feat(folders): generalize folders and pinning across workflows, files, knowledge bases, and tables

Introduces a shared `folder`/`pinned_item` schema replacing the per-resource
folder tables, and generalizes resource-level locking (item lock + folder
cascade) across all four resource types with full parity to the existing
workflow implementation.

- Generic `folder` table (resourceType discriminator) + `pinned_item` table,
  shared API contracts/routes/hooks/UI across workflows, files, knowledge
  bases, and tables.
- Generic resource-lock engine (`@sim/platform-authz/resource-lock`):
  item-level `locked` column + folder-cascade enforcement, wired into every
  structural mutation entry point (create, rename, move, delete, restore)
  for all four resource types, including destination-folder and TOCTOU
  checks a prior implementation missed.
- Migration collapses cleanly with expand/contract discipline: FK adds
  deferred to a follow-up contract migration (blue/green deploy safety),
  concurrent index builds, NOT VALID + VALIDATE for new-column FKs, and a
  dedup-safe backfill for production's pre-existing duplicate folder names.
- Extensive review-loop hardening: cycle-detection gaps, archived-row
  mutability gaps, silent-partial-success batch operations, and lock-check
  TOCTOU races closed across every restore/move/create entry point, with
  regression tests for each.

# Conflicts:
#	packages/db/migrations/meta/0259_snapshot.json
#	packages/db/migrations/meta/_journal.json

Author: waleedlatif1

apps/sim/app/api/folders/[id]/duplicate/route.test.ts

@@ -0,0 +1,162 @@
+/**
+ * Tests for the folder-duplicate route's target-parent ancestor walk.
+ *
+ * @vitest-environment node
+ */
+import { FolderLockedError } from '@sim/platform-authz/workflow'
+import { describe, expect, it, vi } from 'vitest'
+import { assertTargetParentFolderMutable } from '@/app/api/folders/[id]/duplicate/route'
+
+describe('assertTargetParentFolderMutable', () => {
+  const workspaceId = 'workspace-123'
+  const sourceFolderId = 'source-folder'
+
+  /**
+   * `assertTargetParentFolderMutable` issues one `select().from().where().limit()`
+   * per ancestor hop, in walk order (target parent, then its parent, ...).
+   * `eq(folderTable.id, currentFolderId)` isn't inspectable without mocking
+   * drizzle-orm, so this mock returns each `chain` entry in call order instead.
+   */
+  function buildTx(chain: Array<Record<string, unknown> | undefined>) {
+    let call = 0
+    return {
+      select: vi.fn().mockReturnValue({
+        from: vi.fn().mockReturnValue({
+          where: vi.fn().mockReturnValue({
+            limit: vi.fn().mockImplementation(() => {
+              const row = chain[call]
+              call += 1
+              return row ? [row] : []
+            }),
+          }),
+        }),
+      }),
+    } as unknown as Parameters<typeof assertTargetParentFolderMutable>[0]
+  }
+
+  it('allows a target parent whose full ancestor chain is active', async () => {
+    const tx = buildTx([
+      {
+        id: 'parent',
+        parentId: 'grandparent',
+        locked: false,
+        workspaceId,
+        resourceType: 'workflow',
+        deletedAt: null,
+      },
+      {
+        id: 'grandparent',
+        parentId: null,
+        locked: false,
+        workspaceId,
+        resourceType: 'workflow',
+        deletedAt: null,
+      },
+    ])
+
+    await expect(
+      assertTargetParentFolderMutable(tx, 'parent', workspaceId, sourceFolderId)
+    ).resolves.toBeUndefined()
+  })
+
+  it('rejects when the immediate target parent is soft-deleted', async () => {
+    const tx = buildTx([
+      {
+        id: 'parent',
+        parentId: null,
+        locked: false,
+        workspaceId,
+        resourceType: 'workflow',
+        deletedAt: new Date(),
+      },
+    ])
+
+    await expect(
+      assertTargetParentFolderMutable(tx, 'parent', workspaceId, sourceFolderId)
+    ).rejects.toThrow('Target parent folder not found')
+  })
+
+  it('rejects when an ANCESTOR beyond the immediate parent is soft-deleted (regression: previously only checked the first hop)', async () => {
+    const tx = buildTx([
+      {
+        id: 'parent',
+        parentId: 'grandparent',
+        locked: false,
+        workspaceId,
+        resourceType: 'workflow',
+        deletedAt: null,
+      },
+      {
+        id: 'grandparent',
+        parentId: null,
+        locked: false,
+        workspaceId,
+        resourceType: 'workflow',
+        deletedAt: new Date(),
+      },
+    ])
+
+    await expect(
+      assertTargetParentFolderMutable(tx, 'parent', workspaceId, sourceFolderId)
+    ).rejects.toThrow('Target parent folder not found')
+  })
+
+  it('rejects when the target parent belongs to a different workspace', async () => {
+    const tx = buildTx([
+      {
+        id: 'parent',
+        parentId: null,
+        locked: false,
+        workspaceId: 'other-workspace',
+        resourceType: 'workflow',
+        deletedAt: null,
+      },
+    ])
+
+    await expect(
+      assertTargetParentFolderMutable(tx, 'parent', workspaceId, sourceFolderId)
+    ).rejects.toThrow('Target parent folder not found')
+  })
+
+  it('rejects duplicating into the source folder itself', async () => {
+    const tx = buildTx([
+      {
+        id: sourceFolderId,
+        parentId: null,
+        locked: false,
+        workspaceId,
+        resourceType: 'workflow',
+        deletedAt: null,
+      },
+    ])
+
+    await expect(
+      assertTargetParentFolderMutable(tx, sourceFolderId, workspaceId, sourceFolderId)
+    ).rejects.toThrow('Cannot duplicate folder into itself or one of its descendants')
+  })
+
+  it('rejects when the target parent is locked', async () => {
+    const tx = buildTx([
+      {
+        id: 'parent',
+        parentId: null,
+        locked: true,
+        workspaceId,
+        resourceType: 'workflow',
+        deletedAt: null,
+      },
+    ])
+
+    await expect(
+      assertTargetParentFolderMutable(tx, 'parent', workspaceId, sourceFolderId)
+    ).rejects.toThrow(FolderLockedError)
+  })
+
+  it('is a no-op for a null parentId (duplicating to root)', async () => {
+    const tx = buildTx([])
+
+    await expect(
+      assertTargetParentFolderMutable(tx, null, workspaceId, sourceFolderId)
+    ).resolves.toBeUndefined()
+  })
+})