iframe-proxy

waleedlatif1 · 2026-07-03T22:49:34Z

Summary

The multipart-upload fallback route (/api/files/upload) had no workspace-permission check for execution-context uploads, while the primary presigned-upload route (/api/files/presigned) already requires write/admin for the same upload type.
Added the same write/admin gate to the fallback route's execution branch, and now require workspaceId (in addition to workflowId/executionId) before proceeding, matching the presigned route's validation.

Note: self-hosted deployments without cloud storage configured will now require write/admin workspace permission for execution-context uploads via this fallback path, matching the existing requirement on the primary presigned-upload path.

Type of Change

Bug fix

Testing

Added 5 new tests covering: missing workspaceId, read-only member rejected, no-permission member rejected, write-permission member allowed, admin-permission member allowed.
bun run vitest run app/api/files/upload/route.test.ts — 19/19 passing.
bun run check:api-validation passes.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…ership workflow edits via sockets, ui improvements

…hog upgrade

…lama fix

…ng improvements, posthog, secrets mutations

…ration, signup method feature flags, SSO improvements

* feat(posthog): Add tracking on mothership abort (#4023) Co-authored-by: Theodore Li <theo@sim.ai> * fix(login): fix captcha headers for manual login (#4025) * fix(signup): fix turnstile key loading * fix(login): fix captcha header passing * Catch user already exists, remove login form captcha

…nts, secrets performance, polling refactors, drag resources in mothership

… enterprises

…ension

…y invalidation, HITL docs

…endar triggers, docs updates, integrations/models pages improvements

…ups ui

…ions, jira forms endpoints

…mat, logs performance improvements fix(csp): add missing analytics domains, remove unsafe-eval, fix workspace CSP gap (#4179) fix(landing): return 404 for invalid dynamic route slugs (#4182) improvement(seo): optimize sitemaps, robots.txt, and core web vitals across sim and docs (#4170) fix(gemini): support structured output with tools on Gemini 3 models (#4184) feat(brightdata): add Bright Data integration with 8 tools (#4183) fix(mothership): fix superagent credentials (#4185) fix(logs): close sidebar when selected log disappears from filtered list; cleanup (#4186)

v0.6.46: mothership streaming fixes, brightdata integration

…m integration, atlassian triggers

…ration, smooth streaming, security hardening, db fixes

…x, db migrations from ci, docs updates, read replicas v0.7.3: jira oauth scope fix, read-replica client, table wire data fix, db migrations from ci, docs updates, read replicas

…uting, trigger.dev, temporal, latex, quartr, brex, convex integrations

…rovements, styling consolidation

…, db perf improvements

…nges, code hygiene

…lassian assets and google calendar tools

…d, security fixes

…richment providers, deepseek models, db performance

…nce, file sharing, scheduled tasks granularity

…t harness, sakana fugu provider v0.7.13: pii redaction, react query frontend refactor, pi coding agent harness, sakana fugu provider

…ix, settings overhaul, thrive learning integration

…extension, workspace forking, slack trigger extension, new README

…ssion Fallback multipart upload route (/api/files/upload) had no workspace permission check for execution-context uploads, unlike the primary presigned-upload route which requires write/admin. Mirror that gate so both paths enforce the same access control.

vercel · 2026-07-03T22:49:40Z

cursor · 2026-07-03T22:49:43Z

PR Summary

Medium Risk
Tightens authorization on a file-upload API path (execution context); read-only or missing-permission users lose a previously allowed fallback upload route, which is intentional but behavior-changing for self-hosted/local storage.

Overview
Closes a permission gap on the multipart fallback upload route (POST /api/files/upload): execution-context uploads now match the presigned path by requiring workspaceId alongside workflowId and executionId, and by checking getUserEntityPermissions so only write or admin workspace members can upload (403 otherwise).

The execution branch no longer passes an empty workspaceId when it was omitted; uploads are rejected up front with a validation error instead of proceeding.

Tests add an Execution Context Permission Gate suite (missing workspaceId, read/null permission denied, write/admin allowed) with mocks for uploadExecutionFile.

^{Reviewed by Cursor Bugbot for commit fe82691. Configure here.}

greptile-apps · 2026-07-03T22:51:35Z

Greptile Summary

This PR closes a permission gap where the multipart-upload fallback route (/api/files/upload) accepted execution-context uploads from any authenticated user, while the primary presigned-upload route (/api/files/presigned) already enforced write/admin workspace permission for the same operation.

Adds a workspaceId requirement and a write/admin permission gate to the execution branch of the fallback upload route, mirroring the existing check in the presigned route.
Fixes the prior workspaceId || '' fallback that silently accepted requests with no workspace context by throwing a 400 instead.
Adds 5 targeted tests covering the missing-workspaceId, read-only, no-permission, write, and admin cases; all 19 route tests pass.

Confidence Score: 5/5

The change is a targeted security hardening that brings the fallback upload route in line with the presigned route; no existing functionality is removed and the added permission check cannot be bypassed.

