fix(uploads): preserve attachment storage semantics

Author: TheodoreSpeaks

apps/sim/app/api/files/uploads/route.test.ts

@@ -54,6 +54,7 @@ vi.mock('@/lib/uploads/contexts/workspace', () => ({
 
 vi.mock('@/lib/realtime/notify', () => ({ notifyWorkspaceFilesChanged: vi.fn() }))
 
+import { MAX_WORKSPACE_FILE_SIZE } from '@/lib/uploads/shared/types'
 import { POST as completeUpload } from '@/app/api/files/uploads/[uploadId]/complete/route'
 import { POST as createUpload } from '@/app/api/files/uploads/route'
 
@@ -142,6 +143,62 @@ describe('/api/files/uploads', () => {
     expect(body.data.session).not.toHaveProperty('transfer')
   })
 
+  it('preserves the 5 GiB direct-to-storage limit for mothership attachments', async () => {
+    mockCreateUploadSession.mockResolvedValue({
+      ...session({
+        workspaceId: 'workspace-1',
+        purpose: 'mothership_attachment',
+        method: 'multipart',
+        storageContext: 'mothership',
+        storageKey: 'mothership/workspace-1/archive.zip',
+        fileName: 'archive.zip',
+        contentType: 'application/zip',
+        fileSize: MAX_WORKSPACE_FILE_SIZE,
+      }),
+      transfer: { method: 'multipart', partSize: 8 * 1024 * 1024, partCount: 640 },
+    })
+    const request = new NextRequest('http://localhost/api/files/uploads', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        purpose: 'mothership_attachment',
+        workspaceId: 'workspace-1',
+        name: 'archive.zip',
+        contentType: 'application/zip',
+        size: MAX_WORKSPACE_FILE_SIZE,
+      }),
+    })
+
+    const response = await createUpload(request)
+
+    expect(response.status).toBe(201)
+    expect(mockCreateUploadSession).toHaveBeenCalledWith(
+      expect.objectContaining({
+        purpose: 'mothership_attachment',
+        fileSize: MAX_WORKSPACE_FILE_SIZE,
+      })
+    )
+  })
+
+  it('rejects mothership attachments above the 5 GiB direct-to-storage limit', async () => {
+    const request = new NextRequest('http://localhost/api/files/uploads', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        purpose: 'mothership_attachment',
+        workspaceId: 'workspace-1',
+        name: 'archive.zip',
+        contentType: 'application/zip',
+        size: MAX_WORKSPACE_FILE_SIZE + 1,
+      }),
+    })
+
+    const response = await createUpload(request)
+
+    expect(response.status).toBe(400)
+    expect(mockCreateUploadSession).not.toHaveBeenCalled()
+  })
+
   it('reauthorizes a terminal request and returns only the terminal-safe session', async () => {
     const logoSession = session({
       workspaceId: 'workspace-1',

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/copilot/components/user-input/hooks/use-file-attachments.test.tsx

@@ -16,7 +16,7 @@ vi.mock('@/lib/uploads/client/session-upload', () => ({
   uploadInternalFileSession: mockUploadInternalFileSession,
 }))
 
-import { MULTI_FILE_UPLOAD_MAX_FILE_BYTES } from '@/lib/uploads/client/admission'
+import { MAX_WORKSPACE_FILE_SIZE } from '@/lib/uploads/shared/types'
 import { useFileAttachments } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/copilot/components/user-input/hooks/use-file-attachments'
 
 interface HookHarness {
@@ -73,23 +73,46 @@ describe('useFileAttachments admission', () => {
 
   it('rejects aggregate bytes before previews, placeholders, or sessions are allocated', async () => {
     const { result, unmount } = renderFileAttachmentsHook()
-    const files = asFileList(
-      Array.from({ length: 6 }, (_, index) =>
-        sizedFile(`image-${index}.png`, MULTI_FILE_UPLOAD_MAX_FILE_BYTES)
-      )
-    )
+    const files = asFileList([
+      ...Array.from({ length: 5 }, (_, index) =>
+        sizedFile(`large-image-${index}.png`, MAX_WORKSPACE_FILE_SIZE)
+      ),
+      sizedFile('extra-image.png', 1),
+    ])
 
