feat(folders): generalize folders and add pinning across workflows, files, knowledge bases, and tables

- Replace workflowFolder/workspaceFileFolder with one generic `folder` table
  (resourceType discriminator) and a new polymorphic `pinnedItem` table
- Migration backfills existing folders, repoints FKs, adds folderId to
  knowledge_base/user_table_definitions; DB trigger + app-level validation
  enforce same-workspace/same-resourceType parenting
- Generic /api/folders and new /api/pinned-items routes, contracts, and
  React Query hooks shared by all four resource types
- Real folder tree + breadcrumb navigation and pin buttons wired into
  Knowledge Bases and Tables pages (previously flat lists), consolidating
  duplicated create/delete/restore cascade and breadcrumb logic into
  shared helpers used by files/knowledge/tables/workflow sidebar

Author: waleedlatif1

apps/sim/app/api/folders/[id]/duplicate/route.ts

@@ -1,6 +1,6 @@
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
-import { workflow, workflowFolder } from '@sim/db/schema'
+import { folder as folderTable, workflow } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { FolderLockedError } from '@sim/platform-authz/workflow'
 import { generateId } from '@sim/utils/id'
@@ -39,8 +39,14 @@ export const POST = withRouteHandler(
 
       const sourceFolder = await db
         .select()
-        .from(workflowFolder)
-        .where(and(eq(workflowFolder.id, sourceFolderId), isNull(workflowFolder.archivedAt)))
+        .from(folderTable)
+        .where(
+          and(
+            eq(folderTable.id, sourceFolderId),
+            eq(folderTable.resourceType, 'workflow'),
+            isNull(folderTable.deletedAt)
+          )
+        )
         .then((rows) => rows[0])
 
       if (!sourceFolder) {
@@ -69,17 +75,23 @@ export const POST = withRouteHandler(
         await assertTargetParentFolderMutable(tx, targetParentId, targetWorkspaceId, sourceFolderId)
 
         const folderParentCondition = targetParentId
-          ? eq(workflowFolder.parentId, targetParentId)
-          : isNull(workflowFolder.parentId)
+          ? eq(folderTable.parentId, targetParentId)
+          : isNull(folderTable.parentId)
         const workflowParentCondition = targetParentId
           ? eq(workflow.folderId, targetParentId)
           : isNull(workflow.folderId)
 
         const [[folderResult], [workflowResult]] = await Promise.all([
           tx
-            .select({ minSortOrder: min(workflowFolder.sortOrder) })
-            .from(workflowFolder)
-            .where(and(eq(workflowFolder.workspaceId, targetWorkspaceId), folderParentCondition)),
+            .select({ minSortOrder: min(folderTable.sortOrder) })
+            .from(folderTable)
+            .where(
+              and(
+                eq(folderTable.workspaceId, targetWorkspaceId),
+                eq(folderTable.resourceType, 'workflow'),
+                folderParentCondition
+              )
+            ),
           tx
             .select({ minSortOrder: min(workflow.sortOrder) })
             .from(workflow)
@@ -101,8 +113,9 @@ export const POST = withRouteHandler(
           name
         )
 
-        await tx.insert(workflowFolder).values({
+        await tx.insert(folderTable).values({
           id: newFolderId,
+          resourceType: 'workflow',
           userId: session.user.id,
           workspaceId: targetWorkspaceId,
           name: deduplicatedName,
@@ -168,8 +181,8 @@ export const POST = withRouteHandler(
 
       const duplicatedFolder = await db
         .select()
-        .from(workflowFolder)
-        .where(eq(workflowFolder.id, newFolderId))
+        .from(folderTable)
+        .where(and(eq(folderTable.id, newFolderId), eq(folderTable.resourceType, 'workflow')))
         .then((rows) => rows[0])
 
       return NextResponse.json({ folder: duplicatedFolder }, { status: 201 })
@@ -216,30 +229,54 @@ export const POST = withRouteHandler(
   }
 )
 
+/**
+ * Verifies a prospective duplicate-target parent is usable: the same
+ * existence/workspace/resourceType/deleted invariant every other folder
+ * write path checks via `assertFolderParentValid` is applied inline to the
+ * immediate parent's row (the first loop iteration below), then the walk
+ * continues up the full ancestor chain applying the workflow-specific
+ * lock-cascade and self-descendant checks. Workspace/resourceType
+ * consistency for ancestors beyond the immediate parent is guaranteed by the
+ * `folder_parent_resource_type_match` DB trigger, so later iterations only
+ * need to re-fetch `parentId`/`locked`. Checking inline on the one row
+ * already being fetched for the walk avoids a redundant second SELECT of
+ * the same immediate-parent row that a separate `assertFolderParentValid`
+ * call would issue.
+ */
 async function assertTargetParentFolderMutable(
   tx: DbOrTx,
   parentId: string | null,
   targetWorkspaceId: string,
   sourceFolderId: string
 ): Promise<void> {
-  let currentFolderId = parentId
+  if (!parentId) return
+
+  let currentFolderId: string | null = parentId
   const visited = new Set<string>()
+  let isFirstIteration = true
 
