refactor(account-deletion): split the storage reference guard and sha…

…re storage primitives - keysNamedByUrl also yields a leniently decoded candidate when a stored URL's percent-encoding is malformed, so a legacy key holding a literal '%' is kept - correct the guard's TSDoc: rowless keys stay reachable through key paths under a live workspace and object metadata, not only through a row - move the reference guard to lib/users/storage-reference-guard.ts - move prefix listing/deletion, the upload-TTL cleanup delay, and the outbox deadline margin from lib/projects/files/prefix-cleanup.ts to lib/uploads/core/prefix-sweep.ts; drop the projectUploadCleanupAvailableAt alias - share WORKSPACE_SHARED_FILE_CONTEXTS between member handoff and account cleanup - isPublicStorageKey replaces the public-prefix lists in the serve route and guard
waleedlatif1 · Oct 17, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026
commit f8a8d6498ebc494396ef9490b601daa7068c6dd8
diff --git a/apps/sim/app/api/files/serve/[...path]/route.ts b/apps/sim/app/api/files/serve/[...path]/route.ts
@@ -25,7 +25,11 @@ import { FILE_CACHE_CONTROL, workspaceFileCacheControl } from '@/lib/uploads/ser
 import { resolveServableImageBytes } from '@/lib/uploads/server/image-derivative'
 import { resolveStoredFileContext } from '@/lib/uploads/server/metadata'
 import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
-import { inferContextFromKey, resolveEffectiveMimeType } from '@/lib/uploads/utils/file'
+import {
+  inferContextFromKey,
+  isPublicStorageKey,
+  resolveEffectiveMimeType,
+} from '@/lib/uploads/utils/file'
 import { internalWorkspaceFileServeAuth } from '@/lib/workspace-files/api'
 import { fetchAuthorizedServableWorkspaceFileBuffer } from '@/lib/workspace-files/application/fetch-servable-workspace-file-buffer'
 import { finishFileDelivery } from '@/lib/workspace-files/application/finish-file-delivery'
@@ -299,13 +303,7 @@ export const GET = withRouteHandler(
         })
       }
 
-      const isPublicByKeyPrefix =
-        cloudKey.startsWith('profile-pictures/') ||
-        cloudKey.startsWith('og-images/') ||
-        cloudKey.startsWith('workspace-logos/') ||
-        cloudKey.startsWith('organization-logos/')
-
-      if (isPublicByKeyPrefix) {
+      if (isPublicStorageKey(cloudKey)) {
         const context = inferContextFromKey(cloudKey)
         logger.info(`Serving public ${context}:`, { cloudKey })
         if (isUsingCloudStorage() || isCloudPath) {

diff --git a/apps/sim/lib/projects/files/application/uploads.ts b/apps/sim/lib/projects/files/application/uploads.ts
@@ -29,10 +29,7 @@ import {
   prepareProjectFileAccounting,
   recordProjectFileWriteEffects,
 } from '@/lib/projects/files/application/write-effects'
-import {
-  projectUploadCleanupAvailableAt,
-  queueRetiredProjectUploadCleanup,
-} from '@/lib/projects/files/prefix-cleanup'
+import { queueRetiredProjectUploadCleanup } from '@/lib/projects/files/prefix-cleanup'
 import { resolveFileFolderTarget } from '@/lib/uploads/contexts/workspace/file-folder-manager'
 import {
   adoptVerifiedUploadSession,
@@ -43,6 +40,7 @@ import {
 } from '@/lib/uploads/contexts/workspace/file-manager'
 import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/file-secret-provenance'
 import { enqueueWorkspaceFileStorageCleanups } from '@/lib/uploads/contexts/workspace/file-storage-cleanup-outbox'
+import { storageCleanupAvailableAt } from '@/lib/uploads/core/prefix-sweep'
 import { downloadFile } from '@/lib/uploads/core/storage-service'
 import { requestOrigin } from '@/lib/uploads/upload-session/application'
 import { assertProjectFileUploadBinding } from '@/lib/uploads/upload-session/project-file-binding'
@@ -321,7 +319,7 @@ const registerProjectUpload = defineAuthorizedProjectFileUseCase({
     await registration.registerFile(file.id)
     const cleanupIds = prepared.restored
       ? await enqueueWorkspaceFileStorageCleanups(tx, [input.session.finalKey], 'project', {
-          availableAt: projectUploadCleanupAvailableAt(),
+          availableAt: storageCleanupAvailableAt(),
         })
       : []
     const result = await mapProjectFileResult(tx, context, file)

