fix(storage): validation pass — gcs serve-prefix parity in key parsers + CORS doc fix

- extractStorageKey, extractFilename, and extractEmbeddedFileRef now strip the
  gcs/ serve prefix like s3/ and blob/, so direct-uploaded files on GCS parse,
  delete, download, and embed correctly (previously only the serve route knew
  the prefix)
- file-download storageProvider union includes 'gcs'
- completeGcsMultipartUpload defensively rejects a 200 response carrying an
  XML error document
- docs: CORS example lists concrete x-goog-meta-* header names (GCS matches
  responseHeader entries exactly; wildcards are only supported for origin)

Author: waleedlatif1

apps/docs/content/docs/en/platform/self-hosting/object-storage.mdx

@@ -237,7 +237,17 @@ cat > /tmp/cors.json <<'EOF'
   {
     "origin": ["https://your-sim-domain.com"],
     "method": ["GET", "PUT"],
-    "responseHeader": ["Content-Type", "ETag", "x-goog-meta-*"],
+    "responseHeader": [
+      "Content-Type",
+      "ETag",
+      "x-goog-meta-originalname",
+      "x-goog-meta-uploadedat",
+      "x-goog-meta-purpose",
+      "x-goog-meta-userid",
+      "x-goog-meta-workspaceid",
+      "x-goog-meta-workflowid",
+      "x-goog-meta-executionid"
+    ],
     "maxAgeSeconds": 3600
   }
 ]
@@ -250,7 +260,7 @@ done
 ```
 
 <Callout type="info">
-  `ETag` must be in `responseHeader` — large-file multipart uploads read each part's `ETag` from the browser, and CORS hides the header otherwise.
+  Header names must be listed individually — GCS CORS matches `responseHeader` entries exactly and does not support wildcards like `x-goog-meta-*`. `ETag` is required because large-file multipart uploads read each part's `ETag` from the browser, and CORS hides the header otherwise.
 </Callout>
 
 </Step>

apps/sim/app/api/files/utils.ts

@@ -99,9 +99,9 @@ export function extractFilename(path: string): string {
     .replace(/\/\.\./g, '')
     .replace(/\.\.\//g, '')
 
-  if (filename.startsWith('s3/') || filename.startsWith('blob/')) {
+  if (filename.startsWith('s3/') || filename.startsWith('blob/') || filename.startsWith('gcs/')) {
     const parts = filename.split('/')
-    const prefix = parts[0] // 's3' or 'blob'
+    const prefix = parts[0] // 's3', 'blob', or 'gcs'
     const keyParts = parts.slice(1)
 
     const sanitizedKeyParts = keyParts

apps/sim/app/workspace/[workspaceId]/logs/components/log-details/components/file-download/file-download.tsx

@@ -15,7 +15,7 @@ interface FileData {
   type: string
   key: string
   url: string
-  storageProvider?: 's3' | 'blob' | 'local'
+  storageProvider?: 's3' | 'blob' | 'gcs' | 'local'
   bucketName?: string
 }
 

apps/sim/lib/uploads/providers/gcs/client.ts

@@ -538,10 +538,24 @@ export async function completeGcsMultipartUpload(
     .join('')
   const body = `<CompleteMultipartUpload>${partsXml}</CompleteMultipartUpload>`
 
-  await gcsXmlApiRequest('POST', config.bucket, key, `uploadId=${encodeURIComponent(uploadId)}`, {
-    headers: { 'Content-Type': 'application/xml' },
-    body,
-  })
+  const response = await gcsXmlApiRequest(
+    'POST',
+    config.bucket,
+    key,
+    `uploadId=${encodeURIComponent(uploadId)}`,
+    {
+      headers: { 'Content-Type': 'application/xml' },
+      body,
+    }
+  )
+
+  // The S3 XML dialect permits a 200 response carrying an error document; GCS
+  // does not document that behavior, but checking is cheap insurance against
