chore: import upstream snapshot with attribution

apps/sim/app/api/workspaces/[id]/files/route.ts

@@ -0,0 +1,230 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  listWorkspaceFilesQuerySchema,
+  workspaceFilesParamsSchema,
+} from '@/lib/api/contracts/workspace-files'
+import { getValidationErrorMessage } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { generateRequestId } from '@/lib/core/utils/request'
+import {
+  isPayloadSizeLimitError,
+  MAX_MULTIPART_OVERHEAD_BYTES,
+  readFormDataWithLimit,
+} from '@/lib/core/utils/stream-limits'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { captureServerEvent } from '@/lib/posthog/server'
+import { getSharesForResources } from '@/lib/public-shares/share-manager'
+import {
+  FileConflictError,
+  listWorkspaceFiles,
+  uploadWorkspaceFile,
+} from '@/lib/uploads/contexts/workspace'
+import { MAX_WORKSPACE_FORMDATA_FILE_SIZE } from '@/lib/uploads/shared/types'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+import { verifyWorkspaceMembership } from '@/app/api/workflows/utils'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('WorkspaceFilesAPI')
+
+/**
+ * GET /api/workspaces/[id]/files
+ * List all files for a workspace (requires read permission)
+ */
+export const GET = withRouteHandler(
+  async (request: NextRequest, { params }: { params: Promise<{ id: string }> }) => {
+    const requestId = generateRequestId()
+    const paramsResult = workspaceFilesParamsSchema.safeParse(await params)
+    if (!paramsResult.success) {
+      return NextResponse.json(
+        { error: getValidationErrorMessage(paramsResult.error, 'Invalid route parameters') },
+        { status: 400 }
+      )
+    }
+    const { id: workspaceId } = paramsResult.data
+
+    try {
+      const session = await getSession()
+      if (!session?.user?.id) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+
+      // Check workspace permissions (requires read)
+      const userPermission = await verifyWorkspaceMembership(session.user.id, workspaceId)
+      if (!userPermission) {
+        logger.warn(
+          `[${requestId}] User ${session.user.id} lacks permission for workspace ${workspaceId}`
+        )
+        return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })
+      }
+
+      const queryResult = listWorkspaceFilesQuerySchema.safeParse(
+        Object.fromEntries(request.nextUrl.searchParams.entries())
+      )
+      if (!queryResult.success) {
+        return NextResponse.json(
+          { error: getValidationErrorMessage(queryResult.error, 'Invalid scope') },
+          { status: 400 }
+        )
+      }
+      const { scope } = queryResult.data
+
+      const files = await listWorkspaceFiles(workspaceId, { scope })
+
+      const shares = await getSharesForResources(
+        'file',
+        files.map((file) => file.id)
+      )
+      const filesWithShares = files.map((file) => ({
+        ...file,
+        share: shares.get(file.id) ?? null,
+      }))
+
+      logger.info(`[${requestId}] Listed ${files.length} files for workspace ${workspaceId}`)
+
+      return NextResponse.json({
+        success: true,
+        files: filesWithShares,
+      })
+    } catch (error) {
+      logger.error(`[${requestId}] Error listing workspace files:`, error)
+      return NextResponse.json(
+        {
+          success: false,
+          error: getErrorMessage(error, 'Failed to list files'),
+        },
+        { status: 500 }
+      )
+    }
+  }
+)
+
+/**
+ * POST /api/workspaces/[id]/files
+ * Upload a new file to workspace storage (requires write permission)
+ */
+export const POST = withRouteHandler(
+  async (request: NextRequest, { params }: { params: Promise<{ id: string }> }) => {
+    const requestId = generateRequestId()
+    const paramsResult = workspaceFilesParamsSchema.safeParse(await params)
+    if (!paramsResult.success) {
+      return NextResponse.json(
+        { error: getValidationErrorMessage(paramsResult.error, 'Invalid route parameters') },
+        { status: 400 }
+      )
+    }
+    const { id: workspaceId } = paramsResult.data
+
+    try {
+      const session = await getSession()
+      if (!session?.user?.id) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+
+      // Check workspace permissions (requires write)
+      const userPermission = await getUserEntityPermissions(
+        session.user.id,
+        'workspace',
+        workspaceId
+      )
+      if (userPermission !== 'admin' && userPermission !== 'write') {
+        logger.warn(
+          `[${requestId}] User ${session.user.id} lacks write permission for workspace ${workspaceId}`
+        )
+        return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })
+      }
+
+      let formData: FormData
+      try {
+        formData = await readFormDataWithLimit(request, {
+          maxBytes: MAX_WORKSPACE_FORMDATA_FILE_SIZE + MAX_MULTIPART_OVERHEAD_BYTES,
+          label: 'workspace file upload body',
+        })
+      } catch (error) {
+        if (isPayloadSizeLimitError(error)) {
+          return NextResponse.json({ error: error.message }, { status: 413 })
+        }
+        return NextResponse.json(
+          { error: 'Request body must be valid multipart form data' },
+          { status: 400 }
+        )
+      }
+      const rawFile = formData.get('file')
+      const rawFolderId = formData.get('folderId')
+      const folderId =
+        typeof rawFolderId === 'string' && rawFolderId.length > 0 ? rawFolderId : null
+
+      if (!rawFile || !(rawFile instanceof File)) {
+        return NextResponse.json({ error: 'No file provided' }, { status: 400 })
+      }
+
+      const fileName = rawFile.name || 'untitled.md'
+
+      if (rawFile.size > MAX_WORKSPACE_FORMDATA_FILE_SIZE) {
+        return NextResponse.json(
+          {
+            error: `File size exceeds maximum of ${MAX_WORKSPACE_FORMDATA_FILE_SIZE} bytes (${(rawFile.size / (1024 * 1024)).toFixed(2)}MB)`,
+          },
+          { status: 413 }
+        )
+      }
+
+      const buffer = Buffer.from(await rawFile.arrayBuffer())
+
+      const userFile = await uploadWorkspaceFile(
+        workspaceId,
+        session.user.id,
+        buffer,
+        fileName,
+        rawFile.type || 'application/octet-stream',
+        { folderId }
+      )
+
+      logger.info(`[${requestId}] Uploaded workspace file: ${fileName}`)
+
+      captureServerEvent(
+        session.user.id,
+        'file_uploaded',
+        { workspace_id: workspaceId, file_type: rawFile.type || 'application/octet-stream' },
+        { groups: { workspace: workspaceId } }
+      )
+
+      recordAudit({
+        workspaceId,
+        actorId: session.user.id,
+        actorName: session.user.name,
+        actorEmail: session.user.email,
+        action: AuditAction.FILE_UPLOADED,
+        resourceType: AuditResourceType.FILE,
+        resourceId: userFile.id,
+        resourceName: fileName,
+        description: `Uploaded file "${fileName}"`,
+        metadata: { fileSize: rawFile.size, fileType: rawFile.type || 'application/octet-stream' },
+        request,
+      })
+
+      return NextResponse.json({
+        success: true,
+        file: userFile,
+      })
+    } catch (error) {
+      logger.error(`[${requestId}] Error uploading workspace file:`, error)
+
+      const errorMessage = getErrorMessage(error, 'Failed to upload file')
+      const isDuplicate =
+        error instanceof FileConflictError || errorMessage.includes('already exists')
+
+      return NextResponse.json(
+        {
+          success: false,
+          error: errorMessage,
+          isDuplicate,
+        },
+        { status: isDuplicate ? 409 : 500 }
+      )
+    }
+  }
+)