fix(uploads): write workspaceFiles row when issuing presigned URL

[waleedlatif1]

Summary

• Mothership/execution/workspace-logos presigned uploads no longer leave previews unauthorized — the route now writes the workspaceFiles row at presign time, matching what storageService.uploadFile does on main
• Without this, clicking an in-chat image preview before sending the message threw FileNotFoundError from /api/files/serve because no DB row existed and S3 HeadObject returned lowercased metadata keys
• Added test coverage asserting the row is inserted with the expected context for each branch

Type of Change

• Bug fix

Testing

Tested manually on staging — dropped image into Mothership chat, clicked preview, image renders. bun run check:api-validation passes; new and existing tests pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		May 9, 2026 9:36pm

[cursor]

PR Summary

Medium Risk
Adds a DB write to the presigned-upload API for several upload types; failures now surface as 500s, which could impact upload flows if metadata persistence is flaky.

Overview
Presigned uploads for mothership, execution, and workspace-logos now insert a workspaceFiles metadata row at presign time via insertFileMetadata, ensuring subsequent /api/files/serve authorization/preview lookups can succeed.

Tests were extended to mock insertFileMetadata, assert it is called with the expected context/fields for each branch, and verify the route returns 500 if metadata insertion fails (to avoid handing out an unauthorizable URL).

^{Reviewed by Cursor Bugbot for commit c89ef33. Configure here.}

[greptile-apps]

Greptile Summary

This PR fixes image preview authorization failures in Mothership/execution/workspace-logos flows by writing the workspaceFiles DB row at presign time (matching what storageService.uploadFile does on the main upload path), so that /api/files/serve can authorize the request before the S3 object is confirmed present.

• route.ts: Three await insertFileMetadata(...) calls added immediately after generatePresignedUploadUrl for the mothership, execution, and workspace-logos branches; DB failure bubbles up to the existing catch block and returns 500, which was deliberately chosen over silently returning the URL.
• route.test.ts: Happy-path coverage added for all three branches asserting the correct context, key, userId, and workspaceId are passed to insertFileMetadata; one failure-path test added for the mothership branch confirming 500 is returned on DB error.

Confidence Score: 5/5

Safe to merge — the change is a targeted hotfix that adds three DB writes at presign time, each gated behind the existing permission checks, with the same error-handling path as the rest of the route.

The logic is straightforward: insert a DB row after a successful presigned URL generation so downstream serve requests can authorize. The insertFileMetadata function handles duplicate-key races gracefully, the outer catch block correctly converts DB failures to 500s, and the tests confirm both the happy path and the DB-failure path for the mothership branch.

No files require special attention.

Important Files Changed

Filename	Overview
apps/sim/app/api/files/presigned/route.ts	Adds insertFileMetadata after generatePresignedUploadUrl for mothership, execution, and workspace-logos branches; DB failure propagates as 500 via the existing catch block, preventing the client from receiving an unauthorizable URL.
apps/sim/app/api/files/presigned/route.test.ts	Adds happy-path assertions for all three new insertFileMetadata call sites and a failure-path test for the mothership branch; mock setup and vi.clearAllMocks() are correctly wired.

Sequence Diagram

sequenceDiagram
participant Client
participant PresignedRoute as /api/files/presigned
participant S3 as S3/Blob Storage
participant DB as workspaceFiles (DB)
participant ServeRoute as /api/files/serve
Client->>PresignedRoute: "POST ?type=mothership|execution|workspace-logos"
PresignedRoute->>S3: generatePresignedUploadUrl()
S3-->>PresignedRoute: "{ url, key }"
PresignedRoute->>DB: "insertFileMetadata({ key, context, userId, workspaceId, ... })"
DB-->>PresignedRoute: FileMetadataRecord
PresignedRoute-->>Client: "{ presignedUrl, fileInfo.key, ... }"
Client->>S3: PUT (presigned URL) - actual file upload
S3-->>Client: 200 OK
Client->>ServeRoute: "GET /api/files/serve/s3/:key?context=mothership"
ServeRoute->>DB: getFileMetadataByKey(key)
DB-->>ServeRoute: FileMetadataRecord (row exists - authorized)
ServeRoute->>S3: downloadFile(key)
S3-->>ServeRoute: file bytes
ServeRoute-->>Client: file response

Loading

_{Reviews (2): Last reviewed commit: "test(uploads): cover insertFileMetadata ..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c89ef33. Configure here.}