fix(workflows): enforce server-side cascade lock checks and close security gaps

- Split lock utilities into pure functions (lock.ts) and DB-backed functions (lock-db.ts)
- Add cascade lock checks to all API routes: workflow CRUD, folder CRUD, state save, reorder/move
- Add workflow lock check to Socket.IO collaborative operations
- Block drag-and-drop for locked items and into locked folders
- Fix lock bypass when isLocked is included alongside other fields in request body
- Disable duplicate action for locked workflows and folders
- Make isLocked required in WorkflowMetadata type (matches NOT NULL schema)
- Add 16 unit tests for lock utility functions
- Re-export pure functions from hooks/use-effective-lock.ts for client compatibility

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/app/academy/components/sandbox-canvas-provider.tsx

@@ -216,6 +216,7 @@ export function SandboxCanvasProvider({
       workspaceId: SANDBOX_WORKSPACE_ID,
       sortOrder: 0,
       isSandbox: true,
+      isLocked: false,
     }
 
     useWorkflowStore.getState().replaceWorkflowState(workflowState)

apps/sim/app/api/folders/[id]/route.ts

@@ -6,6 +6,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getSession } from '@/lib/auth'
 import { captureServerEvent } from '@/lib/posthog/server'
+import { isFolderEffectivelyLockedDb } from '@/lib/workflows/lock-db'
 import { performDeleteFolder } from '@/lib/workflows/orchestration'
 import { checkForCircularReference } from '@/lib/workflows/utils'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
@@ -78,15 +79,15 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
       )
     }
 
-    // If folder is locked, only allow toggling isLocked and isExpanded (by admins)
-    if (existingFolder.isLocked && isLocked === undefined) {
-      // Allow isExpanded toggle on locked folders (UI collapse/expand)
-      const hasNonExpandUpdates =
+    // If folder is effectively locked, only allow isLocked toggle (admin) and isExpanded toggle
+    const effectivelyLocked = await isFolderEffectivelyLockedDb(id)
+    if (effectivelyLocked) {
+      const hasNonAllowedUpdates =
         name !== undefined ||
         color !== undefined ||
         parentId !== undefined ||
         sortOrder !== undefined
-      if (hasNonExpandUpdates) {
+      if (hasNonAllowedUpdates) {
         return NextResponse.json({ error: 'Folder is locked' }, { status: 403 })
       }
     }
@@ -167,7 +168,8 @@ export async function DELETE(
       )
     }
 
-    if (existingFolder.isLocked) {
+    const effectivelyLocked = await isFolderEffectivelyLockedDb(id)
+    if (effectivelyLocked) {
       return NextResponse.json({ error: 'Folder is locked' }, { status: 403 })
     }
 

apps/sim/app/api/folders/reorder/route.ts

@@ -6,6 +6,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getSession } from '@/lib/auth'
 import { generateRequestId } from '@/lib/core/utils/request'
+import { isFolderEffectivelyLocked } from '@/lib/workflows/lock'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('FolderReorderAPI')
@@ -44,7 +45,12 @@ export async function PUT(req: NextRequest) {
 
     const folderIds = updates.map((u) => u.id)
     const existingFolders = await db
-      .select({ id: workflowFolder.id, workspaceId: workflowFolder.workspaceId })
+      .select({
+        id: workflowFolder.id,
+        workspaceId: workflowFolder.workspaceId,
+        parentId: workflowFolder.parentId,
+        isLocked: workflowFolder.isLocked,
+      })
       .from(workflowFolder)
       .where(inArray(workflowFolder.id, folderIds))
 
@@ -58,6 +64,37 @@ export async function PUT(req: NextRequest) {
       return NextResponse.json({ error: 'No valid folders to update' }, { status: 400 })
     }
 
+    // Build folder map for cascade lock checks
+    const allFolders = await db
+      .select({
+        id: workflowFolder.id,
+        parentId: workflowFolder.parentId,
+        isLocked: workflowFolder.isLocked,
+      })
+      .from(workflowFolder)
+      .where(eq(workflowFolder.workspaceId, workspaceId))
+
+    const folderMap: Record<string, { id: string; parentId: string | null; isLocked: boolean }> = {}
+    for (const f of allFolders) {
+      folderMap[f.id] = f
+    }
+
+    // Block if any source folder or destination parent is effectively locked
+    for (const update of validUpdates) {
+      if (isFolderEffectivelyLocked(update.id, folderMap)) {
+        return NextResponse.json(
+          { error: 'Cannot move or reorder a locked folder' },
+          { status: 403 }
+        )
+      }
+      if (update.parentId && isFolderEffectivelyLocked(update.parentId, folderMap)) {
+        return NextResponse.json(
+          { error: 'Cannot move folders into a locked folder' },
+          { status: 403 }
+        )
+      }
+    }
+
     await db.transaction(async (tx) => {
       for (const update of validUpdates) {
         const updateData: Record<string, unknown> = {

