H-6623: Fix uploading and making user and org avatars public by CiaranMn · Pull Request #8913 · hashintel/hash

CiaranMn · 2026-06-29T16:19:04Z

🌟 What is the purpose of this PR?

The public view policy needs to be created at the same time as creating the entity – adding the viewer afterwards is not currently supported, and was causing a crash.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

do not affect the execution graph

❓ How to test this?

Try uploading a user or org avatar.
To check public status, try switching to another user and checking the avatars are visible.

vercel · 2026-06-29T16:19:12Z

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
hash	Ignored	Preview	Jun 29, 2026 4:54pm
hashdotdesign-tokens	Ignored	Preview	Jun 29, 2026 4:54pm
petrinaut	Skipped		Jun 29, 2026 4:54pm

cursor · 2026-06-29T16:19:13Z

PR Summary

Medium Risk
Changes how public read access is granted (authorization policies at create time); behavior is opt-in via makePublic but affects file/avatar flows that rely on it.

Overview
Fixes user/org avatar uploads that crashed when visibility was applied after creation by supporting makePublic on createEntity, requestFileUpload, and createFileFromUrl (GraphQL + frontend). When enabled, creation passes a viewEntity permit policy with principal: null alongside a generated entityUuid instead of calling addEntityViewer afterward.

createEntityWithLinks now applies entityUuid and policies only to the root node in a linked tree so nested new entities do not reuse the same UUID. File upload context threads makePublic through file and link-entity creation and drops the separate viewer mutation. An integration test asserts distinct UUIDs for root, linked, and link entities.

^{Reviewed by Cursor Bugbot for commit 1ba9241. Bugbot is set up for automated code reviews on this repo. Configure here.}

TimDiekmann

Looks good, that should help until we have a proper public flag or something similar 🚀

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 33ba797. Configure here.}

Copilot

Pull request overview

This PR fixes avatar uploads (user + org) by adding a makePublic flag to relevant GraphQL mutations and ensuring public-view policies are created during entity creation (instead of attempting to add a public viewer afterwards, which was crashing).

Changes:

Add makePublic: Boolean = false to GraphQL schema for createEntity, requestFileUpload, and createFileFromUrl.
Update frontend upload flows to pass makePublic through mutations and remove the post-create “add public viewer” step.
Update API resolvers and file creation logic to plumb makePublic down and create a public-view policy at entity creation time.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
libs/@local/hash-isomorphic-utils/src/graphql/type-defs/knowledge/file.typedef.ts	Adds `makePublic` argument to file upload/link creation mutations in the shared schema.
libs/@local/hash-isomorphic-utils/src/graphql/type-defs/knowledge/entity.typedef.ts	Adds `makePublic` argument to `createEntity` in the shared schema.
apps/hash-frontend/src/shared/file-upload-context.tsx	Removes `addEntityViewer` follow-up mutation and passes `makePublic` directly to create/upload mutations.
apps/hash-frontend/src/graphql/queries/knowledge/file.queries.ts	Adds `$makePublic` variable and passes it to `requestFileUpload` / `createFileFromUrl`.
apps/hash-frontend/src/graphql/queries/knowledge/entity.queries.ts	Adds `$makePublic` variable and passes it to `createEntity`.
apps/hash-api/src/graphql/resolvers/knowledge/file/request-file-upload.ts	Threads `makePublic` into the underlying file upload creation call.
apps/hash-api/src/graphql/resolvers/knowledge/file/create-file-from-url.ts	Threads `makePublic` into the underlying external-url file creation call.
apps/hash-api/src/graphql/resolvers/knowledge/entity/entity.ts	Adds `makePublic` support to `createEntityResolver` via creation-time policies.
apps/hash-api/src/graph/knowledge/system-types/file.ts	Adds creation-time public-view policy support for file entities created from uploads/URLs.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

codecov · 2026-06-29T16:27:02Z

Codecov Report

❌ Patch coverage is 0% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.65%. Comparing base (93903d1) to head (1b76815).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
.../hash-api/src/graph/knowledge/system-types/file.ts	0.00%	5 Missing ⚠️
...s/hash-api/src/graph/knowledge/primitive/entity.ts	0.00%	3 Missing ⚠️
...i/src/graphql/resolvers/knowledge/entity/entity.ts	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8913      +/-   ##
==========================================
- Coverage   59.76%   59.65%   -0.12%     
==========================================
  Files        1348     1350       +2     
  Lines      131800   132047     +247     
  Branches     5943     5950       +7     
==========================================
+ Hits        78772    78773       +1     
- Misses      52120    52366     +246     
  Partials      908      908

