Skip to content

Commit 93b1565

Browse files
waleedlatif1waleedlatif1
committed
test(uploads): add coverage for attachment validator and dedupe extensions
- Dedupe SUPPORTED_ATTACHMENT_EXTENSIONS (webm appears in both audio and video lists) - Reuse SUPPORTED_ATTACHMENT_EXTENSIONS in /api/files/upload to avoid drift with the presigned route - Add unit tests for validateAttachmentFileType - Add presigned route tests covering mothership/execution/knowledge-base validator selection and permission gating
1 parent c44177b commit 93b1565

4 files changed

Lines changed: 274 additions & 25 deletions

File tree

‎apps/sim/app/api/files/presigned/route.test.ts‎

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,14 @@ const {
1717
mockIsUsingCloudStorage,
1818
mockGetStorageProvider,
1919
mockValidateFileType,
20+
mockValidateAttachmentFileType,
2021
mockGenerateCopilotUploadUrl,
2122
mockIsImageFileType,
2223
mockGetStorageProviderUploads,
2324
mockIsUsingCloudStorageUploads,
25+
mockGetUserEntityPermissions,
26+
mockGenerateWorkspaceFileKey,
27+
mockGenerateExecutionFileKey,
2428
} = vi.hoisted(() => ({
2529
mockVerifyFileAccess: vi.fn().mockResolvedValue(true),
2630
mockVerifyWorkspaceFileAccess: vi.fn().mockResolvedValue(true),
@@ -30,13 +34,22 @@ const {
3034
mockIsUsingCloudStorage: vi.fn(),
3135
mockGetStorageProvider: vi.fn(),
3236
mockValidateFileType: vi.fn().mockReturnValue(null),
37+
mockValidateAttachmentFileType: vi.fn().mockReturnValue(null),
3338
mockGenerateCopilotUploadUrl: vi.fn().mockResolvedValue({
3439
url: 'https://example.com/presigned-url',
3540
key: 'copilot/test-key.txt',
3641
}),
3742
mockIsImageFileType: vi.fn().mockReturnValue(true),
3843
mockGetStorageProviderUploads: vi.fn(),
3944
mockIsUsingCloudStorageUploads: vi.fn(),
45+
mockGetUserEntityPermissions: vi.fn().mockResolvedValue('admin'),
46+
mockGenerateWorkspaceFileKey: vi.fn(
47+
(workspaceId: string, fileName: string) => `workspace/${workspaceId}/${fileName}`
48+
),
49+
mockGenerateExecutionFileKey: vi.fn(
50+
(ctx: { workspaceId: string; workflowId: string; executionId: string }, fileName: string) =>
51+
`execution/${ctx.workspaceId}/${ctx.workflowId}/${ctx.executionId}/${fileName}`
52+
),
4053
}))
4154

4255
vi.mock('@/app/api/files/authorization', () => ({
@@ -61,6 +74,19 @@ vi.mock('@/lib/uploads/core/storage-service', () => storageServiceMock)
6174

6275
vi.mock('@/lib/uploads/utils/validation', () => ({
6376
validateFileType: mockValidateFileType,
77+
validateAttachmentFileType: mockValidateAttachmentFileType,
78+
}))
79+
80+
vi.mock('@/lib/workspaces/permissions/utils', () => ({
81+
getUserEntityPermissions: mockGetUserEntityPermissions,
82+
}))
83+
84+
vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => ({
85+
generateWorkspaceFileKey: mockGenerateWorkspaceFileKey,
86+
}))
87+
88+
vi.mock('@/lib/uploads/contexts/execution/utils', () => ({
89+
generateExecutionFileKey: mockGenerateExecutionFileKey,
6490
}))
6591

6692
vi.mock('@/lib/uploads/utils/file-utils', () => ({
@@ -139,6 +165,8 @@ function setupFileApiMocks(
139165
)
140166

141167
mockValidateFileType.mockReturnValue(null)
168+
mockValidateAttachmentFileType.mockReturnValue(null)
169+
mockGetUserEntityPermissions.mockResolvedValue('admin')
142170

