fix(security): make the chat-upload ownership check atomic with its write

The ownership lookup and the binding UPDATE were separate statements, and the
UPDATE matched on the captured row id alone. A concurrent `materialize_file`
sets `context='workspace'` and clears `chatId` on that same row, so the
tracking write still matched and dragged the saved file back into chat scope —
hiding it from every workspace-file listing and re-exposing it to the
chat-delete cascade, with materialize's storage-usage increment left stranded.

Re-assert every ownership predicate in the UPDATE so the statement is itself
the atomic check. The lookup now only decides UPDATE-vs-INSERT and is no
longer load-bearing for authorization, which also makes the existing
`updated.length === 0` fail-closed branch correct rather than dead.

Author: waleedlatif1

apps/sim/lib/uploads/contexts/workspace/track-chat-upload.test.ts

@@ -376,6 +376,31 @@ describe('trackChatUpload', () => {
       expect(dbChainMockFns.values).not.toHaveBeenCalled()
     })
 
+    /**
+     * The ownership lookup and the write are separate statements, so a
+     * concurrent `materialize_file` can flip the row to context='workspace'
+     * in between. The UPDATE must re-assert every ownership predicate rather
+     * than matching on the captured row id alone, or it would drag a saved
+     * workspace file back into chat scope.
+     */
+    it('re-asserts every ownership predicate in the update, not just the row id', async () => {
+      queueOwnershipLookup([existingRow({ id: 'wf_mine' })])
+      dbChainMockFns.returning.mockResolvedValueOnce([{ id: 'wf_mine' }])
+
+      await trackChatUpload(WORKSPACE_ID, USER_ID, CHAT_ID, S3_KEY, 'image.png', 'image/png', 1024)
+
+      expect(dbChainMockFns.where.mock.calls.at(-1)?.[0]).toEqual({
+        type: 'and',
+        conditions: [
+          { type: 'eq', left: 'id', right: 'wf_mine' },
+          { type: 'eq', left: 'userId', right: USER_ID },
+          { type: 'eq', left: 'workspaceId', right: WORKSPACE_ID },
+          { type: 'eq', left: 'context', right: 'mothership' },
+          { type: 'isNull', column: 'deletedAt' },
+        ],
+      })
+    })
+
     it('requires the object to exist in storage before minting a new binding', async () => {
       queueOwnershipLookup([])
       mockHeadObject.mockResolvedValueOnce(null)

apps/sim/lib/uploads/contexts/workspace/workspace-file-manager.ts

@@ -707,12 +707,24 @@ export async function trackChatUpload(
             context: 'mothership',
             displayName: candidate,
           })
-          .where(eq(workspaceFiles.id, claimable.id))
+          .where(
+            and(
+              eq(workspaceFiles.id, claimable.id),
+              eq(workspaceFiles.userId, userId),
+              eq(workspaceFiles.workspaceId, workspaceId),
+              eq(workspaceFiles.context, 'mothership'),
+              isNull(workspaceFiles.deletedAt)
+            )
+          )
           .returning({ id: workspaceFiles.id })
 
         if (updated.length === 0) {
-          // The row was deleted or re-owned between the ownership check and the
-          // write. Fail closed rather than silently minting a new binding.
+          // The ownership lookup is a separate statement, so re-assert every
+          // predicate here — this UPDATE is the atomic check. A concurrent
+          // `materialize_file` flips the same row to context='workspace' and
+          // clears chatId; matching on id alone would drag that saved file back
+          // into chat scope, hiding it from the Files listing and re-exposing it
+          // to the chat-delete cascade.
           throw new WorkspaceFileKeyOwnershipError(s3Key)
         }