feat(folders): generalize resource locking across workflows, files, knowledge bases, and tables

- New generic locking engine (packages/platform-authz/src/resource-lock.ts):
  one config-driven RESOURCE_LOCK_LOOKUP + ResourceLockedError, mirroring the
  PINNED_RESOURCE_LOOKUP/FolderCascadeConfig pattern already established for
  folders/pinning. packages/platform-authz/src/workflow.ts's lock exports
  become thin resourceType='workflow' wrappers over the generic engine --
  WorkflowLockedError/FolderLockedError are now ResourceLockedError
  subclasses, so all ~30 existing call sites keep working unchanged
- New locked column on workspaceFiles/knowledgeBase/userTableDefinitions
  (mirrors workflow.locked), migration 0259_resource_level_locking.sql
- FOLDER_RESOURCE_POLICIES now enables real lock enforcement (not a no-op)
  for all four resourceTypes -- folder-level lock cascade, previously
  workflow-only, now applies uniformly
- assertResourceMutable/assertFolderMutable wired into the structural
  mutation entry points for each type: file rename/delete/move/restore
  (including bulk folder-scoped operations), knowledge base update/delete,
  table rename/delete -- locked blocks all of these but never blocks reads
  (download/search/query), matching the workflow precedent
- Lock/unlock UI: row-level toggle for files/knowledge bases/tables plus
  folder-level lock in their context menus, reusing the existing generic
  Lock/Unlock context-menu item
- Route-level 423 test coverage added for every new lock-enforcement call
  site (direct lock and folder-inherited lock)

Deep content-mutation lock enforcement (table row/column edits, knowledge
base document/chunk/connector edits) is intentionally out of scope here --
a much larger surface (~35 additional routes) that assertResourceMutable is
positioned to extend into as a follow-up, not silently dropped.

Author: waleedlatif1

apps/sim/app/api/folders/[id]/route.ts

@@ -1,7 +1,7 @@
 import { db } from '@sim/db'
 import { folder } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { FolderLockedError } from '@sim/platform-authz/workflow'
+import { ResourceLockedError } from '@sim/platform-authz/resource-lock'
 import { eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { updateFolderContract } from '@/lib/api/contracts'
@@ -110,7 +110,7 @@ export const PUT = withRouteHandler(
 
       return NextResponse.json({ folder: result.folder })
     } catch (error) {
-      if (error instanceof FolderLockedError) {
+      if (error instanceof ResourceLockedError) {
         return NextResponse.json({ error: error.message }, { status: error.status })
       }
 
@@ -183,7 +183,7 @@ export const DELETE = withRouteHandler(
         deletedItems: result.deletedItems,
       })
     } catch (error) {
-      if (error instanceof FolderLockedError) {
+      if (error instanceof ResourceLockedError) {
         return NextResponse.json({ error: error.message }, { status: error.status })
       }
 

apps/sim/app/api/folders/reorder/route.ts

@@ -1,7 +1,7 @@
 import { db } from '@sim/db'
 import { folder } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { FolderLockedError } from '@sim/platform-authz/workflow'
+import { ResourceLockedError } from '@sim/platform-authz/resource-lock'
 import { eq, inArray } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { reorderFoldersContract } from '@/lib/api/contracts'
@@ -135,7 +135,7 @@ export const PUT = withRouteHandler(async (req: NextRequest) => {
 
     return NextResponse.json({ success: true, updated: result.updated })
   } catch (error) {
-    if (error instanceof FolderLockedError) {
+    if (error instanceof ResourceLockedError) {
       return NextResponse.json({ error: error.message }, { status: error.status })
     }
 

apps/sim/app/api/folders/route.test.ts

@@ -9,7 +9,7 @@ import {
   createMockRequest,
   permissionsMock,
   permissionsMockFns,
-  workflowAuthzMockFns,
+  resourceLockMockFns,
 } from '@sim/testing'
 import { drizzleOrmMock } from '@sim/testing/mocks'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
@@ -392,9 +392,9 @@ describe('Folders API Route', () => {
     it('should reject creating a subfolder inside a locked parent folder', async () => {
       mockAuthenticatedUser()
 
