fix(review): exclude deleted folders from sort order; make the allowlist tests real

Three findings from cubic on #7062, all valid.

1. nextWorkflowSortOrder consulted the folder minimum without excluding
   soft-deleted folders. Because the helper returns min - 1, a deleted folder
   holding the lowest slot ratchets the floor down permanently — the same class
   of bug as the archived-workflow one this PR set out to fix, on the other half
   of the query. lib/folders/orchestration.ts already documents this exact
   rationale for the folder-creation side of the same algorithm, and the uploads
   folder manager filters it too; this was the outlier.

2. The two new allowlist tests did not call setEnterpriseOrgWorkspace(), so
   resolution never reached the group queries and validateBlockType returned
   early. They passed against the unfixed code when run in isolation and only
   appeared to fail in a full-file run, where mock state leaked from earlier
   tests. Verified with 'vitest -t': both now fail without the case-folding fix
   and pass with it.

3. The restore-resource comment this PR rewrote was itself wrong. A Partial map
   does not defer the failure into the cascade — the lookup widens to
   FolderResourceType | undefined and the error lands on the restoreFolder call
   site. Reworded to say that, and why keeping the check at the mapping matters.

Author: waleedlatif1

apps/sim/ee/access-control/utils/permission-check.test.ts

@@ -448,12 +448,14 @@ describe('validateBlockType', () => {
     })
 
     it('case-folds a stored allowlist so a mixed-case entry still matches', async () => {
+      setEnterpriseOrgWorkspace()
       queueGroupResolution([{ config: { allowedIntegrations: ['Slack'] } }])
 
       await validateBlockType('user-123', 'workspace-1', 'slack')
     })
 
     it('still rejects a block absent from a mixed-case stored allowlist', async () => {
+      setEnterpriseOrgWorkspace()
       queueGroupResolution([{ config: { allowedIntegrations: ['Slack'] } }])
 
       await expect(validateBlockType('user-123', 'workspace-1', 'discord')).rejects.toThrow(

apps/sim/lib/resources/orchestration/restore-resource.ts

@@ -47,10 +47,10 @@ type RestorableFolderType = 'folder' | 'knowledge_folder' | 'table_folder'
 
 /**
  * Deliberately a total `Record` over the folder types, not a `Partial` one: adding a tree to
- * `RestorableFolderType` without a mapping here has to fail the build. With a partial map the
- * lookup would yield `undefined`, which `restoreFolder` types as a required
- * `FolderResourceType` — so the failure would surface as an undefined folder config deep in
- * the cascade rather than at the call site.
+ * `RestorableFolderType` without a mapping has to fail the build *here*, at the mapping. A
+ * `Partial` still compiles with the tree missing — the lookup widens to
+ * `FolderResourceType | undefined`, so the error moves to the `restoreFolder` call site, and
+ * suppressing it there leaves the cascade resolving an undefined folder config.
  */
 const FOLDER_RESOURCE_TYPE_BY_RESTORABLE: Record<RestorableFolderType, FolderResourceType> = {
   folder: 'workflow',

apps/sim/lib/workflows/sort-order.ts

@@ -6,9 +6,12 @@ import type { DbOrTx } from '@/lib/db/types'
 /**
  * Sort order placing a new workflow above everything already in its folder.
  *
- * Workflows and folders share one ordering, so both minimums are consulted.
- * Archived workflows are excluded: a soft-deleted row must not hold a slot that
- * pushes new siblings further up each time one is created.
+ * Workflows and folders share one ordering, so both minimums are consulted, and
+ * *both* exclude soft-deleted rows. Because this returns `min - 1`, counting a
+ * deleted row lets every delete ratchet the floor further negative and never
+ * recover: a deleted sibling at -400 pins the next new workflow at -401 forever.
+ * `lib/folders/orchestration.ts` documents the same rule for the folder-creation
+ * side of this algorithm.
  *
  * Pass `tx` when the caller is inside a transaction, so the read sees that
  * transaction's uncommitted rows rather than the pre-transaction snapshot.
@@ -43,7 +46,8 @@ export async function nextWorkflowSortOrder(
         and(
           eq(folderTable.workspaceId, workspaceId),
           eq(folderTable.resourceType, 'workflow'),
-          folderParentCondition
+          folderParentCondition,
+          isNull(folderTable.deletedAt)
         )
       ),
   ])