consolidate migrations, rollout compat

Author: icecrasher321

apps/docs/content/docs/en/platform/self-hosting/object-storage.mdx

@@ -237,6 +237,21 @@ AZURE_STORAGE_OG_IMAGES_CONTAINER_NAME=og-images
 AZURE_STORAGE_WORKSPACE_LOGOS_CONTAINER_NAME=workspace-logos
 ```
 
+Browser uploads also require an account-level Blob service CORS rule. This rule explicitly allows Sim's create-only `If-None-Match` precondition, Azure upload headers, and multipart `ETag` reads:
+
+```bash
+az storage cors add \
+  --services b \
+  --methods GET PUT OPTIONS \
+  --origins "https://your-sim-domain.com" \
+  --allowed-headers "Content-Type" "If-None-Match" "x-ms-*" \
+  --exposed-headers "ETag" \
+  --max-age 3600 \
+  --account-name mystorageaccount
+```
+
+The CORS rule applies to every blob container in the storage account, so it only needs to be added once per account.
+
 A full Helm example lives at `helm/sim/examples/values-azure.yaml`.
 
 ## Set up Google Cloud Storage
@@ -276,14 +291,16 @@ cat > /tmp/cors.json <<'EOF'
     "responseHeader": [
       "Content-Type",
       "ETag",
+      "x-goog-if-generation-match",
       "x-goog-meta-originalname",
       "x-goog-meta-uploadedat",
       "x-goog-meta-purpose",
       "x-goog-meta-userid",
       "x-goog-meta-workspaceid",
       "x-goog-meta-folderid",
       "x-goog-meta-workflowid",
-      "x-goog-meta-executionid"
+      "x-goog-meta-executionid",
+      "x-goog-meta-simuploadid"
     ],
     "maxAgeSeconds": 3600
   }
@@ -297,7 +314,7 @@ done
 ```
 
 <Callout type="info">
-  Header names must be listed individually — GCS CORS matches `responseHeader` entries exactly and does not support wildcards like `x-goog-meta-*`. `ETag` is required because large-file multipart uploads read each part's `ETag` from the browser, and CORS hides the header otherwise.
+  Header names must be listed individually — GCS CORS matches `responseHeader` entries exactly and does not support wildcards like `x-goog-meta-*`. `ETag` is required because large-file multipart uploads read each part's `ETag` from the browser, and CORS hides the header otherwise. `x-goog-if-generation-match` is required by Sim's create-only signed uploads, which prevent a reused upload URL from replacing existing bytes. `x-goog-meta-simuploadid` carries the opaque receipt used to verify an upload after an ambiguous network response.
 </Callout>
 
 </Step>

apps/sim/app/api/files/multipart/route.test.ts

@@ -51,14 +51,23 @@ vi.mock('@/lib/uploads/providers/blob/client', () => ({
   abortMultipartUpload: vi.fn(),
 }))
 
+vi.mock('@/lib/uploads/contexts/execution/utils', () => ({
+  generateExecutionAttachmentKey: mockGenerateExecutionAttachmentKey,
+}))
+
 vi.mock('@/lib/workspaces/permissions/utils', () => permissionsMock)
 
-const { mockCheckStorageQuota, mockInitiateS3MultipartUpload, mockResolveStorageBillingContext } =
-  vi.hoisted(() => ({
-    mockCheckStorageQuota: vi.fn(),
-    mockInitiateS3MultipartUpload: vi.fn(),
-    mockResolveStorageBillingContext: vi.fn(),
-  }))
+const {
+  mockCheckStorageQuota,
+  mockGenerateExecutionAttachmentKey,
+  mockInitiateS3MultipartUpload,
+  mockResolveStorageBillingContext,
+} = vi.hoisted(() => ({
+  mockCheckStorageQuota: vi.fn(),
+  mockGenerateExecutionAttachmentKey: vi.fn(),
+  mockInitiateS3MultipartUpload: vi.fn(),
+  mockResolveStorageBillingContext: vi.fn(),
+}))
 
 vi.mock('@/lib/billing/storage', () => ({
   checkStorageQuotaForBillingContext: mockCheckStorageQuota,
@@ -180,6 +189,7 @@ describe('POST /api/files/multipart action=complete', () => {
     expect(mockDeriveBlobBlockId).toHaveBeenCalledWith(2)
     expect(mockCompleteBlobMultipartUpload).toHaveBeenCalledWith(
       tokenPayload.key,
+      tokenPayload.uploadId,
       [
         { partNumber: 1, blockId: 'block-000001' },
         { partNumber: 2, blockId: 'block-000002' },
@@ -240,6 +250,13 @@ describe('POST /api/files/multipart action=initiate quota enforcement', () => {
     mockResolveStorageBillingContext.mockResolvedValue(STORAGE_CONTEXT)
     mockCheckStorageQuota.mockResolvedValue({ allowed: true })
     mockInitiateS3MultipartUpload.mockResolvedValue({ uploadId: 'up-1', key: 'k/file.bin' })
+    mockGenerateExecutionAttachmentKey.mockImplementation(
+      (
+        context: { workspaceId: string; workflowId: string; executionId: string },
+        fileName: string
+      ) =>
+        `execution/${context.workspaceId}/${context.workflowId}/${context.executionId}/unique-${fileName}`
+    )
   })
 
