From a442cdddbb1677436aecd5cd28dd5b3ebdab89c5 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Mon, 8 Jun 2026 10:07:26 -0400
Subject: [PATCH] update path

---
 .../artcraft/artcraft_api_defs/src/folders/folder.rs       | 2 +-
 .../artcraft/artcraft_api_defs/src/folders/media_files.rs  | 3 ++-
 .../artcraft/artcraft_api_defs/src/folders/subfolder.rs    | 2 +-
 .../endpoints/folders/folder/color_code_folder_handler.rs  | 5 ++---
 .../endpoints/folders/folder/delete_folder_handler.rs      | 5 ++---
 .../endpoints/folders/folder/get_folder_handler.rs         | 5 ++---
 .../endpoints/folders/folder/rename_folder_handler.rs      | 5 ++---
 .../endpoints/folders/folder/star_folder_handler.rs        | 5 ++---
 .../media_files/bulk_add_folder_media_files_handler.rs     | 7 +++----
 .../media_files/bulk_remove_folder_media_files_handler.rs  | 7 +++----
 .../folders/media_files/list_folder_media_files_handler.rs | 7 +++----
 .../folders/subfolder/bulk_add_subfolders_handler.rs       | 7 +++----
 .../folders/subfolder/bulk_remove_subfolders_handler.rs    | 5 ++---
 .../endpoints/folders/subfolder/list_subfolders_handler.rs | 7 +++----
 14 files changed, 31 insertions(+), 41 deletions(-)

diff --git a/crates/api_clients/artcraft/artcraft_api_defs/src/folders/folder.rs b/crates/api_clients/artcraft/artcraft_api_defs/src/folders/folder.rs
index 7a1c7146b4..e323887828 100644
--- a/crates/api_clients/artcraft/artcraft_api_defs/src/folders/folder.rs
+++ b/crates/api_clients/artcraft/artcraft_api_defs/src/folders/folder.rs
@@ -39,7 +39,7 @@ pub struct ListFoldersSuccessResponse {
 
 #[derive(Deserialize, ToSchema)]
 pub struct FolderPathInfo {
-  pub folder_token: String,
+  pub folder_token: FolderToken,
 }
 
 #[derive(Serialize, ToSchema)]
diff --git a/crates/api_clients/artcraft/artcraft_api_defs/src/folders/media_files.rs b/crates/api_clients/artcraft/artcraft_api_defs/src/folders/media_files.rs
index dcb3a72baa..b42517da65 100644
--- a/crates/api_clients/artcraft/artcraft_api_defs/src/folders/media_files.rs
+++ b/crates/api_clients/artcraft/artcraft_api_defs/src/folders/media_files.rs
@@ -1,6 +1,7 @@
 use serde_derive::{Deserialize, Serialize};
 use utoipa::{IntoParams, ToSchema};
 
+use tokens::tokens::folders::FolderToken;
 use tokens::tokens::media_files::MediaFileToken;
 
 use crate::folders::common::FolderMediaFileInfo;
@@ -9,7 +10,7 @@ use crate::folders::common::FolderMediaFileInfo;
 
 #[derive(Deserialize, ToSchema)]
 pub struct FolderMediaFilesPathInfo {
-  pub folder_token: String,
+  pub folder_token: FolderToken,
 }
 
 #[derive(Deserialize, ToSchema, IntoParams)]
diff --git a/crates/api_clients/artcraft/artcraft_api_defs/src/folders/subfolder.rs b/crates/api_clients/artcraft/artcraft_api_defs/src/folders/subfolder.rs
index d62352b276..346039af34 100644
--- a/crates/api_clients/artcraft/artcraft_api_defs/src/folders/subfolder.rs
+++ b/crates/api_clients/artcraft/artcraft_api_defs/src/folders/subfolder.rs
@@ -9,7 +9,7 @@ use crate::folders::common::FolderInfo;
 
 #[derive(Deserialize, ToSchema)]
 pub struct SubfolderPathInfo {
-  pub folder_token: String,
+  pub folder_token: FolderToken,
 }
 
