fix(execution): resolve stored file references only for workspace members

Workflow file inputs can reference stored files by id, key, or internal URL,
and every resolved file is added to the run's explicit file grants. Any
caller could use this, so an anonymous public-API, public MCP, chat, or
webhook caller could pull another workflow's run files or workspace files
into a run and receive a presigned URL for them.

Execution now derives a stored-file reference scope from the run's
principal: authorized member principals (session, personal/workspace API
key, OAuth token, delegated) resolve workspace-wide; system principals may
only reference files already stored under the current execution, which keeps
chat and webhook uploads working. The default is the restricted scope, so a
new caller fails closed. Input-format defaults are workflow-authored and
still resolve workspace-wide.

Outside workspace scope, an upload whose URL is an internal file URL is
resolved as the stored reference it names rather than downloaded with the
run user's access, and a key from another execution is refused before it is
looked up, so the refusal does not reveal whether the file exists.

Author: waleedlatif1

apps/sim/lib/execution/files.test.ts

@@ -1,4 +1,5 @@
 /** @vitest-environment node */
+import type { WorkflowExecutionPrincipal } from '@sim/auth/principal'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { SerializedBlock } from '@/serializer/types'
 
@@ -8,6 +9,7 @@ const mocks = vi.hoisted(() => ({
   byKey: vi.fn(),
   presign: vi.fn(),
   readWorkspace: vi.fn(),
+  download: vi.fn(),
 }))
 vi.mock('@/lib/uploads/contexts/execution', () => ({ uploadExecutionFile: mocks.upload }))
 vi.mock('@/lib/uploads/server/metadata', () => ({
@@ -17,6 +19,7 @@ vi.mock('@/lib/uploads/server/metadata', () => ({
 vi.mock('@/lib/uploads/core/storage-service', () => ({
   generatePresignedDownloadUrl: mocks.presign,
 }))
+vi.mock('@/lib/uploads/utils/file-utils.server', () => ({ downloadFileFromUrl: mocks.download }))
 vi.mock('@/lib/core/network/resource-scope.server', () => ({
   withResourceOutboundScope: (_: unknown, fn: () => unknown) => fn(),
 }))
@@ -31,7 +34,11 @@ vi.mock(
   })
 )
 
-import { processExecutionFiles, processInputFileFields } from '@/lib/execution/files'
+import {
+  getStoredFileReferenceScope,
+  processExecutionFiles,
+  processInputFileFields,
+} from '@/lib/execution/files'
 import { assertUserFileContentAccess } from '@/lib/execution/payloads/materialization.server'
 import { StartBlockPath } from '@/lib/workflows/triggers/triggers'
 import { buildStartBlockOutput } from '@/executor/utils/start-block'
@@ -102,7 +109,9 @@ describe('workflow input files', () => {
         scope,
         'request',
         'actor',
-        'selected'
+        'selected',
+        undefined,
+        'workspace'
       )
       expect(result).toEqual({
         ...input,
@@ -127,7 +136,8 @@ describe('workflow input files', () => {
       [existing, { type: 'file', name: 'new.txt', data: 'data:text/plain;base64,YWJj' }, existing],
       scope,
       'request',
-      'actor'
+      'actor',
+      'workspace'
     )
     expect(files.map((file) => file.id)).toEqual([stored.id, 'new', stored.id])
     expect(mocks.upload).toHaveBeenCalledTimes(1)
@@ -140,7 +150,13 @@ describe('workflow input files', () => {
     )
   })
   it('resolves an ID-only reference against active workspace metadata', async () => {
-    const result = await processExecutionFiles({ id: 'metadata-id' }, scope, 'request', 'actor')
+    const result = await processExecutionFiles(
+      { id: 'metadata-id' },
+      scope,
+      'request',
+      'actor',
+      'workspace'
+    )
     expect(result[0]).toMatchObject({ id: 'metadata-id', name: 'report.pdf', size: 24 })
     expect(mocks.byId).toHaveBeenCalledWith('metadata-id')
   })
@@ -150,7 +166,8 @@ describe('workflow input files', () => {
       { ...file, url: `/api/files/serve/s3/${encodeURIComponent(key)}?context=workspace` },
       scope,
       'request',
-      'actor'
+      'actor',
+      'workspace'
     )
     expect(mocks.byKey).toHaveBeenCalledWith(key)
     expect(mocks.byId).not.toHaveBeenCalled()
@@ -184,7 +201,9 @@ describe('workflow input files', () => {
       scope,
       'request',
       'actor',
-      'start'
+      'start',
+      undefined,
+      'workspace'
     )
     const output = buildStartBlockOutput({
       resolution: { blockId: block.id, block, path: StartBlockPath.UNIFIED },
@@ -211,7 +230,9 @@ describe('workflow input files', () => {
       scope,
       'request',
       'actor',
-      'start'
+      'start',
+      undefined,
+      'workspace'
     )
     expect(
       buildStartBlockOutput({
@@ -228,9 +249,9 @@ describe('workflow input files', () => {
     { ...stored, key: 'workspace/foreign/file.pdf' },
   ])('rejects missing, deleted, and foreign file bindings before signing', async (record) => {
     mocks.byKey.mockResolvedValue(record)
-    await expect(processExecutionFiles([existing], scope, 'request', 'actor')).rejects.toThrow(
-      'File not found in this workspace'
-    )
+    await expect(
+      processExecutionFiles([existing], scope, 'request', 'actor', 'workspace')
+    ).rejects.toThrow('File not found in this workspace')
     expect(mocks.presign).not.toHaveBeenCalled()
   })
   it('grants only successfully resolved declared and reserved file inputs, not arbitrary JSON', async () => {
@@ -246,7 +267,8 @@ describe('workflow input files', () => {
       'request',
       'actor',
       'start',
-      granted
+      granted,
+      'workspace'
     )
     expect(granted).toHaveBeenCalledTimes(2)
     expect(granted.mock.calls.map(([file]) => file.key)).toEqual([stored.key, stored.key])
@@ -264,15 +286,16 @@ describe('workflow input files', () => {
         'request',
         'actor',
         'start',
-        granted
+        granted,
+        'workspace'
       )
     ).rejects.toThrow('File not found')
     expect(granted).not.toHaveBeenCalled()
   })
 
