chore: import upstream snapshot with attribution

apps/sim/lib/uploads/contexts/workspace/fetch-external-url.test.ts

@@ -0,0 +1,237 @@
+/**
+ * @vitest-environment node
+ */
+import {
+  inputValidationMock,
+  inputValidationMockFns,
+  permissionsMock,
+  permissionsMockFns,
+} from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockUploadWorkspaceFile } = vi.hoisted(() => ({
+  mockUploadWorkspaceFile: vi.fn(),
+}))
+
+vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)
+vi.mock('@/lib/workspaces/permissions/utils', () => permissionsMock)
+vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => ({
+  uploadWorkspaceFile: mockUploadWorkspaceFile,
+}))
+
+import {
+  ExternalUrlValidationError,
+  fetchExternalUrlToWorkspace,
+} from '@/lib/uploads/contexts/workspace/fetch-external-url'
+
+function makeResponse(body: string, contentType = 'application/octet-stream'): Response {
+  return new Response(body, { status: 200, headers: { 'content-type': contentType } })
+}
+
+describe('fetchExternalUrlToWorkspace', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    inputValidationMockFns.mockValidateUrlWithDNS.mockResolvedValue({
+      isValid: true,
+      resolvedIP: '203.0.113.10',
+    })
+    permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue('write')
+    mockUploadWorkspaceFile.mockImplementation(
+      async (workspaceId: string, _userId: string, _buffer: Buffer, fileName: string) => ({
+        id: `wf_${fileName}`,
+        name: fileName,
+        size: 0,
+        type: 'application/octet-stream',
+        url: `/api/files/serve/${workspaceId}/${fileName}`,
+        key: `${workspaceId}/${fileName}`,
+        context: 'workspace',
+      })
+    )
+  })
+
+  it('downloads each URL independently — never dedups by path filename', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP
+      .mockResolvedValueOnce(makeResponse('first bytes', 'image/png'))
+      .mockResolvedValueOnce(makeResponse('different second bytes', 'image/png'))
+
+    const first = await fetchExternalUrlToWorkspace({
+      url: 'https://files.slack.com/files-pri/T07-FAAA/download/image.png',
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+    })
+    const second = await fetchExternalUrlToWorkspace({
+      url: 'https://files.slack.com/files-pri/T07-FBBB/download/image.png',
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+    })
+
+    expect(first.filename).toBe('image.png')
+    expect(second.filename).toBe('image.png')
+    expect(first.buffer.toString()).toBe('first bytes')
+    expect(second.buffer.toString()).toBe('different second bytes')
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).toHaveBeenCalledTimes(2)
+    expect(mockUploadWorkspaceFile).toHaveBeenCalledTimes(2)
+  })
+
+  it('throws ExternalUrlValidationError when SSRF validation fails', async () => {
+    inputValidationMockFns.mockValidateUrlWithDNS.mockResolvedValue({
+      isValid: false,
+      error: 'Blocked private IP',
+    })
+
+    await expect(
+      fetchExternalUrlToWorkspace({
+        url: 'http://169.254.169.254/secret',
+        userId: 'user-1',
+      })
+    ).rejects.toBeInstanceOf(ExternalUrlValidationError)
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
+  })
+
+  it('throws on non-2xx fetch responses', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      new Response('not found', { status: 404, statusText: 'Not Found' })
+    )
+
+    await expect(
+      fetchExternalUrlToWorkspace({
+        url: 'https://example.com/missing.txt',
+        userId: 'user-1',
+      })
+    ).rejects.toThrow(/404/)
+  })
+
+  it('skips workspace save when saveToWorkspace is false', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('bytes', 'text/plain')
+    )
+
+    const result = await fetchExternalUrlToWorkspace({
+      url: 'https://example.com/file.txt',
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+      saveToWorkspace: false,
+    })
+
+    expect(result.savedWorkspaceFile).toBeUndefined()
+    expect(mockUploadWorkspaceFile).not.toHaveBeenCalled()
+    expect(permissionsMockFns.mockGetUserEntityPermissions).not.toHaveBeenCalled()
+  })
+
+  it('skips workspace save when no workspaceId is provided', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('bytes', 'text/plain')
+    )
+
+    const result = await fetchExternalUrlToWorkspace({
+      url: 'https://example.com/file.txt',
+      userId: 'user-1',
+    })
+
+    expect(result.savedWorkspaceFile).toBeUndefined()
+    expect(mockUploadWorkspaceFile).not.toHaveBeenCalled()
+  })
+
+  it('skips workspace save when user lacks write permission', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('bytes', 'text/plain')
+    )
+    permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue('read')
+
+    const result = await fetchExternalUrlToWorkspace({
+      url: 'https://example.com/file.txt',
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+    })
+
+    expect(result.savedWorkspaceFile).toBeUndefined()
+    expect(mockUploadWorkspaceFile).not.toHaveBeenCalled()
+  })
+
+  it('returns parsed bytes but skips save when user is not a workspace member', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('bytes', 'text/plain')
+    )
+    permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue(null)
+
+    const result = await fetchExternalUrlToWorkspace({
+      url: 'https://example.com/file.txt',
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+    })
+
+    expect(result.buffer.toString()).toBe('bytes')
+    expect(result.savedWorkspaceFile).toBeUndefined()
+    expect(mockUploadWorkspaceFile).not.toHaveBeenCalled()
+  })
+
+  it('returns the saved workspace file when permission allows save', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('bytes', 'text/plain')
+    )
+
+    const result = await fetchExternalUrlToWorkspace({
+      url: 'https://example.com/notes.txt',
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+    })
+
+    expect(mockUploadWorkspaceFile).toHaveBeenCalledWith(
+      'workspace-1',
+      'user-1',
+      expect.any(Buffer),
+      'notes.txt',
+      'text/plain'
+    )
+    expect(result.savedWorkspaceFile?.key).toBe('workspace-1/notes.txt')
+  })
+
+  it('swallows workspace save errors so parsing can still proceed', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('bytes', 'text/plain')
+    )
+    mockUploadWorkspaceFile.mockRejectedValueOnce(new Error('disk full'))
+
+    const result = await fetchExternalUrlToWorkspace({
+      url: 'https://example.com/file.txt',
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+    })
+
+    expect(result.buffer.toString()).toBe('bytes')
+    expect(result.savedWorkspaceFile).toBeUndefined()
+  })
+
+  it('forwards custom headers to the fetch', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('bytes', 'text/plain')
+    )
+
+    await fetchExternalUrlToWorkspace({
+      url: 'https://files.slack.com/files-pri/T07/download/report.txt',
+      userId: 'user-1',
+      headers: { Authorization: 'Bearer xoxb-test-token' },
+    })
+
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).toHaveBeenCalledWith(
+      'https://files.slack.com/files-pri/T07/download/report.txt',
+      '203.0.113.10',
+      expect.objectContaining({
+        headers: { Authorization: 'Bearer xoxb-test-token' },
+      })
+    )
+  })
+
+  it('uses content-type from response headers', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('pdf bytes', 'application/pdf')
+    )
+
+    const result = await fetchExternalUrlToWorkspace({
+      url: 'https://example.com/report.pdf',
+      userId: 'user-1',
+    })
+
+    expect(result.mimeType).toBe('application/pdf')
+  })
+})