update path

crates/api_clients/artcraft/artcraft_api_defs/src/folders/folder.rs

@@ -39,7 +39,7 @@ pub struct ListFoldersSuccessResponse {
 
 #[derive(Deserialize, ToSchema)]
 pub struct FolderPathInfo {
-  pub folder_token: String,
+  pub folder_token: FolderToken,
 }
 
 #[derive(Serialize, ToSchema)]

crates/api_clients/artcraft/artcraft_api_defs/src/folders/media_files.rs

@@ -1,6 +1,7 @@
 use serde_derive::{Deserialize, Serialize};
 use utoipa::{IntoParams, ToSchema};
 
+use tokens::tokens::folders::FolderToken;
 use tokens::tokens::media_files::MediaFileToken;
 
 use crate::folders::common::FolderMediaFileInfo;
@@ -9,7 +10,7 @@ use crate::folders::common::FolderMediaFileInfo;
 
 #[derive(Deserialize, ToSchema)]
 pub struct FolderMediaFilesPathInfo {
-  pub folder_token: String,
+  pub folder_token: FolderToken,
 }
 
 #[derive(Deserialize, ToSchema, IntoParams)]

crates/api_clients/artcraft/artcraft_api_defs/src/folders/subfolder.rs

@@ -9,7 +9,7 @@ use crate::folders::common::FolderInfo;
 
 #[derive(Deserialize, ToSchema)]
 pub struct SubfolderPathInfo {
-  pub folder_token: String,
+  pub folder_token: FolderToken,
 }
 
 #[derive(Deserialize, ToSchema, IntoParams)]

crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/color_code_folder_handler.rs

@@ -23,7 +23,7 @@ const MAX_COLOR_CODE_LEN: usize = 16;
   put,
   tag = "Folders",
   path = "/v1/folders/folder/{folder_token}/color_code",
-  params(("folder_token" = String, description = "Folder token")),
+  params(("folder_token" = FolderToken, description = "Folder token")),
   request_body = SetFolderColorCodeRequest,
   responses(
     (status = 200, body = SetFolderColorCodeSuccessResponse),
@@ -63,10 +63,9 @@ pub async fn color_code_folder_handler(
     }
   }
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let rows_affected = update_folder_color_code(UpdateFolderColorCodeArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     maybe_color_code: trimmed.as_deref(),
     mysql_executor: &mut *conn,

crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/delete_folder_handler.rs

@@ -21,7 +21,7 @@ use crate::state::server_state::ServerState;
   delete,
   tag = "Folders",
   path = "/v1/folders/folder/{folder_token}",
-  params(("folder_token" = String, description = "Folder token")),
+  params(("folder_token" = FolderToken, description = "Folder token")),
   responses(
     (status = 200, body = DeleteFolderSuccessResponse),
     (status = 401, body = CommonWebError),
@@ -43,10 +43,9 @@ pub async fn delete_folder_handler(
     &http_request, &server_state.session_checker, &mut conn,
   ).await.map_err(|_| CommonWebError::NotAuthorized)?;
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let rows_affected = soft_delete_folder(SoftDeleteFolderArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,

crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/get_folder_handler.rs

@@ -21,7 +21,7 @@ use crate::state::server_state::ServerState;
   get,
   tag = "Folders",
   path = "/v1/folders/folder/{folder_token}",
-  params(("folder_token" = String, description = "Folder token")),
+  params(("folder_token" = FolderToken, description = "Folder token")),
   responses(
     (status = 200, body = GetFolderSuccessResponse),
     (status = 401, body = CommonWebError),
@@ -43,10 +43,9 @@ pub async fn get_folder_handler(
     &http_request, &server_state.session_checker, &mut conn,
   ).await.map_err(|_| CommonWebError::NotAuthorized)?;
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let row = get_folder_for_owner(GetFolderForOwnerArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,

crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/rename_folder_handler.rs

@@ -23,7 +23,7 @@ const MAX_NAME_LEN: usize = 255;
   put,
   tag = "Folders",
   path = "/v1/folders/folder/{folder_token}/rename",
-  params(("folder_token" = String, description = "Folder token")),
+  params(("folder_token" = FolderToken, description = "Folder token")),
   request_body = RenameFolderRequest,
   responses(
     (status = 200, body = RenameFolderSuccessResponse),
@@ -58,10 +58,9 @@ pub async fn rename_folder_handler(
     ));
   }
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let rows_affected = update_folder_name(UpdateFolderNameArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     new_name: &new_name,
     mysql_executor: &mut *conn,

crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/star_folder_handler.rs

@@ -21,7 +21,7 @@ use crate::state::server_state::ServerState;
   put,
   tag = "Folders",
   path = "/v1/folders/folder/{folder_token}/star",
-  params(("folder_token" = String, description = "Folder token")),
+  params(("folder_token" = FolderToken, description = "Folder token")),
   request_body = SetFolderStarRequest,
   responses(
     (status = 200, body = SetFolderStarSuccessResponse),
@@ -45,10 +45,9 @@ pub async fn star_folder_handler(
     &http_request, &server_state.session_checker, &mut conn,
   ).await.map_err(|_| CommonWebError::NotAuthorized)?;
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let rows_affected = update_folder_has_star(UpdateFolderHasStarArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     has_star: request.has_star,
     mysql_executor: &mut *conn,

crates/service/web/storyteller_web/src/http_server/endpoints/folders/media_files/bulk_add_folder_media_files_handler.rs

@@ -34,7 +34,7 @@ const MAX_BULK: usize = 500;
   put,
   tag = "Folders",
   path = "/v1/folders/media_files/{folder_token}/bulk_add",
-  params(("folder_token" = String, description = "Folder token")),
+  params(("folder_token" = FolderToken, description = "Folder token")),
   request_body = BulkAddFolderMediaFilesRequest,
   responses(
     (status = 200, body = BulkAddFolderMediaFilesSuccessResponse),
@@ -65,10 +65,9 @@ pub async fn bulk_add_folder_media_files_handler(
     ));
   }
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let folder = get_folder_for_owner(GetFolderForOwnerArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,
@@ -91,7 +90,7 @@ pub async fn bulk_add_folder_media_files_handler(
 
   if !accepted.is_empty() {
     bulk_insert_folder_media_files(BulkInsertFolderMediaFilesArgs {
-      folder_token: &folder_token,
+      folder_token: &path.folder_token,
       media_file_tokens: &accepted,
       mysql_executor: &mut *conn,
       phantom: PhantomData,

crates/service/web/storyteller_web/src/http_server/endpoints/folders/media_files/bulk_remove_folder_media_files_handler.rs

@@ -29,7 +29,7 @@ const MAX_BULK: usize = 500;
   put,
   tag = "Folders",
   path = "/v1/folders/media_files/{folder_token}/bulk_remove",
-  params(("folder_token" = String, description = "Folder token")),
+  params(("folder_token" = FolderToken, description = "Folder token")),
   request_body = BulkRemoveFolderMediaFilesRequest,
   responses(
     (status = 200, body = BulkRemoveFolderMediaFilesSuccessResponse),
@@ -60,10 +60,9 @@ pub async fn bulk_remove_folder_media_files_handler(
     ));
   }
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let folder = get_folder_for_owner(GetFolderForOwnerArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,
@@ -76,7 +75,7 @@ pub async fn bulk_remove_folder_media_files_handler(
   }
 
   let removed_count = bulk_delete_folder_media_files(BulkDeleteFolderMediaFilesArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     media_file_tokens: &request.media_file_tokens,
     mysql_executor: &mut *conn,
     phantom: PhantomData,

crates/service/web/storyteller_web/src/http_server/endpoints/folders/media_files/list_folder_media_files_handler.rs

