fix

Author: icecrasher321

apps/sim/lib/knowledge/documents/document-processing-source.test.ts

@@ -182,4 +182,25 @@ describe('knowledge document processing source', () => {
     )
     expect(mockGenerateEmbeddings).not.toHaveBeenCalled()
   })
+
+  it('fails before parsing an existing document when its current source is tracked unknown', async () => {
+    mockGetFileMetadataByKeys.mockImplementation(async (_keys: string[], context: string) =>
+      context === 'workspace' ? [{ ...SOURCE_BINDING, secretProvenanceVersion: 1 }] : []
+    )
+    mockGetBoundWorkspaceFileSecretProvenanceByMetadata.mockResolvedValue(
+      new Map([[SOURCE_BINDING.id, { status: 'unknown' }]])
+    )
+
+    await expect(
+      processDocumentAsync('knowledge-base-1', 'document-1', {
+        filename: 'stale.pdf',
+        fileUrl: 'https://example.com/stale.pdf',
+        fileSize: 1,
+        mimeType: 'text/plain',
+      })
+    ).rejects.toThrow('Knowledge document secret provenance is unavailable')
+
+    expect(mockProcessDocument).not.toHaveBeenCalled()
+    expect(mockGenerateEmbeddings).not.toHaveBeenCalled()
+  })
 })

apps/sim/lib/knowledge/documents/service.ts

@@ -2550,7 +2550,10 @@ export async function deleteDocumentStorageFiles(
     ...new Set(
       entries
         .map((entry) => entry.storageKey)
-        .filter((key): key is string => typeof key === 'string')
+        .filter(
+          (key): key is string =>
+            typeof key === 'string' && (key.startsWith('kb/') || key.startsWith('knowledge-base/'))
+        )
     ),
   ]
   const bindingByKey = new Map<string, FileMetadataRecord>()
@@ -2566,6 +2569,10 @@ export async function deleteDocumentStorageFiles(
       return
     }
 
+    if (!storageKey.startsWith('kb/') && !storageKey.startsWith('knowledge-base/')) {
+      return
+    }
+
     const binding = bindingByKey.get(storageKey)
     if (!binding?.workspaceId || binding.context !== 'knowledge-base') {
       logger.warn(`[${requestId}] Skipping storage delete: no ownership binding for key`, {

apps/sim/lib/knowledge/documents/workspace-source-provenance.test.ts

@@ -193,6 +193,73 @@ describe('knowledge workspace source provenance', () => {
     )
   })
 
+  it('preserves a tracked exact-empty manual upload as model-safe', async () => {
+    mockGetBoundWorkspaceFileSecretProvenanceByMetadata.mockResolvedValue(
+      new Map([[SOURCE_BINDING.id, { status: 'exact', entries: [] }]])
+    )
+
+    await createSingleDocument(
+      {
+        filename: 'source.pdf',
+        fileUrl: SOURCE_URL,
+        fileSize: 512,
+        mimeType: 'application/pdf',
+      },
+      KNOWLEDGE_BASE_ID,
+      'request-1',
+      SOURCE_USER_ID
+    )
+
+    expect(findDocumentProvenanceWrite()).toEqual(
+      expect.objectContaining({ status: 'exact', entries: [] })
+    )
+  })
+
+  it('uses the trusted mothership row context instead of the URL context label', async () => {
+    const mothershipBinding = {
+      ...SOURCE_BINDING,
+      id: 'mothership-file-1',
+      context: 'mothership',
+    }
+    mockGetFileMetadataByKeys.mockImplementation(async (_keys: string[], context: string) =>
+      context === 'mothership' ? [mothershipBinding] : []
+    )
+    mockGetBoundWorkspaceFileSecretProvenanceByMetadata.mockResolvedValue(
+      new Map([
+        [
+          mothershipBinding.id,
+          {
+            status: 'exact',
+            entries: [{ name: 'CHAT_SECRET', encryptedValue: 'encrypted-chat-secret' }],
+          },
+        ],
+      ])
+    )
+
+    await createSingleDocument(
+      {
+        filename: 'source.pdf',
+        fileUrl: SOURCE_URL,
+        fileSize: 512,
+        mimeType: 'application/pdf',
+      },
+      KNOWLEDGE_BASE_ID,
+      'request-1',
+      SOURCE_USER_ID
+    )
+
+    expect(mockGetBoundWorkspaceFileSecretProvenanceByMetadata).toHaveBeenCalledWith(
+      expect.anything(),
+      [mothershipBinding]
+    )
+    expect(findDocumentProvenanceWrite()).toEqual(
+      expect.objectContaining({
+        status: 'exact',
+        entries: [expect.objectContaining({ name: 'CHAT_SECRET' })],
+      })
+    )
+  })
+
   it('preserves legacy behavior when a workspace source has no metadata binding', async () => {
     mockGetFileMetadataByKeys.mockResolvedValue([])
 
@@ -221,7 +288,7 @@ describe('knowledge workspace source provenance', () => {
       'request-1'
     )
 
-    expect(mockGetFileMetadataByKeys).toHaveBeenCalledWith([SOURCE_KEY], 'knowledge-base')
+    expect(mockGetFileMetadataByKeys).not.toHaveBeenCalled()
     expect(mockDeleteFile).not.toHaveBeenCalled()
     expect(mockDeleteFileMetadataByIdentity).not.toHaveBeenCalled()
   })