 #[derive(Deserialize, ToSchema, IntoParams)]
diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/color_code_folder_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/color_code_folder_handler.rs
index 80aa0c0ab3..ed24cf1f8f 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/color_code_folder_handler.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/color_code_folder_handler.rs
@@ -23,7 +23,7 @@ const MAX_COLOR_CODE_LEN: usize = 16;
   put,
   tag = "Folders",
   path = "/v1/folders/folder/{folder_token}/color_code",
-  params(("folder_token" = String, description = "Folder token")),
+  params(("folder_token" = FolderToken, description = "Folder token")),
   request_body = SetFolderColorCodeRequest,
   responses(
     (status = 200, body = SetFolderColorCodeSuccessResponse),
@@ -63,10 +63,9 @@ pub async fn color_code_folder_handler(
     }
   }
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let rows_affected = update_folder_color_code(UpdateFolderColorCodeArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     maybe_color_code: trimmed.as_deref(),
     mysql_executor: &mut *conn,
diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/delete_folder_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/delete_folder_handler.rs
index 015932f2f1..7cd38425d6 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/delete_folder_handler.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/delete_folder_handler.rs
@@ -21,7 +21,7 @@ use crate::state::server_state::ServerState;
   delete,
   tag = "Folders",
   path = "/v1/folders/folder/{folder_token}",
-  params(("folder_token" = String, description = "Folder token")),
+  params(("folder_token" = FolderToken, description = "Folder token")),
   responses(
     (status = 200, body = DeleteFolderSuccessResponse),
     (status = 401, body = CommonWebError),
@@ -43,10 +43,9 @@ pub async fn delete_folder_handler(
     &http_request, &server_state.session_checker, &mut conn,
   ).await.map_err(|_| CommonWebError::NotAuthorized)?;
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let rows_affected = soft_delete_folder(SoftDeleteFolderArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,
diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/get_folder_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/get_folder_handler.rs
index 10835cb4ae..6926ec4f27 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/get_folder_handler.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/get_folder_handler.rs
@@ -21,7 +21,7 @@ use crate::state::server_state::ServerState;
   get,
   tag = "Folders",
   path = "/v1/folders/folder/{folder_token}",
-  params(("folder_token" = String, description = "Folder token")),
+  params(("folder_token" = FolderToken, description = "Folder token")),
   responses(
     (status = 200, body = GetFolderSuccessResponse),
     (status = 401, body = CommonWebError),
@@ -43,10 +43,9 @@ pub async fn get_folder_handler(
     &http_request, &server_state.session_checker, &mut conn,
   ).await.map_err(|_| CommonWebError::NotAuthorized)?;
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let row = get_folder_for_owner(GetFolderForOwnerArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,
diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/rename_folder_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/rename_folder_handler.rs
index 0ea7fb5b15..38f11f8eac 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/rename_folder_handler.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/rename_folder_handler.rs
@@ -23,7 +23,7 @@ const MAX_NAME_LEN: usize = 255;
   put,
   tag = "Folders",
   path = "/v1/folders/folder/{folder_token}/rename",
-  params(("folder_token" = String, description = "Folder token")),
+  params(("folder_token" = FolderToken, description = "Folder token")),
   request_body = RenameFolderRequest,
   responses(
     (status = 200, body = RenameFolderSuccessResponse),
@@ -58,10 +58,9 @@ pub async fn rename_folder_handler(
     ));
   }
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let rows_affected = update_folder_name(UpdateFolderNameArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     new_name: &new_name,
     mysql_executor: &mut *conn,
diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/star_folder_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/star_folder_handler.rs
index 00d0dd2b7f..8cd5f6fe9d 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/star_folder_handler.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/star_folder_handler.rs
@@ -21,7 +21,7 @@ use crate::state::server_state::ServerState;
   put,
   tag = "Folders",
   path = "/v1/folders/folder/{folder_token}/star",
-  params(("folder_token" = String, description = "Folder token")),
+  params(("folder_token" = FolderToken, description = "Folder token")),
   request_body = SetFolderStarRequest,
   responses(
     (status = 200, body = SetFolderStarSuccessResponse),
@@ -45,10 +45,9 @@ pub async fn star_folder_handler(
     &http_request, &server_state.session_checker, &mut conn,
   ).await.map_err(|_| CommonWebError::NotAuthorized)?;
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let rows_affected = update_folder_has_star(UpdateFolderHasStarArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     has_star: request.has_star,
     mysql_executor: &mut *conn,
diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/media_files/bulk_add_folder_media_files_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/media_files/bulk_add_folder_media_files_handler.rs
index ec6140f408..e5b7bb4d28 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/media_files/bulk_add_folder_media_files_handler.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/media_files/bulk_add_folder_media_files_handler.rs
@@ -34,7 +34,7 @@ const MAX_BULK: usize = 500;
   put,
   tag = "Folders",
   path = "/v1/folders/media_files/{folder_token}/bulk_add",
-  params(("folder_token" = String, description = "Folder token")),
+  params(("folder_token" = FolderToken, description = "Folder token")),
   request_body = BulkAddFolderMediaFilesRequest,
   responses(
     (status = 200, body = BulkAddFolderMediaFilesSuccessResponse),
@@ -65,10 +65,9 @@ pub async fn bulk_add_folder_media_files_handler(
     ));
   }
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let folder = get_folder_for_owner(GetFolderForOwnerArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,
@@ -91,7 +90,7 @@ pub async fn bulk_add_folder_media_files_handler(
 