143171
mockGetStorageProviderUploads.mockReturnValue(
144172
storageProvider === 'blob' ? 'Azure Blob' : storageProvider === 's3' ? 'S3' : 'Local'
@@ -518,6 +546,167 @@ describe('/api/files/presigned', () => {
518546
})
519547
})
520548

549+
describe('mothership uploads', () => {
550+
it('uses validateAttachmentFileType (not validateFileType) — accepts images', async () => {
551+
setupFileApiMocks({ cloudEnabled: true, storageProvider: 's3' })
552+
553+
const request = new NextRequest(
554+
'http://localhost:3000/api/files/presigned?type=mothership&workspaceId=ws-1',
555+
{
556+
method: 'POST',
557+
body: JSON.stringify({
558+
fileName: 'screenshot.png',
559+
contentType: 'image/png',
560+
fileSize: 4096,
561+
}),
562+
}
563+
)
564+
565+
const response = await POST(request)
566+
expect(response.status).toBe(200)
567+
expect(mockValidateAttachmentFileType).toHaveBeenCalledWith('screenshot.png')
568+
expect(mockValidateFileType).not.toHaveBeenCalled()
569+
})
570+
571+
it('rejects unsupported types when validator returns an error', async () => {
572+
setupFileApiMocks({ cloudEnabled: true, storageProvider: 's3' })
573+
mockValidateAttachmentFileType.mockReturnValue({
574+
code: 'UNSUPPORTED_FILE_TYPE',
575+
message: 'Unsupported file type: exe.',
576+
supportedTypes: [],
577+
})
578+
579+
const request = new NextRequest(
580+
'http://localhost:3000/api/files/presigned?type=mothership&workspaceId=ws-1',
581+
{
582+
method: 'POST',
583+
body: JSON.stringify({
584+
fileName: 'virus.exe',
585+
contentType: 'application/octet-stream',
586+
fileSize: 4096,
587+
}),
588+
}
589+
)
590+
591+
const response = await POST(request)
592+
const data = await response.json()
593+
expect(response.status).toBe(400)
594+
expect(data.code).toBe('VALIDATION_ERROR')
595+
expect(data.error).toContain('exe')
596+
})
597+
598+
it('returns 403 when user lacks workspace write permission', async () => {
599+
setupFileApiMocks({ cloudEnabled: true, storageProvider: 's3' })
600+
mockGetUserEntityPermissions.mockResolvedValue('read')
601+
602+
const request = new NextRequest(
603+
'http://localhost:3000/api/files/presigned?type=mothership&workspaceId=ws-1',
604+
{
605+
method: 'POST',
606+
body: JSON.stringify({
607+
fileName: 'doc.pdf',
608+
contentType: 'application/pdf',
609+
fileSize: 4096,
610+
}),
611+
}
612+
)
613+
614+
const response = await POST(request)
615+
expect(response.status).toBe(403)
616+
})
617+
})
618+
619+
describe('execution uploads', () => {
620+
it('uses validateAttachmentFileType — accepts video', async () => {
621+
setupFileApiMocks({ cloudEnabled: true, storageProvider: 's3' })
622+
623+
const request = new NextRequest(
624+
'http://localhost:3000/api/files/presigned?type=execution&workspaceId=ws-1&workflowId=wf-1&executionId=exec-1',
625+
{
626+
method: 'POST',
627+
body: JSON.stringify({
628+
fileName: 'output.mp4',
629+
contentType: 'video/mp4',
630+
fileSize: 4096,
631+
}),
632+
}
633+
)
634+
635+
const response = await POST(request)
636+
expect(response.status).toBe(200)
637+
expect(mockValidateAttachmentFileType).toHaveBeenCalledWith('output.mp4')
638+
expect(mockValidateFileType).not.toHaveBeenCalled()
639+
})
640+
641+
it('rejects when validator returns an error', async () => {
642+
setupFileApiMocks({ cloudEnabled: true, storageProvider: 's3' })
643+
mockValidateAttachmentFileType.mockReturnValue({
644+
code: 'UNSUPPORTED_FILE_TYPE',
645+
message: 'Unsupported file type: bin.',
646+
supportedTypes: [],
647+
})
648+
649+
const request = new NextRequest(
650+
'http://localhost:3000/api/files/presigned?type=execution&workspaceId=ws-1&workflowId=wf-1&executionId=exec-1',
651+
{
652+
method: 'POST',
653+
body: JSON.stringify({
654+
fileName: 'blob.bin',
655+
contentType: 'application/octet-stream',
656+
fileSize: 4096,
657+
}),
658+
}
659+
)
660+
661+
const response = await POST(request)
662+
const data = await response.json()
663+
expect(response.status).toBe(400)
664+
expect(data.code).toBe('VALIDATION_ERROR')
665+
})
666+
667+
it('returns 400 when missing workflowId/executionId', async () => {
668+
setupFileApiMocks({ cloudEnabled: true, storageProvider: 's3' })
669+
670+
const request = new NextRequest(
671+
'http://localhost:3000/api/files/presigned?type=execution&workspaceId=ws-1',
672+
{
673+
method: 'POST',
674+
body: JSON.stringify({
675+
fileName: 'output.mp4',
676+
contentType: 'video/mp4',
677+
fileSize: 4096,
678+
}),
679+
}
680+
)
681+
682+
const response = await POST(request)
683+
expect(response.status).toBe(400)
684+
})
685+
})
686+
687+
describe('knowledge-base uploads', () => {
688+
it('uses validateFileType (docs-only), not validateAttachmentFileType', async () => {
689+
setupFileApiMocks({ cloudEnabled: true, storageProvider: 's3' })
690+
691+
const request = new NextRequest(
692+
'http://localhost:3000/api/files/presigned?type=knowledge-base',
693+
{
694+
method: 'POST',
695+
body: JSON.stringify({
696+
fileName: 'doc.pdf',
697+
contentType: 'application/pdf',
698+
fileSize: 4096,
699+
}),
700+
}
701+
)
702+
703+
const response = await POST(request)
704+
expect(response.status).toBe(200)
705+
expect(mockValidateFileType).toHaveBeenCalledWith('doc.pdf', 'application/pdf')
706+
expect(mockValidateAttachmentFileType).not.toHaveBeenCalled()
707+
})
708+
})
709+
521710
describe('OPTIONS', () => {
522711
it('should handle CORS preflight requests', async () => {
523712
const response = await OPTIONS()

