test(supabase): pin both derived parameter groups, not just their total

Sixth instance of the vacuous-assertion pattern, found by auditing my own
each() call sites rather than waiting for review.

describe.each over an empty array emits no tests and no failure. KEY_PARAMS and
FLAT_PARAMS are derived by filtering PATH_PARAMS on the 'path' name, so renaming
that parameter would silently empty KEY_PARAMS and delete the entire legitimate
object keys block — the assertions proving folder/sub/file.png survives
byte-for-byte — while the floor on the total still passed. A floor on the sum
cannot see a shift between the two groups.

Verified non-vacuous: pointing the filter at a renamed parameter fails the new
assertion where everything else still passed.

Author: waleedlatif1

apps/sim/tools/supabase/path_safety.test.ts

@@ -100,6 +100,21 @@ describe('supabase path traversal safety', () => {
     expect(PATH_PARAMS.length).toBeGreaterThanOrEqual(21)
   })
 
+  /**
+   * Both derived groups are pinned, not just their total.
+   *
+   * `describe.each` over an empty array emits **no tests and no failure**, so
+   * if `path` were renamed, `KEY_PARAMS` would silently empty and the entire
+   * "legitimate object keys" block — the assertions proving
+   * `folder/sub/file.png` survives byte-for-byte — would disappear while the
+   * total above still passed. A floor on the sum cannot see a shift between the
+   * two groups.
+   */
+  it('keeps both parameter groups non-empty', () => {
+    expect(KEY_PARAMS.length).toBeGreaterThanOrEqual(3)
+    expect(FLAT_PARAMS.length).toBeGreaterThanOrEqual(18)
+  })
+
   describe.each(PATH_PARAMS)('$label', (param) => {
     itResistsTraversal(param, {
       origin: ORIGIN,