fix(files): guard dimension writes by content key so a stale PATCH can't persist

Ties the dimensions write to the storage key the client measured. The key is
regenerated on every content replacement, so an in-flight PATCH measured against
superseded bytes is rejected at the DB (WHERE key = measured key) instead of
persisting the old aspect ratio for new content. Closes the last stale-ordering
window Greptile flagged — the write is now content-version-conditioned, not just
corrected on the next render.

Author: waleedlatif1

apps/sim/app/api/workspaces/[id]/files/[fileId]/dimensions/route.test.ts

@@ -16,6 +16,7 @@ vi.mock('@/lib/workspaces/permissions/utils', () => permissionsMock)
 
 const WS = '7727ef3f-8cf6-4686-b063-2bb006a10785'
 const FILE = 'wf_abc123'
+const KEY = 'workspace/7727ef3f/screenshot.png'
 
 import { PATCH } from '@/app/api/workspaces/[id]/files/[fileId]/dimensions/route'
 
@@ -37,43 +38,45 @@ describe('PATCH /api/workspaces/[id]/files/[fileId]/dimensions', () => {
     mockUpdateWorkspaceFileDimensions.mockResolvedValue(true)
   })
 
-  it('stores dimensions for a writer', async () => {
-    const res = await PATCH(buildRequest({ width: 1600, height: 900 }), routeContext)
+  it('stores dimensions for a writer, keyed to the content version', async () => {
+    const res = await PATCH(buildRequest({ key: KEY, width: 1600, height: 900 }), routeContext)
     expect(res.status).toBe(200)
     expect(await res.json()).toEqual({ success: true })
     expect(mockUpdateWorkspaceFileDimensions).toHaveBeenCalledWith(WS, FILE, {
+      key: KEY,
       width: 1600,
       height: 900,
     })
   })
 
   it('allows an admin', async () => {
     permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue('admin')
-    const res = await PATCH(buildRequest({ width: 10, height: 20 }), routeContext)
+    const res = await PATCH(buildRequest({ key: KEY, width: 10, height: 20 }), routeContext)
     expect(res.status).toBe(200)
     expect(mockUpdateWorkspaceFileDimensions).toHaveBeenCalledOnce()
   })
 
   it('rejects an unauthenticated caller before touching the DB', async () => {
     authMockFns.mockGetSession.mockResolvedValue(null)
-    const res = await PATCH(buildRequest({ width: 10, height: 10 }), routeContext)
+    const res = await PATCH(buildRequest({ key: KEY, width: 10, height: 10 }), routeContext)
     expect(res.status).toBe(401)
     expect(mockUpdateWorkspaceFileDimensions).not.toHaveBeenCalled()
   })
 
   it('rejects a read-only member (backfill requires write)', async () => {
     permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue('read')
-    const res = await PATCH(buildRequest({ width: 10, height: 10 }), routeContext)
+    const res = await PATCH(buildRequest({ key: KEY, width: 10, height: 10 }), routeContext)
     expect(res.status).toBe(403)
     expect(mockUpdateWorkspaceFileDimensions).not.toHaveBeenCalled()
   })
 
-  it('rejects non-positive / non-integer dimensions', async () => {
+  it('rejects a missing key or non-positive / non-integer dimensions', async () => {
     for (const body of [
-      { width: 0, height: 10 },
-      { width: 10, height: -5 },
-      { width: 10.5, height: 10 },
-      { width: 10 },
+      { width: 10, height: 10 }, // missing key
+      { key: KEY, width: 0, height: 10 },
+      { key: KEY, width: 10, height: -5 },
+      { key: KEY, width: 10.5, height: 10 },
+      { key: KEY, width: 10 },
     ]) {
       const res = await PATCH(buildRequest(body), routeContext)
       expect(res.status).toBe(400)