diff --git a/apps/sim/lib/projects/files/prefix-cleanup.ts b/apps/sim/lib/projects/files/prefix-cleanup.ts
@@ -1,5 +1,3 @@
-import { opendir, rmdir } from 'node:fs/promises'
-import { dirname, join } from 'node:path'
 import { db } from '@sim/db'
 import { project, uploadSession } from '@sim/db/schema'
 import { describeError } from '@sim/utils/errors'
@@ -18,22 +16,18 @@ import {
   PROJECT_FILE_PREFIX_CLEANUP_EVENT,
   PROJECT_STORAGE_RECONCILE_EVENT,
 } from '@/lib/projects/files/outbox-events'
-import {
-  getStorageConfig,
-  type StorageContext,
-  USE_BLOB_STORAGE,
-  USE_GCS_STORAGE,
-  USE_S3_STORAGE,
-} from '@/lib/uploads/config'
 import { isObjectNotFoundError } from '@/lib/uploads/core/errors'
-import { UPLOAD_DIR_SERVER } from '@/lib/uploads/core/setup.server'
-import { deleteFile } from '@/lib/uploads/core/storage-service'
-import { abortProviderUpload, UPLOAD_URL_TTL_MS } from '@/lib/uploads/upload-session/provider'
+import {
+  deleteStorageKeysUnderPrefix,
+  listStorageKeyPage,
+  outboxDeadlineNear,
+  storageCleanupAvailableAt,
+} from '@/lib/uploads/core/prefix-sweep'
+import { abortProviderUpload } from '@/lib/uploads/upload-session/provider'
 import type { UploadSessionRecord } from '@/lib/uploads/upload-session/service'
 import { PROJECT_FILE_UPLOAD_BINDING_KEY } from '@/lib/uploads/upload-session/types'
 
 const PAGE_SIZE = 500
-const CLOCK_SKEW_MS = 60_000
 
 type UploadCleanup = Pick<
   UploadSessionRecord,
@@ -45,16 +39,6 @@ interface CleanupPayload {
   uploadCursor?: number
 }
 
-/** Expired signatures stop new transfers, but a transfer already in progress may finish later. */
-export function projectUploadCleanupAvailableAt(now = new Date()): Date {
-  return storageCleanupAvailableAt(now)
-}
-
-/** Earliest moment no upload URL signed before `now` can still write an object. */
-export function storageCleanupAvailableAt(now = new Date()): Date {
-  return new Date(now.getTime() + UPLOAD_URL_TTL_MS + CLOCK_SKEW_MS)
-}
-
 function prefixFor(projectId: string): string {
   if (!/^[a-zA-Z0-9_-]+$/.test(projectId)) throw new Error('Invalid Project cleanup identity')
   return `project/${projectId}/`
@@ -108,7 +92,7 @@ async function enqueueSweeps(
 ) {
   await enqueueOutboxEvent(executor, PROJECT_FILE_PREFIX_CLEANUP_EVENT, payload)
   await enqueueOutboxEvent(executor, PROJECT_FILE_PREFIX_CLEANUP_EVENT, payload, {
-    availableAt: projectUploadCleanupAvailableAt(retiredAt),
+    availableAt: storageCleanupAvailableAt(retiredAt),
   })
 }
 
@@ -217,171 +201,20 @@ export async function queueRetiredProjectUploadCleanup(
   })
 }
 
