fix(security): compare-and-swap the chat binding on chat uploads

Two overlapping chat requests could both observe the same claimable row with
`chat_id IS NULL` and both satisfy the update predicate, so the later write
silently moved the upload to its own chat — taking over the delete-cascade
lifecycle of a file the first chat had already bound.

Scope the update to `chat_id IS NULL OR chat_id = <target>` so the statement
is a compare-and-swap: the loser matches zero rows and fails closed. The
resolver applies the same rule so the update-vs-insert decision stays
coherent.

This also makes an upload bind to exactly one chat, matching the 409 the
sibling `local-files/stage` route already returns for the same case; verified
no client flow relinks a key across chats (drafts are per-chat, every retry
path replays under a pinned chat id, forking copies blobs to fresh keys).

Author: waleedlatif1

apps/sim/lib/uploads/contexts/workspace/track-chat-upload.test.ts

@@ -52,6 +52,7 @@ function existingRow(overrides: Record<string, unknown> = {}) {
     userId: USER_ID,
     workspaceId: WORKSPACE_ID,
     context: 'mothership',
+    chatId: null,
     deletedAt: null,
     ...overrides,
   }
@@ -397,10 +398,49 @@ describe('trackChatUpload', () => {
           { type: 'eq', left: 'workspaceId', right: WORKSPACE_ID },
           { type: 'eq', left: 'context', right: 'mothership' },
           { type: 'isNull', column: 'deletedAt' },
+          {
+            type: 'or',
+            conditions: [
+              { type: 'isNull', column: 'chatId' },
+              { type: 'eq', left: 'chatId', right: CHAT_ID },
+            ],
+          },
         ],
       })
     })
 
+    /**
+     * An upload binds to exactly one chat. Matches the 409 the sibling
+     * `local-files/stage` route already returns for this case.
+     */
+    it('refuses to relink an upload already bound to a different chat', async () => {
+      queueOwnershipLookup([existingRow({ chatId: 'other-chat-id' })])
+
+      await expect(
+        trackChatUpload(WORKSPACE_ID, USER_ID, CHAT_ID, S3_KEY, 'image.png', 'image/png', 1024)
+      ).rejects.toThrow('not available for a chat attachment')
+
+      expect(dbChainMockFns.set).not.toHaveBeenCalled()
+      expect(dbChainMockFns.values).not.toHaveBeenCalled()
+    })
+
+    it('still re-links an upload already bound to this same chat', async () => {
+      queueOwnershipLookup([existingRow({ chatId: CHAT_ID })])
+      dbChainMockFns.returning.mockResolvedValueOnce([{ id: 'wf_existing' }])
+
+      const result = await trackChatUpload(
+        WORKSPACE_ID,
+        USER_ID,
+        CHAT_ID,
+        S3_KEY,
+        'image.png',
+        'image/png',
+        1024
+      )
+
+      expect(result).toEqual({ displayName: 'image.png' })
+    })
+
     it('requires the object to exist in storage before minting a new binding', async () => {
       queueOwnershipLookup([])
       mockHeadObject.mockResolvedValueOnce(null)

apps/sim/lib/uploads/contexts/workspace/workspace-file-manager.ts

@@ -9,7 +9,7 @@ import { workspaceFiles } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, getPostgresConstraintName, getPostgresErrorCode } from '@sim/utils/errors'
 import { generateShortId } from '@sim/utils/id'
-import { and, eq, isNotNull, isNull, sql } from 'drizzle-orm'
+import { and, eq, isNotNull, isNull, or, sql } from 'drizzle-orm'
 import type { ShareRecord } from '@/lib/api/contracts/public-shares'
 import {
   decrementStorageUsageForBillingContextInTx,
@@ -617,10 +617,15 @@ type ClaimableChatUploadRow = { kind: 'update'; id: string } | { kind: 'insert'
  * Soft-deleted rows count: the active-key unique index is partial on
  * `deleted_at IS NULL`, so inserting over an archived row would succeed and
  * hand the caller read access to the archived file's bytes.
+ *
+ * An upload also binds to exactly one chat: a row already linked to a different
+ * chat is not claimable, matching the 409 the sibling `local-files/stage` route
+ * returns for the same case. Re-sending the key within its own chat still works.
  */
 async function resolveClaimableChatUploadRow(
   workspaceId: string,
   userId: string,
+  chatId: string,
   s3Key: string
 ): Promise<ClaimableChatUploadRow> {
   const rows = await db
@@ -629,6 +634,7 @@ async function resolveClaimableChatUploadRow(
       userId: workspaceFiles.userId,
       workspaceId: workspaceFiles.workspaceId,
       context: workspaceFiles.context,
+      chatId: workspaceFiles.chatId,
       deletedAt: workspaceFiles.deletedAt,
     })
     .from(workspaceFiles)
@@ -643,7 +649,8 @@ async function resolveClaimableChatUploadRow(
       row.userId === userId &&
       row.workspaceId === workspaceId &&
       row.context === 'mothership' &&
-      row.deletedAt === null
+      row.deletedAt === null &&
+      (row.chatId === null || row.chatId === chatId)
   )
 
   if (!owned) {
@@ -686,7 +693,7 @@ export async function trackChatUpload(
     throw new WorkspaceFileKeyOwnershipError(s3Key)
   }
 
-  const claimable = await resolveClaimableChatUploadRow(workspaceId, userId, s3Key)
+  const claimable = await resolveClaimableChatUploadRow(workspaceId, userId, chatId, s3Key)
 
   if (claimable.kind === 'insert' && hasCloudStorage()) {
     // Hygiene only — the format and no-prior-record guards above already carry
@@ -727,7 +734,13 @@ export async function trackChatUpload(
               eq(workspaceFiles.userId, userId),
               eq(workspaceFiles.workspaceId, workspaceId),
               eq(workspaceFiles.context, 'mothership'),
-              isNull(workspaceFiles.deletedAt)
+              isNull(workspaceFiles.deletedAt),
+              // Compare-and-swap on the chat binding: an upload belongs to one
+              // chat. Two overlapping requests both observe `chat_id IS NULL`,
+              // but only the first satisfies this predicate — the loser matches
+              // zero rows and fails closed instead of stealing the binding and
+              // its delete-cascade lifecycle.
+              or(isNull(workspaceFiles.chatId), eq(workspaceFiles.chatId, chatId))
             )
           )
           .returning({ id: workspaceFiles.id })