fix(folders): stop archived rows skewing sortOrder, hide them from admin, and cover the two untested modules (#6062)

* fix(folders): stop archived rows skewing sortOrder, hide them from admin, and cover the two untested modules

nextFolderSortOrder returned min - 1 over ALL rows including soft-deleted ones,
so every delete ratcheted the floor further negative and never recovered — an
archived folder at -400 forced the next new folder to -401 forever. Both minima
(folders and child resources) now see only rows a user can still see, which is
how the Files path has always worked.

The admin workspace-folders endpoint counted and paginated soft-deleted folders,
so an operator saw phantom folders and an inflated total, disagreeing with every
user-facing list.

Adds naming.test.ts and queries.test.ts. Both modules had zero tests and are
mocked at every call site, so their bodies executed in no test anywhere. That
left unasserted the two bug classes that caused real defects in the folder
migration: the suffix sequence (must start at (1) and skip taken suffixes) and
resourceType scoping on the id-keyed lookups, where a missing clause silently
files a knowledge base under a table folder.

Every assertion is mutation-checked. The first version of the sortOrder test was
vacuous — for a root folder the parent condition is itself an isNull node, so a
presence-only check passed with the soft-delete filter deleted; it now asserts
the specific column.

* refactor(testing): share the drizzle condition-tree helpers

Asserting on WHERE clauses is the only way to pin a filter the row-queue mocks
cannot enforce — a mock returns whatever was queued regardless of the predicate
— so this pattern spreads to every test that guards a query's scoping. It had
reached five local copies of the same flatten/has pair, four of them added by
the tests in this branch.

Moved to @sim/testing beside createMockSqlOperators, whose output shape they
parse, so the helper and the node types it depends on live together.

Author: waleedlatif1

apps/sim/app/api/v1/admin/workspaces/[id]/folders/route.test.ts

@@ -0,0 +1,80 @@
+/**
+ * @vitest-environment node
+ */
+import {
+  createMockRequest,
+  dbChainMockFns,
+  flattenMockConditions,
+  queueTableRows,
+  resetDbChainMock,
+  schemaMock,
+} from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+/**
+ * The route composes `withAdminAuthParams`, so auth is bypassed by making that wrapper a
+ * passthrough — the assertions here are about query construction, not the auth gate.
+ */
+vi.mock('@/app/api/v1/admin/middleware', () => ({
+  withAdminAuthParams: (handler: unknown) => handler,
+}))
+
+import { GET } from '@/app/api/v1/admin/workspaces/[id]/folders/route'
+
+const WORKSPACE_ID = 'ws-1'
+const routeContext = { params: Promise.resolve({ id: WORKSPACE_ID }) }
+
+function listRequest() {
+  return createMockRequest(
+    'GET',
+    undefined,
+    {},
+    `http://localhost:3000/api/v1/admin/workspaces/${WORKSPACE_ID}/folders?limit=50&offset=0`
+  )
+}
+
+describe('admin workspace folders GET', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+  })
+
+  /**
+   * Both the count and the page must exclude soft-deleted folders. Without the filter an operator
+   * inspecting a workspace sees folders that live in Recently Deleted and an inflated total, and
+   * this endpoint disagrees with every user-facing folder list — all of which filter `deletedAt`.
+   */
+  it('excludes soft-deleted folders from both the count and the page', async () => {
+    queueTableRows(schemaMock.workspace, [{ id: WORKSPACE_ID }])
+    queueTableRows(schemaMock.folder, [{ total: 0 }])
+    queueTableRows(schemaMock.folder, [])
+
+    await GET(listRequest(), routeContext)
+
+    // Calls: [0] workspace lookup, then the count and page share one prebuilt condition.
+    const folderWheres = dbChainMockFns.where.mock.calls.slice(1).map(([where]) => where)
+    expect(folderWheres.length).toBeGreaterThanOrEqual(2)
+    for (const where of folderWheres) {
+      // Asserted on the COLUMN: `resourceType`/`workspaceId` are eq nodes, so a bare
+      // "some isNull exists" check could pass on an unrelated clause.
+      expect(
+        flattenMockConditions(where).some(
+          (node) => node.type === 'isNull' && node.column === schemaMock.folder.deletedAt
+        )
+      ).toBe(true)
+    }
+  })
+
+  it('still scopes to the workspace and to workflow folders', async () => {
+    queueTableRows(schemaMock.workspace, [{ id: WORKSPACE_ID }])
+    queueTableRows(schemaMock.folder, [{ total: 0 }])
+    queueTableRows(schemaMock.folder, [])
+
+    await GET(listRequest(), routeContext)
+
+    const where = dbChainMockFns.where.mock.calls[1]?.[0]
+    const nodes = flattenMockConditions(where)
+    expect(nodes.some((n) => n.type === 'eq' && n.right === WORKSPACE_ID)).toBe(true)
+    expect(nodes.some((n) => n.type === 'eq' && n.right === 'workflow')).toBe(true)
+  })
+})

apps/sim/app/api/v1/admin/workspaces/[id]/folders/route.ts

@@ -13,7 +13,7 @@
 import { db } from '@sim/db'
 import { folder as folderTable, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, count, eq } from 'drizzle-orm'
+import { and, count, eq, isNull } from 'drizzle-orm'
 import { adminV1ListWorkspaceFoldersContract } from '@/lib/api/contracts/v1/admin'
 import { parseRequest } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -46,19 +46,24 @@ export const GET = withRouteHandler(
         return notFoundResponse('Workspace')
       }
 
