feat(workspaces): add workspace logo upload by waleedlatif1 · Pull Request #4136 · simstudioai/sim

waleedlatif1 · 2026-04-13T21:13:28Z

Summary

Add workspace logo upload via right-click context menu on workspace items
New dedicated storage bucket for workspace logos with S3 and Azure support
Show uploaded logo in place of the default color + letter avatar across the sidebar
Route whitelabeling logo and wordmark uploads to the new storage bucket
Consolidate duplicate Workspace type definitions to use a single shared interface

Type of Change

New feature

Testing

Tested manually

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-04-13T21:13:34Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 13, 2026 10:38pm

cursor · 2026-04-13T21:13:57Z

PR Summary

Medium Risk
Adds a new public file context and upload path gated by workspace admin checks, plus a DB schema change for workspace.logoUrl; mistakes could expose or break logo/file access across workspaces.

Overview
Enables workspace logos to be uploaded and shown in the sidebar workspace switcher/context menu, falling back to the existing color+initial avatar when no logo is set.

Introduces a new uploads context workspace-logos with S3/Azure config/env support and treats it as publicly servable (like profile-pictures/og-images), while restricting uploads to workspace admins and emitting audit + PostHog event workspace_logo_uploaded.

Extends the workspace API and client types/mutations to persist logoUrl (DB migration adds workspace.logo_url), and routes whitelabeling logo/wordmark uploads through the same workspace-logos storage context; also consolidates duplicate Workspace typings and expands image uploads to accept WebP.

^{Reviewed by Cursor Bugbot for commit 473785c. Configure here.}

greptile-apps · 2026-04-13T21:18:47Z

Greptile Summary

This PR adds workspace logo upload support via a right-click context menu, introduces a dedicated workspace-logos storage bucket (S3 + Azure), wires logos into the sidebar header, and consolidates the Workspace type. It also routes whitelabeling logo/wordmark uploads to the new bucket and adds a logo_url column to the workspace table.

The previous thread concerns — storage cleanup parity with profile-pictures and URL validation — have been acknowledged/addressed. All remaining findings are P2.

Confidence Score: 5/5

Safe to merge — all findings are P2 style/edge-case concerns with no blocking bugs or security issues

Server-side authorization is correct (admin-only upload + PATCH, URL validation, public serve for logos). The DB migration is additive and backwards-compatible. Prior review concerns (storage cleanup parity, arbitrary URL injection) have been acknowledged or addressed. The two remaining findings are code duplication and an edge-case workspaceIdRef drift that only affects audit logs in an unlikely navigation sequence, neither of which blocks shipping.

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/hooks/use-workspace-logo-upload.ts — code duplication and workspaceIdRef drift

Important Files Changed

Filename	Overview
apps/sim/app/workspace/[workspaceId]/w/components/sidebar/hooks/use-workspace-logo-upload.ts	New hook for workspace logo upload; near-duplicate of useProfilePictureUpload with the only addition being setTargetWorkspaceId; also contains a workspaceIdRef drift edge case
apps/sim/app/api/files/upload/route.ts	Correctly adds workspace-logos context with admin-only authorization check, audit logging, and PostHog event capture
apps/sim/app/api/workspaces/[id]/route.ts	PATCH route correctly validates logoUrl (must start with / or https://), requires admin permission, and records audit log for logo changes
apps/sim/app/api/files/authorization.ts	workspace-logos correctly added to public-access contexts alongside profile-pictures and og-images; serve route also short-circuits auth for the new prefix
apps/sim/lib/uploads/config.ts	S3_WORKSPACE_LOGOS_CONFIG and BLOB_WORKSPACE_LOGOS_CONFIG added correctly; switch cases handle workspace-logos with correct fallback to general config
apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx	useWorkspaceLogoUpload correctly wired; admin-only handlers passed down; logoTargetWorkspaceIdRef tracks target workspace for multi-workspace upload scenario
packages/db/migrations/0190_shocking_karma.sql	Simple nullable text column addition to workspace table; backwards-compatible, no data migration needed
apps/sim/hooks/queries/workspace.ts	Workspace type consolidated with logoUrl field; useUpdateWorkspace params extended with logoUrl; clean single source of truth