   it('normalizes Mothership attachment storage context for downstream materialization', async () => {
     mocks.byKey.mockResolvedValue({ ...stored, context: 'mothership' })
-    const [file] = await processExecutionFiles([existing], scope, 'request', 'actor')
+    const [file] = await processExecutionFiles([existing], scope, 'request', 'actor', 'workspace')
     expect(file).toMatchObject({ id: stored.id, context: 'workspace', key: stored.key })
     expect(mocks.presign).toHaveBeenCalledWith(stored.key, 'workspace', 300)
     await assertUserFileContentAccess(file, {
@@ -291,7 +314,8 @@ describe('workflow input files', () => {
       [{ name: 'new.txt', data: 'YWJj', mimeType: 'text/plain' }],
       scope,
       'request',
-      'actor'
+      'actor',
+      'workspace'
     )
     expect(mocks.upload).toHaveBeenCalledWith(
       scope,
@@ -309,7 +333,9 @@ describe('workflow input files', () => {
       scope,
       'request',
       'actor',
-      'start'
+      'start',
+      undefined,
+      'workspace'
     )
     expect(nested).toMatchObject({
       input: {
@@ -354,8 +380,186 @@ describe('workflow input files', () => {
       scope,
       'request',
       'actor',
-      'start'
+      'start',
+      undefined,
+      'workspace'
     )
     expect(mocks.byKey).toHaveBeenCalledWith(existing.key)
   })
+
+  describe('stored references from callers outside the workspace', () => {
+    const priorRun = {
+      ...stored,
+      key: 'execution/11111111-1111-4111-8111-111111111111/other-workflow/old-run/secret.txt',
+      context: 'execution',
+    }
+    const references = [
+      { key: priorRun.key },
+      { id: 'metadata-id' },
+      {
+        id: 'client-id',
+        url: `/api/files/serve/s3/${encodeURIComponent(priorRun.key)}?context=execution`,
+      },
+    ]
+
+    it.each([
+      ['a public API principal', 'execution' as const],
+      ['an omitted scope', undefined],
+    ])(
+      'rejects key, ID, and internal URL references from %s and grants nothing',
+      async (_, scopeOption) => {
+        for (const record of [priorRun, stored]) {
+          mocks.byKey.mockResolvedValue(record)
+          mocks.byId.mockResolvedValue(record)
+          for (const reference of references) {
+            const granted = vi.fn()
+            await expect(
+              processInputFileFields(
+                { documents: [reference] },
+                [trigger('start', 'documents')],
+                scope,
+                'request',
+                'actor',
+                'start',
+                granted,
+                scopeOption
+              )
+            ).rejects.toThrow('Stored file references require workspace member access')
+            expect(granted).not.toHaveBeenCalled()
+          }
+        }
+        expect(mocks.presign).not.toHaveBeenCalled()
+      }
+    )
+
+    it('does not reveal whether a rejected reference exists', async () => {
+      mocks.byKey.mockResolvedValue(null)
+      await expect(
+        processExecutionFiles([{ key: priorRun.key }], scope, 'request')
+      ).rejects.toThrow('Stored file references require workspace member access')
+    })
+
+    it('refuses a key from another execution before looking it up', async () => {
+      await expect(
+        processExecutionFiles([{ key: priorRun.key }], scope, 'request')
+      ).rejects.toThrow('Stored file references require workspace member access')
+      expect(mocks.byKey).not.toHaveBeenCalled()
+    })
+
+    it('treats an internal file URL upload as a stored reference, not a download', async () => {
+      mocks.download.mockResolvedValue(Buffer.from('secret'))
+      await expect(
+        processExecutionFiles(
+          [
+            {
+              type: 'url',
+              name: 'secret.txt',
+              data: `/api/files/serve/s3/${encodeURIComponent(priorRun.key)}?context=execution`,
