useFolderMap(workspaceId)
   const workflowMetadata = workflowId ? workflows[workflowId] : undefined
-  const workflowLocked = isWorkflowEffectivelyLocked(workflowMetadata, folders)
+  const workflowLocked = isResourceEffectivelyLocked(workflowMetadata, folders)
 
   // Check if block is locked (or inside a locked ancestor) and compute edit permission
   // Locked blocks cannot be edited by anyone (admins can only lock/unlock)

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/panel.tsx

@@ -74,7 +74,7 @@ import {
   useCopilotChats,
 } from '@/hooks/queries/copilot-chats'
 import { useFolderMap } from '@/hooks/queries/folders'
-import { isWorkflowEffectivelyLocked } from '@/hooks/queries/utils/folder-tree'
+import { isResourceEffectivelyLocked } from '@/hooks/queries/utils/folder-tree'
 import { useDuplicateWorkflowMutation, useWorkflowMap } from '@/hooks/queries/workflows'
 import { useCollaborativeWorkflow } from '@/hooks/use-collaborative-workflow'
 import { usePermissionConfig } from '@/hooks/use-permission-config'
@@ -232,7 +232,7 @@ export const Panel = memo(function Panel() {
   )
 
   const currentWorkflow = activeWorkflowId ? workflows[activeWorkflowId] : null
-  const workflowLocked = isWorkflowEffectivelyLocked(currentWorkflow, folders)
+  const workflowLocked = isResourceEffectivelyLocked(currentWorkflow, folders)
   const canMutateWorkflow = userPermissions.canEdit && !workflowLocked
   const { isSnapshotView } = useCurrentWorkflow()
 

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/search-replace/workflow-search-replace.tsx

@@ -40,7 +40,7 @@ import { useMcpTools } from '@/hooks/mcp/use-mcp-tools'
 import { useWorkspaceCredentials } from '@/hooks/queries/credentials'
 import { useCustomTools } from '@/hooks/queries/custom-tools'
 import { useFolderMap } from '@/hooks/queries/folders'
-import { isWorkflowEffectivelyLocked } from '@/hooks/queries/utils/folder-tree'
+import { isResourceEffectivelyLocked } from '@/hooks/queries/utils/folder-tree'
 import { useWorkflowMap } from '@/hooks/queries/workflows'
 import { useCollaborativeWorkflow } from '@/hooks/use-collaborative-workflow'
 import { usePanelEditorSearchStore, usePanelEditorStore } from '@/stores/panel'
@@ -122,7 +122,7 @@ export function WorkflowSearchReplace() {
   const { data: workflows = {} } = useWorkflowMap(workspaceId)
   const { data: folders = {} } = useFolderMap(workspaceId)
   const workflowMetadata = workflowId ? workflows[workflowId] : undefined
-  const workflowLocked = isWorkflowEffectivelyLocked(workflowMetadata, folders)
+  const workflowLocked = isResourceEffectivelyLocked(workflowMetadata, folders)
   const searchReadOnly = currentWorkflow.isSnapshotView || workflowLocked
   const readonlyReason = currentWorkflow.isSnapshotView
     ? 'Snapshot view is readonly'

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/workflow-item/workflow-item.tsx

@@ -35,7 +35,7 @@ import { useFolderMap } from '@/hooks/queries/folders'
 import { getFolderMap } from '@/hooks/queries/utils/folder-cache'
 import {
   isFolderOrAncestorLocked,
-  isWorkflowEffectivelyLocked,
+  isResourceEffectivelyLocked,
 } from '@/hooks/queries/utils/folder-tree'
 import { getWorkflows } from '@/hooks/queries/utils/workflow-cache'
 import { useUpdateWorkflow } from '@/hooks/queries/workflows'
@@ -79,7 +79,7 @@ export const WorkflowItem = memo(function WorkflowItem({
 
   const { data: foldersById = {} } = useFolderMap(workspaceId)
   const inheritedFolderLocked = isFolderOrAncestorLocked(workflow.folderId, foldersById)
-  const effectiveLocked = isWorkflowEffectivelyLocked(workflow, foldersById)
+  const effectiveLocked = isResourceEffectivelyLocked(workflow, foldersById)
 
   const { canDeleteWorkflows, canDeleteFolder } = useCanDelete({ workspaceId })
 

apps/sim/app/workspace/[workspaceId]/w/hooks/use-export-folder.ts

@@ -12,7 +12,7 @@ import {
 import { useFolderMap } from '@/hooks/queries/folders'
 import { useWorkflowMap } from '@/hooks/queries/workflows'
 import { useFolderStore } from '@/stores/folders/store'
-import type { WorkflowFolder } from '@/stores/folders/types'
+import type { Folder } from '@/stores/folders/types'
 import type { WorkflowMetadata } from '@/stores/workflows/registry/types'
 
 const logger = createLogger('useExportFolder')
@@ -43,7 +43,7 @@ interface CollectedWorkflow {
 function collectWorkflowsInFolder(
   folderId: string,
   workflows: Record<string, WorkflowMetadata>,
-  folders: Record<string, WorkflowFolder>
+  folders: Record<string, Folder>
 ): CollectedWorkflow[] {
   const collectedWorkflows: CollectedWorkflow[] = []
 