   while (currentFolderId && !visited.has(currentFolderId)) {
     visited.add(currentFolderId)
     const [folder] = await tx
       .select({
-        id: workflowFolder.id,
-        parentId: workflowFolder.parentId,
-        workspaceId: workflowFolder.workspaceId,
-        locked: workflowFolder.locked,
-        archivedAt: workflowFolder.archivedAt,
+        id: folderTable.id,
+        parentId: folderTable.parentId,
+        locked: folderTable.locked,
+        workspaceId: folderTable.workspaceId,
+        resourceType: folderTable.resourceType,
+        deletedAt: folderTable.deletedAt,
       })
-      .from(workflowFolder)
-      .where(eq(workflowFolder.id, currentFolderId))
+      .from(folderTable)
+      .where(eq(folderTable.id, currentFolderId))
       .limit(1)
 
-    if (!folder || folder.workspaceId !== targetWorkspaceId || folder.archivedAt) {
+    if (
+      !folder ||
+      (isFirstIteration &&
+        (folder.workspaceId !== targetWorkspaceId ||
+          folder.resourceType !== 'workflow' ||
+          folder.deletedAt))
+    ) {
       throw new Error('Target parent folder not found')
     }
     if (folder.id === sourceFolderId) {
@@ -250,6 +287,7 @@ async function assertTargetParentFolderMutable(
     }
 
     currentFolderId = folder.parentId
+    isFirstIteration = false
   }
 }
 
@@ -260,16 +298,17 @@ async function deduplicateFolderName(
   requestedName: string
 ): Promise<string> {
   const parentCondition = parentId
-    ? eq(workflowFolder.parentId, parentId)
-    : isNull(workflowFolder.parentId)
+    ? eq(folderTable.parentId, parentId)
+    : isNull(folderTable.parentId)
   const siblingRows = await tx
-    .select({ name: workflowFolder.name })
-    .from(workflowFolder)
+    .select({ name: folderTable.name })
+    .from(folderTable)
     .where(
       and(
-        eq(workflowFolder.workspaceId, workspaceId),
+        eq(folderTable.workspaceId, workspaceId),
+        eq(folderTable.resourceType, 'workflow'),
         parentCondition,
-        isNull(workflowFolder.archivedAt)
+        isNull(folderTable.deletedAt)
       )
     )
   const siblingNames = new Set(siblingRows.map((row) => row.name))
@@ -296,21 +335,23 @@ async function duplicateFolderStructure(
 ): Promise<void> {
   const childFolders = await tx
     .select()
-    .from(workflowFolder)
+    .from(folderTable)
     .where(
       and(
-        eq(workflowFolder.parentId, sourceFolderId),
-        eq(workflowFolder.workspaceId, sourceWorkspaceId),
-        isNull(workflowFolder.archivedAt)
+        eq(folderTable.parentId, sourceFolderId),
+        eq(folderTable.workspaceId, sourceWorkspaceId),
+        eq(folderTable.resourceType, 'workflow'),
+        isNull(folderTable.deletedAt)
       )
     )
 
   for (const childFolder of childFolders) {
     const newChildFolderId = generateId()
     folderMapping.set(childFolder.id, newChildFolderId)
 
-    await tx.insert(workflowFolder).values({
+    await tx.insert(folderTable).values({
       id: newChildFolderId,
+      resourceType: 'workflow',
       userId,
       workspaceId: targetWorkspaceId,
       name: childFolder.name,

apps/sim/app/api/folders/[id]/restore/route.ts

@@ -1,12 +1,15 @@
+import { db } from '@sim/db'
+import { folder as folderTable } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
+import { and, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { restoreFolderContract } from '@/lib/api/contracts'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { performRestoreFolder } from '@/lib/folders/orchestration'
 import { captureServerEvent } from '@/lib/posthog/server'
-import { performRestoreFolder } from '@/lib/workflows/orchestration/folder-lifecycle'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('RestoreFolderAPI')
@@ -30,7 +33,18 @@ export const POST = withRouteHandler(async (request: NextRequest, context: Route
       return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })
     }
 