-      const { FolderLockedError } = await import('@sim/platform-authz/workflow')
-      workflowAuthzMockFns.mockAssertFolderMutable.mockRejectedValueOnce(
-        new FolderLockedError('Folder is locked')
+      const { ResourceLockedError } = await import('@sim/platform-authz/resource-lock')
+      resourceLockMockFns.mockAssertFolderMutable.mockRejectedValueOnce(
+        new ResourceLockedError('workflow', false, 'Folder is locked')
       )
 
       const req = createMockRequest('POST', {

apps/sim/app/api/folders/route.ts

@@ -1,5 +1,5 @@
 import { createLogger } from '@sim/logger'
-import { FolderLockedError } from '@sim/platform-authz/workflow'
+import { ResourceLockedError } from '@sim/platform-authz/resource-lock'
 import { type NextRequest, NextResponse } from 'next/server'
 import { createFolderContract, listFoldersContract } from '@/lib/api/contracts'
 import { parseRequest } from '@/lib/api/server'
@@ -116,7 +116,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     return NextResponse.json({ folder: newFolder })
   } catch (error) {
-    if (error instanceof FolderLockedError) {
+    if (error instanceof ResourceLockedError) {
       return NextResponse.json({ error: error.message }, { status: error.status })
     }
     logger.error('Error creating folder:', { error })

apps/sim/app/api/knowledge/[id]/route.ts

@@ -1,5 +1,6 @@
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { createLogger } from '@sim/logger'
+import { ResourceLockedError } from '@sim/platform-authz/resource-lock'
 import { type NextRequest, NextResponse } from 'next/server'
 import { updateKnowledgeBaseContract } from '@/lib/api/contracts/knowledge'
 import { parseRequest } from '@/lib/api/server'
@@ -15,6 +16,7 @@ import {
   KnowledgeBaseValidationError,
   updateKnowledgeBase,
 } from '@/lib/knowledge/service'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 import { checkKnowledgeBaseAccess, checkKnowledgeBaseWriteAccess } from '@/app/api/knowledge/utils'
 
 const logger = createLogger('KnowledgeBaseByIdAPI')
@@ -95,6 +97,19 @@ export const PUT = withRouteHandler(
 
       const validatedData = parsed.data.body
 
+      if (validatedData.locked !== undefined) {
+        const workspaceId = accessCheck.knowledgeBase.workspaceId
+        const workspacePermission = workspaceId
+          ? await getUserEntityPermissions(userId, 'workspace', workspaceId)
+          : null
+        if (workspacePermission !== 'admin') {
+          return NextResponse.json(
+            { error: 'Admin access required to lock knowledge bases' },
+            { status: 403 }
+          )
+        }
+      }
+
       const updatedKnowledgeBase = await updateKnowledgeBase(
         id,
         {
@@ -103,6 +118,7 @@ export const PUT = withRouteHandler(
           workspaceId: validatedData.workspaceId,
           folderId: validatedData.folderId,
           chunkingConfig: validatedData.chunkingConfig,
+          locked: validatedData.locked,
         },
         requestId,
         { actorUserId: userId }
@@ -142,6 +158,9 @@ export const PUT = withRouteHandler(
         data: updatedKnowledgeBase,
       })
     } catch (error) {
+      if (error instanceof ResourceLockedError) {
+        return NextResponse.json({ error: error.message }, { status: error.status })
+      }
       if (error instanceof KnowledgeBaseConflictError) {
         return NextResponse.json({ error: error.message }, { status: 409 })
       }
@@ -218,6 +237,9 @@ export const DELETE = withRouteHandler(
         data: { message: 'Knowledge base deleted successfully' },
       })
     } catch (error) {
+      if (error instanceof ResourceLockedError) {
+        return NextResponse.json({ error: error.message }, { status: error.status })
+      }
       logger.error(`[${requestId}] Error deleting knowledge base`, error)
       return NextResponse.json({ error: 'Failed to delete knowledge base' }, { status: 500 })
     }

apps/sim/app/api/table/[tableId]/route.ts

@@ -1,4 +1,5 @@
 import { createLogger } from '@sim/logger'
+import { ResourceLockedError } from '@sim/platform-authz/resource-lock'
 import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
 import { getTableQuerySchema, renameTableContract } from '@/lib/api/contracts/tables'
@@ -9,6 +10,7 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { deleteTable, renameTable, TableConflictError, type TableSchema } from '@/lib/table'
 import { getWorkspaceTableLimits } from '@/lib/table/billing'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 import { accessError, checkAccess, normalizeColumn } from '@/app/api/table/utils'
 
 const logger = createLogger('TableDetailAPI')
@@ -65,6 +67,7 @@ export const GET = withRouteHandler(async (request: NextRequest, { params }: Tab
           metadata: table.metadata ?? null,
           rowCount: table.rowCount,
           maxRows: maxRowsPerTable,
+          locked: table.locked,
           createdAt:
             table.createdAt instanceof Date
               ? table.createdAt.toISOString()
@@ -125,19 +128,42 @@ export const PATCH = withRouteHandler(
         return NextResponse.json({ error: 'Invalid workspace ID' }, { status: 400 })
       }
 
