refactor(locks): hoist constant folder-lock check out of move loop; scope test mocks with Once

Author: waleedlatif1

apps/sim/app/api/workflows/route.test.ts

@@ -89,7 +89,7 @@ describe('Workflows API Route - POST ordering', () => {
 
   it('rejects creating a workflow inside a locked folder', async () => {
     const { FolderLockedError } = await import('@sim/workflow-authz')
-    workflowAuthzMockFns.mockAssertFolderMutable.mockRejectedValue(
+    workflowAuthzMockFns.mockAssertFolderMutable.mockRejectedValueOnce(
       new FolderLockedError('Folder is locked')
     )
 

apps/sim/lib/copilot/tools/handlers/workflow/mutations.test.ts

@@ -155,7 +155,7 @@ describe('lock enforcement', () => {
     ensureWorkflowAccessMock.mockResolvedValue({
       workflow: { id: 'workflow-1', variables: {} },
     })
-    workflowAuthzMockFns.mockAssertWorkflowMutable.mockRejectedValue(
+    workflowAuthzMockFns.mockAssertWorkflowMutable.mockRejectedValueOnce(
       new Error('Workflow is locked')
     )
 
@@ -178,15 +178,17 @@ describe('lock enforcement', () => {
       workflow: { id: 'workflow-1', name: 'WF', folderId: null },
     })
     verifyFolderWorkspaceMock.mockResolvedValue(true)
-    workflowAuthzMockFns.mockAssertFolderMutable.mockRejectedValue(new Error('Folder is locked'))
+    workflowAuthzMockFns.mockAssertFolderMutable.mockRejectedValueOnce(
+      new Error('Folder is locked')
+    )
 
     const result = await executeMoveWorkflow(
       { workflowIds: ['workflow-1'], folderId: 'locked-folder' },
       { userId: 'user-1' } as any
     )
 
     expect(result.success).toBe(false)
-    expect(result.output).toMatchObject({ moved: [], failed: ['workflow-1'] })
+    expect(result.error).toBe('Folder is locked')
     expect(performUpdateWorkflowMock).not.toHaveBeenCalled()
   })
 })

apps/sim/lib/copilot/tools/handlers/workflow/mutations.ts

@@ -676,6 +676,8 @@ export async function executeMoveWorkflow(
     const moved: string[] = []
     const failed: string[] = []
 
+    await assertFolderMutable(folderId)
+
     for (const workflowId of workflowIds) {
       try {
         const { workspaceId, workflow } = await ensureWorkflowAccess(
@@ -694,7 +696,6 @@ export async function executeMoveWorkflow(
           }
         }
         await assertWorkflowMutable(workflowId)
-        await assertFolderMutable(folderId)
         assertWorkflowMutationNotAborted(context)
         const result = await performUpdateWorkflow({
           workflowId,