fix(folders): scope every folder query to its resource type

Review + cleanup pass over the cutover.

- id-keyed lookups were left unfiltered on the theory that UUIDs cannot
  collide across resource types. That rules out accidental collision but
  not a caller passing a file/kb/table folder id as a workflow folderId —
  isFolderInWorkspace and the folder PUT/DELETE/parent checks would have
  accepted one. Every folder query now carries the resourceType filter
- the soft-delete cleanup job pointed at the shared folder table with no
  resource scope, so it would have hard-deleted file/kb/table rows the
  workflow cleanup does not own; batchDeleteByWorkspaceAndTimestamp gains
  an additionalPredicate and the folder target uses it
- drop lib/folders/cascade.ts and config.ts: unreferenced, and a second
  recursive cascade engine over the same table that duplicates
  folder-lifecycle's. They belong with their first consumer
- narrow listFoldersQuerySchema.resourceType to the servable set instead
  of accepting the full enum and silently answering "you have none",
  matching the create and reorder bodies
- de-alias `folder as workflowFolder` to `folderTable`; collapse six
  doubled resourceType predicates; drop the orphaned CreateFolderInput
  and restore TSDoc lost to the dead-code delete

Author: waleedlatif1

apps/sim/app/api/folders/[id]/duplicate/route.ts

@@ -1,6 +1,6 @@
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
-import { workflow, folder as workflowFolder } from '@sim/db/schema'
+import { folder as folderTable, workflow } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { FolderLockedError } from '@sim/platform-authz/workflow'
 import { generateId } from '@sim/utils/id'
@@ -40,8 +40,14 @@ export const POST = withRouteHandler(
 
       const sourceFolder = await db
         .select()
-        .from(workflowFolder)
-        .where(and(eq(workflowFolder.id, sourceFolderId), isNull(workflowFolder.deletedAt)))
+        .from(folderTable)
+        .where(
+          and(
+            eq(folderTable.id, sourceFolderId),
+            isNull(folderTable.deletedAt),
+            eq(folderTable.resourceType, 'workflow')
+          )
+        )
         .then((rows) => rows[0])
 
       if (!sourceFolder) {
@@ -70,20 +76,20 @@ export const POST = withRouteHandler(
         await assertTargetParentFolderMutable(tx, targetParentId, targetWorkspaceId, sourceFolderId)
 
         const folderParentCondition = targetParentId
-          ? eq(workflowFolder.parentId, targetParentId)
-          : isNull(workflowFolder.parentId)
+          ? eq(folderTable.parentId, targetParentId)
+          : isNull(folderTable.parentId)
         const workflowParentCondition = targetParentId
           ? eq(workflow.folderId, targetParentId)
           : isNull(workflow.folderId)
 
         const [[folderResult], [workflowResult]] = await Promise.all([
           tx
-            .select({ minSortOrder: min(workflowFolder.sortOrder) })
-            .from(workflowFolder)
+            .select({ minSortOrder: min(folderTable.sortOrder) })
+            .from(folderTable)
             .where(
               and(
-                eq(workflowFolder.workspaceId, targetWorkspaceId),
-                eq(workflowFolder.resourceType, 'workflow'),
+                eq(folderTable.workspaceId, targetWorkspaceId),
+                eq(folderTable.resourceType, 'workflow'),
                 folderParentCondition
               )
             ),
@@ -108,7 +114,7 @@ export const POST = withRouteHandler(
           name
         )
 
-        await tx.insert(workflowFolder).values({
+        await tx.insert(folderTable).values({
           id: newFolderId,
           resourceType: 'workflow',
           userId: session.user.id,
@@ -174,8 +180,8 @@ export const POST = withRouteHandler(
 
       const duplicatedFolder = await db
         .select()
-        .from(workflowFolder)
-        .where(eq(workflowFolder.id, newFolderId))
+        .from(folderTable)
+        .where(and(eq(folderTable.id, newFolderId), eq(folderTable.resourceType, 'workflow')))
         .then((rows) => rows[0])
 
