fix(folders): address round-2 review feedback on locking + reorder

- File-folder locked was never persisted: toFileFolder() hardcoded
  locked: false, and updateWorkspaceFileFolder() didn't accept/forward the
  field at all. Threaded locked through WorkspaceFileFolderRecord,
  updateWorkspaceFileFolder(), and the orchestration call site (Cursor)
- Generic knowledge_base/table folder update branch silently dropped
  locked (only wrote name/parentId/sortOrder) -- a route could report
  success while the lock never took effect (Greptile P1)
- Folder reorder now fails the WHOLE batch on any invalid parentId instead
  of silently skipping just that entry and reporting a partial success --
  restores this endpoint's pre-generalization all-or-nothing guarantee,
  which an earlier round-1 fix regressed (Cursor)

Author: waleedlatif1

apps/sim/app/api/folders/reorder/route.test.ts

@@ -77,12 +77,15 @@ describe('PUT /api/folders/reorder', () => {
     expect(data).toMatchObject({ success: true, updated: 1 })
   })
 
-  it('rejects a parentId that belongs to another workspace', async () => {
+  it('rejects a parentId that belongs to another workspace, failing the whole batch', async () => {
     // Parent-id validity is checked once, inside `performReorderFolders`
     // (via `assertFolderParentValid`) — the route no longer re-implements
     // this check, so the mock sequence covers: (1) route's own-id lookup,
     // (2) route's workspace-folders lookup for the circular-reference walk,
     // (3) orchestration's own-id lookup, (4) orchestration's parentId lookup.
+    // A single invalid parentId fails the ENTIRE batch (matching this
+    // endpoint's pre-generalization all-or-nothing behavior) rather than
+    // silently skipping just that one entry.
     mockWhere
       .mockReturnValueOnce([
         { id: 'folder-1', workspaceId: 'workspace-123', resourceType: 'workflow' },
@@ -103,7 +106,7 @@ describe('PUT /api/folders/reorder', () => {
 
     expect(response.status).toBe(400)
     const data = await response.json()
-    expect(data.error).toBe('No valid folders to update')
+    expect(data.error).toBe('Parent folder not found')
     expect(mockDb.transaction).not.toHaveBeenCalled()
   })
 

apps/sim/app/api/folders/reorder/route.ts

@@ -128,7 +128,10 @@ export const PUT = withRouteHandler(async (req: NextRequest) => {
     })
 
     if (!result.success) {
-      return NextResponse.json({ error: 'No valid folders to update' }, { status: 400 })
+      return NextResponse.json(
+        { error: result.error ?? 'No valid folders to update' },
+        { status: 400 }
+      )
     }
 
     logger.info(`[${requestId}] Reordered ${result.updated} folders in workspace ${workspaceId}`)

apps/sim/lib/folders/orchestration.ts

@@ -120,7 +120,7 @@ function toFileFolder(record: WorkspaceFileFolderRecord): Folder {
     userId: record.userId,
     workspaceId: record.workspaceId,
     parentId: record.parentId,
-    locked: false,
+    locked: record.locked,
     sortOrder: record.sortOrder,
     createdAt: record.createdAt,
     updatedAt: record.updatedAt,
@@ -204,6 +204,7 @@ async function performUpdateFileFolder(
       name: params.name,
       parentId: params.parentId,
       sortOrder: params.sortOrder,
+      locked: params.locked,
     })
 
     recordAudit({
@@ -684,6 +685,7 @@ export async function performUpdateFolder(
   if (params.name !== undefined) updates.name = params.name.trim()
   if (params.parentId !== undefined) updates.parentId = params.parentId || null
   if (params.sortOrder !== undefined) updates.sortOrder = params.sortOrder
+  if (params.locked !== undefined) updates.locked = params.locked
 
   const [updated] = await db
     .update(folderTable)
@@ -739,7 +741,7 @@ export async function performRestoreFolder(
 
 export async function performReorderFolders(
   params: PerformReorderFoldersParams
-): Promise<{ success: boolean; updated: number }> {
+): Promise<{ success: boolean; updated: number; error?: string }> {
   const { resourceType, workspaceId, updates } = params
 
   const folderIds = updates.map((u) => u.id)
@@ -751,48 +753,33 @@ export async function performReorderFolders(
   const validIds = new Set(
     existingFolders.filter((f) => f.workspaceId === workspaceId).map((f) => f.id)
   )
-  const idValidUpdates = updates.filter((u) => validIds.has(u.id))
+  const validUpdates = updates.filter((u) => validIds.has(u.id))
+  if (validUpdates.length === 0) return { success: false, updated: 0 }
 
