fix(api): close import defects found in audit and share one write pipeline

Security:
- Escape block names before interpolating them into a RegExp in
  updateValueReferences. Names reach it straight from imported workflow JSON
  and normalizeWorkflowBlockName preserves regex metacharacters, so a name
  like `a*a*a*a*b` compiled to a catastrophically backtracking pattern. A
  sub-kilobyte body blocked the event loop for 50s and grew exponentially.
  Also skip rename-to-itself, which is the entire map on the import path, so
  the scan no longer runs at all there.
- Validate folder ownership before folder lock state, so a locked folder in
  another workspace can no longer be distinguished from a missing one.

Correctness:
- Gate the imported graph on workflowStateSchema, the same schema the
  canonical PUT /api/workflows/[id]/state path enforces. Without it a valid
  201 could persist a block field of the wrong type, which then threw on
  every subsequent read and left a workflow nothing could open.
- Guard the compensating delete so a failed rollback logs the orphaned id
  instead of vanishing into a generic 500.
- Validate variable `type` against the enum and build the record on a
  null-prototype object, so a `__proto__` key no longer silently drops the
  variable.
- Bound payload-derived names and descriptions to the same limits the
  contract declares for the explicit overrides.
- Return the description as stored rather than coercing '' to null, matching
  GET /api/v1/workflows/[id].

Shared code, so the two write paths cannot drift:
- Extract prepareWorkflowStateForPersistence and use it from both
  PUT /api/workflows/[id]/state and the v1 import route: agent-tool
  sanitization, block backfill, dangling-edge removal, and loop/parallel
  recomputation now have one implementation.
- Persist inline custom tools on import, which the canonical path already did.
- Move variable normalization into lib/workflows/variables and repoint the
  admin importer at it, removing the last duplicate.

Docs:
- OpenAPI: oneOf -> anyOf on the import body. WorkflowExport matches any
  object, so every valid object payload matched two branches and failed
  validation under any spec-driven validator. Document 423 and the loss of
  workspace-scoped bindings on export.

Tests: prepare-state unit tests and a real export -> import round trip with
no mocks of the sanitizer or parser, covering loop/parallel children and the
regex-metacharacter payload.

Author: waleedlatif1

apps/docs/openapi.json

@@ -1085,13 +1085,14 @@
                   },
                   "workflow": {
                     "description": "The workflow to import. Accepts the export envelope returned by GET /api/v1/workflows/{id}/export, a bare workflow state object (`{ blocks, edges, ... }`), or a JSON string of either.",
-                    "oneOf": [
+                    "anyOf": [
                       {
                         "$ref": "#/components/schemas/WorkflowExport"
                       },
                       {
                         "type": "object",
                         "additionalProperties": true,
+                        "minProperties": 1,
                         "description": "A bare workflow state object."
                       },
                       {
@@ -1166,6 +1167,22 @@
               }
             }
           },
+          "423": {
+            "description": "The target folder is locked and cannot accept new workflows.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "error": {
+                      "type": "string",
+                      "example": "Folder is locked"
+                    }
+                  }
+                }
+              }
+            }
+          },
           "429": {
             "$ref": "#/components/responses/RateLimited"
           }
@@ -1245,7 +1262,7 @@
       "get": {
         "operationId": "exportWorkflow",
         "summary": "Export Workflow",
-        "description": "Export a workflow as a portable JSON envelope that POST /api/v1/workflows/import accepts verbatim. Credential and password field values stored on blocks are redacted from the payload, while `{{ENV_VAR}}` references and block positions are preserved. Workflow variables are returned as stored \u2014 they are plaintext configuration readable by anyone with workspace read, and secrets belong in environment variables, which travel as unresolved references. Requires read permission on the workflow's workspace. Returns 404 when the workflow does not exist or you do not have access to it.",
+        "description": "Export a workflow as a portable JSON envelope that POST /api/v1/workflows/import accepts verbatim. Credential and password field values stored on blocks are redacted from the payload, while `{{ENV_VAR}}` references and block positions are preserved. Workflow variables are returned as stored \u2014 they are plaintext configuration readable by anyone with workspace read, and secrets belong in environment variables, which travel as unresolved references. Requires read permission on the workflow's workspace. Returns 404 when the workflow does not exist or you do not have access to it. Workspace-scoped bindings (knowledge bases, workspace files, channels, projects, folders, MCP servers) are cleared, since those ids do not resolve in another workspace \u2014 an imported copy needs them re-selected.",
         "tags": ["Workflows"],
         "x-codeSamples": [
           {