+  // reporting a failed completion as success.
+  const responseXml = await response.text()
+  if (responseXml.includes('<Error')) {
+    throw new Error(`GCS multipart completion failed for ${key}: ${responseXml.slice(0, 500)}`)
+  }
 
   return {
     location: buildGcsObjectUrl(config.bucket, key),

apps/sim/lib/uploads/utils/embedded-image-ref.test.ts

@@ -14,6 +14,7 @@ describe('extractEmbeddedFileRef', () => {
     })
     expect(extractEmbeddedFileRef(`/api/files/serve/s3/${ENCODED}`)).toEqual({ key: KEY })
     expect(extractEmbeddedFileRef(`/api/files/serve/blob/${ENCODED}`)).toEqual({ key: KEY })
+    expect(extractEmbeddedFileRef(`/api/files/serve/gcs/${ENCODED}`)).toEqual({ key: KEY })
   })
 
   it('parses view-url and in-app-path embeds to the file id', () => {

apps/sim/lib/uploads/utils/embedded-image-ref.ts

@@ -24,7 +24,7 @@ const EMBED_URL_RE =
 
 /**
  * Parse a single embed `src` into the workspace file it references, normalizing the spellings the
- * editor and file agent produce: `/api/files/serve/<key>` (incl. `s3/`/`blob/` prefixes), `/api/files/view/<id>`,
+ * editor and file agent produce: `/api/files/serve/<key>` (incl. `s3/`/`blob/`/`gcs/` prefixes), `/api/files/view/<id>`,
  * and the in-app path `/workspace/<wsId>/files/<id>`. Returns null for absolute, `data:`, or non-workspace
  * URLs (e.g. public `profile-pictures/` assets), which render as-is.
  */
@@ -35,7 +35,9 @@ export function extractEmbeddedFileRef(src: string): EmbeddedFileRef {
     const segs = parsed.pathname.split('/')
     if (segs[1] === 'api' && segs[2] === 'files' && segs[3] === 'serve') {
       let keySegs = segs.slice(4)
-      if (keySegs[0] === 's3' || keySegs[0] === 'blob') keySegs = keySegs.slice(1)
+      if (keySegs[0] === 's3' || keySegs[0] === 'blob' || keySegs[0] === 'gcs') {
+        keySegs = keySegs.slice(1)
+      }
       const raw = keySegs.join('/')
       if (!raw) return null
       const key = decodeURIComponent(raw)

apps/sim/lib/uploads/utils/file-utils.test.ts

@@ -4,6 +4,7 @@
 import { createLogger } from '@sim/logger'
 import { describe, expect, it } from 'vitest'
 import {
+  extractStorageKey,
   inferContextFromKey,
   isAbortError,
   isInternalFileUrl,
@@ -14,6 +15,24 @@ import {
 
 const logger = createLogger('FileUtilsTest')
 
+describe('extractStorageKey', () => {
+  it('strips every provider serve prefix', () => {
+    expect(extractStorageKey('/api/files/serve/s3/workspace%2Fws-1%2Ffile.txt')).toBe(
+      'workspace/ws-1/file.txt'
+    )
+    expect(extractStorageKey('/api/files/serve/blob/workspace%2Fws-1%2Ffile.txt')).toBe(
+      'workspace/ws-1/file.txt'
+    )
+    expect(extractStorageKey('/api/files/serve/gcs/workspace%2Fws-1%2Ffile.txt')).toBe(
+      'workspace/ws-1/file.txt'
+    )
+  })
+
+  it('returns unprefixed serve keys as-is', () => {
+    expect(extractStorageKey('/api/files/serve/kb/123-doc.pdf')).toBe('kb/123-doc.pdf')
+  })
+})
+
 describe('isInternalFileUrl', () => {
   it('classifies relative serve paths as internal', () => {
     expect(isInternalFileUrl('/api/files/serve/kb/123-file.pdf')).toBe(true)

apps/sim/lib/uploads/utils/file-utils.ts

@@ -532,6 +532,8 @@ export function extractStorageKey(filePath: string): string {
       key = key.substring(3)
     } else if (key.startsWith('blob/')) {
       key = key.substring(5)
+    } else if (key.startsWith('gcs/')) {
+      key = key.substring(4)
     }
     return key
   }