+            },
+          ],
+          scope,
+          'request',
+          'actor'
+        )
+      ).rejects.toThrow('Stored file references require workspace member access')
+      expect(mocks.download).not.toHaveBeenCalled()
+      expect(mocks.upload).not.toHaveBeenCalled()
+    })
+
+    it('keeps downloading internal file URL uploads for a workspace member', async () => {
+      mocks.download.mockResolvedValue(Buffer.from('bytes'))
+      await processExecutionFiles(
+        [
+          {
+            type: 'url',
+            name: 'secret.txt',
+            data: `/api/files/serve/s3/${encodeURIComponent(priorRun.key)}?context=execution`,
+          },
+        ],
+        scope,
+        'request',
+        'actor',
+        'workspace'
+      )
+      expect(mocks.download).toHaveBeenCalledTimes(1)
+      expect(mocks.upload).toHaveBeenCalledTimes(1)
+    })
+
+    it('still resolves files this execution stored before handing its input on', async () => {
+      const ownKey = `execution/${scope.workspaceId}/${scope.workflowId}/${scope.executionId}/upload.txt`
+      mocks.byKey.mockResolvedValue({ ...priorRun, key: ownKey })
+      const granted = vi.fn()
+      await processInputFileFields(
+        { files: [{ id: 'upload', key: ownKey }] },
+        [trigger('start', 'other')],
+        scope,
+        'request',
+        'actor',
+        'start',
+        granted
+      )
+      expect(granted.mock.calls.map(([file]) => file.key)).toEqual([ownKey])
+    })
+
+    it('resolves the same prior-run reference for a workspace member and grants it', async () => {
+      mocks.byKey.mockResolvedValue(priorRun)
+      const granted = vi.fn()
+      await processInputFileFields(
+        { documents: [{ key: priorRun.key }] },
+        [trigger('start', 'documents')],
+        scope,
+        'request',
+        'actor',
+        'start',
+        granted,
+        'workspace'
+      )
+      expect(granted.mock.calls.map(([file]) => file.key)).toEqual([priorRun.key])
+    })
+  })
+
+  describe('getStoredFileReferenceScope', () => {
+    const workspaceId = scope.workspaceId
+    const workflowId = scope.workflowId
+    const delegation = {
+      workspaceId,
+      delegationId: 'delegation',
+      audience: 'workflow-execution',
+      issuedAt: new Date(),
+      expiresAt: new Date(),
+    }
+    it.each<WorkflowExecutionPrincipal>([
+      { kind: 'session', userId: 'user', sessionId: 'session' },
+      { kind: 'personal_api_key', userId: 'user', keyId: 'key' },
+      {
+        kind: 'oauth_access_token',
+        userId: 'user',
+        clientId: 'client',
+        tokenId: 'token',
+        scopes: [],
+        expiresAt: new Date(),
+      },
+      { kind: 'workspace_api_key', workspaceId, keyId: 'key' },
+      { kind: 'delegated', serviceId: 'copilot', subjectUserId: 'user', ...delegation },
+    ])('lets authorized member principal $kind reference workspace files', (principal) => {
+      expect(getStoredFileReferenceScope(principal)).toBe('workspace')
+    })
+    it.each<WorkflowExecutionPrincipal>([
+      { kind: 'system', serviceId: 'public_api', workspaceId, workflowId },
+      { kind: 'system', serviceId: 'internal', workspaceId, workflowId },
+      { kind: 'system', serviceId: 'schedule', workspaceId, workflowId },
+      { kind: 'system', serviceId: 'table', workspaceId, workflowId },
+      { kind: 'system', serviceId: 'chat', workspaceId, workflowId },
+      {
+        kind: 'system',
+        serviceId: 'webhook',
+        workspaceId,
+        workflowId,
+        webhookId: 'webhook',
+        provider: 'generic',
+      },
+    ])('limits system principal $serviceId to its own execution files', (principal) => {
+      expect(getStoredFileReferenceScope(principal)).toBe('execution')
+    })
+  })
 })