apps/sim/app/api/v1/admin/workflows/import/route.ts

@@ -26,18 +26,14 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { parseWorkflowJson } from '@/lib/workflows/operations/import-export'
 import { saveWorkflowToNormalizedTables } from '@/lib/workflows/persistence/utils'
 import { deduplicateWorkflowName } from '@/lib/workflows/utils'
+import { normalizeImportedVariables } from '@/lib/workflows/variables/parse'
 import { withAdminAuth } from '@/app/api/v1/admin/middleware'
 import {
   badRequestResponse,
   internalErrorResponse,
   notFoundResponse,
 } from '@/app/api/v1/admin/responses'
-import {
-  extractWorkflowMetadata,
-  type VariableType,
-  type WorkflowImportRequest,
-  type WorkflowVariable,
-} from '@/app/api/v1/admin/types'
+import { extractWorkflowMetadata, type WorkflowImportRequest } from '@/app/api/v1/admin/types'
 
 const logger = createLogger('AdminWorkflowImportAPI')
 
@@ -117,42 +113,8 @@ export const POST = withRouteHandler(
         return internalErrorResponse(`Failed to save workflow state: ${saveResult.error}`)
       }
 
-      if (
-        workflowData.variables &&
-        typeof workflowData.variables === 'object' &&
-        !Array.isArray(workflowData.variables)
-      ) {
-        const variablesRecord: Record<string, WorkflowVariable> = {}
-        const vars = workflowData.variables as Record<
-          string,
-          { id?: string; name: string; type?: VariableType; value: unknown }
-        >
-        Object.entries(vars).forEach(([key, v]) => {
-          const varId = v.id || key
-          variablesRecord[varId] = {
-            id: varId,
-            name: v.name,
-            type: v.type ?? 'string',
-            value: v.value,
-          }
-        })
-
-        await db
-          .update(workflow)
-          .set({ variables: variablesRecord, updatedAt: new Date() })
-          .where(eq(workflow.id, workflowId))
-      } else if (workflowData.variables && Array.isArray(workflowData.variables)) {
-        const variablesRecord: Record<string, WorkflowVariable> = {}
-        workflowData.variables.forEach((v) => {
-          const varId = v.id || generateId()
-          variablesRecord[varId] = {
-            id: varId,
-            name: v.name,
-            type: (v.type as VariableType) ?? 'string',
-            value: v.value,
-          }
-        })
-
+      const variablesRecord = normalizeImportedVariables(workflowData.variables)
+      if (Object.keys(variablesRecord).length > 0) {
         await db
           .update(workflow)
           .set({ variables: variablesRecord, updatedAt: new Date() })

apps/sim/app/api/v1/workflows/[id]/export/route.ts

@@ -67,9 +67,22 @@ function toExportedEdge(edge: Edge): ExportedEdge {
  *
  * Unlike the admin export (`/api/v1/admin/workflows/[id]/export`), which emits
  * the raw state for backup/restore, this surface runs the payload through
- * `sanitizeForExport`: block sub-block values declared `password: true` or
- * `oauth-input` are nulled, while `{{ENV_VAR}}` references and block positions
- * are preserved.
+ * `sanitizeForExport`, which nulls three classes of sub-block value:
+ * - `password: true` fields, unless the value is a whole `{{ENV_VAR}}`
+ *   reference, which is preserved so the import resolves it in the target
+ *   workspace;
+ * - `oauth-input` credentials;
+ * - **workspace-scoped bindings** — `knowledge-base-selector`, `file-selector`,
+ *   `channel-selector`, `project-selector`, `folder-selector`,
+ *   `mcp-server-selector` and friends, plus fields keyed `knowledgeBaseId`,
+ *   `fileId`, `channelId`, `projectId`, `documentId`, `tagFilters`. These point
+ *   at rows that do not exist in another workspace, so they are cleared rather
+ *   than carried across as dangling ids.
+ *
+ * The last class means an export is **not** a byte-for-byte clone even when
+ * re-imported into the same workspace: those bindings come back empty and must
+ * be re-selected. This matches the in-app export and is documented on the
+ * public endpoint so callers do not expect otherwise.
  *
  * Workflow **variables** are emitted as stored, matching `GET
  * /api/v1/workflows/[id]` and the in-app export. Variables are plaintext