     await act(async () => {
       await result().processFiles(files)
     })
 
     expect(mockToastError).toHaveBeenCalledWith("Couldn't add files", {
-      description: 'Select files totaling 500 MiB or less.',
+      description: 'Select files totaling 25 GiB or less.',
     })
     expect(createObjectUrl).not.toHaveBeenCalled()
     expect(mockUploadInternalFileSession).not.toHaveBeenCalled()
     expect(result().attachedFiles).toEqual([])
 
     unmount()
   })
+
+  it('starts a mothership session for a file above the old FormData limit', async () => {
+    mockUploadInternalFileSession.mockResolvedValue({
+      path: '/api/files/serve/s3/mothership%2Flarge-image.png?context=mothership',
+      key: 'mothership/large-image.png',
+    })
+    const { result, unmount } = renderFileAttachmentsHook()
+    const file = sizedFile('large-image.png', 101 * 1024 * 1024)
+
+    await act(async () => {
+      await result().processFiles(asFileList([file]))
+    })
+
+    expect(mockUploadInternalFileSession).toHaveBeenCalledWith(
+      expect.objectContaining({ purpose: 'mothership_attachment', file })
+    )
+    expect(result().attachedFiles).toEqual([
+      expect.objectContaining({ name: file.name, uploading: false }),
+    ])
+
+    unmount()
+  })
 })

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/copilot/components/user-input/hooks/use-file-attachments.ts

@@ -8,6 +8,7 @@ import { generateId } from '@sim/utils/id'
 import { assertMultiFileUploadAdmission } from '@/lib/uploads/client/admission'
 import { runWithConcurrency, WHOLE_FILE_PARALLEL_UPLOADS } from '@/lib/uploads/client/concurrency'
 import { uploadInternalFileSession } from '@/lib/uploads/client/session-upload'
+import { MAX_WORKSPACE_FILE_SIZE } from '@/lib/uploads/shared/types'
 import { resolveFileType } from '@/lib/uploads/utils/file-utils'
 
 const logger = createLogger('useFileAttachments')
@@ -135,7 +136,10 @@ export function useFileAttachments(props: UseFileAttachmentsProps) {
 
       if (fileList.length === 0) return
       try {
-        assertMultiFileUploadAdmission(fileList, { existingFiles: attachedFilesRef.current })
+        assertMultiFileUploadAdmission(fileList, {
+          existingFiles: attachedFilesRef.current,
+          maxFileBytes: MAX_WORKSPACE_FILE_SIZE,
+        })
       } catch (error) {
         toast.error("Couldn't add files", { description: toError(error).message })
         return

apps/sim/lib/api/contracts/upload-sessions.ts

@@ -57,7 +57,7 @@ export const createInternalFileUploadBodySchema = z.discriminatedUnion('purpose'
     .object({
       purpose: z.literal('mothership_attachment'),
       ...internalFileUploadBaseShape,
-      size: z.number().int().min(1).max(MAX_WORKSPACE_FORMDATA_FILE_SIZE),
+      size: z.number().int().min(1).max(MAX_WORKSPACE_FILE_SIZE),
       workspaceId: workspaceIdSchema,
     })
     .strict(),

apps/sim/lib/uploads/client/admission.test.ts

@@ -54,4 +54,24 @@ describe('multi-file upload admission', () => {
       })
     )
   })
+
+  it('supports a larger direct-to-storage limit without weakening aggregate admission', () => {
+    expect(() =>
+      assertMultiFileUploadAdmission([{ name: 'archive.zip', size: 1024 }], {
+        maxFileBytes: 1024,
+        maxTotalBytes: 2048,
+      })
+    ).not.toThrow()
+
+    expect(() =>
+      assertMultiFileUploadAdmission(files(3, 1024), {
+        maxFileBytes: 1024,
+        maxTotalBytes: 2048,
+      })
+    ).toThrow(
+      expect.objectContaining<Partial<MultiFileUploadAdmissionError>>({
+        code: 'UPLOAD_TOTAL_SIZE_EXCEEDED',
+      })
+    )
+  })
 })

apps/sim/lib/uploads/client/admission.ts

@@ -4,11 +4,13 @@ import {
 } from '@/lib/uploads/shared/types'
 