-async function removeEmptyDirectory(path: string): Promise<void> {
-  try {
-    await rmdir(path)
-  } catch (error) {
-    if (!['ENOENT', 'ENOTEMPTY', 'EEXIST'].includes(describeError(error).code ?? '')) throw error
-  }
-}
-
-async function localKeys(prefix: string, signal: AbortSignal): Promise<string[]> {
-  const keys: string[] = []
-  async function visit(key: string): Promise<void> {
-    signal.throwIfAborted()
-    let directory
-    try {
-      directory = await opendir(join(UPLOAD_DIR_SERVER, key))
-    } catch (error) {
-      if (describeError(error).code === 'ENOENT') return
-      throw error
-    }
-    for await (const entry of directory) {
-      signal.throwIfAborted()
-      const child = `${key}${entry.name}`
-      if (entry.isDirectory()) await visit(`${child}/`)
-      else keys.push(child)
-      if (keys.length >= PAGE_SIZE) return
-    }
-    await removeEmptyDirectory(join(UPLOAD_DIR_SERVER, key))
-  }
-  await visit(prefix)
-  return keys
-}
-
-/** One provider page of object keys; `done` once the listing has nothing after this page. */
-interface StorageKeyPage {
-  keys: string[]
-  done: boolean
-  /** Provider cursor for the following page, valid only within the current run. */
-  nextPageToken?: string
-}
-
-/**
- * Lists one page of object keys under `prefix` in the bucket serving `context`. A local listing
- * has no cursor: it returns the first keys still on disk, so callers advance by deleting them.
- */
-export async function listStorageKeyPage(
-  prefix: string,
-  context: StorageContext,
-  signal: AbortSignal,
-  pageToken?: string
-): Promise<StorageKeyPage> {
-  signal.throwIfAborted()
-  if (USE_S3_STORAGE) {
-    const { ListObjectsV2Command } = await import('@aws-sdk/client-s3')
-    const { getS3Client } = await import('@/lib/uploads/providers/s3/client')
-    const config = getStorageConfig(context)
-    const page = await getS3Client().send(
-      new ListObjectsV2Command({
-        Bucket: config.bucket,
-        Prefix: prefix,
-        MaxKeys: PAGE_SIZE,
-        ...(pageToken ? { ContinuationToken: pageToken } : {}),
-      }),
-      { abortSignal: signal }
-    )
-    const nextPageToken = page.IsTruncated ? page.NextContinuationToken : undefined
-    return {
-      keys: (page.Contents ?? []).flatMap((object) => (object.Key ? [object.Key] : [])),
-      done: !nextPageToken,
-      ...(nextPageToken ? { nextPageToken } : {}),
-    }
-  }
-  if (USE_BLOB_STORAGE) {
-    const { getBlobServiceClient } = await import('@/lib/uploads/providers/blob/client')
-    const config = getStorageConfig(context)
-    if (!config.containerName) throw new Error(`Blob container missing for ${context} storage`)
-    const pages = (await getBlobServiceClient())
-      .getContainerClient(config.containerName)
-      .listBlobsFlat({ prefix, abortSignal: signal })
-      .byPage({ maxPageSize: PAGE_SIZE, ...(pageToken ? { continuationToken: pageToken } : {}) })
-    const page = await pages.next()
-    if (page.done) return { keys: [], done: true }
-    const nextPageToken = page.value.continuationToken || undefined
-    return {
-      keys: page.value.segment.blobItems.map((object) => object.name),
-      done: !nextPageToken,
-      ...(nextPageToken ? { nextPageToken } : {}),
-    }
-  }
-  if (USE_GCS_STORAGE) {
-    const { getGcsClient } = await import('@/lib/uploads/providers/google-cloud-storage/client')
-    const config = getStorageConfig(context)
-    if (!config.bucket) throw new Error(`Bucket missing for ${context} storage`)
-    const [files, nextQuery] = await (await getGcsClient()).bucket(config.bucket).getFiles({
-      prefix,
-      maxResults: PAGE_SIZE,