Both changed files are small and self-contained. The permission logic directly mirrors the already-reviewed presigned route. The new validation eliminates the workspaceId || '' silent no-op that previously allowed any authenticated user to reach uploadExecutionFile. Test coverage is comprehensive for the new branch.

No files require special attention.

Important Files Changed

Filename	Overview
apps/sim/app/api/files/upload/route.ts	Adds workspaceId validation and write/admin permission gate to the execution context branch, matching the presigned route; the fix is well-scoped and logically consistent with peer contexts.
apps/sim/app/api/files/upload/route.test.ts	Adds 5 new tests covering the full permission matrix for execution uploads; mocks are correctly scoped and assertions cover both rejection and success paths.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Client
    participant FallbackRoute as /api/files/upload
    participant Auth as getSession()
    participant Perms as getUserEntityPermissions()
    participant Storage as uploadExecutionFile()

    Client->>FallbackRoute: "POST (context=execution, workspaceId, workflowId, executionId, file)"
    FallbackRoute->>Auth: getSession()
    Auth-->>FallbackRoute: session or null
    alt No session
        FallbackRoute-->>Client: 401 Unauthorized
    end

    FallbackRoute->>FallbackRoute: Validate form fields (Zod)
    alt workflowId / executionId / workspaceId missing
        FallbackRoute-->>Client: 400 Invalid Request
    end

    FallbackRoute->>Perms: getUserEntityPermissions(userId, 'workspace', workspaceId)
    Perms-->>FallbackRoute: "'read' | 'write' | 'admin' | null"
    alt "permission != 'write' and != 'admin'"
        FallbackRoute-->>Client: 403 Write or Admin access required
    end

    FallbackRoute->>Storage: "uploadExecutionFile({workspaceId, workflowId, executionId}, buffer, ...)"
    Storage-->>FallbackRoute: userFile
    FallbackRoute-->>Client: "200 { id, name, url, ... }"

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Client
    participant FallbackRoute as /api/files/upload
    participant Auth as getSession()
    participant Perms as getUserEntityPermissions()
    participant Storage as uploadExecutionFile()

    Client->>FallbackRoute: "POST (context=execution, workspaceId, workflowId, executionId, file)"
    FallbackRoute->>Auth: getSession()
    Auth-->>FallbackRoute: session or null
    alt No session
        FallbackRoute-->>Client: 401 Unauthorized
    end

    FallbackRoute->>FallbackRoute: Validate form fields (Zod)
    alt workflowId / executionId / workspaceId missing
        FallbackRoute-->>Client: 400 Invalid Request
    end

    FallbackRoute->>Perms: getUserEntityPermissions(userId, 'workspace', workspaceId)
    Perms-->>FallbackRoute: "'read' | 'write' | 'admin' | null"
    alt "permission != 'write' and != 'admin'"
        FallbackRoute-->>Client: 403 Write or Admin access required
    end

    FallbackRoute->>Storage: "uploadExecutionFile({workspaceId, workflowId, executionId}, buffer, ...)"
    Storage-->>FallbackRoute: userFile
    FallbackRoute-->>Client: "200 { id, name, url, ... }"

_{Reviews (1): Last reviewed commit: "fix(uploads): gate execution-context upl..." | Re-trigger Greptile}

