refactor(workflows): merge lock-db.ts into utils.ts

Move isFolderEffectivelyLockedDb and isWorkflowEffectivelyLockedDb into
utils.ts which already imports @sim/db and contains other server-side
workflow helpers. Eliminates the non-standard -db suffix file naming
and consolidates duplicate imports across 5 route files.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/app/api/folders/[id]/duplicate/route.ts

@@ -8,8 +8,8 @@ import { AuditAction, AuditResourceType, recordAudit } from '@/lib/audit/log'
 import { getSession } from '@/lib/auth'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { generateId } from '@/lib/core/utils/uuid'
-import { isFolderEffectivelyLockedDb } from '@/lib/workflows/lock-db'
 import { duplicateWorkflow } from '@/lib/workflows/persistence/duplicate'
+import { isFolderEffectivelyLockedDb } from '@/lib/workflows/utils'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('FolderDuplicateAPI')

apps/sim/app/api/folders/[id]/route.ts

@@ -6,9 +6,8 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getSession } from '@/lib/auth'
 import { captureServerEvent } from '@/lib/posthog/server'
-import { isFolderEffectivelyLockedDb } from '@/lib/workflows/lock-db'
 import { performDeleteFolder } from '@/lib/workflows/orchestration'
-import { checkForCircularReference } from '@/lib/workflows/utils'
+import { checkForCircularReference, isFolderEffectivelyLockedDb } from '@/lib/workflows/utils'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('FoldersIDAPI')

apps/sim/app/api/folders/route.ts

@@ -8,7 +8,7 @@ import { AuditAction, AuditResourceType, recordAudit } from '@/lib/audit/log'
 import { getSession } from '@/lib/auth'
 import { generateId } from '@/lib/core/utils/uuid'
 import { captureServerEvent } from '@/lib/posthog/server'
-import { isFolderEffectivelyLockedDb } from '@/lib/workflows/lock-db'
+import { isFolderEffectivelyLockedDb } from '@/lib/workflows/utils'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('FoldersAPI')

apps/sim/app/api/workflows/[id]/duplicate/route.ts

@@ -9,8 +9,8 @@ import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { PlatformEvents } from '@/lib/core/telemetry'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { captureServerEvent } from '@/lib/posthog/server'
-import { isFolderEffectivelyLockedDb } from '@/lib/workflows/lock-db'
 import { duplicateWorkflow } from '@/lib/workflows/persistence/duplicate'
+import { isFolderEffectivelyLockedDb } from '@/lib/workflows/utils'
 
 const logger = createLogger('WorkflowDuplicateAPI')
 

apps/sim/app/api/workflows/[id]/route.ts

@@ -7,10 +7,13 @@ import { z } from 'zod'
 import { AuthType, checkHybridAuth, checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { captureServerEvent } from '@/lib/posthog/server'
-import { isWorkflowEffectivelyLockedDb } from '@/lib/workflows/lock-db'
 import { performDeleteWorkflow } from '@/lib/workflows/orchestration'
 import { loadWorkflowFromNormalizedTables } from '@/lib/workflows/persistence/utils'
-import { authorizeWorkflowByWorkspacePermission, getWorkflowById } from '@/lib/workflows/utils'
+import {
+  authorizeWorkflowByWorkspacePermission,
+  getWorkflowById,
+  isWorkflowEffectivelyLockedDb,
+} from '@/lib/workflows/utils'
 
 const logger = createLogger('WorkflowByIdAPI')
 

apps/sim/app/api/workflows/[id]/state/route.ts

@@ -7,14 +7,16 @@ import { z } from 'zod'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { env } from '@/lib/core/config/env'
 import { generateRequestId } from '@/lib/core/utils/request'
-import { isWorkflowEffectivelyLockedDb } from '@/lib/workflows/lock-db'
 import { extractAndPersistCustomTools } from '@/lib/workflows/persistence/custom-tools-persistence'
 import {
   loadWorkflowFromNormalizedTables,
   saveWorkflowToNormalizedTables,
 } from '@/lib/workflows/persistence/utils'
 import { sanitizeAgentToolsInBlocks } from '@/lib/workflows/sanitization/validation'
-import { authorizeWorkflowByWorkspacePermission } from '@/lib/workflows/utils'
+import {
+  authorizeWorkflowByWorkspacePermission,
+  isWorkflowEffectivelyLockedDb,
+} from '@/lib/workflows/utils'
 import { validateEdges } from '@/stores/workflows/workflow/edge-validation'
 import type { BlockState, WorkflowState } from '@/stores/workflows/workflow/types'
 import { generateLoopBlocks, generateParallelBlocks } from '@/stores/workflows/workflow/utils'

