fix(folders): map reorder internal errors to 500 instead of 400

performReorderFolders caught every transaction failure -- including genuine
unexpected DB/transaction errors, not just client-caused validation issues
-- and returned success:false with no way to distinguish them. The route
then unconditionally mapped any failure to 400, mislabeling real server
errors as bad requests.

Adds errorCode: OrchestrationErrorCode to the result (not_found for
concurrent-deletion races and missing parents, internal for anything else,
following the same pattern already used elsewhere in this file), and the
route now maps status via the shared statusForOrchestrationError helper.
Unexpected errors are logged with their real cause but returned to the
client as a generic message instead of leaking internals.

Author: waleedlatif1

apps/sim/app/api/folders/reorder/route.test.ts

@@ -262,11 +262,40 @@ describe('PUT /api/folders/reorder', () => {
 
     const response = await PUT(req)
 
-    expect(response.status).toBe(400)
+    expect(response.status).toBe(404)
     const data = await response.json()
     expect(data.error).toBe('One or more folders were not found')
   })
 
+  it('returns a 500 when the transaction fails for an unexpected reason', async () => {
+    // Regression test: performReorderFolders previously mapped every non-lock
+    // transaction failure -- including genuine unexpected DB errors, not just
+    // client-caused validation issues -- to a 400 in the route. An internal
+    // failure should surface as a 500 with a generic message, not leak the raw
+    // error or masquerade as a client error.
+    mockWhere
+      .mockReturnValueOnce([
+        { id: 'folder-1', workspaceId: 'workspace-123', resourceType: 'workflow' },
+      ])
+      .mockReturnValueOnce([{ id: 'folder-1', parentId: null }])
+      .mockReturnValueOnce([{ id: 'folder-1', workspaceId: 'workspace-123' }])
+
+    mockDb.transaction.mockImplementation(async () => {
+      throw new Error('connection terminated unexpectedly')
+    })
+
+    const req = createMockRequest('PUT', {
+      workspaceId: 'workspace-123',
+      updates: [{ id: 'folder-1', sortOrder: 2, parentId: null }],
+    })
+
+    const response = await PUT(req)
+
+    expect(response.status).toBe(500)
+    const data = await response.json()
+    expect(data.error).toBe('Failed to reorder folders')
+  })
+
   it('returns a 423 when a folder is concurrently locked before the write', async () => {
     // Regression test: the route checks lock state before calling
     // performReorderFolders (both of the route's own checks -- for update.id and

apps/sim/app/api/folders/reorder/route.ts

@@ -11,6 +11,7 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { performReorderFolders } from '@/lib/folders/orchestration'
 import { FOLDER_RESOURCE_POLICIES } from '@/lib/folders/policy'
+import { statusForOrchestrationError } from '@/lib/workflows/orchestration/types'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('FolderReorderAPI')
@@ -139,7 +140,7 @@ export const PUT = withRouteHandler(async (req: NextRequest) => {
     if (!result.success) {
       return NextResponse.json(
         { error: result.error ?? 'No valid folders to update' },
-        { status: 400 }
+        { status: statusForOrchestrationError(result.errorCode) }
       )
     }
 

apps/sim/lib/folders/orchestration.ts

@@ -777,9 +777,15 @@ export async function performRestoreFolder(
   return performRestoreResourceFolder(params, TABLE_FOLDER_CASCADE)
 }
 
-export async function performReorderFolders(
-  params: PerformReorderFoldersParams
-): Promise<{ success: boolean; updated: number; error?: string }> {
+/** Marks a concurrent-deletion race caught inside the reorder transaction as a 404, not a 500. */
+class FolderReorderNotFoundError extends Error {}
+
+export async function performReorderFolders(params: PerformReorderFoldersParams): Promise<{
+  success: boolean
+  updated: number
+  error?: string
+  errorCode?: OrchestrationErrorCode
+}> {
   const { resourceType, workspaceId, updates } = params
 
   const folderIds = updates.map((u) => u.id)
@@ -803,7 +809,12 @@ export async function performReorderFolders(
   // reporting success with a smaller `updated` count.
   const invalidId = updates.find((u) => !validIds.has(u.id))
   if (invalidId) {
-    return { success: false, updated: 0, error: 'One or more folders were not found' }
+    return {
+      success: false,
+      updated: 0,
+      error: 'One or more folders were not found',
+      errorCode: 'not_found',
+    }
   }
   const validUpdates = updates
 
@@ -822,7 +833,12 @@ export async function performReorderFolders(
   )
   const firstParentError = parentErrors.find((error) => error !== null)
   if (firstParentError) {
-    return { success: false, updated: 0, error: firstParentError.error }
+    return {
+      success: false,
+      updated: 0,
+      error: firstParentError.error,
+      errorCode: firstParentError.errorCode,
+    }
   }
 
   try {
@@ -837,7 +853,7 @@ export async function performReorderFolders(
           .from(folderTable)
           .where(and(inArray(folderTable.id, targetParentIds), isNull(folderTable.deletedAt)))
         if (activeParents.length !== targetParentIds.length) {
-          throw new Error('Parent folder not found')
+          throw new FolderReorderNotFoundError('Parent folder not found')
         }
       }
 
@@ -871,7 +887,7 @@ export async function performReorderFolders(
           .where(and(eq(folderTable.id, update.id), isNull(folderTable.deletedAt)))
           .returning({ id: folderTable.id })
         if (!updated) {
-          throw new Error('One or more folders were not found')
+          throw new FolderReorderNotFoundError('One or more folders were not found')
         }
       }
     })
@@ -880,7 +896,18 @@ export async function performReorderFolders(
     if (error instanceof ResourceLockedError) {
       throw error
     }
-    return { success: false, updated: 0, error: toError(error).message }
+    if (error instanceof FolderReorderNotFoundError) {
+      return { success: false, updated: 0, error: error.message, errorCode: 'not_found' }
+    }
+    // An unexpected DB/transaction failure, not a client-caused validation error --
+    // log the real cause but don't leak internal error details to the response.
+    logger.error('Unexpected error reordering folders', { error })
+    return {
+      success: false,
+      updated: 0,
+      error: 'Failed to reorder folders',
+      errorCode: 'internal',
+    }
   }
 
   return { success: true, updated: validUpdates.length }