fix(uploads): allow images/video/audio in mothership presigned route

[waleedlatif1]

Summary

• The mothership branch of /api/files/presigned calls validateFileType, which only permits SUPPORTED_DOCUMENT_EXTENSIONS. That rejects PNG screenshots (and any image/video/audio) at the new presigned upload path introduced in improvement(uploads): migrate remaining FormData uploads to presigned PUT #4509, even though Mothership has always supported media attachments via the legacy /api/files/upload route.
• Introduce validateAttachmentFileType in lib/uploads/utils/validation.ts, backed by the union of document, code, image, audio, and video extension sets, and wire it into the mothership branch. Behavior now matches what /api/files/upload already enforced.
• Executables and unknown extensions are still rejected.

Test plan

• Drag a .png screenshot into Mothership chat input on staging — uploads successfully
• Drag a .mp4 / .mp3 — uploads successfully
• Drag a .exe — rejected with a clear error
• bun run check:api-validation passes

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		May 9, 2026 5:31pm

[cursor]

PR Summary

Medium Risk
Changes server-side upload validation for mothership/execution presigned URLs to allow more file types; mistakes could unintentionally broaden accepted uploads or block valid ones. Touches file-upload entrypoints and permission-gated paths, so regressions would directly impact user uploads.

Overview
Enables mothership and execution presigned uploads to accept typical chat attachments (images/audio/video/code/docs) by switching those branches from validateFileType (docs-only) to a new validateAttachmentFileType extension-based validator.

Introduces SUPPORTED_ATTACHMENT_EXTENSIONS (deduped union of supported document/code/image/audio/video extensions) and reuses it in the legacy /api/files/upload route’s allowed-extension list.

Expands API/unit test coverage to assert the correct validator is used per upload type (attachments vs knowledge-base), validate permission failures, and exercise new attachment validation behavior and error payloads.

^{Reviewed by Cursor Bugbot for commit a70f6f2. Configure here.}

[greptile-apps]

Greptile Summary

This PR fixes a regression introduced in #4509 where the presigned URL route rejected image, audio, and video files for mothership and execution uploads because it used validateFileType, which only permits document extensions. The fix introduces validateAttachmentFileType (extension-only, no MIME cross-validation) backed by the new SUPPORTED_ATTACHMENT_EXTENSIONS constant — the deduplicated union of all five extension sets — and wires it into both affected branches.

• validation.ts: adds SUPPORTED_ATTACHMENT_EXTENSIONS (built via Array.from(new Set([...])) to prevent duplicates) and validateAttachmentFileType, restoring parity with the legacy /api/files/upload route that already allowed all attachment types.
• presigned/route.ts: swaps validateFileType(fileName, contentType) → validateAttachmentFileType(fileName) for the mothership and execution branches; knowledge-base continues to use the stricter document-only validator.
• upload/route.ts: consolidates the inline ALLOWED_EXTENSIONS set into the new shared constant — no behavioral change.

Confidence Score: 5/5

Safe to merge — the change is a targeted fix that restores the intended attachment-type permissions for mothership and execution uploads with no impact on other upload paths.

The change is narrow in scope: two call sites swap to a new validator, the new validator is backed by the same extension sets already used in the legacy route, deduplication is handled at construction time and covered by a test, and the permission gates for both affected branches are untouched. No new execution paths are opened; knowledge-base validation is deliberately unchanged.

No files require special attention.

Important Files Changed

Filename	Overview
apps/sim/lib/uploads/utils/validation.ts	Adds SUPPORTED_ATTACHMENT_EXTENSIONS (deduped union of all extension sets) and validateAttachmentFileType (extension-only check, no MIME cross-validation); clean and well-structured.
apps/sim/app/api/files/presigned/route.ts	Swaps validateFileType → validateAttachmentFileType for mothership and execution branches, restoring parity with the legacy upload route; permission gating and error handling are unchanged.
apps/sim/app/api/files/upload/route.ts	Consolidates the inline ALLOWED_EXTENSIONS union into the shared SUPPORTED_ATTACHMENT_EXTENSIONS constant; no behavioral change.
apps/sim/lib/uploads/utils/validation.test.ts	New test file covers accept/reject cases, no-extension files, non-alphanumeric extensions, duplicate-extension guard, and error payload shape.
apps/sim/app/api/files/presigned/route.test.ts	Adds mothership, execution, and knowledge-base upload test suites verifying the correct validator is called and permission checks work correctly.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[POST /api/files/presigned] --> B{uploadType}
B -->|knowledge-base| C[validateFileType\ndocs only + MIME check]
B -->|mothership| D{permission\nwrite or admin?}
B -->|execution| E{permission\nwrite or admin?}
B -->|workspace-logos| F[isImageFileType\nMIME check]
B -->|profile-pictures| G[isImageFileType\nMIME check]
B -->|copilot| H[CopilotFiles.generateCopilotUploadUrl\ninternal validation]
B -->|chat| I[No file-type validation]
D -->|yes| J[validateAttachmentFileType\nall ext, no MIME]
D -->|no| K[403]
E -->|yes| L[validateAttachmentFileType\nall ext, no MIME]
E -->|no| M[403]
C --> N{error?}
J --> O{error?}
L --> P{error?}
N -->|yes| Q[400 VALIDATION_ERROR]
O -->|yes| Q
P -->|yes| Q
N -->|no| R[generatePresignedUploadUrl]
O -->|no| R
P -->|no| R
F --> R
G --> R
H --> R
I --> R
style J fill:#90EE90
style L fill:#90EE90

Loading

_{Reviews (3): Last reviewed commit: "fix(uploads): restore SUPPORTED_IMAGE_EX..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 93b1565. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a70f6f2. Configure here.}