Flag	Coverage Δ
apps.hash-api	`3.10% <0.00%> (-0.16%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

apps/hash-api/src/graph/knowledge/system-types/file.ts:418

In this function makePublic is only applied in the createEntity branch; when existingEntity is present the code updates the entity and does not validate or enforce the requested public visibility. If the Graph can’t add view policies after creation (per PR description), it would be safer to either verify the entity is already public when makePublic is true or fail fast with a clear error so the caller can choose to create a new entity instead.

    return existingEntity
      ? await updateEntity<File>(ctx, authentication, {
          entity: existingEntity,
          entityTypeIds,

Only pass the pre-generated entityUuid and public policies to the root entity in createEntityWithLinks. Nested entities and link entities now receive their own UUIDs from the graph store instead of reusing the root entity UUID. Co-authored-by: Ciaran Morinan <CiaranMn@users.noreply.github.com>

Co-authored-by: Ciaran Morinan <CiaranMn@users.noreply.github.com>

fix making user and org avatars public

9030b08

CiaranMn requested review from TimDiekmann and Copilot June 29, 2026 16:19

graphite-app Bot assigned CiaranMn Jun 29, 2026

Copilot started reviewing on behalf of CiaranMn June 29, 2026 16:19 View session

TimDiekmann previously approved these changes Jun 29, 2026

View reviewed changes

cursor Bot reviewed Jun 29, 2026

View reviewed changes

Comment thread apps/hash-api/src/graph/knowledge/system-types/file.ts

Comment thread apps/hash-api/src/graphql/resolvers/knowledge/entity/entity.ts

CiaranMn enabled auto-merge June 29, 2026 16:20

pass entityUuid into create calls

33ba797

CiaranMn dismissed TimDiekmann’s stale review via 33ba797 June 29, 2026 16:22

CiaranMn requested a review from TimDiekmann June 29, 2026 16:23

cursor Bot reviewed Jun 29, 2026

View reviewed changes

Comment thread apps/hash-api/src/graphql/resolvers/knowledge/entity/entity.ts

Copilot AI reviewed Jun 29, 2026

View reviewed changes

Comment thread apps/hash-api/src/graphql/resolvers/knowledge/entity/entity.ts

Comment thread apps/hash-api/src/graphql/resolvers/knowledge/entity/entity.ts

Copilot AI review requested due to automatic review settings June 29, 2026 16:25

Copilot started reviewing on behalf of CiaranMn June 29, 2026 16:25 View session

graphite-app Bot reviewed Jun 29, 2026

View reviewed changes

Comment thread apps/hash-api/src/graph/knowledge/system-types/file.ts

Copilot AI reviewed Jun 29, 2026

View reviewed changes

Comment thread apps/hash-api/src/graph/knowledge/system-types/file.ts

Comment thread apps/hash-api/src/graph/knowledge/system-types/file.ts

vercel Bot temporarily deployed to Preview – petrinaut June 29, 2026 16:37 Inactive

github-actions Bot added area/tests New or updated tests area/tests > integration New or updated integration tests labels Jun 29, 2026

Fix import ordering in entity integration test

a226b65

Co-authored-by: Ciaran Morinan <CiaranMn@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 29, 2026 16:46

CiaranMn removed the request for review from Copilot June 29, 2026 16:46

vercel Bot temporarily deployed to Preview – petrinaut June 29, 2026 16:46 Inactive

Cast generated UUID to EntityUuid in integration test

1ba9241

Co-authored-by: Ciaran Morinan <CiaranMn@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 29, 2026 16:53

CiaranMn removed the request for review from Copilot June 29, 2026 16:53

vercel Bot temporarily deployed to Preview – petrinaut June 29, 2026 16:54 Inactive

TimDiekmann approved these changes Jun 29, 2026

View reviewed changes

CiaranMn added this pull request to the merge queue Jun 29, 2026

Merged via the queue into main with commit e04b538 Jun 29, 2026
62 checks passed

CiaranMn deleted the cm/fix-avatar-upload branch June 29, 2026 19:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

H-6623: Fix uploading and making user and org avatars public#8913

H-6623: Fix uploading and making user and org avatars public#8913
CiaranMn merged 5 commits into
mainfrom
cm/fix-avatar-upload

CiaranMn commented Jun 29, 2026

Uh oh!

vercel Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

TimDiekmann left a comment

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

CiaranMn commented Jun 29, 2026

🌟 What is the purpose of this PR?

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

📜 Does this require a change to the docs?

🕸️ Does this require a change to the Turbo Graph?

❓ How to test this?

Uh oh!

vercel Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

TimDiekmann left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

vercel Bot commented Jun 29, 2026 •

edited

Loading

cursor Bot commented Jun 29, 2026 •

edited

Loading

codecov Bot commented Jun 29, 2026 •

edited

Loading