   if !accepted.is_empty() {
     bulk_insert_folder_media_files(BulkInsertFolderMediaFilesArgs {
-      folder_token: &folder_token,
+      folder_token: &path.folder_token,
       media_file_tokens: &accepted,
       mysql_executor: &mut *conn,
       phantom: PhantomData,
diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/media_files/bulk_remove_folder_media_files_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/media_files/bulk_remove_folder_media_files_handler.rs
index 327b5658af..ee065c8136 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/media_files/bulk_remove_folder_media_files_handler.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/media_files/bulk_remove_folder_media_files_handler.rs
@@ -29,7 +29,7 @@ const MAX_BULK: usize = 500;
   put,
   tag = "Folders",
   path = "/v1/folders/media_files/{folder_token}/bulk_remove",
-  params(("folder_token" = String, description = "Folder token")),
+  params(("folder_token" = FolderToken, description = "Folder token")),
   request_body = BulkRemoveFolderMediaFilesRequest,
   responses(
     (status = 200, body = BulkRemoveFolderMediaFilesSuccessResponse),
@@ -60,10 +60,9 @@ pub async fn bulk_remove_folder_media_files_handler(
     ));
   }
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let folder = get_folder_for_owner(GetFolderForOwnerArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,
@@ -76,7 +75,7 @@ pub async fn bulk_remove_folder_media_files_handler(
   }
 
   let removed_count = bulk_delete_folder_media_files(BulkDeleteFolderMediaFilesArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     media_file_tokens: &request.media_file_tokens,
     mysql_executor: &mut *conn,
     phantom: PhantomData,
diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/media_files/list_folder_media_files_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/media_files/list_folder_media_files_handler.rs
index 09988f903f..b375587338 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/media_files/list_folder_media_files_handler.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/media_files/list_folder_media_files_handler.rs
@@ -30,7 +30,7 @@ const MAX_LIMIT: u32 = 1000;
   tag = "Folders",
   path = "/v1/folders/media_files/{folder_token}",
   params(
-    ("folder_token" = String, description = "Folder token"),
+    ("folder_token" = FolderToken, description = "Folder token"),
     ListFolderMediaFilesQueryParams,
   ),
   responses(
@@ -56,10 +56,9 @@ pub async fn list_folder_media_files_handler(
     &http_request, &server_state.session_checker, &mut conn,
   ).await.map_err(|_| CommonWebError::NotAuthorized)?;
 