+      if (validated.locked !== undefined && validated.locked !== table.locked) {
+        const workspacePermission = await getUserEntityPermissions(
+          authResult.userId,
+          'workspace',
+          table.workspaceId
+        )
+        if (workspacePermission !== 'admin') {
+          return NextResponse.json(
+            { error: 'Admin access required to lock tables' },
+            { status: 403 }
+          )
+        }
+      }
+
+      const isLockOnlyUpdate =
+        validated.name === table.name &&
+        (validated.folderId === undefined || validated.folderId === (table.folderId ?? null))
+
       const updated = await renameTable(
         tableId,
         validated.name,
         requestId,
         authResult.userId,
-        validated.folderId
+        validated.folderId,
+        validated.locked,
+        isLockOnlyUpdate
       )
 
       return NextResponse.json({
         success: true,
         data: { table: updated },
       })
     } catch (error) {
+      if (error instanceof ResourceLockedError) {
+        return NextResponse.json({ error: error.message }, { status: error.status })
+      }
       if (error instanceof TableConflictError) {
         return NextResponse.json({ error: error.message }, { status: 409 })
       }
@@ -200,6 +226,9 @@ export const DELETE = withRouteHandler(
       if (isZodError(error)) {
         return validationErrorResponse(error)
       }
+      if (error instanceof ResourceLockedError) {
+        return NextResponse.json({ error: error.message }, { status: error.status })
+      }
 
       logger.error(`[${requestId}] Error deleting table:`, error)
       return NextResponse.json({ error: 'Failed to delete table' }, { status: 500 })

apps/sim/app/api/table/route.ts

@@ -210,6 +210,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
         maxRows: t.maxRows,
         workspaceId: t.workspaceId,
         folderId: t.folderId ?? null,
+        locked: t.locked,
         createdBy: t.createdBy,
         createdAt: t.createdAt instanceof Date ? t.createdAt.toISOString() : String(t.createdAt),
         updatedAt: t.updatedAt instanceof Date ? t.updatedAt.toISOString() : String(t.updatedAt),

apps/sim/app/api/workspaces/[id]/files/[fileId]/restore/route.ts

@@ -6,7 +6,10 @@ import { getValidationErrorMessage } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { performRestoreWorkspaceFile } from '@/lib/workspace-files/orchestration'
+import {
+  performRestoreWorkspaceFile,
+  workspaceFilesOrchestrationStatus,
+} from '@/lib/workspace-files/orchestration'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('RestoreWorkspaceFileAPI')
@@ -46,7 +49,7 @@ export const POST = withRouteHandler(
       if (!result.success) {
         return NextResponse.json(
           { error: result.error },
-          { status: result.errorCode === 'conflict' ? 409 : 500 }
+          { status: workspaceFilesOrchestrationStatus(result.errorCode) }
         )
       }
 

apps/sim/app/api/workspaces/[id]/files/[fileId]/route.ts

@@ -10,9 +10,11 @@ import { getSession } from '@/lib/auth'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { captureServerEvent } from '@/lib/posthog/server'
+import { getWorkspaceFile } from '@/lib/uploads/contexts/workspace'
 import {
   performDeleteWorkspaceFileItems,
   performRenameWorkspaceFile,
+  workspaceFilesOrchestrationStatus,
 } from '@/lib/workspace-files/orchestration'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
@@ -37,7 +39,7 @@ export const PATCH = withRouteHandler(
       const parsed = await parseRequest(renameWorkspaceFileContract, request, context)
       if (!parsed.success) return parsed.response
       const { id: workspaceId, fileId } = parsed.data.params
-      const { name } = parsed.data.body
+      const { name, locked } = parsed.data.body
 
       const userPermission = await getUserEntityPermissions(
         session.user.id,
@@ -51,16 +53,32 @@ export const PATCH = withRouteHandler(
         return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })
       }
 
+      const existingFile = await getWorkspaceFile(workspaceId, fileId)
+      if (!existingFile) {
+        return NextResponse.json({ success: false, error: 'File not found' }, { status: 404 })
+      }
+
+      if (locked !== undefined && locked !== existingFile.locked && userPermission !== 'admin') {
+        return NextResponse.json(
+          { success: false, error: 'Admin access required to lock files' },
+          { status: 403 }
+        )
+      }
+
+      const isLockOnlyUpdate = name === existingFile.name
+
       const result = await performRenameWorkspaceFile({
         workspaceId,
         fileId,
         name,
         userId: session.user.id,
+        locked,
+        isLockOnlyUpdate,
       })
       if (!result.success || !result.file) {
         return NextResponse.json(
           { success: false, error: result.error },
-          { status: result.errorCode === 'conflict' ? 409 : 500 }
+          { status: workspaceFilesOrchestrationStatus(result.errorCode) }
         )
       }
 
@@ -132,14 +150,7 @@ export const DELETE = withRouteHandler(
       if (!result.success) {
         return NextResponse.json(
           { success: false, error: result.error },
-          {
-            status:
-              result.errorCode === 'validation'
-                ? 400
-                : result.errorCode === 'not_found'
-                  ? 404
-                  : 500,
-          }
+          { status: workspaceFilesOrchestrationStatus(result.errorCode) }
         )
       }