   it('blocks upload when fileSize: 0 exceeds quota', async () => {
@@ -293,6 +310,38 @@ describe('POST /api/files/multipart action=initiate quota enforcement', () => {
     expect(mockInitiateS3MultipartUpload).toHaveBeenCalled()
   })
 
+  it('allocates distinct multipart keys for duplicate execution attachment names', async () => {
+    mockGenerateExecutionAttachmentKey
+      .mockReturnValueOnce('execution/ws-1/wf-1/exec-1/one-output.bin')
+      .mockReturnValueOnce('execution/ws-1/wf-1/exec-1/two-output.bin')
+    mockInitiateS3MultipartUpload.mockImplementation(async ({ customKey }) => ({
+      uploadId: `upload-${customKey}`,
+      key: customKey,
+    }))
+
+    const makeExecutionRequest = (fileSize: number) =>
+      makeInitiateRequest({
+        fileName: 'output.bin',
+        contentType: 'application/octet-stream',
+        fileSize,
+        workspaceId: 'ws-1',
+        workflowId: 'wf-1',
+        executionId: 'exec-1',
+        context: 'execution',
+      })
+
+    const first = await POST(makeExecutionRequest(60 * 1024 * 1024))
+    const second = await POST(makeExecutionRequest(70 * 1024 * 1024))
+    const firstBody = await first.json()
+    const secondBody = await second.json()
+
+    expect(first.status).toBe(200)
+    expect(second.status).toBe(200)
+    expect(firstBody.key).toBe('execution/ws-1/wf-1/exec-1/one-output.bin')
+    expect(secondBody.key).toBe('execution/ws-1/wf-1/exec-1/two-output.bin')
+    expect(firstBody.key).not.toBe(secondBody.key)
+  })
+
   it.each(['og-images', 'profile-pictures', 'workspace-logos', 'logs'])(
     'rejects quota-exempt context %s — not allowed via the multipart endpoint',
     async (context) => {

apps/sim/app/api/files/multipart/route.ts

@@ -215,10 +215,13 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
               { status: 400 }
             )
           }
-          const { generateExecutionFileKey } = await import(
+          const { generateExecutionAttachmentKey } = await import(
             '@/lib/uploads/contexts/execution/utils'
           )
-          customKey = generateExecutionFileKey({ workspaceId, workflowId, executionId }, fileName)
+          customKey = generateExecutionAttachmentKey(
+            { workspaceId, workflowId, executionId },
+            fileName
+          )
         }
 
         let uploadId: string
@@ -389,7 +392,12 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
               partNumber: p.partNumber,
               blockId: deriveBlobBlockId(p.partNumber),
             }))
-            completed = await completeMultipartUpload(key, blobParts, buildBlobCustomConfig(config))
+            completed = await completeMultipartUpload(
+              key,
+              uploadId,
+              blobParts,
+              buildBlobCustomConfig(config)
+            )
           } else if (storageProvider === 'gcs' && gcsModule) {
             const { completeGcsMultipartUpload } = gcsModule
             const gcsParts = parts.map((p) => {
@@ -501,7 +509,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           logger.info(`Aborted S3 multipart upload for key ${key} (context: ${context})`)
         } else if (storageProvider === 'blob') {
           const { abortMultipartUpload } = await import('@/lib/uploads/providers/blob/client')
-          await abortMultipartUpload(key, buildBlobCustomConfig(config))
+          await abortMultipartUpload(key, uploadId, buildBlobCustomConfig(config))
           logger.info(`Aborted Azure multipart upload for key ${key} (context: ${context})`)
         } else if (storageProvider === 'gcs') {
           const { abortGcsMultipartUpload } = await import('@/lib/uploads/providers/gcs/client')

apps/sim/app/api/files/presigned/batch/route.test.ts

@@ -12,10 +12,12 @@ const {
   mockValidateFileType,
   mockGetUserEntityPermissions,
   mockRecordKnowledgeBaseFileOwnershipMany,
+  mockSignUploadToken,
 } = vi.hoisted(() => ({
   mockValidateFileType: vi.fn().mockReturnValue(null),
   mockGetUserEntityPermissions: vi.fn().mockResolvedValue('write'),
   mockRecordKnowledgeBaseFileOwnershipMany: vi.fn().mockResolvedValue(undefined),
+  mockSignUploadToken: vi.fn(),
 }))
 
 vi.mock('@/lib/uploads/config', () => ({
@@ -24,6 +26,10 @@ vi.mock('@/lib/uploads/config', () => ({
 
 vi.mock('@/lib/uploads/core/storage-service', () => storageServiceMock)
 