Sequence Diagram

sequenceDiagram
    actor User
    participant Sidebar
    participant Hook as useWorkspaceLogoUpload
    participant UploadAPI as POST /api/files/upload
    participant Storage as workspace-logos bucket
    participant PatchAPI as PATCH /api/workspaces/[id]
    participant DB as workspace.logo_url

    User->>Sidebar: Right-click workspace → Upload logo
    Sidebar->>Hook: setTargetWorkspaceId(workspaceId)
    Sidebar->>Sidebar: logoTargetWorkspaceIdRef = workspaceId
    Sidebar->>User: Open file picker

    User->>Sidebar: Select image file
    Sidebar->>Hook: handleFileChange(file)
    Hook->>Hook: validateFile (size ≤5MB, allowed type)
    Hook->>Hook: setPreviewUrl(objectURL)

    Hook->>UploadAPI: POST multipart (file, context=workspace-logos, workspaceId)
    UploadAPI->>UploadAPI: Verify user is workspace admin
    UploadAPI->>Storage: uploadFile(workspace-logos/ts-filename)
    Storage-->>UploadAPI: fileInfo.path
    UploadAPI->>UploadAPI: recordAudit + captureServerEvent
    UploadAPI-->>Hook: fileInfo.path

    Hook->>Hook: setPreviewUrl(serverUrl)
    Hook->>Sidebar: onUpload(serverUrl)
    Sidebar->>PatchAPI: PATCH { logoUrl: serverUrl }
    PatchAPI->>PatchAPI: Verify user is workspace admin
    PatchAPI->>PatchAPI: Validate logoUrl (starts with / or https://)
    PatchAPI->>DB: UPDATE workspace SET logo_url = serverUrl
    PatchAPI->>PatchAPI: recordAudit
    PatchAPI-->>Sidebar: updated workspace

    Sidebar->>Sidebar: invalidate workspaceKeys.lists()
    Sidebar->>Sidebar: Re-render with new logoUrl in header

_{Reviews (6): Last reviewed commit: "refactor: replace raw fetch with useWork..." | Re-trigger Greptile}

waleedlatif1 · 2026-04-13T21:29:24Z

Both security findings are now addressed:

Workspace auth on logo uploads — The upload route now requires workspaceId for workspace-logos context and validates admin-only access via getUserEntityPermissions. Both useWorkspaceLogoUpload and useProfilePictureUpload (used by whitelabeling) now forward workspaceId in the form data. Also added recordAudit and PostHog event tracking for logo uploads.
Arbitrary logoUrl validation — The PATCH endpoint now validates logoUrl only accepts strings starting with / (local paths) or https:// (cloud storage URLs), preventing external tracker URLs.

waleedlatif1 · 2026-04-13T21:29:36Z

@greptile

waleedlatif1 · 2026-04-13T21:29:40Z

@cursor review

…t for workspace logo uploads

- Add image/webp to ACCEPTED_IMAGE_TYPES in useProfilePictureUpload - Add image/webp to file input accept attributes in whitelabeling settings - Refactor useProfilePictureUpload to use refs for onUpload, onError, and currentImage callbacks, matching the established codebase pattern Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

These files were accidentally regressed during rebase conflict resolution, reverting changes from #4027. Restoring to staging versions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

waleedlatif1 · 2026-04-13T22:01:02Z

@greptile

waleedlatif1 · 2026-04-13T22:01:05Z

@cursor review

Split the ref sync useEffect so workspaceIdRef only updates when the workspaceId prop changes, not when onUpload/onError callbacks get new references. Prevents setTargetWorkspaceId from being overwritten by a re-render before the file upload completes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

waleedlatif1 · 2026-04-13T22:14:36Z

@cursor review

waleedlatif1 · 2026-04-13T22:14:43Z

@greptile

waleedlatif1 · 2026-04-13T22:24:53Z

@greptile

waleedlatif1 · 2026-04-13T22:24:57Z

@cursor review

The shared Workspace type requires ownerId and other fields that aren't available from the workspaces API response mapping. Use a Pick type to accurately represent the subset of fields actually constructed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove useState + useEffect + fetch anti-pattern for loading workspaces. Use useWorkspacesQuery from React Query with inline filter for write/admin permissions. Eliminates ~30 lines of manual state management, any casts, and the Pick type workaround. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

waleedlatif1 · 2026-04-13T22:43:29Z

@cursor review

waleedlatif1 · 2026-04-13T22:43:32Z

@greptile

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f05046a. Configure here.}

greptile-apps bot reviewed Apr 13, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx

