Unify file creation and signed upload sessions

[TheodoreSpeaks]

Summary

• replace legacy buffered, presigned, fallback, and multipart upload paths with stateless signed upload sessions
• use a single signed PUT for workspace files from zero bytes through 50 MiB, with multipart transfer above that boundary
• add immutable staging, provider-native create-only promotion, replay-safe completion, conditional cleanup, and bounded local-storage cleanup
• migrate workspace files, knowledge documents, table imports, profile pictures, workspace logos, mothership attachments, and execution attachments
• add authored file creation to the workspace UI and public v2 API, with optional UTF-8 or base64 initial content
• harden create and content-replace APIs with authorization-before-body parsing, canonical base64 validation, bounded JSON bodies, and canonical v2 errors
• return the committed workspace-file row directly so successful creates cannot fail on a follow-up read
• bound multi-file admission, transfer concurrency, and table-import memory usage
• update OpenAPI and self-hosting CORS/lifecycle documentation
• align the v2 service-account credential contract with the existing dataCenter field required by its shared field discriminator

Test plan

• bun run lint
• bun run type-check
• bun run check:boundaries
• bun run check:api-validation:strict
• bun run check:openapi
• bun run check:client-boundary
• bun run check:utils
• bun run check:zustand-v5
• bun run check:react-query
• bun run check:realtime-prune
• 17 upload/create/content-focused Vitest files, 186 tests
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 4, 2026 11:34pm

[cursor]

PR Summary

High Risk
Touches authentication, workspace permissions, storage quota accounting, and public v2 file/upload contracts across many upload purposes; regressions could break uploads, billing, or API clients.

Overview
Replaces buffered multipart/form-data uploads, standalone presigned URL minting, and the legacy /api/files/multipart action router with purpose-scoped signed upload sessions under /api/files/uploads (create, part URLs, complete, abort). Clients get a signed control token plus either a single PUT (empty through 50 MiB) or multipart transfer instructions for larger files, with domain-specific finalization in finalizers and purposes.

v2 API and clients shift workspace file creation to JSON POST /api/v2/files for small inline content; larger or streamed bytes use upload-session endpoints. Knowledge documents, table imports, and related OpenAPI schemas now describe PUT vs multipart completion and separate session envelopes from transfer metadata.

Self-hosting docs add Azure Blob CORS for direct uploads, extra GCS exposed metadata headers, and lifecycle rules to expire staged upload-sessions/ objects (and incomplete multipart where supported).

Also documents optional dataCenter on v2 service-account credential create/update schemas.

^{Reviewed by Cursor Bugbot for commit c03fc3d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[TheodoreSpeaks]

@greptile-apps

[greptile-apps]

Greptile Summary

The PR replaces legacy buffered and presigned upload paths with a unified stateless signed-session model.

• Uses one signed PUT through 50 MiB and multipart transfer above that boundary.
• Adds immutable staging, create-only promotion, replay-safe finalization, abort handling, and bounded cleanup.
• Migrates workspace files, knowledge documents, tables, profile assets, and workflow attachments to the shared flow.
• Updates upload contracts, provider implementations, OpenAPI specifications, and self-hosting guidance.

Confidence Score: 5/5

The PR appears safe to merge based on the eligible follow-up review scope.

No blocking failure remains in the available scoring findings.

Important Files Changed

Filename	Overview
apps/sim/lib/uploads/upload-session/service.ts	Implements the central stateless session lifecycle, including validation, promotion, replay handling, finalization, abort, and cleanup.
apps/sim/lib/uploads/upload-session/provider.ts	Unifies local, S3, GCS, and Azure staging, multipart assembly, create-only promotion, and conditional deletion operations.
apps/sim/lib/uploads/client/upload-session.ts	Implements the shared browser PUT and multipart transfer engine with retries, cancellation, progress, and bounded concurrency.
apps/sim/app/api/files/uploads/finalizers.ts	Adds purpose-specific, conflict-aware finalization for workspace files and internal attachment or profile assets.
apps/sim/lib/table/orchestration/import-resource.ts	Migrates table imports to uploaded resources while bounding import processing and preserving retryable orchestration.
apps/sim/lib/api/contracts/upload-sessions.ts	Defines the shared signed-session request, transfer, completion, and purpose-result contracts.
apps/docs/content/docs/en/platform/self-hosting/object-storage.mdx	Documents browser CORS requirements and lifecycle cleanup for staged upload objects and abandoned multipart data.

Sequence Diagram

sequenceDiagram
  participant Client
  participant API as Upload Session API
  participant Store as Object Storage
  participant Finalizer as Purpose Finalizer
  Client->>API: Create session with file metadata
  API-->>Client: Signed token and PUT or multipart transfer
  Client->>Store: Upload into immutable staging key
  Client->>API: Complete session
  API->>Store: Verify staged object or assemble parts
  API->>Store: Promote to create-only final key
  API->>Finalizer: Register file, document, or import
  API->>Store: Conditionally remove staging object
  API-->>Client: Purpose-specific result

Loading

_{Reviews (2): Last reviewed commit: "fix(uploads): preserve attachment storag..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile-apps

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b1d4d63. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c03fc3d. Configure here.}

[cursor]

V2 create parses before authz

Medium Severity

The new POST /api/v2/files handler runs parseRequest with a 70 MiB JSON cap before resolveWorkspaceAccess verifies workspace write permission. Callers with a valid API key but without write access can still force the server to read and validate large bodies for arbitrary workspaceId values, unlike the workspace JSON create route in the same change, which checks permissions before parsing.

 

^{Reviewed by Cursor Bugbot for commit c03fc3d. Configure here.}

[cursor]

Zero-byte session quota block

Medium Severity

Allowing workspace_file upload sessions with fileSize: 0 still runs checkStorageQuotaForBillingContext with zero additional bytes. When recorded usage is already above the payer limit, that check fails even though completion would not increase storage, so signed-session empty uploads are rejected while inline POST create paths can still add zero-byte files.

 

^{Reviewed by Cursor Bugbot for commit c03fc3d. Configure here.}