fix(files): enforce live sharing checks and stabilize browser coverage

Author: waleedlatif1

.github/workflows/checks.yml

@@ -203,11 +203,11 @@ jobs:
 
       - name: Cache Files browser download
         if: matrix.group == 'files'
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
+        uses: ./.github/actions/cache
         with:
+          provider: ${{ vars.CI_PROVIDER }}
           path: ~/.cache/ms-playwright
-          key: files-browser-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('bun.lock') }}
-          restore-keys: files-browser-${{ runner.os }}-${{ runner.arch }}-
+          key: ${{ github.repository }}-files-browser-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('bun.lock') }}
 
       - name: Install Files browser from the pinned Playwright dependency
         if: matrix.group == 'files'

apps/sim/app/api/files/public/[token]/content/route.test.ts

@@ -1,4 +1,4 @@
-import { publicShare } from '@sim/db/schema'
+import { publicShare, workspaceFiles } from '@sim/db/schema'
 import { createRouteContext } from '@sim/testing/helpers/http'
 import { queueTableRows } from '@sim/testing/mocks/database.mock'
 import { publicSharesMock, publicSharesMockFns } from '@sim/testing/mocks/public-shares.mock'
@@ -43,7 +43,17 @@ const request = (token = 'tok_1') =>
   createMockRequest({ url: `http://localhost/api/files/public/${token}/content` })
 
 const passwordShare = {
-  share: { id: 'sh_1', token: 'tok_1', authType: 'password', password: 'enc:secret' },
+  share: {
+    id: 'sh_1',
+    token: 'tok_1',
+    resourceId: 'wf_1',
+    workspaceId: 'ws-1',
+    resourceType: 'file',
+    isActive: true,
+    authType: 'password',
+    password: 'enc:secret',
+    allowedEmails: [],
+  },
   file: {
     id: 'wf_1',
     key: 'workspace/ws/secret-key.pdf',
@@ -63,6 +73,7 @@ describe('GET /api/files/public/[token]/content', () => {
     mockDownloadFile.mockResolvedValue(Buffer.from('data'))
     mockResolveServableDoc.mockResolvedValue({ kind: 'passthrough' })
     queueTableRows(publicShare, [{ id: 'sh_1' }])
+    queueTableRows(workspaceFiles, [passwordShare.file])
   })
 
   it('returns 401 and never reads storage when a password share is unauthorized', async () => {

apps/sim/app/api/files/public/[token]/inline/route.test.ts

@@ -1,4 +1,4 @@
-import { publicShare } from '@sim/db/schema'
+import { publicShare, workspaceFiles } from '@sim/db/schema'
 import { createRouteContext } from '@sim/testing/helpers/http'
 import { queueTableRows } from '@sim/testing/mocks/database.mock'
 import { publicSharesMock, publicSharesMockFns } from '@sim/testing/mocks/public-shares.mock'
@@ -40,7 +40,17 @@ const req = (q: string) =>
   createMockRequest({ url: `http://localhost/api/files/public/${TOKEN}/inline?${q}` })
 
 const share = {
-  share: { id: 'sh_1', token: TOKEN, authType: 'public' },
+  share: {
+    id: 'sh_1',
+    token: TOKEN,
+    resourceId: 'wf_doc',
+    workspaceId: 'ws-1',
+    resourceType: 'file',
+    isActive: true,
+    authType: 'public',
+    password: null,
+    allowedEmails: [],
+  },
   file: { id: 'wf_doc', key: DOC_KEY, workspaceId: 'ws-1', originalName: 'doc.md' },
   workspaceName: 'Acme',
   ownerName: 'Jane',
@@ -64,6 +74,7 @@ describe('GET /api/files/public/[token]/inline', () => {
     })
     mockDownloadFile.mockImplementation(downloadByKey())
     queueTableRows(publicShare, [{ id: 'sh_1' }])
+    queueTableRows(workspaceFiles, [share.file])
   })
 
   it('rejects exhausted image budgets before share lookup, authentication, or storage reads', async () => {