apps/sim/app/api/workflows/[id]/route.ts

@@ -7,6 +7,7 @@ import { z } from 'zod'
 import { AuthType, checkHybridAuth, checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { captureServerEvent } from '@/lib/posthog/server'
+import { isFolderEffectivelyLockedDb } from '@/lib/workflows/lock-db'
 import { performDeleteWorkflow } from '@/lib/workflows/orchestration'
 import { loadWorkflowFromNormalizedTables } from '@/lib/workflows/persistence/utils'
 import { authorizeWorkflowByWorkspacePermission, getWorkflowById } from '@/lib/workflows/utils'
@@ -183,7 +184,10 @@ export async function DELETE(
       )
     }
 
-    if (workflowData.isLocked) {
+    const isLocked =
+      workflowData.isLocked ||
+      (workflowData.folderId ? await isFolderEffectivelyLockedDb(workflowData.folderId) : false)
+    if (isLocked) {
       return NextResponse.json({ error: 'Workflow is locked' }, { status: 403 })
     }
 
@@ -308,9 +312,20 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
       }
     }
 
-    // If workflow is locked, only allow toggling isLocked (by admins)
-    if (workflowData.isLocked && updates.isLocked === undefined) {
-      return NextResponse.json({ error: 'Workflow is locked' }, { status: 403 })
+    // If workflow is effectively locked, only allow isLocked toggle (by admins)
+    const effectivelyLocked =
+      workflowData.isLocked ||
+      (workflowData.folderId ? await isFolderEffectivelyLockedDb(workflowData.folderId) : false)
+    if (effectivelyLocked) {
+      const hasNonLockUpdates =
+        updates.name !== undefined ||
+        updates.description !== undefined ||
+        updates.color !== undefined ||
+        updates.folderId !== undefined ||
+        updates.sortOrder !== undefined
+      if (hasNonLockUpdates) {
+        return NextResponse.json({ error: 'Workflow is locked' }, { status: 403 })
+      }
     }
 
     const updateData: Record<string, unknown> = { updatedAt: new Date() }

apps/sim/app/api/workflows/[id]/state/route.ts

@@ -12,6 +12,7 @@ import {
   loadWorkflowFromNormalizedTables,
   saveWorkflowToNormalizedTables,
 } from '@/lib/workflows/persistence/utils'
+import { isFolderEffectivelyLockedDb } from '@/lib/workflows/lock-db'
 import { sanitizeAgentToolsInBlocks } from '@/lib/workflows/sanitization/validation'
 import { authorizeWorkflowByWorkspacePermission } from '@/lib/workflows/utils'
 import { validateEdges } from '@/stores/workflows/workflow/edge-validation'
@@ -199,6 +200,14 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
       )
     }
 
+    // Check if workflow is effectively locked (directly or via folder cascade)
+    const isLocked =
+      workflowData.isLocked ||
+      (workflowData.folderId ? await isFolderEffectivelyLockedDb(workflowData.folderId) : false)
+    if (isLocked) {
+      return NextResponse.json({ error: 'Workflow is locked' }, { status: 403 })
+    }
+
     // Sanitize custom tools in agent blocks before saving
     const { blocks: sanitizedBlocks, warnings } = sanitizeAgentToolsInBlocks(
       state.blocks as Record<string, BlockState>

apps/sim/app/api/workflows/reorder/route.ts

@@ -1,11 +1,12 @@
 import { db } from '@sim/db'
-import { workflow } from '@sim/db/schema'
+import { workflow, workflowFolder } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { eq, inArray } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { generateRequestId } from '@/lib/core/utils/request'
+import { isFolderEffectivelyLocked, isWorkflowEffectivelyLocked } from '@/lib/workflows/lock'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('WorkflowReorderAPI')
@@ -44,7 +45,12 @@ export async function PUT(req: NextRequest) {
 
     const workflowIds = updates.map((u) => u.id)
     const existingWorkflows = await db
-      .select({ id: workflow.id, workspaceId: workflow.workspaceId })
+      .select({
+        id: workflow.id,
+        workspaceId: workflow.workspaceId,
+        isLocked: workflow.isLocked,
+        folderId: workflow.folderId,
+      })
       .from(workflow)
       .where(inArray(workflow.id, workflowIds))
 
@@ -58,6 +64,41 @@ export async function PUT(req: NextRequest) {
       return NextResponse.json({ error: 'No valid workflows to update' }, { status: 400 })
     }
 