Comment thread apps/sim/app/api/workspaces/[id]/route.ts Outdated

vercel bot deployed to Preview April 13, 2026 21:19 View deployment

waleedlatif1 force-pushed the waleedlatif1/workspace-logo-upload branch from 7ca4af8 to 1d5656a Compare April 13, 2026 21:22

vercel bot temporarily deployed to Preview April 13, 2026 21:24 Inactive

vercel bot temporarily deployed to Preview April 13, 2026 21:29 Inactive

vercel bot temporarily deployed to Preview April 13, 2026 21:30 Inactive

cursor bot reviewed Apr 13, 2026

View reviewed changes

Comment thread apps/sim/blocks/blocks/cloudwatch.ts Outdated

Comment thread apps/sim/blocks/blocks/cloudwatch.ts

Comment thread apps/sim/tools/cloudformation/index.ts Outdated

vercel bot temporarily deployed to Preview April 13, 2026 21:39 Inactive

waleedlatif1 and others added 7 commits April 13, 2026 14:43

feat(workspaces): add workspace logo upload

30d6b70

feat(workspaces): add workspace logo upload

5c8b91b

fix(workspaces): validate logoUrl accepts only paths or HTTPS URLs

9e543d2

fix(workspaces): add admin authorization, audit log, and posthog even…

ff7c724

…t for workspace logo uploads

lint

e3620f0

fix: restore cloudwatch/cloudformation files from staging

8794e12

These files were accidentally regressed during rebase conflict resolution, reverting changes from #4027. Restoring to staging versions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

waleedlatif1 force-pushed the waleedlatif1/workspace-logo-upload branch from 0e1b3a0 to 8794e12 Compare April 13, 2026 21:44

vercel bot deployed to Preview April 13, 2026 21:47 View deployment

fix: add workspace_logo_uploaded to PostHogEventMap

fa70e3e

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

vercel bot temporarily deployed to Preview April 13, 2026 21:52 Inactive

cursor bot reviewed Apr 13, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/[workspaceId]/w/components/sidebar/hooks/use-workspace-logo-upload.ts Outdated

Comment thread apps/sim/app/workspace/[workspaceId]/w/components/sidebar/hooks/use-workspace-logo-upload.ts

vercel bot temporarily deployed to Preview April 13, 2026 22:11 Inactive

cursor bot reviewed Apr 13, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx

Comment thread apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx

cursor bot reviewed Apr 13, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/[workspaceId]/knowledge/components/knowledge-header/knowledge-header.tsx Outdated

vercel bot temporarily deployed to Preview April 13, 2026 22:33 Inactive

vercel bot temporarily deployed to Preview April 13, 2026 22:38 Inactive

cursor bot reviewed Apr 13, 2026

View reviewed changes

waleedlatif1 merged commit 7491d70 into staging Apr 13, 2026
12 checks passed

waleedlatif1 deleted the waleedlatif1/workspace-logo-upload branch April 13, 2026 22:54

waleedlatif1 mentioned this pull request Apr 14, 2026

v0.6.40: mothership tool loop, new skills, agiloft, STS, IAM integrations, jira forms endpoints #4146

Merged

Conversation

waleedlatif1 commented Apr 13, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 13, 2026

Uh oh!

waleedlatif1 commented Apr 13, 2026

Uh oh!

waleedlatif1 commented Apr 13, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 13, 2026

Uh oh!

waleedlatif1 commented Apr 13, 2026

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 13, 2026

Uh oh!

waleedlatif1 commented Apr 13, 2026

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 13, 2026

Uh oh!

waleedlatif1 commented Apr 13, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Apr 13, 2026

Uh oh!

waleedlatif1 commented Apr 13, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel bot commented Apr 13, 2026 •

edited

Loading

cursor bot commented Apr 13, 2026 •

edited

Loading

greptile-apps bot commented Apr 13, 2026 •

edited

Loading