waleedlatif1 · 2026-07-03T22:52:11Z

waleedlatif1 and others added 30 commits April 3, 2026 23:30

v0.6.23: MCP fixes, remove local state in favor of server state, moth…

0b9019d

…ership workflow edits via sockets, ui improvements

v0.6.24: copilot feedback wiring, captcha fixes

a54dcbe

v0.6.25: cloudwatch, cloudformation, live kb sync, linear fixes, post…

28af223

…hog upgrade

v0.6.26: ui improvements, multiple response blocks, docx previews, ol…

d889f32

…lama fix

v0.6.27: new triggers, mothership improvements, files archive, queuei…

316bc8c

…ng improvements, posthog, secrets mutations

v0.6.28: new docs, delete confirmation standardization, dagster integ…

3f508e4

…ration, signup method feature flags, SSO improvements

v0.6.30: slack trigger enhancements, connectors performance improveme…

d7da35b

…nts, secrets performance, polling refactors, drag resources in mothership

v0.6.31: elevenlabs voice, trigger.dev fixes, cloud whitelabeling for…

cf233bb

… enterprises

v0.6.32: BYOK fixes, ui improvements, cloudwatch tools, jsm tools ext…

f8f3758

…ension

v0.6.33: polling improvements, jsm forms tools, credentials reactquer…

3c8bb40

…y invalidation, HITL docs

v0.6.34: trigger.dev fixes, CI speedup, atlassian error extractor

d33acf4

v0.6.35: additional jira fields, HITL docs, logs cleanup efficiency

4f40c4c

v0.6.36: new chunkers, sockets state machine, google sheets/drive/cal…

cbfab1c

…endar triggers, docs updates, integrations/models pages improvements

v0.6.37: audit logs page, isolated-vm worker rotation, permission gro…

4309d06

…ups ui

v0.6.38: models page

8b57476

v0.6.39: billing fixes, tools audit, landing fix

e3d0e74

v0.6.40: mothership tool loop, new skills, agiloft, STS, IAM integrat…

0ac0539

…ions, jira forms endpoints

v0.6.41: webhooks fix, workers removal

3838b6e

v0.6.42: mothership nested file reads, search modal improvements

fc07922

v0.6.43: mothership billing idempotency, env var resolution fixes

3a1b1a8

v0.6.44: streamdown, mothership intelligence, excel extension

46ffc49

Merge pull request #4190 from simstudioai/staging

c0bc62c

v0.6.46: mothership streaming fixes, brightdata integration

v0.6.46: mothership queueing, web vitals

387cc97

v0.6.47: files focusing, documentation, opus 4.7

2dbc7fd

v0.6.48: import csv into tables, subflow fixes, CSP updates

8a50f18

v0.6.49: deploy sockets event, resolver, logs improvements, monday.co…

dcf3302

…m integration, atlassian triggers

v0.6.50: ppt/doc/pdf worker isolation, docs, chat, sidebar improvements

bc09865

v0.6.51: tables improvements, billing fixes, 404 pages, code hygiene

5f56e46

waleedlatif1 and others added 22 commits June 10, 2026 13:20

v0.7.1: chat voice mode model update, sim trigger, codepipeline integ…

7ffc495

…ration, smooth streaming, security hardening, db fixes

v0.7.2: logs export security, code hygiene, mship cost attribution

d4722f9

v0.7.3: jira oauth scope fix, read-replica client, table wire data fi…

f4d22ff

…x, db migrations from ci, docs updates, read replicas v0.7.3: jira oauth scope fix, read-replica client, table wire data fix, db migrations from ci, docs updates, read replicas

v0.7.4: round-robin byok support, table block fix, db read replica ro…

a48b4a1

…uting, trigger.dev, temporal, latex, quartr, brex, convex integrations

v0.7.5: deployments API and block, vanta integration, performance imp…

79d98b3

…rovements, styling consolidation

v0.7.6: calendar scheduled tasks, new hubspot tools, virtualized chat…

e6587ca

…, db perf improvements

v0.7.7: square, context.dev integrations, scheduled tasks styling cha…

8c3706e

…nges, code hygiene

v0.7.8: security hardening, code hygiene, MSFT oauth provider, new at…

59d9496

…lassian assets and google calendar tools

v0.7.9: agent file attachments, chat autoscroll, knowledge base uploa…

56a88a2

…d, security fixes

v0.7.10: models sorting, compress/decompress file block tools, new en…

db47da5

…richment providers, deepseek models, db performance

v0.7.11: parallel subagents, new tools, rich markdown editor, governa…

8df34a3

…nce, file sharing, scheduled tasks granularity

v0.7.12: mcp servers ui/ux fixes, nuqs for query param management

aaca750

v0.7.13: pii redaction, react query frontend refactor, pi coding agen…

ad0b867

…t harness, sakana fugu provider v0.7.13: pii redaction, react query frontend refactor, pi coding agent harness, sakana fugu provider

v0.7.14: perf improvements, code hygiene, GitLab private host support

11168f9

v0.7.15: academy, perf improvements, db attribution, kb tags filter f…

613e8ea

…ix, settings overhaul, thrive learning integration

v0.7.16: security hardening, db o11y and profiling, settings UI

38c088a

v0.7.17: emcn and workflow renderer isolated package, popular blocks …

0371856

…extension, workspace forking, slack trigger extension, new README

v0.7.18: landing, tools depth, media embeds in md editor, sonnet 5

fabf696

v0.7.19: newsletter, contact, careers

6e426f8

v0.7.20: perf, ui improvements, fable 5, tables row size bump, blogs

62ef96f

v0.7.21: tools audits and extensions, appsheet integration, hitl fix

4fcfe76

waleedlatif1 mentioned this pull request Jul 3, 2026

fix(files): require workspace write permission for execution-context uploads #5402

Closed

6 tasks

waleedlatif1 mentioned this pull request Jul 3, 2026

fix(uploads): gate execution-context uploads behind write/admin permission #5404

Merged

6 tasks

waleedlatif1 closed this Jul 3, 2026

waleedlatif1 deleted the worktree-deepsec-fresh branch July 4, 2026 03:05

Sunbelt Computer Software

PL/B Language Development and Support

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(uploads): gate execution-context uploads behind write/admin permission#5403

fix(uploads): gate execution-context uploads behind write/admin permission#5403
waleedlatif1 wants to merge 110 commits into
stagingfrom
worktree-deepsec-fresh

waleedlatif1 commented Jul 3, 2026

Uh oh!

vercel Bot commented Jul 3, 2026

Uh oh!

cursor Bot commented Jul 3, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Jul 3, 2026

Uh oh!

waleedlatif1 commented Jul 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Sunbelt Computer Software

PL/B Language Development and Support

Uh oh!

Conversation

waleedlatif1 commented Jul 3, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Jul 3, 2026

Uh oh!

cursor Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Jul 3, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

waleedlatif1 commented Jul 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

cursor Bot commented Jul 3, 2026 •

edited

Loading