fix(folders): bound the workflow folderId-branch path index reads

`createWorkflow` and `updateWorkflow` each resolve a folder two ways inside one
function. The folderPath branch goes through `resolveWorkflowFolderPath`, which
loads the path index with `maxRows: MAX_FOLDERS_PER_WORKSPACE`; the folderId
branch loaded it with no bound at all, issuing a `SELECT` over every active
folder row in the workspace. In `updateWorkflow` the unbounded read and the
bounded fallback sit thirty lines apart in the same function.

Passes the cap at both sites, matching the read sites that already opt in.
Exceeding it throws `FolderCollectionLimitExceededError` rather than truncating,
because a partial path index resolves real folder paths to `undefined` and
re-roots resources at the workspace root.

`maxRows` deliberately stays opt-in rather than becoming the default. Folder
creation does not refuse at the same ceiling on every path — `POST /api/folders`
goes through the `createFolder` name/parentId variant, which passes no
`maxFolderRows`, so the count guard in `executeCreateFolderAtPath` never runs
and a workspace can already hold more than `MAX_FOLDERS_PER_WORKSPACE` folders.
Defaulting the bound would make every path-index consumer throw for a state the
product allows to exist. Reconciling reader and writer is a separate change with
a user-facing limit, not a chore.

Author: waleedlatif1

apps/sim/lib/folders/queries.test.ts

@@ -202,6 +202,26 @@ describe('folder queries', () => {
       expect(dbChainMockFns.limit).toHaveBeenCalledWith(3)
     })
 
+    /**
+     * The bound stays opt-in. Folder creation does not refuse at
+     * `MAX_FOLDERS_PER_WORKSPACE` on every path — `POST /api/folders` passes no
+     * `maxFolderRows` — so a workspace already over the cap must still be
+     * readable. Defaulting the bound would turn every path-index consumer into
+     * a hard failure for a state the product allows to exist.
+     */
+    it('leaves the read unbounded when no maxRows is given', async () => {
+      queueTableRows(schemaMock.folder, [
+        ROW,
+        { ...ROW, id: 'f-2', name: 'Archive' },
+        { ...ROW, id: 'f-3', name: 'Drafts' },
+      ])
+
+      const index = await loadActiveFolderPathIndex('ws-1', 'workflow')
+
+      expect(dbChainMockFns.limit).not.toHaveBeenCalled()
+      expect(index.rowById.size).toBe(3)
+    })
+
     it('fails before returning an oversized folder list', async () => {
       queueTableRows(schemaMock.folder, [ROW, { ...ROW, id: 'f-2' }, { ...ROW, id: 'f-3' }])
 

apps/sim/lib/folders/queries.ts

@@ -169,6 +169,16 @@ interface ListActiveFolderRowsOptions {
   maxRows?: number
 }
 
+/**
+ * Materializes the workspace's active folder tree for one resource type.
+ *
+ * `maxRows` is opt-in: omitting it reads every active folder row. Callers that
+ * pass it get a throw of `FolderCollectionLimitExceededError` rather than a
+ * truncated index, because a partial path index resolves real folder paths to
+ * `undefined` and re-roots resources at the workspace root. The bound is not a
+ * default because folder creation does not enforce the same ceiling on every
+ * path, so a workspace can hold more rows than the cap and must still be read.
+ */
 export async function loadActiveFolderPathIndex(
   workspaceId: string,
   resourceType: FolderResourceType,