 export const MULTI_FILE_UPLOAD_MAX_FILES = 20
+const MULTI_FILE_UPLOAD_MAX_TOTAL_FILE_EQUIVALENTS = 5
 export const MULTI_FILE_UPLOAD_MAX_FILE_BYTES = Math.min(
   MAX_KNOWLEDGE_DOCUMENT_FILE_SIZE,
   MAX_WORKSPACE_FORMDATA_FILE_SIZE
 )
-export const MULTI_FILE_UPLOAD_MAX_TOTAL_BYTES = 5 * MULTI_FILE_UPLOAD_MAX_FILE_BYTES
+export const MULTI_FILE_UPLOAD_MAX_TOTAL_BYTES =
+  MULTI_FILE_UPLOAD_MAX_TOTAL_FILE_EQUIVALENTS * MULTI_FILE_UPLOAD_MAX_FILE_BYTES
 
 export type MultiFileUploadAdmissionErrorCode =
   | 'UPLOAD_FILE_COUNT_EXCEEDED'
@@ -32,18 +34,29 @@ interface UploadAdmissionFile {
 
 interface MultiFileUploadAdmissionOptions {
   existingFiles?: ArrayLike<UploadAdmissionFile>
+  maxFileBytes?: number
+  maxTotalBytes?: number
 }
 
 /**
  * Bounds one user upload action before previews, UI rows, or upload sessions are allocated.
- * Both consumers accept 100 MiB files, so five maximum-sized files form the 500 MiB aggregate
- * budget while the count cap still bounds actions containing many small files.
+ * Knowledge uploads use the shared 100 MiB / 500 MiB defaults. Direct-to-storage consumers may
+ * provide their larger server-side limit while retaining the same count and aggregate bounds.
  */
 export function assertMultiFileUploadAdmission(
   files: ArrayLike<UploadAdmissionFile>,
   options: MultiFileUploadAdmissionOptions = {}
 ): void {
   const existingFiles = options.existingFiles
+  const maxFileBytes = options.maxFileBytes ?? MULTI_FILE_UPLOAD_MAX_FILE_BYTES
+  const maxTotalBytes =
+    options.maxTotalBytes ?? MULTI_FILE_UPLOAD_MAX_TOTAL_FILE_EQUIVALENTS * maxFileBytes
+  if (!Number.isSafeInteger(maxFileBytes) || maxFileBytes < 1) {
+    throw new Error('Invalid per-file upload limit')
+  }
+  if (!Number.isSafeInteger(maxTotalBytes) || maxTotalBytes < maxFileBytes) {
+    throw new Error('Invalid aggregate upload limit')
+  }
   const existingCount = existingFiles?.length ?? 0
   const totalCount = existingCount + files.length
   if (totalCount > MULTI_FILE_UPLOAD_MAX_FILES) {
@@ -61,21 +74,29 @@ export function assertMultiFileUploadAdmission(
       if (!file || !Number.isSafeInteger(file.size) || file.size < 0) {
         throw new Error('Invalid file size in upload selection')
       }
-      if (file.size > MULTI_FILE_UPLOAD_MAX_FILE_BYTES) {
+      if (file.size > maxFileBytes) {
         const label = file.name ? `"${file.name}"` : 'A selected file'
         throw new MultiFileUploadAdmissionError(
-          `${label} is too large. Each file must be 100 MiB or smaller.`,
+          `${label} is too large. Each file must be ${formatBinaryBytes(maxFileBytes)} or smaller.`,
           'UPLOAD_FILE_SIZE_EXCEEDED'
         )
       }
       totalBytes += file.size
     }
   }
 
-  if (totalBytes > MULTI_FILE_UPLOAD_MAX_TOTAL_BYTES) {
+  if (totalBytes > maxTotalBytes) {
     throw new MultiFileUploadAdmissionError(
-      'Select files totaling 500 MiB or less.',
+      `Select files totaling ${formatBinaryBytes(maxTotalBytes)} or less.`,
       'UPLOAD_TOTAL_SIZE_EXCEEDED'
     )
   }
 }
+
+function formatBinaryBytes(bytes: number): string {
+  const gibibyte = 1024 ** 3
+  if (bytes % gibibyte === 0) return `${bytes / gibibyte} GiB`
+  const mebibyte = 1024 ** 2
+  if (bytes % mebibyte === 0) return `${bytes / mebibyte} MiB`
+  return `${bytes} bytes`
+}

apps/sim/lib/uploads/upload-session/service.test.ts

@@ -50,6 +50,10 @@ vi.mock('@/lib/uploads/upload-session/provider', () => ({
   uploadStorageProvider: vi.fn(() => 's3'),
 }))
 
