The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		May 3, 2026 0:27am

PR Summary

Medium Risk
Changes core file upload paths by introducing direct-to-cloud PUT/multipart and new workspace registration endpoints; mistakes could orphan objects, mis-handle quotas, or allow cross-tenant key misuse despite added validation.

Overview
Moves workspace file uploads to a direct-to-cloud transport. Adds a shared client upload module (lib/uploads/client/direct-upload.ts) that chooses presigned PUT for smaller files and multipart for larger ones, with progress callbacks, abort support, and bounded retries.

Introduces workspace-scoped presign + registration APIs. Adds POST /api/workspaces/[id]/files/presigned (permission check, size ceiling, quota check, local-storage fallback) and POST /api/workspaces/[id]/files/register (validates key belongs to workspace, HEAD-verifies object, idempotent metadata insert, best-effort orphan cleanup, emits audit + analytics on first create).

Hardens multipart + storage primitives. Updates /api/files/multipart completion to accept a unified { partNumber, etag? } parts payload, derive Azure block IDs server-side, and pass provider-specific config through initiate/get-urls/complete/abort. Adds headObject support to storage-service (S3/Blob) and allows generatePresignedUploadUrl to accept a caller-supplied customKey.

UI and tests updated. Workspace Files UI now enforces a 5 GiB per-file limit client-side and shows per-file percent progress; the legacy FormData upload route is capped via MAX_WORKSPACE_FORMDATA_FILE_SIZE (100MB) and returns 413. Adds extensive new tests, plus shared testing mocks for storage-service and PostHog.

^{Reviewed by Cursor Bugbot for commit c7a6fc9. Configure here.}

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

Greptile Summary

This PR replaces the buffered-FormData proxy path for workspace file uploads with direct-to-storage transfers: presigned PUT for files ≤50MB and chunked multipart for larger files. It adds /api/workspaces/[id]/files/presigned and /register endpoints with cross-tenant key validation, HEAD-based size verification, quota enforcement, and orphan cleanup. Client transport is consolidated into lib/uploads/client/direct-upload.ts, which the KB upload hook now consumes, eliminating ~250 lines of duplicated logic. The FormData fallback is retained for local-dev environments without cloud storage.

• fetchBatchPresignedData in the KB hook accesses presignedItems[batchPos] without a null guard — a malformed server response (missing files key) would throw a TypeError instead of a handled error.
• MultipartUploadOptions.workspaceId is required for all contexts including 'knowledge-base'; this implicit contract is not documented and could silently fail for callers that don't supply a valid workspace ID for large KB files.

Confidence Score: 5/5

Safe to merge — all previously identified P1 issues are addressed and no new blocking issues were found.

All P1s from prior review iterations (orphan cleanup, quota inflation via zero-size HEAD fallback, TOCTOU in blob HEAD, multipart abort leaks, presigned URL error surfacing, retry-on-register TOCTOU) appear to have been fixed. The remaining findings are P2: a missing null guard in the KB batch presigned response and an undocumented implicit workspaceId requirement on MultipartUploadOptions. Neither is a runtime blocker under normal server behavior. Test coverage is thorough (60 unit tests, new route tests for both endpoints).

apps/sim/app/workspace/[workspaceId]/knowledge/hooks/use-knowledge-upload.ts (presignedItems null guard), apps/sim/lib/uploads/client/direct-upload.ts (MultipartUploadOptions.workspaceId implicit requirement)

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Client
    participant PresignedAPI as /workspaces/[id]/files/presigned
    participant S3Blob as S3 / Azure Blob
    participant RegisterAPI as /workspaces/[id]/files/register
    participant MultipartAPI as /api/files/multipart
    participant DB as Database

    alt Small file (≤50MB)
        Client->>PresignedAPI: POST {fileName, contentType, fileSize}
        PresignedAPI-->>Client: {presignedUrl, fileInfo, directUploadSupported}
        Note over Client,PresignedAPI: hasCloudStorage()=false → directUploadSupported:false → FormData fallback
        Client->>S3Blob: PUT file (XHR with progress)
        S3Blob-->>Client: 200 OK
        Client->>RegisterAPI: POST {key, name, contentType}
        RegisterAPI->>S3Blob: HEAD (verify object exists + get size)
        RegisterAPI->>DB: INSERT metadata (idempotent)
        RegisterAPI-->>Client: {success, file}
    else Large file (>50MB) multipart
        Client->>MultipartAPI: POST action=initiate {fileName, workspaceId, context}
        MultipartAPI-->>Client: {uploadId, key, uploadToken}
        Client->>MultipartAPI: POST action=get-part-urls {uploadToken, partNumbers}
        MultipartAPI-->>Client: {presignedUrls[]}
        loop Per chunk (parallel, concurrency=3, with retry)
            Client->>S3Blob: PUT chunk
            S3Blob-->>Client: ETag
        end
        Client->>MultipartAPI: POST action=complete {uploadToken, parts}
        MultipartAPI->>S3Blob: CompleteMultipartUpload
        MultipartAPI-->>Client: {path, key}
        Client->>RegisterAPI: POST {key, name, contentType}
        RegisterAPI->>S3Blob: HEAD (verify)
        RegisterAPI->>DB: INSERT metadata
        RegisterAPI-->>Client: {success, file}
    end

_{Reviews (19): Last reviewed commit: "fix(uploads): add timeout/abort to kb ap..." | Re-trigger Greptile}

@greptile

@cursor review

@greptile

@cursor review

@cursor review

@greptile

@cursor review

@greptile

@cursor review

@greptile

@cursor review

@greptile

@cursor review