+vi.mock('@/lib/uploads/core/upload-token', () => ({
+  signUploadToken: mockSignUploadToken,
+}))
+
 vi.mock('@/lib/uploads/utils/validation', () => ({
   validateFileType: mockValidateFileType,
   SUPPORTED_ARCHIVE_EXTENSIONS: ['zip'] as const,
@@ -56,12 +62,14 @@ describe('/api/files/presigned/batch', () => {
     mockValidateFileType.mockReturnValue(null)
     mockGetUserEntityPermissions.mockResolvedValue('write')
     mockRecordKnowledgeBaseFileOwnershipMany.mockResolvedValue(undefined)
+    mockSignUploadToken.mockReturnValue('signed-receipt-token')
     storageServiceMockFns.mockHasCloudStorage.mockReturnValue(true)
     storageServiceMockFns.mockGenerateBatchPresignedUploadUrls.mockImplementation(
       async (files: Array<{ fileName: string }>, context: string) =>
         files.map((file) => ({
           url: `https://example.com/${context}/${file.fileName}`,
           key: `${context}/${file.fileName}`,
+          uploadId: `receipt-${file.fileName}`,
         }))
     )
   })
@@ -162,6 +170,17 @@ describe('/api/files/presigned/batch', () => {
     expect(data.files).toHaveLength(1)
     expect(data.files[0].fileInfo.key).toBe('knowledge-base/doc.pdf')
     expect(data.files[0].fileInfo.path).toContain('?context=knowledge-base')
+    expect(data.files[0].uploadToken).toBe('signed-receipt-token')
+    expect(mockSignUploadToken).toHaveBeenCalledWith(
+      expect.objectContaining({
+        uploadId: 'receipt-doc.pdf',
+        key: 'knowledge-base/doc.pdf',
+        userId: 'user-1',
+        workspaceId: 'ws-1',
+        context: 'knowledge-base',
+        uploadKind: 'direct',
+      })
+    )
     expect(data.directUploadSupported).toBe(true)
     expect(mockRecordKnowledgeBaseFileOwnershipMany).toHaveBeenCalledWith([
       {

apps/sim/app/api/files/presigned/batch/route.ts

@@ -13,6 +13,7 @@ import {
   generateBatchPresignedUploadUrls,
   hasCloudStorage,
 } from '@/lib/uploads/core/storage-service'
+import { signUploadToken } from '@/lib/uploads/core/upload-token'
 import { recordKnowledgeBaseFileOwnershipMany } from '@/lib/uploads/server/metadata'
 import { validateFileType } from '@/lib/uploads/utils/validation'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
@@ -170,6 +171,21 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
             type: file.contentType,
           },
           uploadHeaders: urlResponse.uploadHeaders,
+          ...(urlResponse.uploadId
+            ? {
+                uploadToken: signUploadToken({
+                  uploadId: urlResponse.uploadId,
+                  key: urlResponse.key,
+                  userId: sessionUserId,
+                  workspaceId,
+                  context: 'knowledge-base',
+                  fileName: file.fileName,
+                  contentType: file.contentType,
+                  fileSize: file.fileSize,
+                  uploadKind: 'direct',
+                }),
+              }
+            : {}),
           directUploadSupported: true,
         }
       }),

apps/sim/app/api/files/presigned/route.test.ts

@@ -24,12 +24,13 @@ const {
   mockIsUsingCloudStorageUploads,
   mockGetUserEntityPermissions,
   mockGenerateWorkspaceFileKey,
-  mockGenerateExecutionFileKey,
+  mockGenerateExecutionAttachmentKey,
   mockInsertFileMetadata,
   mockCheckStorageQuotaForBillingContext,
   mockDecrementStorageUsageForBillingContext,
   mockIncrementStorageUsageForBillingContext,
   mockResolveStorageBillingContext,
+  mockSignUploadToken,
 } = vi.hoisted(() => ({
   mockVerifyFileAccess: vi.fn().mockResolvedValue(true),
   mockVerifyWorkspaceFileAccess: vi.fn().mockResolvedValue(true),
@@ -51,15 +52,16 @@ const {
   mockGenerateWorkspaceFileKey: vi.fn(
     (workspaceId: string, fileName: string) => `workspace/${workspaceId}/${fileName}`
   ),
-  mockGenerateExecutionFileKey: vi.fn(
+  mockGenerateExecutionAttachmentKey: vi.fn(
     (ctx: { workspaceId: string; workflowId: string; executionId: string }, fileName: string) =>
-      `execution/${ctx.workspaceId}/${ctx.workflowId}/${ctx.executionId}/${fileName}`
+      `execution/${ctx.workspaceId}/${ctx.workflowId}/${ctx.executionId}/attachment-${fileName}`
   ),
   mockInsertFileMetadata: vi.fn().mockResolvedValue({ id: 'wf_test' }),
   mockCheckStorageQuotaForBillingContext: vi.fn(),
   mockDecrementStorageUsageForBillingContext: vi.fn(),
   mockIncrementStorageUsageForBillingContext: vi.fn(),
   mockResolveStorageBillingContext: vi.fn(),
+  mockSignUploadToken: vi.fn(),
 }))
 