apps/sim/lib/workflows/application/create-workflow.ts

@@ -4,6 +4,7 @@ import { createLogger } from '@sim/logger'
 import { assertFolderMutable, FolderLockedError } from '@sim/platform-authz/workflow'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { PlatformEvents } from '@/lib/core/telemetry'
+import { MAX_FOLDERS_PER_WORKSPACE } from '@/lib/folders/constants'
 import { loadActiveFolderPathIndex } from '@/lib/folders/queries'
 import { notifyWorkflowUpdated } from '@/lib/realtime/notify'
 import { defineAuthorizedWorkflowUseCase } from '@/lib/workflows/application/authorized-workflow-use-case'
@@ -40,7 +41,9 @@ export const createWorkflow = defineAuthorizedWorkflowUseCase({
         ? await resolveWorkflowFolderPath(context.workspaceId, input.folderPath ?? '/')
         : {
             folderId: input.folderId,
-            index: await loadActiveFolderPathIndex(context.workspaceId, 'workflow'),
+            index: await loadActiveFolderPathIndex(context.workspaceId, 'workflow', undefined, {
+              maxRows: MAX_FOLDERS_PER_WORKSPACE,
+            }),
           }
     if (resolution.folderId && !resolution.index.pathById.has(resolution.folderId)) {
       throw new OrchestrationError('not_found', 'Folder not found')

apps/sim/lib/workflows/application/update-workflow.ts

@@ -146,7 +146,9 @@ async function executeWorkflowUpdate(args: {
     input.folderId !== undefined
       ? {
           folderId: input.folderId,
-          index: await loadActiveFolderPathIndex(context.workspaceId, 'workflow'),
+          index: await loadActiveFolderPathIndex(context.workspaceId, 'workflow', undefined, {
+            maxRows: MAX_FOLDERS_PER_WORKSPACE,
+          }),
         }
       : input.folderPath === undefined
         ? undefined

apps/sim/lib/workflows/application/workflow-crud.test.ts

@@ -95,6 +95,7 @@ vi.mock('@/lib/core/telemetry', () => ({
   PlatformEvents: { workflowCreated: mocks.workflowCreated },
 }))
 
+import { MAX_FOLDERS_PER_WORKSPACE } from '@/lib/folders/constants'
 import { createWorkflow } from '@/lib/workflows/application/create-workflow'
 import { deleteWorkflow } from '@/lib/workflows/application/delete-workflow'
 import { listWorkflowVersions } from '@/lib/workflows/application/list-workflow-versions'
@@ -365,6 +366,45 @@ describe('authorized workflow CRUD and version reads', () => {
     expect(mocks.updateRecord).toHaveBeenCalledTimes(1)
   })
 
+  /**
+   * Both use cases resolve a folder two ways in one function. The folderPath
+   * branch goes through `resolveWorkflowFolderPath`, which bounds its path
+   * index at `MAX_FOLDERS_PER_WORKSPACE`; the folderId branch loads the index
+   * directly and must pass the same cap rather than issuing an unbounded
+   * `SELECT` over every folder row in the workspace.
+   */
+  it.each([
+    [
+      'createWorkflow',
+      () =>
+        createWorkflow.execute({
+          principal: personalPrincipal,
+          input: { workspaceId: WORKSPACE_ID, name: workflowRecord.name, folderId: 'folder-1' },
+        }),
+    ],
+    [
+      'updateWorkflow',
+      () =>
+        updateWorkflow.execute({
+          principal: personalPrincipal,
+          input: { workflowId: WORKFLOW_ID, folderId: 'folder-1' },
+        }),
+    ],
+  ])('bounds the %s folderId-branch path index at the workspace cap', async (_name, run) => {
+    mocks.loadFolderIndex.mockResolvedValue({
+      rowById: new Map(),
+      pathById: new Map([['folder-1', '/Reports']]),
+      idByPath: new Map([['/Reports', 'folder-1']]),
+    })
+
+    await run()
+
+    expect(mocks.loadFolderIndex).toHaveBeenCalledTimes(1)
+    expect(mocks.loadFolderIndex).toHaveBeenCalledWith(WORKSPACE_ID, 'workflow', undefined, {
+      maxRows: MAX_FOLDERS_PER_WORKSPACE,
+    })
+  })
+
   it('does not audit an authoritative delete no-op', async () => {
     mocks.deleteRecord.mockResolvedValue({
       success: true,