-  let folder_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let folder = get_folder_for_owner(GetFolderForOwnerArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,
@@ -87,7 +86,7 @@ pub async fn list_folder_media_files_handler(
   };
 
   let rows = list_folder_media_files(ListFolderMediaFilesArgs {
-    folder_token: &folder_token,
+    folder_token: &path.folder_token,
     maybe_cursor_id,
     limit,
     mysql_executor: &mut *conn,
diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/subfolder/bulk_add_subfolders_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/subfolder/bulk_add_subfolders_handler.rs
index 57226ff87c..54d0f279d1 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/subfolder/bulk_add_subfolders_handler.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/subfolder/bulk_add_subfolders_handler.rs
@@ -32,7 +32,7 @@ const MAX_BULK: usize = 500;
   put,
   tag = "Folders",
   path = "/v1/folders/subfolders/{folder_token}/bulk_add",
-  params(("folder_token" = String, description = "Parent folder token")),
+  params(("folder_token" = FolderToken, description = "Parent folder token")),
   request_body = BulkAddSubfoldersRequest,
   responses(
     (status = 200, body = BulkAddSubfoldersSuccessResponse),
@@ -63,10 +63,9 @@ pub async fn bulk_add_subfolders_handler(
     ));
   }
 
-  let parent_token = FolderToken::new_from_str(path.folder_token.trim());
 
   let parent = get_folder_for_owner(GetFolderForOwnerArgs {
-    folder_token: &parent_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,
@@ -91,7 +90,7 @@ pub async fn bulk_add_subfolders_handler(
   if !accepted.is_empty() {
     bulk_set_parent_folder(BulkSetParentFolderArgs {
       child_tokens: &accepted,
-      new_parent_token: &parent_token,
+      new_parent_token: &path.folder_token,
       owner_user_token: &user_session.user_token,
       mysql_executor: &mut *conn,
       phantom: PhantomData,
diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/subfolder/bulk_remove_subfolders_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/subfolder/bulk_remove_subfolders_handler.rs
index d2724229ea..7395230b8a 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/subfolder/bulk_remove_subfolders_handler.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/subfolder/bulk_remove_subfolders_handler.rs
@@ -25,7 +25,7 @@ const MAX_BULK: usize = 500;
   put,
   tag = "Folders",
   path = "/v1/folders/subfolders/{folder_token}/bulk_remove",
-  params(("folder_token" = String, description = "Parent folder token")),
+  params(("folder_token" = FolderToken, description = "Parent folder token")),
   request_body = BulkRemoveSubfoldersRequest,
   responses(
     (status = 200, body = BulkRemoveSubfoldersSuccessResponse),
@@ -55,14 +55,13 @@ pub async fn bulk_remove_subfolders_handler(
     ));
   }
 
-  let from_parent_token = FolderToken::new_from_str(path.folder_token.trim());
 
   // No parent existence check — the UPDATE's WHERE clause already gates
   // on owner_user_token AND current parent, so this is naturally a no-op
   // for rows we shouldn't touch.
   let removed_count = bulk_clear_parent_folder(BulkClearParentFolderArgs {
     child_tokens: &request.subfolder_tokens,
-    from_parent_token: &from_parent_token,
+    from_parent_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,
diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/subfolder/list_subfolders_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/subfolder/list_subfolders_handler.rs
index 281393a636..ea1d4b260f 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/subfolder/list_subfolders_handler.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/subfolder/list_subfolders_handler.rs
@@ -30,7 +30,7 @@ const MAX_LIMIT: u32 = 1000;
   tag = "Folders",
   path = "/v1/folders/subfolders/{folder_token}",
   params(
-    ("folder_token" = String, description = "Parent folder token"),
+    ("folder_token" = FolderToken, description = "Parent folder token"),
     ListSubfoldersQueryParams,
   ),
   responses(
@@ -56,11 +56,10 @@ pub async fn list_subfolders_handler(
     &http_request, &server_state.session_checker, &mut conn,
   ).await.map_err(|_| CommonWebError::NotAuthorized)?;
 
-  let parent_token = FolderToken::new_from_str(path.folder_token.trim());
 
   // Confirm the parent exists + is owned by the caller before listing.
   let parent = get_folder_for_owner(GetFolderForOwnerArgs {
-    folder_token: &parent_token,
+    folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     mysql_executor: &mut *conn,
     phantom: PhantomData,
@@ -88,7 +87,7 @@ pub async fn list_subfolders_handler(
   };
 
   let rows = list_subfolders(ListSubfoldersArgs {
-    parent_folder_token: &parent_token,
+    parent_folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     maybe_cursor_id,
     limit,