chore: import upstream snapshot with attribution

apps/sim/app/api/table/[tableId]/export/download/route.test.ts

@@ -0,0 +1,124 @@
+/**
+ * @vitest-environment node
+ */
+import { hybridAuthMockFns } from '@sim/testing'
+import { NextRequest } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { TableDefinition } from '@/lib/table'
+
+const { mockCheckAccess, mockGetTableJob, mockGeneratePresignedDownloadUrl } = vi.hoisted(() => ({
+  mockCheckAccess: vi.fn(),
+  mockGetTableJob: vi.fn(),
+  mockGeneratePresignedDownloadUrl: vi.fn(),
+}))
+
+vi.mock('@/lib/table/jobs/service', () => ({ getTableJob: mockGetTableJob }))
+vi.mock('@/lib/uploads/core/storage-service', () => ({
+  generatePresignedDownloadUrl: mockGeneratePresignedDownloadUrl,
+}))
+vi.mock('@/app/api/table/utils', async () => {
+  const { NextResponse } = await import('next/server')
+  return {
+    checkAccess: mockCheckAccess,
+    accessError: (result: { status: number }) =>
+      NextResponse.json({ error: 'denied' }, { status: result.status }),
+  }
+})
+
+import { GET } from '@/app/api/table/[tableId]/export/download/route'
+
+function buildTable(overrides: Partial<TableDefinition> = {}): TableDefinition {
+  return {
+    id: 'tbl_1',
+    name: 'People',
+    description: null,
+    schema: { columns: [] },
+    metadata: null,
+    rowCount: 0,
+    maxRows: 1_000_000,
+    workspaceId: 'workspace-1',
+    createdBy: 'user-1',
+    archivedAt: null,
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    ...overrides,
+  }
+}
+
+function makeRequest(query: Record<string, string>, tableId = 'tbl_1') {
+  const qs = new URLSearchParams(query).toString()
+  const req = new NextRequest(`http://localhost:3000/api/table/${tableId}/export/download?${qs}`)
+  return GET(req, { params: Promise.resolve({ tableId }) })
+}
+
+const validQuery = { workspaceId: 'workspace-1', jobId: 'job_1' }
+
+describe('GET /api/table/[tableId]/export/download', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValue({
+      success: true,
+      userId: 'user-1',
+      authType: 'session',
+    })
+    mockCheckAccess.mockResolvedValue({ ok: true, table: buildTable() })
+    mockGetTableJob.mockResolvedValue({
+      id: 'job_1',
+      type: 'export',
+      status: 'ready',
+      payload: { format: 'csv', resultKey: 'workspace/workspace-1/exports/tbl_1/job_1/people.csv' },
+    })
+    mockGeneratePresignedDownloadUrl.mockResolvedValue('https://storage.example/signed-url')
+  })
+
+  it('resolves a ready export to a presigned URL', async () => {
+    const response = await makeRequest(validQuery)
+    const data = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(data.data).toEqual({ url: 'https://storage.example/signed-url', fileName: 'people.csv' })
+    expect(mockGeneratePresignedDownloadUrl).toHaveBeenCalledWith(
+      'workspace/workspace-1/exports/tbl_1/job_1/people.csv',
+      'workspace'
+    )
+  })
+
+  it('404s when the job is missing or not an export', async () => {
+    mockGetTableJob.mockResolvedValue({ id: 'job_1', type: 'delete', status: 'ready', payload: {} })
+    const response = await makeRequest(validQuery)
+    expect(response.status).toBe(404)
+  })
+
+  it('409s when the export is not ready yet', async () => {
+    mockGetTableJob.mockResolvedValue({
+      id: 'job_1',
+      type: 'export',
+      status: 'running',
+      payload: { format: 'csv' },
+    })
+    const response = await makeRequest(validQuery)
+    expect(response.status).toBe(409)
+  })
+
+  it('410s when the result file is gone from the payload', async () => {
+    mockGetTableJob.mockResolvedValue({
+      id: 'job_1',
+      type: 'export',
+      status: 'ready',
+      payload: { format: 'csv' },
+    })
+    const response = await makeRequest(validQuery)
+    expect(response.status).toBe(410)
+  })
+
+  it('returns 401 when unauthenticated', async () => {
+    hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValue({ success: false })
+    const response = await makeRequest(validQuery)
+    expect(response.status).toBe(401)
+  })
+
+  it('returns 400 on workspace mismatch', async () => {
+    const response = await makeRequest({ ...validQuery, workspaceId: 'other-ws' })
+    expect(response.status).toBe(400)
+  })
+})

apps/sim/app/api/table/[tableId]/export/download/route.ts

@@ -0,0 +1,64 @@
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import { exportDownloadContract } from '@/lib/api/contracts/tables'
+import { parseRequest } from '@/lib/api/server'
+import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getTableJob } from '@/lib/table/jobs/service'
+import type { TableExportJobPayload } from '@/lib/table/types'
+import { generatePresignedDownloadUrl } from '@/lib/uploads/core/storage-service'
+import { accessError, checkAccess } from '@/app/api/table/utils'
+
+const logger = createLogger('TableExportDownload')
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+interface RouteParams {
+  params: Promise<{ tableId: string }>
+}
+
+/**
+ * GET /api/table/[tableId]/export/download?jobId=…
+ *
+ * Resolves a completed export job to a short-lived presigned URL for the generated file. The job
+ * must belong to the table, be an export, and be `ready` — the worker stamps `resultKey` onto the
+ * job payload when the upload lands.
+ */
+export const GET = withRouteHandler(async (request: NextRequest, { params }: RouteParams) => {
+  const requestId = generateRequestId()
+
+  const authResult = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
+  if (!authResult.success || !authResult.userId) {
+    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })
+  }
+
+  const parsed = await parseRequest(exportDownloadContract, request, { params })
+  if (!parsed.success) return parsed.response
+  const { tableId } = parsed.data.params
+  const { workspaceId, jobId } = parsed.data.query
+
+  const access = await checkAccess(tableId, authResult.userId, 'read')
+  if (!access.ok) return accessError(access, requestId, tableId)
+  if (access.table.workspaceId !== workspaceId) {
+    return NextResponse.json({ error: 'Invalid workspace ID' }, { status: 400 })
+  }
+
+  const job = await getTableJob(tableId, jobId)
+  if (!job || job.type !== 'export') {
+    return NextResponse.json({ error: 'Export job not found' }, { status: 404 })
+  }
+  if (job.status !== 'ready') {
+    return NextResponse.json({ error: 'Export is not ready' }, { status: 409 })
+  }
+  const payload = job.payload as TableExportJobPayload | null
+  if (!payload?.resultKey) {
+    return NextResponse.json({ error: 'Export file is no longer available' }, { status: 410 })
+  }
+
+  const url = await generatePresignedDownloadUrl(payload.resultKey, 'workspace')
+  const fileName = payload.resultKey.split('/').pop() ?? `export.${payload.format}`
+  logger.info(`[${requestId}] Export download URL issued`, { tableId, jobId })
+  return NextResponse.json({ success: true, data: { url, fileName } })
+})