   // A reparent (non-null parentId) must independently be validated against
-  // `assertFolderParentValid` — `validIds` above only checks that `id` itself
-  // belongs to this workspace/resourceType, not that the *new parent* does.
-  // Without this, a reorder call could silently re-parent a folder under a
-  // folder from a different workspace or resourceType. Invalid reparents are
-  // skipped (not failed outright), matching this function's existing
-  // skip-invalid-entries behavior for `validIds`.
+  // `assertFolderParentValid` — the `validIds` check above only confirms `id`
+  // itself belongs to this workspace/resourceType, not that the *new parent*
+  // does. This is an all-or-nothing check: ANY invalid parentId fails the
+  // whole batch before the transaction runs (rather than silently skipping
+  // that one entry and reporting a partial `updated` count as success) —
+  // matching this endpoint's pre-generalization behavior, where a bad
+  // reparent surfaced as `Parent folder not found` up front.
   //
   // A subtree drag-drop can reparent many folders in one call, so the
   // distinct target parentIds are validated concurrently (one round-trip per
   // distinct parent, not one per update) rather than sequentially.
   const targetParentIds = Array.from(
-    new Set(idValidUpdates.map((u) => u.parentId).filter((id): id is string => Boolean(id)))
+    new Set(validUpdates.map((u) => u.parentId).filter((id): id is string => Boolean(id)))
   )
-  const parentErrorEntries = await Promise.all(
-    targetParentIds.map(
-      async (parentId) =>
-        [parentId, await assertFolderParentValid(parentId, { workspaceId, resourceType })] as const
+  const parentErrors = await Promise.all(
+    targetParentIds.map((parentId) =>
+      assertFolderParentValid(parentId, { workspaceId, resourceType })
     )
   )
-  const parentErrorById = new Map(parentErrorEntries)
-
-  const validUpdates: typeof idValidUpdates = []
-  for (const update of idValidUpdates) {
-    if (update.parentId) {
-      const parentError = parentErrorById.get(update.parentId)
-      if (parentError) {
-        logger.warn('Skipping folder reorder entry with invalid parentId', {
-          folderId: update.id,
-          parentId: update.parentId,
-          workspaceId,
-          resourceType,
-          error: parentError.error,
-        })
-        continue
-      }
-    }
-    validUpdates.push(update)
+  const firstParentError = parentErrors.find((error) => error !== null)
+  if (firstParentError) {
+    return { success: false, updated: 0, error: firstParentError.error }
   }
-  if (validUpdates.length === 0) return { success: false, updated: 0 }
 
   await db.transaction(async (tx) => {
     for (const update of validUpdates) {

apps/sim/lib/uploads/contexts/workspace/workspace-file-folder-manager.ts

@@ -55,6 +55,7 @@ export interface WorkspaceFileFolderRecord {
   parentId: string | null
   path: string
   sortOrder: number
+  locked: boolean
   deletedAt: Date | null
   createdAt: Date
   updatedAt: Date
@@ -67,6 +68,7 @@ interface RawWorkspaceFileFolder {
   name: string
   parentId: string | null
   sortOrder: number
+  locked: boolean
   deletedAt: Date | null
   createdAt: Date
   updatedAt: Date
@@ -165,6 +167,7 @@ function mapFolder(
     parentId: folder.parentId,
     path: paths.get(folder.id) ?? folder.name,
     sortOrder: folder.sortOrder,
+    locked: folder.locked,
     deletedAt: folder.deletedAt,
     createdAt: folder.createdAt,
     updatedAt: folder.updatedAt,
@@ -517,6 +520,7 @@ export async function ensureWorkspaceFileFolderPath(params: {
         name: created.name,
         parentId: created.parentId,
         sortOrder: created.sortOrder,
+        locked: created.locked,
         deletedAt: created.deletedAt,
         createdAt: created.createdAt,
         updatedAt: created.updatedAt,
@@ -556,6 +560,7 @@ export async function updateWorkspaceFileFolder(params: {
   name?: string
   parentId?: string | null
   sortOrder?: number
+  locked?: boolean
 }): Promise<WorkspaceFileFolderRecord> {
   const folder = await db.transaction(async (tx) => {
     await acquireWorkspaceFileFolderMutationLock(tx, params.workspaceId)
@@ -654,6 +659,10 @@ export async function updateWorkspaceFileFolder(params: {
       updates.sortOrder = params.sortOrder
     }
 
+    if (params.locked !== undefined) {
+      updates.locked = params.locked
+    }
+
     try {
       const [updatedFolder] = await tx
         .update(workspaceFileFolder)