+    // Build folder map for cascade lock checks
+    const allFolders = await db
+      .select({
+        id: workflowFolder.id,
+        parentId: workflowFolder.parentId,
+        isLocked: workflowFolder.isLocked,
+      })
+      .from(workflowFolder)
+      .where(eq(workflowFolder.workspaceId, workspaceId))
+
+    const folderMap: Record<string, { id: string; parentId: string | null; isLocked: boolean }> = {}
+    for (const f of allFolders) {
+      folderMap[f.id] = f
+    }
+
+    // Build workflow lookup for lock checks
+    const workflowLookup = new Map(existingWorkflows.map((w) => [w.id, w]))
+
+    // Block if any source workflow or destination folder is effectively locked
+    for (const update of validUpdates) {
+      const wf = workflowLookup.get(update.id)
+      if (wf && isWorkflowEffectivelyLocked(wf, folderMap)) {
+        return NextResponse.json(
+          { error: 'Cannot move or reorder a locked workflow' },
+          { status: 403 }
+        )
+      }
+      if (update.folderId && isFolderEffectivelyLocked(update.folderId, folderMap)) {
+        return NextResponse.json(
+          { error: 'Cannot move workflows into a locked folder' },
+          { status: 403 }
+        )
+      }
+    }
+
     await db.transaction(async (tx) => {
       for (const update of validUpdates) {
         const updateData: Record<string, unknown> = {

apps/sim/app/workspace/[workspaceId]/home/hooks/use-chat.ts

@@ -326,6 +326,7 @@ function ensureWorkflowInRegistry(resourceId: string, title: string, workspaceId
     workspaceId,
     folderId: null,
     sortOrder,
+    isLocked: false,
   }
   const queryClient = getQueryClient()
   const key = workflowKeys.list(workspaceId, 'active')

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/folder-item/folder-item.tsx

@@ -498,7 +498,7 @@ export function FolderItem({
         onClick={handleClick}
         onKeyDown={handleKeyDown}
         onContextMenu={handleContextMenu}
-        draggable={!isEditing && !dragDisabled}
+        draggable={!isEditing && !dragDisabled && !isEffectivelyLocked}
         onDragStart={handleDragStart}
         onDragEnd={handleDragEnd}
         {...hoverHandlers}
@@ -592,7 +592,10 @@ export function FolderItem({
           !userPermissions.canEdit || createFolderMutation.isPending || isEffectivelyLocked
         }
         disableDuplicate={
-          !userPermissions.canEdit || isDuplicatingSelection || !hasExportableContent
+          !userPermissions.canEdit ||
+          isDuplicatingSelection ||
+          !hasExportableContent ||
+          isEffectivelyLocked
         }
         disableExport={!userPermissions.canEdit || isExporting || !hasExportableContent}
         disableDelete={!userPermissions.canEdit || !canDeleteSelection || isEffectivelyLocked}

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/workflow-item/workflow-item.tsx

@@ -423,7 +423,7 @@ export function WorkflowItem({
             'hover-hover:bg-[var(--surface-hover)]',
           (isDragging || (isAnyDragActive && isSelected)) && 'opacity-50'
         )}
-        draggable={!isEditing && !dragDisabled}
+        draggable={!isEditing && !dragDisabled && !isEffectivelyLocked}
         onDragStart={handleDragStart}
         onDragEnd={handleDragEnd}
         onClick={handleClick}
@@ -509,7 +509,7 @@ export function WorkflowItem({
         showExport={true}
         showColorChange={!isMixedSelection && selectedWorkflows.size <= 1}
         disableRename={!userPermissions.canEdit || isEffectivelyLocked}
-        disableDuplicate={!userPermissions.canEdit || isDuplicatingSelection}
+        disableDuplicate={!userPermissions.canEdit || isDuplicatingSelection || isEffectivelyLocked}
         disableExport={!userPermissions.canEdit}
         disableColorChange={!userPermissions.canEdit || isEffectivelyLocked}
         disableDelete={!userPermissions.canEdit || !canDeleteSelection || isEffectivelyLocked}

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/hooks/use-drag-drop.ts

@@ -2,6 +2,7 @@ import { useCallback, useEffect, useRef, useState } from 'react'
 import { createLogger } from '@sim/logger'
 import { useParams } from 'next/navigation'
 import { getFolderPath } from '@/lib/folders/tree'
+import { isFolderEffectivelyLocked } from '@/lib/workflows/lock'
 import { useReorderFolders } from '@/hooks/queries/folders'
 import { getFolderMap } from '@/hooks/queries/utils/folder-cache'
 import { getWorkflows } from '@/hooks/queries/utils/workflow-cache'
@@ -408,6 +409,15 @@ export function useDragDrop(options: UseDragDropOptions = {}) {
 
       try {
         const destinationFolderId = getDestinationFolderId(indicator)
+
+        // Block drops into locked folders
+        if (destinationFolderId) {
+          const folders = getFolderMap(workspaceId)
+          if (folders && isFolderEffectivelyLocked(destinationFolderId, folders)) {
+            return
+          }
+        }
+
         const validFolderIds = folderIds.filter((id) => canMoveFolderTo(id, destinationFolderId))
         if (workflowIds.length === 0 && validFolderIds.length === 0) {
           return