-      autoPaginate: false,
-      ...(pageToken ? { pageToken } : {}),
-    })
-    signal.throwIfAborted()
-    const nextPageToken =
-      isRecordLike(nextQuery) && typeof nextQuery.pageToken === 'string' && nextQuery.pageToken
-        ? nextQuery.pageToken
-        : undefined
-    return {
-      keys: files.map((file) => file.name),
-      done: !nextPageToken,
-      ...(nextPageToken ? { nextPageToken } : {}),
-    }
-  }
-  const keys = await localKeys(prefix, signal)
-  return { keys, done: keys.length < PAGE_SIZE }
-}
-
-/**
- * Deletes listed keys, each of which must sit under `prefix`, and prunes local directories the
- * deletions empty, never above the prefix itself. Stops before another deletion once the handler
- * deadline is near; `complete` is false when it did. `deleted` counts only objects actually
- * removed: a key already gone (or, locally, one whose on-disk name no storage key resolves to) is
- * no progress, so a caller re-listing the same page can tell that it is stuck.
- */
-export async function deleteStorageKeysUnderPrefix(
-  prefix: string,
-  context: StorageContext,
-  keys: readonly string[],
-  outbox: Pick<OutboxEventContext, 'signal' | 'deadlineAt'>
-): Promise<{ deleted: number; complete: boolean }> {
-  if (prefix.length < 2 || !prefix.endsWith('/')) throw new Error('Unbounded storage prefix')
-  let attempted = 0
-  let deleted = 0
-  for (const key of keys) {
-    if (!key.startsWith(prefix))
-      throw new Error('Storage provider returned a key outside the prefix')
-    outbox.signal.throwIfAborted()
-    if (attempted > 0 && outbox.deadlineAt && Date.now() + 5000 >= outbox.deadlineAt)
-      return { deleted, complete: false }
-    attempted++
-    let removed = true
-    try {
-      await deleteFile({ key, context, signal: outbox.signal })
-    } catch (error) {
-      if (describeError(error).code !== 'ENOENT') throw error
-      removed = false
-    }
-    if (!USE_S3_STORAGE && !USE_BLOB_STORAGE && !USE_GCS_STORAGE) {
-      const root = join(UPLOAD_DIR_SERVER, prefix.slice(0, -1))
-      let directory = dirname(join(UPLOAD_DIR_SERVER, key))
-      while (directory === root || directory.startsWith(`${root}/`)) {
-        await removeEmptyDirectory(directory)
-        directory = dirname(directory)
-      }
-    }
-    if (removed) deleted++
-  }
-  return { deleted, complete: true }
-}
-
 /** `stalled` when a page that must be re-listed removed nothing, so continuing cannot progress. */
 async function sweepPrefix(
   projectId: string,
   context: OutboxEventContext
 ): Promise<'done' | 'continue' | 'stalled'> {
   const prefix = prefixFor(projectId)
-  const { keys } = await listStorageKeyPage(prefix, 'project', context.signal)
-  const { deleted, complete } = await deleteStorageKeysUnderPrefix(prefix, 'project', keys, context)
-  if (complete && keys.length < PAGE_SIZE) return 'done'
+  const page = await listStorageKeyPage(prefix, 'project', context.signal)
+  const { deleted, complete } = await deleteStorageKeysUnderPrefix(
+    prefix,
+    'project',
+    page.keys,
+    context
+  )
+  if (complete && page.done) return 'done'
   return deleted > 0 ? 'continue' : 'stalled'
 }
 
@@ -417,7 +250,7 @@ const cleanupPrefix: OutboxHandler<unknown> = async (raw, context) => {
     }
     if ((index + 1) % 20 === 0 || index === uploads.length - 1)
       await context.checkpointPayload({ uploadCursor: index + 1 })
-    if (context.deadlineAt && Date.now() + 5000 >= context.deadlineAt) {
+    if (outboxDeadlineNear(context)) {
       await context.checkpointPayload({ uploadCursor: index + 1 })
       return continueOutboxHandler('Continuing retired Project upload cleanup')
     }