+import {
+  MAX_WORKSPACE_FILE_SIZE,
+  MAX_WORKSPACE_FORMDATA_FILE_SIZE,
+} from '@/lib/uploads/shared/types'
 import {
   completeUploadSession,
   createUploadSession,
@@ -122,7 +126,11 @@ describe('upload sessions', () => {
     })
   })
 
-  it('quota-gates execution attachments while exempting transient mothership attachments', async () => {
+  it('quota-gates durable files while exempting retention-scoped attachments', async () => {
+    await createWorkspaceUpload(1024)
+    expect(mockResolveBillingContext).toHaveBeenCalledOnce()
+    expect(mockCheckStorageQuota).toHaveBeenCalledOnce()
+
     await createUploadSession({
       id: 'execution-upload',
       workspaceId: WORKSPACE_ID,
@@ -150,6 +158,49 @@ describe('upload sessions', () => {
     expect(mockCheckStorageQuota).toHaveBeenCalledOnce()
   })
 
+  it('preserves the 5 GiB mothership limit while bounding execution attachments at 100 MiB', async () => {
+    await expect(
+      createUploadSession({
+        id: 'mothership-upload',
+        workspaceId: WORKSPACE_ID,
+        userId: 'user-1',
+        purpose: 'mothership_attachment',
+        fileName: 'archive.zip',
+        contentType: 'application/zip',
+        fileSize: MAX_WORKSPACE_FILE_SIZE,
+      })
+    ).resolves.toMatchObject({
+      method: 'multipart',
+      transfer: { method: 'multipart', partCount: 640 },
+    })
+
+    await expect(
+      createUploadSession({
+        id: 'oversized-mothership-upload',
+        workspaceId: WORKSPACE_ID,
+        userId: 'user-1',
+        purpose: 'mothership_attachment',
+        fileName: 'archive.zip',
+        contentType: 'application/zip',
+        fileSize: MAX_WORKSPACE_FILE_SIZE + 1,
+      })
+    ).rejects.toThrow(`File size exceeds maximum of ${MAX_WORKSPACE_FILE_SIZE} bytes`)
+
+    await expect(
+      createUploadSession({
+        id: 'execution-upload',
+        workspaceId: WORKSPACE_ID,
+        workflowId: 'workflow-1',
+        executionId: 'execution-1',
+        userId: 'user-1',
+        purpose: 'execution_attachment',
+        fileName: 'result.txt',
+        contentType: 'text/plain',
+        fileSize: MAX_WORKSPACE_FORMDATA_FILE_SIZE + 1,
+      })
+    ).rejects.toThrow(`File size exceeds maximum of ${MAX_WORKSPACE_FORMDATA_FILE_SIZE} bytes`)
+  })
+
   it('validates PUT completion input independently of finalization', async () => {
     const created = await createWorkspaceUpload(1024)
 

apps/sim/lib/uploads/upload-session/service.ts

@@ -720,18 +720,14 @@ function maximumFileSize(purpose: UploadSessionPurpose): number {
   if (purpose === 'profile_picture' || purpose === 'workspace_logo') {
     return UPLOAD_SESSION_ASSET_MAX_BYTES
   }
-  if (purpose === 'mothership_attachment' || purpose === 'execution_attachment') {
+  if (purpose === 'execution_attachment') {
     return MAX_WORKSPACE_FORMDATA_FILE_SIZE
   }
   return MAX_WORKSPACE_FILE_SIZE
 }
 
 function requiresStorageQuota(purpose: UploadSessionPurpose): boolean {
-  return (
-    purpose === 'workspace_file' ||
-    purpose === 'knowledge_document' ||
-    purpose === 'execution_attachment'
-  )
+  return purpose === 'workspace_file' || purpose === 'knowledge_document'
 }
 
 function resolveUploadStorage(