       return NextResponse.json({ folder: toFolderApi(duplicatedFolder) }, { status: 201 })
@@ -235,14 +241,14 @@ async function assertTargetParentFolderMutable(
     visited.add(currentFolderId)
     const [folder] = await tx
       .select({
-        id: workflowFolder.id,
-        parentId: workflowFolder.parentId,
-        workspaceId: workflowFolder.workspaceId,
-        locked: workflowFolder.locked,
-        archivedAt: workflowFolder.deletedAt,
+        id: folderTable.id,
+        parentId: folderTable.parentId,
+        workspaceId: folderTable.workspaceId,
+        locked: folderTable.locked,
+        archivedAt: folderTable.deletedAt,
       })
-      .from(workflowFolder)
-      .where(eq(workflowFolder.id, currentFolderId))
+      .from(folderTable)
+      .where(and(eq(folderTable.id, currentFolderId), eq(folderTable.resourceType, 'workflow')))
       .limit(1)
 
     if (!folder || folder.workspaceId !== targetWorkspaceId || folder.archivedAt) {
@@ -266,17 +272,17 @@ async function deduplicateFolderName(
   requestedName: string
 ): Promise<string> {
   const parentCondition = parentId
-    ? eq(workflowFolder.parentId, parentId)
-    : isNull(workflowFolder.parentId)
+    ? eq(folderTable.parentId, parentId)
+    : isNull(folderTable.parentId)
   const siblingRows = await tx
-    .select({ name: workflowFolder.name })
-    .from(workflowFolder)
+    .select({ name: folderTable.name })
+    .from(folderTable)
     .where(
       and(
-        eq(workflowFolder.workspaceId, workspaceId),
-        eq(workflowFolder.resourceType, 'workflow'),
+        eq(folderTable.workspaceId, workspaceId),
+        eq(folderTable.resourceType, 'workflow'),
         parentCondition,
-        isNull(workflowFolder.deletedAt)
+        isNull(folderTable.deletedAt)
       )
     )
   const siblingNames = new Set(siblingRows.map((row) => row.name))
@@ -303,21 +309,21 @@ async function duplicateFolderStructure(
 ): Promise<void> {
   const childFolders = await tx
     .select()
-    .from(workflowFolder)
+    .from(folderTable)
     .where(
       and(
-        eq(workflowFolder.parentId, sourceFolderId),
-        eq(workflowFolder.workspaceId, sourceWorkspaceId),
-        eq(workflowFolder.resourceType, 'workflow'),
-        isNull(workflowFolder.deletedAt)
+        eq(folderTable.parentId, sourceFolderId),
+        eq(folderTable.workspaceId, sourceWorkspaceId),
+        eq(folderTable.resourceType, 'workflow'),
+        isNull(folderTable.deletedAt)
       )
     )
 
   for (const childFolder of childFolders) {
     const newChildFolderId = generateId()
     folderMapping.set(childFolder.id, newChildFolderId)
 
-    await tx.insert(workflowFolder).values({
+    await tx.insert(folderTable).values({
       id: newChildFolderId,
       resourceType: 'workflow',
       userId,

apps/sim/app/api/folders/[id]/route.ts

@@ -1,8 +1,8 @@
 import { db } from '@sim/db'
-import { folder as workflowFolder } from '@sim/db/schema'
+import { folder as folderTable } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { assertFolderMutable, FolderLockedError } from '@sim/platform-authz/workflow'
-import { eq } from 'drizzle-orm'
+import { and, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { updateFolderContract } from '@/lib/api/contracts'
 import { parseRequest } from '@/lib/api/server'
@@ -44,8 +44,8 @@ export const PUT = withRouteHandler(
       // Verify the folder exists
       const existingFolder = await db
         .select()
-        .from(workflowFolder)
-        .where(eq(workflowFolder.id, id))
+        .from(folderTable)
+        .where(and(eq(folderTable.id, id), eq(folderTable.resourceType, 'workflow')))
         .then((rows) => rows[0])
 
       if (!existingFolder) {
@@ -125,8 +125,8 @@ export const DELETE = withRouteHandler(
       // Verify the folder exists
       const existingFolder = await db
         .select()
-        .from(workflowFolder)
-        .where(eq(workflowFolder.id, id))
+        .from(folderTable)
+        .where(and(eq(folderTable.id, id), eq(folderTable.resourceType, 'workflow')))
         .then((rows) => rows[0])
 