@@ -30,7 +30,7 @@ const MAX_LIMIT: u32 = 1000;
   tag = "Folders",
   path = "/v1/folders/media_files/{folder_token}",
   params(
-    ("folder_token" = String, description = "Folder token"),
+    ("folder_token" = FolderToken, description = "Folder token"),
     ListFolderMediaFilesQueryParams,
   ),
   responses(
@@ -56,10 +56,9 @@ pub async fn list_folder_media_files_handler(
     &http_request, &server_state.session_checker, &mut conn,
   ).await.map_err(|_| CommonWebError::NotAuthorized)?;
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let folder = get_folder_for_owner(GetFolderForOwnerArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,
@@ -87,7 +86,7 @@ pub async fn list_folder_media_files_handler(
   };
 
   let rows = list_folder_media_files(ListFolderMediaFilesArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     maybe_cursor_id,
     limit,
     mysql_executor: &mut *conn,

crates/service/web/storyteller_web/src/http_server/endpoints/folders/subfolder/bulk_add_subfolders_handler.rs

@@ -32,7 +32,7 @@ const MAX_BULK: usize = 500;
   put,
   tag = "Folders",
   path = "/v1/folders/subfolders/{folder_token}/bulk_add",
-  params(("folder_token" = String, description = "Parent folder token")),
+  params(("folder_token" = FolderToken, description = "Parent folder token")),
   request_body = BulkAddSubfoldersRequest,
   responses(
     (status = 200, body = BulkAddSubfoldersSuccessResponse),
@@ -63,10 +63,9 @@ pub async fn bulk_add_subfolders_handler(
     ));
   }
 
-  let parent_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let parent = get_folder_for_owner(GetFolderForOwnerArgs {
-    folder_token: &parent_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,
@@ -91,7 +90,7 @@ pub async fn bulk_add_subfolders_handler(
   if !accepted.is_empty() {
     bulk_set_parent_folder(BulkSetParentFolderArgs {
       child_tokens: &accepted,
-      new_parent_token: &parent_token,
+      new_parent_token: &path.folder_token,
       owner_user_token: &user_session.user_token,
       mysql_executor: &mut *conn,
       phantom: PhantomData,

crates/service/web/storyteller_web/src/http_server/endpoints/folders/subfolder/bulk_remove_subfolders_handler.rs

@@ -25,7 +25,7 @@ const MAX_BULK: usize = 500;
   put,
   tag = "Folders",
   path = "/v1/folders/subfolders/{folder_token}/bulk_remove",
-  params(("folder_token" = String, description = "Parent folder token")),
+  params(("folder_token" = FolderToken, description = "Parent folder token")),
   request_body = BulkRemoveSubfoldersRequest,
   responses(
     (status = 200, body = BulkRemoveSubfoldersSuccessResponse),
@@ -55,14 +55,13 @@ pub async fn bulk_remove_subfolders_handler(
     ));
   }
 
-  let from_parent_token = FolderToken::new_from_str(path.folder_token.trim());
 
   // No parent existence check — the UPDATE's WHERE clause already gates
   // on owner_user_token AND current parent, so this is naturally a no-op
   // for rows we shouldn't touch.
   let removed_count = bulk_clear_parent_folder(BulkClearParentFolderArgs {
     child_tokens: &request.subfolder_tokens,
-    from_parent_token: &from_parent_token,
+    from_parent_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,

crates/service/web/storyteller_web/src/http_server/endpoints/folders/subfolder/list_subfolders_handler.rs

@@ -30,7 +30,7 @@ const MAX_LIMIT: u32 = 1000;
   tag = "Folders",
   path = "/v1/folders/subfolders/{folder_token}",
   params(
-    ("folder_token" = String, description = "Parent folder token"),
+    ("folder_token" = FolderToken, description = "Parent folder token"),
     ListSubfoldersQueryParams,
   ),
   responses(
@@ -56,11 +56,10 @@ pub async fn list_subfolders_handler(
     &http_request, &server_state.session_checker, &mut conn,
   ).await.map_err(|_| CommonWebError::NotAuthorized)?;
 
-  let parent_token = FolderToken::new_from_str(path.folder_token.trim());
 
   // Confirm the parent exists + is owned by the caller before listing.
   let parent = get_folder_for_owner(GetFolderForOwnerArgs {
-    folder_token: &parent_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,
@@ -88,7 +87,7 @@ pub async fn list_subfolders_handler(
   };
 
   let rows = list_subfolders(ListSubfoldersArgs {
-    parent_folder_token: &parent_token,
+    parent_folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     maybe_cursor_id,
     limit,