apps/sim/app/api/files/public/[token]/route.test.ts

@@ -1,4 +1,4 @@
-import { publicShare as publicShareTable } from '@sim/db/schema'
+import { publicShare as publicShareTable, workspaceFiles } from '@sim/db/schema'
 import { queueTableRows } from '@sim/testing/mocks/database.mock'
 import { publicSharesMock, publicSharesMockFns } from '@sim/testing/mocks/public-shares.mock'
 import { NextRequest } from 'next/server'
@@ -40,7 +40,17 @@ const postRequest = (password: string, token = 'tok_1') =>
   })
 
 const publicShare = {
-  share: { id: 'sh_1', token: 'tok_1', authType: 'public', password: null },
+  share: {
+    id: 'sh_1',
+    token: 'tok_1',
+    resourceId: 'wf_1',
+    workspaceId: 'ws-secret',
+    resourceType: 'file',
+    isActive: true,
+    authType: 'public',
+    password: null,
+    allowedEmails: [],
+  },
   file: {
     id: 'wf_1',
     key: 'workspace/ws/secret-key.pdf',
@@ -55,14 +65,15 @@ const publicShare = {
 
 const passwordShare = {
   ...publicShare,
-  share: { id: 'sh_1', token: 'tok_1', authType: 'password', password: 'enc:secret' },
+  share: { ...publicShare.share, authType: 'password', password: 'enc:secret' },
 }
 
 describe('GET /api/files/public/[token]', () => {
   beforeEach(() => {
     mockEnforceRateLimit.mockResolvedValue(null) // allow by default
     mockValidateDeploymentAuth.mockResolvedValue({ authorized: true }) // public by default
     queueTableRows(publicShareTable, [{ id: 'sh_1' }])
+    queueTableRows(workspaceFiles, [publicShare.file])
   })
 
   it('returns 429 when the per-IP rate limit is exceeded', async () => {

apps/sim/app/workspace/[workspaceId]/components/resource/components/resource-header/resource-header.tsx

@@ -264,7 +264,7 @@ export const ResourceHeader = memo(function ResourceHeader({
                         drag={crumbDrag}
                       />
                     )}
-                    {crumb.navigationItems !== undefined && (
+                    {crumb.navigationItems !== undefined && !crumb.editing?.isEditing && (
                       <BreadcrumbNavigation
                         label={crumb.label}
                         items={crumb.navigationItems}

apps/sim/lib/api/contracts/tools/file.ts

@@ -1,6 +1,13 @@
 import { z } from 'zod'
-import { privateSecretProvenanceBundleSchema } from '@/lib/api/contracts/primitives'
-import { shareAuthTypeSchema, upsertFileShareBodySchema } from '@/lib/api/contracts/public-shares'
+import {
+  orExactEnvironmentReference,
+  privateSecretProvenanceBundleSchema,
+} from '@/lib/api/contracts/primitives'
+import {
+  shareAuthTypeSchema,
+  sharePasswordSchema,
+  upsertFileShareBodySchema,
+} from '@/lib/api/contracts/public-shares'
 import { toolJsonResponseSchema } from '@/lib/api/contracts/tools/media/shared'
 import { defineRouteContract } from '@/lib/api/contracts/types'
 import {
@@ -169,7 +176,7 @@ const fileManageFolderSharingBodySchema = z.object({
   path: v2NonRootFolderPathInputSchema,
   isActive: z.boolean({ error: 'isActive is required for manage_folder_sharing operation' }),
   authType: shareAuthTypeSchema.optional(),
-  password: z.string().min(1).max(1024).optional(),
+  password: orExactEnvironmentReference(sharePasswordSchema).optional(),
   allowedEmails: upsertFileShareBodySchema.shape.allowedEmails,
 })
 