       if (!existingFolder) {

apps/sim/app/api/folders/reorder/route.ts

@@ -1,5 +1,5 @@
 import { db } from '@sim/db'
-import { folder as workflowFolder } from '@sim/db/schema'
+import { folder as folderTable } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { assertFolderMutable, FolderLockedError } from '@sim/platform-authz/workflow'
 import { and, eq, inArray } from 'drizzle-orm'
@@ -37,9 +37,9 @@ export const PUT = withRouteHandler(async (req: NextRequest) => {
 
     const folderIds = updates.map((u) => u.id)
     const existingFolders = await db
-      .select({ id: workflowFolder.id, workspaceId: workflowFolder.workspaceId })
-      .from(workflowFolder)
-      .where(inArray(workflowFolder.id, folderIds))
+      .select({ id: folderTable.id, workspaceId: folderTable.workspaceId })
+      .from(folderTable)
+      .where(and(inArray(folderTable.id, folderIds), eq(folderTable.resourceType, 'workflow')))
 
     const validIds = new Set(
       existingFolders.filter((f) => f.workspaceId === workspaceId).map((f) => f.id)
@@ -58,12 +58,14 @@ export const PUT = withRouteHandler(async (req: NextRequest) => {
     if (targetParentIds.length > 0) {
       const parentFolders = await db
         .select({
-          id: workflowFolder.id,
-          workspaceId: workflowFolder.workspaceId,
-          archivedAt: workflowFolder.deletedAt,
+          id: folderTable.id,
+          workspaceId: folderTable.workspaceId,
+          archivedAt: folderTable.deletedAt,
         })
-        .from(workflowFolder)
-        .where(inArray(workflowFolder.id, targetParentIds))
+        .from(folderTable)
+        .where(
+          and(inArray(folderTable.id, targetParentIds), eq(folderTable.resourceType, 'workflow'))
+        )
 
       const validParentIds = new Set(
         parentFolders.filter((f) => f.workspaceId === workspaceId && !f.archivedAt).map((f) => f.id)
@@ -81,14 +83,10 @@ export const PUT = withRouteHandler(async (req: NextRequest) => {
     }
 
     const workspaceFolders = await db
-      .select({ id: workflowFolder.id, parentId: workflowFolder.parentId })
-      .from(workflowFolder)
+      .select({ id: folderTable.id, parentId: folderTable.parentId })
+      .from(folderTable)
       .where(
-        and(
-          eq(workflowFolder.workspaceId, workspaceId),
-          eq(workflowFolder.resourceType, 'workflow'),
-          eq(workflowFolder.resourceType, 'workflow')
-        )
+        and(eq(folderTable.workspaceId, workspaceId), eq(folderTable.resourceType, 'workflow'))
       )
 
     const parentById = new Map<string, string | null>()
@@ -132,7 +130,10 @@ export const PUT = withRouteHandler(async (req: NextRequest) => {
         if (update.parentId !== undefined) {
           updateData.parentId = update.parentId || null
         }
-        await tx.update(workflowFolder).set(updateData).where(eq(workflowFolder.id, update.id))
+        await tx
+          .update(folderTable)
+          .set(updateData)
+          .where(and(eq(folderTable.id, update.id), eq(folderTable.resourceType, 'workflow')))
       }
     })
 

apps/sim/app/api/v1/admin/folders/[id]/export/route.ts

@@ -12,7 +12,7 @@
  */
 
 import { db } from '@sim/db'
-import { workflow, folder as workflowFolder } from '@sim/db/schema'
+import { folder as folderTable, workflow } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, eq } from 'drizzle-orm'
 import { NextResponse } from 'next/server'
@@ -106,12 +106,12 @@ export const GET = withRouteHandler(
     try {
       const [folderData] = await db
         .select({
-          id: workflowFolder.id,
-          name: workflowFolder.name,
-          workspaceId: workflowFolder.workspaceId,
+          id: folderTable.id,
+          name: folderTable.name,
+          workspaceId: folderTable.workspaceId,
         })
-        .from(workflowFolder)
-        .where(eq(workflowFolder.id, folderId))
+        .from(folderTable)
+        .where(and(eq(folderTable.id, folderId), eq(folderTable.resourceType, 'workflow')))
         .limit(1)
 