apps/sim/app/api/workspaces/[id]/files/[fileId]/dimensions/route.ts

@@ -27,15 +27,15 @@ export const PATCH = withRouteHandler(
     const parsed = await parseRequest(updateWorkspaceFileDimensionsContract, request, context)
     if (!parsed.success) return parsed.response
     const { id: workspaceId, fileId } = parsed.data.params
-    const { width, height } = parsed.data.body
+    const { key, width, height } = parsed.data.body
 
     const permission = await getUserEntityPermissions(session.user.id, 'workspace', workspaceId)
     if (permission !== 'admin' && permission !== 'write') {
       return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })
     }
 
     try {
-      await updateWorkspaceFileDimensions(workspaceId, fileId, { width, height })
+      await updateWorkspaceFileDimensions(workspaceId, fileId, { key, width, height })
       return NextResponse.json({ success: true as const })
     } catch (error) {
       logger.error('Failed to backfill workspace file dimensions', {

apps/sim/hooks/queries/workspace-files.ts

@@ -164,7 +164,9 @@ export function useWorkspaceImageDimensionsAdapter(workspaceId: string): ImageDi
         )
         void requestJson(updateWorkspaceFileDimensionsContract, {
           params: { id: workspaceId, fileId: record.id },
-          body: dimensions,
+          // Send the key we measured against; the server rejects the write if the row's content (key) has
+          // since changed, so a stale in-flight PATCH for replaced bytes can't persist the old size.
+          body: { key: record.key, ...dimensions },
         }).catch(() => {})
       },
     }

apps/sim/lib/api/contracts/workspace-files.ts

@@ -60,6 +60,12 @@ export const updateWorkspaceFileContentBodySchema = z.object({
 const IMAGE_DIMENSION_MAX = 100_000
 
 export const updateWorkspaceFileDimensionsBodySchema = z.object({
+  /**
+   * The storage key the client measured. The write commits only if the row still has this key — a
+   * content-version guard: the key changes on every content replacement, so a stale in-flight write for
+   * superseded bytes is rejected rather than persisting the old aspect ratio.
+   */
+  key: z.string().min(1, 'key is required'),
   width: z.number().int().positive().max(IMAGE_DIMENSION_MAX),
   height: z.number().int().positive().max(IMAGE_DIMENSION_MAX),
 })

apps/sim/lib/uploads/contexts/workspace/workspace-file-manager.ts

@@ -864,15 +864,19 @@ async function mapSingleWorkspaceFileRecord(
 /**
  * Store an image file's intrinsic pixel dimensions (a pure rendering hint used to reserve layout space
  * before the image loads). The client reports the browser's own EXIF-corrected `naturalWidth/Height`, and
- * only when it differs from what's stored, so this overwrites rather than backfilling once — a stale
- * value (e.g. left over after the file's content was replaced) self-corrects on the next view instead of
- * sticking behind a `width IS NULL` guard. Does NOT touch `updatedAt` — dimensions are not content and
- * must not cache-bust the served image bytes. Returns whether a live row was written.
+ * only when it differs from what's stored, so this overwrites rather than backfilling once — a stale value
+ * self-corrects on the next view instead of sticking behind a `width IS NULL` guard.
+ *
+ * `key` is a content-version guard: the write commits only if the row still has the storage key the
+ * client measured. The key is regenerated on every content replacement, so an in-flight write measured
+ * against superseded bytes is rejected here rather than persisting the old aspect ratio for new content.
+ * Does NOT touch `updatedAt` — dimensions are not content and must not cache-bust the served image bytes.
+ * Returns whether a live row was written.
  */
 export async function updateWorkspaceFileDimensions(
   workspaceId: string,
   fileId: string,
-  dimensions: { width: number; height: number }
+  dimensions: { key: string; width: number; height: number }
 ): Promise<boolean> {
   const updated = await db
     .update(workspaceFiles)
@@ -881,6 +885,7 @@ export async function updateWorkspaceFileDimensions(
       and(
         eq(workspaceFiles.id, fileId),
         eq(workspaceFiles.workspaceId, workspaceId),
+        eq(workspaceFiles.key, dimensions.key),
         isNull(workspaceFiles.deletedAt)
       )
     )