+      /**
+       * Soft-deleted folders are excluded. Without this the count and the page both include rows
+       * sitting in Recently Deleted, so an operator inspecting a workspace sees phantom folders
+       * and an inflated total — and the two disagree with every user-facing folder list, all of
+       * which filter on `deletedAt`.
+       */
+      const activeWorkflowFolders = and(
+        eq(folderTable.workspaceId, workspaceId),
+        eq(folderTable.resourceType, 'workflow'),
+        isNull(folderTable.deletedAt)
+      )
+
       const [countResult, folders] = await Promise.all([
-        db
-          .select({ total: count() })
-          .from(folderTable)
-          .where(
-            and(eq(folderTable.workspaceId, workspaceId), eq(folderTable.resourceType, 'workflow'))
-          ),
+        db.select({ total: count() }).from(folderTable).where(activeWorkflowFolders),
         db
           .select()
           .from(folderTable)
-          .where(
-            and(eq(folderTable.workspaceId, workspaceId), eq(folderTable.resourceType, 'workflow'))
-          )
+          .where(activeWorkflowFolders)
           .orderBy(folderTable.sortOrder, folderTable.name)
           .limit(limit)
           .offset(offset),

apps/sim/lib/folders/cascade.test.ts

@@ -1,6 +1,7 @@
 /**
  * @vitest-environment node
  */
+import { flattenMockConditions, hasMockCondition } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   archiveFolderCascade,
@@ -81,23 +82,6 @@ function makeConfig(overrides: Partial<FolderResourceConfig> = {}): FolderResour
   }
 }
 
-/** Flattens the nested `and(...)` objects the drizzle operator mocks produce. */
-function flattenConditions(condition: unknown): Array<Record<string, unknown>> {
-  if (!condition || typeof condition !== 'object') return []
-  const node = condition as Record<string, unknown>
-  if (node.type === 'and' && Array.isArray(node.conditions)) {
-    return node.conditions.flatMap(flattenConditions)
-  }
-  return [node]
-}
-
-function hasCondition(
-  condition: unknown,
-  predicate: (node: Record<string, unknown>) => boolean
-): boolean {
-  return flattenConditions(condition).some(predicate)
-}
-
 const TIMESTAMP = new Date('2026-01-01T00:00:00.000Z')
 const NOW = new Date('2026-02-02T00:00:00.000Z')
 
@@ -138,7 +122,7 @@ describe('collectCascadeSubtreeIds', () => {
 
     expect(ids).toEqual(['root', 'child', 'grandchild'])
     // Either still active, or carrying this cascade's own stamp — never another snapshot's.
-    const clause = flattenConditions(selectCalls[0].where).find((node) => node.type === 'or')
+    const clause = flattenMockConditions(selectCalls[0].where).find((node) => node.type === 'or')
     expect(clause).toBeDefined()
     const branches = (clause?.conditions ?? []) as Array<Record<string, unknown>>
     expect(branches.some((node) => node.type === 'isNull')).toBe(true)
@@ -150,8 +134,10 @@ describe('collectCascadeSubtreeIds', () => {
 
     await collectCascadeSubtreeIds(tx, 'ws-1', 'knowledge_base', 'root', TIMESTAMP)
 
-    expect(hasCondition(selectCalls[0].where, (node) => node.right === 'knowledge_base')).toBe(true)
-    expect(hasCondition(selectCalls[0].where, (node) => node.right === 'ws-1')).toBe(true)
+    expect(hasMockCondition(selectCalls[0].where, (node) => node.right === 'knowledge_base')).toBe(
+      true
+    )
+    expect(hasMockCondition(selectCalls[0].where, (node) => node.right === 'ws-1')).toBe(true)
   })
 })
 
@@ -169,7 +155,7 @@ describe('collectArchivedSubtreeIds', () => {
     const ids = await collectArchivedSubtreeIds(tx, 'ws-1', 'table', 'root', TIMESTAMP)
 
     expect(ids).toEqual(['root', 'child'])
-    expect(hasCondition(selectCalls[0].where, (node) => node.right === TIMESTAMP)).toBe(true)
+    expect(hasMockCondition(selectCalls[0].where, (node) => node.right === TIMESTAMP)).toBe(true)
   })
 
   it('terminates on a parent cycle instead of recursing forever', async () => {
@@ -230,7 +216,7 @@ describe('archiveFolderCascade', () => {
     await archiveFolderCascade(tx, makeConfig(), 'ws-1', ['root'], TIMESTAMP)
 
     for (const call of updateCalls) {
-      expect(hasCondition(call.where, (node) => node.type === 'isNull')).toBe(true)
+      expect(hasMockCondition(call.where, (node) => node.type === 'isNull')).toBe(true)
     }
   })
 