apps/sim/app/api/v1/workflows/import/route.test.ts

@@ -18,6 +18,9 @@ const {
   mockSaveWorkflowToNormalizedTables,
   mockParseWorkflowJson,
   mockAssertFolderMutable,
+  mockAssertFolderInWorkspace,
+  mockExtractAndPersistCustomTools,
+  mockPrepareWorkflowState,
   mockDbDelete,
   mockDbUpdate,
   mockWorkspaceRows,
@@ -28,6 +31,9 @@ const {
   mockSaveWorkflowToNormalizedTables: vi.fn(),
   mockParseWorkflowJson: vi.fn(),
   mockAssertFolderMutable: vi.fn(),
+  mockAssertFolderInWorkspace: vi.fn(),
+  mockExtractAndPersistCustomTools: vi.fn(),
+  mockPrepareWorkflowState: vi.fn(),
   mockDbDelete: vi.fn(),
   mockDbUpdate: vi.fn(),
   mockWorkspaceRows: { value: [{ id: 'ws-1' }] as Array<{ id: string }> },
@@ -59,10 +65,27 @@ vi.mock('@/app/api/v1/logs/meta', () => ({
 }))
 
 vi.mock('@sim/platform-authz/workflow', () => ({
+  assertFolderInWorkspace: mockAssertFolderInWorkspace,
   assertFolderMutable: mockAssertFolderMutable,
   FolderLockedError: class FolderLockedError extends Error {
     status = 423
   },
+  FolderNotFoundError: class FolderNotFoundError extends Error {
+    status = 400
+  },
+}))
+
+vi.mock('@/lib/workflows/persistence/custom-tools-persistence', () => ({
+  extractAndPersistCustomTools: mockExtractAndPersistCustomTools,
+}))
+
+/**
+ * Mocked to keep the block registry (and its icon/CSS graph) out of this
+ * suite. The real normalization is covered by `prepare-state.test.ts` and by
+ * the end-to-end round trip in `import-export-roundtrip.test.ts`.
+ */
+vi.mock('@/lib/workflows/persistence/prepare-state', () => ({
+  prepareWorkflowStateForPersistence: mockPrepareWorkflowState,
 }))
 
 vi.mock('@sim/db', () => ({
@@ -84,8 +107,19 @@ import { POST } from '@/app/api/v1/workflows/import/route'
 const WORKSPACE_ID = 'ws-1'
 const CREATED_AT = new Date('2026-07-01T00:00:00Z')
 
+/** A schema-valid block: the route now gates on `workflowStateSchema`. */
+const VALID_BLOCK = {
+  id: 'block-1',
+  type: 'starter',
+  name: 'Start',
+  position: { x: 0, y: 0 },
+  subBlocks: {},
+  outputs: {},
+  enabled: true,
+}
+
 const PARSED_STATE = {
-  blocks: { 'block-1': { id: 'block-1', type: 'starter', position: { x: 0, y: 0 } } },
+  blocks: { 'block-1': VALID_BLOCK },
   edges: [],
   loops: {},
   parallels: {},
@@ -120,6 +154,12 @@ describe('POST /api/v1/workflows/import', () => {
     mockCheckRateLimit.mockResolvedValue({ allowed: true, userId: 'user-1' })
     mockValidateWorkspaceAccess.mockResolvedValue(null)
     mockAssertFolderMutable.mockResolvedValue(undefined)
+    mockAssertFolderInWorkspace.mockResolvedValue(undefined)
+    mockExtractAndPersistCustomTools.mockResolvedValue({ saved: 0, errors: [] })
+    mockPrepareWorkflowState.mockImplementation((state: { blocks: unknown; edges: unknown }) => ({
+      state: { blocks: state.blocks, edges: state.edges, loops: {}, parallels: {} },
+      warnings: [],
+    }))
     mockParseWorkflowJson.mockReturnValue({ data: { ...PARSED_STATE }, errors: [] })
     mockSaveWorkflowToNormalizedTables.mockResolvedValue({ success: true })
     mockPerformCreateWorkflow.mockResolvedValue({