@@ -69,7 +69,7 @@ function collectWorkflowsInFolder(
  */
 function collectSubfolders(
   rootFolderId: string,
-  folders: Record<string, WorkflowFolder>
+  folders: Record<string, Folder>
 ): FolderExportData[] {
   const subfolders: FolderExportData[] = []
 

apps/sim/app/workspace/[workspaceId]/w/hooks/use-export-selection.ts

@@ -10,7 +10,7 @@ import {
 import { getFolderMap } from '@/hooks/queries/utils/folder-cache'
 import { getWorkflows } from '@/hooks/queries/utils/workflow-cache'
 import { useFolderStore } from '@/stores/folders/store'
-import type { WorkflowFolder } from '@/stores/folders/types'
+import type { Folder } from '@/stores/folders/types'
 import type { WorkflowMetadata } from '@/stores/workflows/registry/types'
 
 const logger = createLogger('useExportSelection')
@@ -37,7 +37,7 @@ interface CollectedWorkflow {
 function collectWorkflowsInFolder(
   folderId: string,
   workflows: Record<string, WorkflowMetadata>,
-  folders: Record<string, WorkflowFolder>
+  folders: Record<string, Folder>
 ): CollectedWorkflow[] {
   const collectedWorkflows: CollectedWorkflow[] = []
 
@@ -62,7 +62,7 @@ function collectWorkflowsInFolder(
  */
 function collectSubfoldersForMultipleFolders(
   rootFolderIds: string[],
-  folders: Record<string, WorkflowFolder>
+  folders: Record<string, Folder>
 ): FolderExportData[] {
   const subfolders: FolderExportData[] = []
 

apps/sim/hooks/queries/utils/folder-tree.test.ts

@@ -7,11 +7,11 @@ import {
   getFolderPath,
   isFolderEffectivelyLocked,
   isFolderOrAncestorLocked,
-  isWorkflowEffectivelyLocked,
+  isResourceEffectivelyLocked,
 } from '@/hooks/queries/utils/folder-tree'
-import type { WorkflowFolder } from '@/stores/folders/types'
+import type { Folder } from '@/stores/folders/types'
 
-function makeFolder(overrides: Partial<WorkflowFolder> & { id: string }): WorkflowFolder {
+function makeFolder(overrides: Partial<Folder> & { id: string }): Folder {
   return {
     id: overrides.id,
     name: overrides.name ?? overrides.id,
@@ -146,31 +146,31 @@ describe('findLockedAncestorFolder', () => {
   })
 })
 
-describe('isWorkflowEffectivelyLocked', () => {
+describe('isResourceEffectivelyLocked', () => {
   it('treats undefined or null workflows as unlocked', () => {
-    expect(isWorkflowEffectivelyLocked(undefined, {})).toBe(false)
-    expect(isWorkflowEffectivelyLocked(null, {})).toBe(false)
+    expect(isResourceEffectivelyLocked(undefined, {})).toBe(false)
+    expect(isResourceEffectivelyLocked(null, {})).toBe(false)
   })
 
   it('returns true when the workflow row itself is locked', () => {
-    expect(isWorkflowEffectivelyLocked({ locked: true, folderId: null }, {})).toBe(true)
+    expect(isResourceEffectivelyLocked({ locked: true, folderId: null }, {})).toBe(true)
   })
 
   it('returns true when an ancestor folder is locked', () => {
     const folders = {
       eng: makeFolder({ id: 'eng', locked: true }),
       be: makeFolder({ id: 'be', parentId: 'eng' }),
     }
-    expect(isWorkflowEffectivelyLocked({ locked: false, folderId: 'be' }, folders)).toBe(true)
+    expect(isResourceEffectivelyLocked({ locked: false, folderId: 'be' }, folders)).toBe(true)
   })
 
   it('returns false when neither row nor any ancestor is locked', () => {
     const folders = { eng: makeFolder({ id: 'eng' }) }
-    expect(isWorkflowEffectivelyLocked({ locked: false, folderId: 'eng' }, folders)).toBe(false)
+    expect(isResourceEffectivelyLocked({ locked: false, folderId: 'eng' }, folders)).toBe(false)
   })
 
   it('returns false for a workflow at workspace root with no row lock', () => {
-    expect(isWorkflowEffectivelyLocked({ locked: false, folderId: null }, {})).toBe(false)
+    expect(isResourceEffectivelyLocked({ locked: false, folderId: null }, {})).toBe(false)
   })
 })
 

apps/sim/hooks/queries/utils/folder-tree.ts

@@ -98,12 +98,6 @@ export function isResourceEffectivelyLocked(
   return isFolderOrAncestorLocked(resource.folderId, folders)
 }
 
-/**
- * @deprecated Use {@link isResourceEffectivelyLocked} — kept as a named alias
- * so existing workflow call sites read naturally.
- */
-export const isWorkflowEffectivelyLocked = isResourceEffectivelyLocked
-
 /**
  * Effective lock state for a folder as visible to the client. Mirrors the
  * server's `getFolderLockStatus(folderId)` (in `@sim/platform-authz/workflow`) but