+    const [existingFolder] = await db
+      .select({ resourceType: folderTable.resourceType })
+      .from(folderTable)
+      .where(and(eq(folderTable.id, folderId), eq(folderTable.workspaceId, workspaceId)))
+      .limit(1)
+
+    if (!existingFolder) {
+      return NextResponse.json({ error: 'Folder not found' }, { status: 404 })
+    }
+
     const result = await performRestoreFolder({
+      resourceType: existingFolder.resourceType,
       folderId,
       workspaceId,
       userId: session.user.id,

apps/sim/app/api/folders/[id]/route.test.ts

@@ -10,7 +10,6 @@ import {
   type MockUser,
   permissionsMock,
   permissionsMockFns,
-  workflowsOrchestrationMock,
   workflowsOrchestrationMockFns,
   workflowsUtilsMock,
   workflowsUtilsMockFns,
@@ -50,7 +49,10 @@ vi.mock('@sim/db', () => ({
     return mockDbRef.current
   },
 }))
-vi.mock('@/lib/workflows/orchestration', () => workflowsOrchestrationMock)
+vi.mock('@/lib/folders/orchestration', () => ({
+  performDeleteFolder: workflowsOrchestrationMockFns.mockPerformDeleteFolder,
+  performUpdateFolder: workflowsOrchestrationMockFns.mockPerformUpdateFolder,
+}))
 vi.mock('@/lib/workflows/utils', () => workflowsUtilsMock)
 
 import { DELETE, PUT } from '@/app/api/folders/[id]/route'
@@ -70,6 +72,7 @@ const TEST_USER: MockUser = {
 
 const mockFolder = {
   id: 'folder-1',
+  resourceType: 'workflow',
   name: 'Test Folder',
   userId: TEST_USER.id,
   workspaceId: 'workspace-123',
@@ -386,6 +389,7 @@ describe('Individual Folder API Route', () => {
       mockDbRef.current = createFolderDbMock({
         folderLookupResult: {
           id: 'folder-3',
+          resourceType: 'workflow',
           parentId: null,
           name: 'Folder 3',
           workspaceId: 'workspace-123',
@@ -432,6 +436,7 @@ describe('Individual Folder API Route', () => {
       expect(data).toHaveProperty('success', true)
       expect(data).toHaveProperty('deletedItems')
       expect(mockPerformDeleteFolder).toHaveBeenCalledWith({
+        resourceType: 'workflow',
         folderId: 'folder-1',
         workspaceId: 'workspace-123',
         userId: TEST_USER.id,

apps/sim/app/api/folders/[id]/route.ts

@@ -1,15 +1,16 @@
 import { db } from '@sim/db'
-import { workflowFolder } from '@sim/db/schema'
+import { folder as folderTable } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { assertFolderMutable, FolderLockedError } from '@sim/platform-authz/workflow'
+import { FolderLockedError } from '@sim/platform-authz/workflow'
 import { eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { updateFolderContract } from '@/lib/api/contracts'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { performDeleteFolder, performUpdateFolder } from '@/lib/folders/orchestration'
+import { FOLDER_RESOURCE_POLICIES } from '@/lib/folders/policy'
 import { captureServerEvent } from '@/lib/posthog/server'
-import { performDeleteFolder, performUpdateFolder } from '@/lib/workflows/orchestration'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('FoldersIDAPI')
@@ -43,8 +44,8 @@ export const PUT = withRouteHandler(
       // Verify the folder exists
       const existingFolder = await db
         .select()
-        .from(workflowFolder)
-        .where(eq(workflowFolder.id, id))
+        .from(folderTable)
+        .where(eq(folderTable.id, id))
         .then((rows) => rows[0])
 
       if (!existingFolder) {
@@ -65,6 +66,14 @@ export const PUT = withRouteHandler(
         )
       }
 
+      const policy = FOLDER_RESOURCE_POLICIES[existingFolder.resourceType]
+
+      if (locked !== undefined && !policy.supportsLocking) {
+        return NextResponse.json(
+          { error: `Folders of type "${existingFolder.resourceType}" do not support locking` },
+          { status: 400 }
+        )
+      }
       if (locked !== undefined && workspacePermission !== 'admin') {
         return NextResponse.json(
           { error: 'Admin access required to lock folders' },
@@ -74,13 +83,14 @@ export const PUT = withRouteHandler(
 
       const hasNonLockUpdate = Object.keys(parsed.data.body).some((key) => key !== 'locked')
       if (hasNonLockUpdate) {
-        await assertFolderMutable(id)
+        await policy.assertMutable(id)
       }
       if (parentId !== undefined) {
-        await assertFolderMutable(parentId)
+        await policy.assertMutable(parentId)
       }
 
       const result = await performUpdateFolder({
+        resourceType: existingFolder.resourceType,
         folderId: id,
         workspaceId: existingFolder.workspaceId,
         userId: session.user.id,
@@ -126,8 +136,8 @@ export const DELETE = withRouteHandler(
       // Verify the folder exists
       const existingFolder = await db
         .select()
-        .from(workflowFolder)
-        .where(eq(workflowFolder.id, id))
+        .from(folderTable)
+        .where(eq(folderTable.id, id))
         .then((rows) => rows[0])
 
       if (!existingFolder) {
@@ -147,9 +157,10 @@ export const DELETE = withRouteHandler(
         )
       }
 
-      await assertFolderMutable(id)
+      await FOLDER_RESOURCE_POLICIES[existingFolder.resourceType].assertMutable(id)
 
       const result = await performDeleteFolder({
+        resourceType: existingFolder.resourceType,
         folderId: id,
         workspaceId: existingFolder.workspaceId,
         userId: session.user.id,