       if (!folderData) {
@@ -125,16 +125,15 @@ export const GET = withRouteHandler(
 
       const allFolders = await db
         .select({
-          id: workflowFolder.id,
-          name: workflowFolder.name,
-          parentId: workflowFolder.parentId,
+          id: folderTable.id,
+          name: folderTable.name,
+          parentId: folderTable.parentId,
         })
-        .from(workflowFolder)
+        .from(folderTable)
         .where(
           and(
-            eq(workflowFolder.workspaceId, folderData.workspaceId),
-            eq(workflowFolder.resourceType, 'workflow'),
-            eq(workflowFolder.resourceType, 'workflow')
+            eq(folderTable.workspaceId, folderData.workspaceId),
+            eq(folderTable.resourceType, 'workflow')
           )
         )
 

apps/sim/app/api/v1/admin/types.ts

@@ -7,13 +7,13 @@
 
 import type {
   auditLog,
+  folder as folderTable,
   member,
   organization,
   subscription,
   user,
   userStats,
   workflow,
-  folder as workflowFolder,
   workspace,
 } from '@sim/db/schema'
 import type { InferSelectModel } from 'drizzle-orm'
@@ -27,7 +27,7 @@ import type { BlockState, Loop, Parallel } from '@/stores/workflows/workflow/typ
 export type DbUser = InferSelectModel<typeof user>
 export type DbWorkspace = InferSelectModel<typeof workspace>
 export type DbWorkflow = InferSelectModel<typeof workflow>
-export type DbWorkflowFolder = InferSelectModel<typeof workflowFolder>
+export type DbWorkflowFolder = InferSelectModel<typeof folderTable>
 export type DbOrganization = InferSelectModel<typeof organization>
 export type DbSubscription = InferSelectModel<typeof subscription>
 export type DbMember = InferSelectModel<typeof member>

apps/sim/app/api/v1/admin/workspaces/[id]/export/route.ts

@@ -13,7 +13,7 @@
 
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
-import { workflow, folder as workflowFolder, workspace } from '@sim/db/schema'
+import { folder as folderTable, workflow, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, eq } from 'drizzle-orm'
 import { NextResponse } from 'next/server'
@@ -68,13 +68,9 @@ export const GET = withRouteHandler(
 
       const folders = await db
         .select()
-        .from(workflowFolder)
+        .from(folderTable)
         .where(
-          and(
-            eq(workflowFolder.workspaceId, workspaceId),
-            eq(workflowFolder.resourceType, 'workflow'),
-            eq(workflowFolder.resourceType, 'workflow')
-          )
+          and(eq(folderTable.workspaceId, workspaceId), eq(folderTable.resourceType, 'workflow'))
         )
 
       const workflowExports: Array<{

apps/sim/app/api/v1/admin/workspaces/[id]/folders/route.ts

@@ -11,7 +11,7 @@
  */
 
 import { db } from '@sim/db'
-import { folder as workflowFolder, workspace } from '@sim/db/schema'
+import { folder as folderTable, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, count, eq } from 'drizzle-orm'
 import { adminV1ListWorkspaceFoldersContract } from '@/lib/api/contracts/v1/admin'
@@ -49,25 +49,17 @@ export const GET = withRouteHandler(
       const [countResult, folders] = await Promise.all([
         db
           .select({ total: count() })
-          .from(workflowFolder)
+          .from(folderTable)
           .where(
-            and(
-              eq(workflowFolder.workspaceId, workspaceId),
-              eq(workflowFolder.resourceType, 'workflow'),
-              eq(workflowFolder.resourceType, 'workflow')
-            )
+            and(eq(folderTable.workspaceId, workspaceId), eq(folderTable.resourceType, 'workflow'))
           ),
         db
           .select()
-          .from(workflowFolder)
+          .from(folderTable)
           .where(
-            and(
-              eq(workflowFolder.workspaceId, workspaceId),
-              eq(workflowFolder.resourceType, 'workflow'),
-              eq(workflowFolder.resourceType, 'workflow')
-            )
+            and(eq(folderTable.workspaceId, workspaceId), eq(folderTable.resourceType, 'workflow'))
           )
-          .orderBy(workflowFolder.sortOrder, workflowFolder.name)
+          .orderBy(folderTable.sortOrder, folderTable.name)
           .limit(limit)
           .offset(offset),
       ])