@@ -299,7 +285,7 @@ describe('restoreFolderCascade', () => {
     expect(updateCalls[1].set).toEqual({ archivedAt: null, updatedAt: NOW })
     expect(updateCalls[2].table).toBe(DEPENDENT_TABLE)
     expect(
-      hasCondition(updateCalls[2].where, (node) => {
+      hasMockCondition(updateCalls[2].where, (node) => {
         return node.type === 'inArray' && Array.isArray(node.values) && node.values.length === 2
       })
     ).toBe(true)
@@ -353,7 +339,7 @@ describe('restoreFolderCascade', () => {
     )
 
     for (const call of updateCalls) {
-      expect(hasCondition(call.where, (node) => node.right === TIMESTAMP)).toBe(true)
+      expect(hasMockCondition(call.where, (node) => node.right === TIMESTAMP)).toBe(true)
     }
   })
 })
@@ -373,7 +359,7 @@ describe('restoreFolderRows', () => {
 
     expect(folders).toBe(2)
     expect(updateCalls).toHaveLength(1)
-    expect(hasCondition(updateCalls[0].where, (node) => node.right === TIMESTAMP)).toBe(true)
+    expect(hasMockCondition(updateCalls[0].where, (node) => node.right === TIMESTAMP)).toBe(true)
   })
 })
 

apps/sim/lib/folders/lifecycle.test.ts

@@ -5,6 +5,7 @@ import {
   auditMock,
   dbChainMock,
   dbChainMockFns,
+  flattenMockConditions,
   queueTableRows,
   resetDbChainMock,
   schemaMock,
@@ -230,6 +231,43 @@ describe('createFolder', () => {
     expect(dbChainMockFns.values).toHaveBeenCalledWith(expect.objectContaining({ sortOrder: -3 }))
   })
 
+  it('ignores soft-deleted folders and resources when picking the new sortOrder', async () => {
+    /**
+     * `min - 1` means archived rows would ratchet the floor further negative on every delete and
+     * never recover. Both minima must therefore see only rows a user can still see. Asserted on
+     * the WHERE clauses because the mock returns whatever is queued regardless of the filter, so
+     * an assertion on the resulting sortOrder alone would pass without either clause.
+     */
+    setConfig({
+      resourceType: 'workflow',
+      countKey: 'workflows',
+      sortOrderColumn: 'child.sortOrder',
+    })
+    queueTableRows(schemaMock.folder, [{ minSortOrder: 0 }])
+    queueTableRows(CHILD_TABLE, [{ minSortOrder: 0 }])
+    dbChainMockFns.returning.mockResolvedValueOnce([folderRow({ sortOrder: -1 })])
+
+    await createFolder({ ...baseCreate, resourceType: 'workflow' })
+
+    const [folderWhere, childWhere] = dbChainMockFns.where.mock.calls
+      .slice(0, 2)
+      .map(([where]) => where)
+
+    // Assert on the specific COLUMN, not merely that some isNull exists: for a root folder the
+    // parent condition is itself `isNull(parentId)`, so a presence-only check passes with the
+    // soft-delete filter deleted. That made the first version of this test vacuous.
+    expect(
+      flattenMockConditions(folderWhere).some(
+        (node) => node.type === 'isNull' && node.column === schemaMock.folder.deletedAt
+      )
+    ).toBe(true)
+    expect(
+      flattenMockConditions(childWhere).some(
+        (node) => node.type === 'isNull' && node.column === 'child.archivedAt'
+      )
+    ).toBe(true)
+  })
+
   it('starts at zero when the folder is the first thing in its location', async () => {
     queueTableRows(schemaMock.folder, [{ minSortOrder: null }])
     dbChainMockFns.returning.mockResolvedValueOnce([folderRow()])

apps/sim/lib/folders/lifecycle.ts

@@ -128,14 +128,22 @@ export async function nextFolderSortOrder(
     ? eq(folderTable.parentId, parentId)
     : isNull(folderTable.parentId)
 
+  /**
+   * Soft-deleted rows are excluded from both minima. This function returns `min - 1` to put a
+   * new folder at the top, so counting archived rows lets every delete ratchet the floor further
+   * negative and never recover — an archived folder at -400 forces the next new folder to -401
+   * forever. Only rows a user can actually see should influence the ordering. The Files path
+   * (`workspace-file-folder-manager`) has always filtered this way.
+   */
   const folderMinPromise = tx
     .select({ minSortOrder: min(folderTable.sortOrder) })
     .from(folderTable)
     .where(
       and(
         eq(folderTable.workspaceId, workspaceId),
         eq(folderTable.resourceType, resourceType),
-        folderParentCondition
+        folderParentCondition,
+        isNull(folderTable.deletedAt)
       )
     )
 
@@ -147,6 +155,7 @@ export async function nextFolderSortOrder(
           and(
             eq(config.workspaceColumn, workspaceId),
             parentId ? eq(config.folderIdColumn, parentId) : isNull(config.folderIdColumn),
+            isNull(config.deletedColumn),
             config.scope
           )
         )