fix(workflows): close duplicate lock bypass and trim redundant query fields

- Fix workflow duplicate route: when folderId is omitted, resolve source
  workflow's folder and check its lock status before allowing duplication
- Remove unnecessary parentId/isLocked fields from folders reorder
  existingFolders query (lock checks use the separate allFolders query)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/app/api/folders/reorder/route.ts

@@ -48,8 +48,6 @@ export async function PUT(req: NextRequest) {
       .select({
         id: workflowFolder.id,
         workspaceId: workflowFolder.workspaceId,
-        parentId: workflowFolder.parentId,
-        isLocked: workflowFolder.isLocked,
       })
       .from(workflowFolder)
       .where(inArray(workflowFolder.id, folderIds))

apps/sim/app/api/workflows/[id]/duplicate/route.ts

@@ -1,4 +1,7 @@
+import { db } from '@sim/db'
+import { workflow } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
+import { eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { AuditAction, AuditResourceType, recordAudit } from '@/lib/audit/log'
@@ -38,8 +41,17 @@ export async function POST(req: NextRequest, { params }: { params: Promise<{ id:
     const { name, description, color, workspaceId, folderId, newId } =
       DuplicateRequestSchema.parse(body)
 
-    if (folderId) {
-      const folderLocked = await isFolderEffectivelyLockedDb(folderId)
+    let targetFolderId = folderId
+    if (targetFolderId === undefined) {
+      const [source] = await db
+        .select({ folderId: workflow.folderId })
+        .from(workflow)
+        .where(eq(workflow.id, sourceWorkflowId))
+        .limit(1)
+      targetFolderId = source?.folderId ?? null
+    }
+    if (targetFolderId) {
+      const folderLocked = await isFolderEffectivelyLockedDb(targetFolderId)
       if (folderLocked) {
         return NextResponse.json(
           { error: 'Cannot duplicate a workflow into a locked folder' },