 vi.mock('@/app/api/files/authorization', () => ({
@@ -83,6 +85,10 @@ vi.mock('@/lib/uploads/config', () => ({
 
 vi.mock('@/lib/uploads/core/storage-service', () => storageServiceMock)
 
+vi.mock('@/lib/uploads/core/upload-token', () => ({
+  signUploadToken: mockSignUploadToken,
+}))
+
 vi.mock('@/lib/billing/storage', () => ({
   checkStorageQuotaForBillingContext: mockCheckStorageQuotaForBillingContext,
   decrementStorageUsageForBillingContext: mockDecrementStorageUsageForBillingContext,
@@ -104,11 +110,11 @@ vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => ({
 }))
 
 vi.mock('@/lib/uploads/contexts/execution/utils', () => ({
-  generateExecutionFileKey: mockGenerateExecutionFileKey,
+  generateExecutionAttachmentKey: mockGenerateExecutionAttachmentKey,
 }))
 
 vi.mock('@/lib/uploads/server/metadata', () => ({
-  insertFileMetadata: mockInsertFileMetadata,
+  insertImmutableFileMetadata: mockInsertFileMetadata,
   recordKnowledgeBaseFileOwnership: (ownership: Record<string, unknown>) =>
     mockInsertFileMetadata({ ...ownership, context: 'knowledge-base' }),
 }))
@@ -181,6 +187,7 @@ function setupFileApiMocks(
       return {
         url: 'https://example.com/presigned-url',
         key,
+        uploadId: `receipt-${key}`,
       }
     }
   )
@@ -207,6 +214,7 @@ describe('/api/files/presigned', () => {
     vi.stubGlobal('crypto', {
       randomUUID: vi.fn().mockReturnValue('mock-uuid-1234-5678'),
     })
+    mockSignUploadToken.mockReturnValue('signed-receipt-token')
   })
 
   afterEach(() => {
@@ -742,6 +750,39 @@ describe('/api/files/presigned', () => {
   })
 
   describe('execution uploads', () => {
+    it('allocates distinct create-only keys for duplicate attachment names', async () => {
+      setupFileApiMocks({ cloudEnabled: true, storageProvider: 's3' })
+      mockGenerateExecutionAttachmentKey
+        .mockReturnValueOnce('execution/ws-1/wf-1/exec-1/one-output.txt')
+        .mockReturnValueOnce('execution/ws-1/wf-1/exec-1/two-output.txt')
+
+      const makeExecutionRequest = (fileSize: number) =>
+        new NextRequest(
+          'http://localhost:3000/api/files/presigned?type=execution&workspaceId=ws-1&workflowId=wf-1&executionId=exec-1',
+          {
+            method: 'POST',
+            body: JSON.stringify({
+              fileName: 'output.txt',
+              contentType: 'text/plain',
+              fileSize,
+            }),
+          }
+        )
+
+      const first = await POST(makeExecutionRequest(3))
+      const second = await POST(makeExecutionRequest(12))
+      const firstBody = await first.json()
+      const secondBody = await second.json()
+
+      expect(first.status).toBe(200)
+      expect(second.status).toBe(200)
+      expect(firstBody.fileInfo.key).toBe('execution/ws-1/wf-1/exec-1/one-output.txt')
+      expect(secondBody.fileInfo.key).toBe('execution/ws-1/wf-1/exec-1/two-output.txt')
+      expect(firstBody.fileInfo.key).not.toBe(secondBody.fileInfo.key)
+      expect(firstBody.uploadToken).toBe('signed-receipt-token')
+      expect(secondBody.uploadToken).toBe('signed-receipt-token')
+    })
+
     it('uses validateAttachmentFileType — accepts video', async () => {
       setupFileApiMocks({ cloudEnabled: true, storageProvider: 's3' })