apps/sim/app/api/workflows/[id]/variables/route.ts

@@ -7,8 +7,10 @@ import { z } from 'zod'
 import { AuditAction, AuditResourceType, recordAudit } from '@/lib/audit/log'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { generateRequestId } from '@/lib/core/utils/request'
-import { isWorkflowEffectivelyLockedDb } from '@/lib/workflows/lock-db'
-import { authorizeWorkflowByWorkspacePermission } from '@/lib/workflows/utils'
+import {
+  authorizeWorkflowByWorkspacePermission,
+  isWorkflowEffectivelyLockedDb,
+} from '@/lib/workflows/utils'
 import type { Variable } from '@/stores/variables/types'
 
 const logger = createLogger('WorkflowVariablesAPI')

apps/sim/app/api/workflows/route.ts

@@ -11,9 +11,13 @@ import { generateId } from '@/lib/core/utils/uuid'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { getNextWorkflowColor } from '@/lib/workflows/colors'
 import { buildDefaultWorkflowArtifacts } from '@/lib/workflows/defaults'
-import { isFolderEffectivelyLockedDb } from '@/lib/workflows/lock-db'
 import { saveWorkflowToNormalizedTables } from '@/lib/workflows/persistence/utils'
-import { deduplicateWorkflowName, listWorkflows, type WorkflowScope } from '@/lib/workflows/utils'
+import {
+  deduplicateWorkflowName,
+  isFolderEffectivelyLockedDb,
+  listWorkflows,
+  type WorkflowScope,
+} from '@/lib/workflows/utils'
 import { getUserEntityPermissions, workspaceExists } from '@/lib/workspaces/permissions/utils'
 import { verifyWorkspaceMembership } from '@/app/api/workflows/utils'
 

apps/sim/lib/workflows/lock-db.ts

@@ -544,6 +544,58 @@ export async function setWorkflowVariables(workflowId: string, variables: Record
     .where(eq(workflowTable.id, workflowId))
 }
 
+// ── Lock checks ──
+
+/**
+ * DB-backed cascade lock check for folders.
+ * Walks up the folder tree via DB queries, checking isLocked at each level.
+ * Uses a visited set to guard against circular references.
+ */
+export async function isFolderEffectivelyLockedDb(folderId: string): Promise<boolean> {
+  let currentId: string | null = folderId
+  const visited = new Set<string>()
+
+  while (currentId) {
+    if (visited.has(currentId)) return false
+    visited.add(currentId)
+
+    const [folder] = await db
+      .select({
+        isLocked: workflowFolder.isLocked,
+        parentId: workflowFolder.parentId,
+      })
+      .from(workflowFolder)
+      .where(eq(workflowFolder.id, currentId))
+      .limit(1)
+
+    if (!folder) return false
+    if (folder.isLocked) return true
+    currentId = folder.parentId
+  }
+
+  return false
+}
+
+/**
+ * DB-backed cascade lock check for workflows.
+ * Checks the workflow's own isLocked flag, then walks its folder chain.
+ */
+export async function isWorkflowEffectivelyLockedDb(workflowId: string): Promise<boolean> {
+  const [wf] = await db
+    .select({
+      isLocked: workflowTable.isLocked,
+      folderId: workflowTable.folderId,
+    })
+    .from(workflowTable)
+    .where(eq(workflowTable.id, workflowId))
+    .limit(1)
+
+  if (!wf) return false
+  if (wf.isLocked) return true
+  if (wf.folderId) return isFolderEffectivelyLockedDb(wf.folderId)
+  return false
+}
+
 // ── Folder CRUD ──
 
 export interface CreateFolderInput {