apps/sim/lib/public-shares/folder-reader.ts

@@ -76,23 +76,27 @@ export async function resolveSharedFile(
   fileId?: string
 ): Promise<WorkspaceFileRow | null> {
   if (!(await shareIsCurrent(resolved))) return null
-  if (resolved.kind === 'file') {
-    return fileId === undefined || fileId === resolved.file.id ? resolved.file : null
-  }
-  if (!fileId) return null
+  const targetId = resolved.kind === 'file' ? resolved.share.resourceId : fileId
+  if (!targetId || (resolved.kind === 'file' && fileId !== undefined && fileId !== targetId))
+    return null
   const [file] = await db
     .select()
     .from(workspaceFiles)
     .where(
       and(
-        eq(workspaceFiles.id, fileId),
+        eq(workspaceFiles.id, targetId),
         eq(workspaceFiles.workspaceId, resolved.share.workspaceId),
         eq(workspaceFiles.context, 'workspace'),
         isNull(workspaceFiles.deletedAt)
       )
     )
     .limit(1)
-  if (!file?.folderId || !(await folderBreadcrumbs(resolved, file.folderId))) return null
+  if (!file) return null
+  if (
+    resolved.kind === 'folder' &&
+    (!file.folderId || !(await folderBreadcrumbs(resolved, file.folderId)))
+  )
+    return null
   return file
 }
 

apps/sim/lib/public-shares/folders.integration.ts

@@ -228,4 +228,53 @@ describe('public folder capabilities in PostgreSQL', () => {
         .where(eq(publicShare.id, directShareId))
     }
   })
+
+  it.each([
+    { name: 'deleted', update: { deletedAt: new Date() } },
+    { name: 'moved out of workspace storage', update: { context: 'chat' } },
+    {
+      name: 'moved to another workspace',
+      update: { workspaceId: otherWorkspaceId, folderId: null },
+    },
+  ])('denies a direct file that is $name during authorization', async ({ update }) => {
+    try {
+      await expect(
+        readPublicSharedFile({
+          token: directToken,
+          authorize: async () => {
+            await db.update(workspaceFiles).set(update).where(eq(workspaceFiles.id, fileId))
+            return { authorized: true }
+          },
+        })
+      ).rejects.toMatchObject({ status: 404 })
+    } finally {
+      await db
+        .update(workspaceFiles)
+        .set({ deletedAt: null, context: 'workspace', workspaceId, folderId: childId })
+        .where(eq(workspaceFiles.id, fileId))
+    }
+  })
+
+  it('reads the current direct file metadata and storage key after authorization', async () => {
+    const updatedKey = `workspace/${workspaceId}/${generateId()}`
+    try {
+      const result = await readPublicSharedFile({
+        token: directToken,
+        authorize: async () => {
+          await db
+            .update(workspaceFiles)
+            .set({ originalName: 'updated.txt', key: updatedKey })
+            .where(eq(workspaceFiles.id, fileId))
+          return { authorized: true }
+        },
+      })
+      expect(result.file.originalName).toBe('updated.txt')
+      expect(result.file.key).toBe(updatedKey)
+    } finally {
+      await db
+        .update(workspaceFiles)
+        .set({ originalName: 'nested.txt', key: `workspace/${workspaceId}/${fileId}` })
+        .where(eq(workspaceFiles.id, fileId))
+    }
+  })
 })

apps/sim/lib/workspace-files/upload-folders.integration.ts

@@ -2,6 +2,7 @@ import { db } from '@sim/db'
 import { folder } from '@sim/db/schema'
 import { eq, sql } from 'drizzle-orm'
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import { MAX_FOLDERS_PER_WORKSPACE } from '@/lib/folders/constants'
 import { prepareUploadFolders } from '@/lib/workspace-files/upload-folders'
 
 const connection = vi.hoisted(() => ({ close: async () => {} }))
@@ -125,7 +126,7 @@ describe('folder upload preparation in Postgres', () => {
     await db.execute(sql`
       INSERT INTO folder (id, workspace_id, user_id, resource_type, name)
       SELECT 'existing-' || position, 'workspace', 'user', 'file', 'Existing ' || position
-      FROM generate_series(1, 9999) AS series(position)
+      FROM generate_series(1, ${MAX_FOLDERS_PER_WORKSPACE - 1}) AS series(position)
     `)
     await expect(prepare([['Incoming'], ['Incoming', 'Child']])).rejects.toMatchObject({
       code: 'conflict',

apps/sim/scripts/files-e2e/browser.ts

@@ -12,3 +12,8 @@ export async function dropPaths(page: Page, paths: string[]) {
     await session.detach()
   }
 }
+
+/** Locates the upload menu by its accessible state without matching the empty-state upload action. */
+export function uploadMenuTrigger(page: Page, name: string | RegExp = 'Upload') {
+  return page.getByRole('button', { name, exact: true }).and(page.locator('[aria-haspopup="menu"]'))
+}