‎apps/sim/app/api/files/upload/route.ts‎

Lines changed: 2 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -14,28 +14,15 @@ import { captureServerEvent } from '@/lib/posthog/server'
1414
import type { StorageContext } from '@/lib/uploads/config'
1515
import { generateWorkspaceFileKey } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
1616
import { isImageFileType, resolveFileType } from '@/lib/uploads/utils/file-utils'
17-
import {
18-
SUPPORTED_AUDIO_EXTENSIONS,
19-
SUPPORTED_CODE_EXTENSIONS,
20-
SUPPORTED_DOCUMENT_EXTENSIONS,
21-
SUPPORTED_IMAGE_EXTENSIONS,
22-
SUPPORTED_VIDEO_EXTENSIONS,
23-
validateFileType,
24-
} from '@/lib/uploads/utils/validation'
17+
import { SUPPORTED_ATTACHMENT_EXTENSIONS, validateFileType } from '@/lib/uploads/utils/validation'
2518
import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
2619
import {
2720
createErrorResponse,
2821
createOptionsResponse,
2922
InvalidRequestError,
3023
} from '@/app/api/files/utils'
3124

32-
const ALLOWED_EXTENSIONS = new Set<string>([
33-
...SUPPORTED_DOCUMENT_EXTENSIONS,
34-
...SUPPORTED_CODE_EXTENSIONS,
35-
...SUPPORTED_IMAGE_EXTENSIONS,
36-
...SUPPORTED_AUDIO_EXTENSIONS,
37-
...SUPPORTED_VIDEO_EXTENSIONS,
38-
])
25+
const ALLOWED_EXTENSIONS = new Set<string>(SUPPORTED_ATTACHMENT_EXTENSIONS)
3926

4027
function validateFileExtension(filename: string): boolean {
4128
const extension = filename.split('.').pop()?.toLowerCase()

‎apps/sim/lib/uploads/utils/validation.test.ts‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
import { describe, expect, it } from 'vitest'
2+
import {
3+
SUPPORTED_ATTACHMENT_EXTENSIONS,
4+
validateAttachmentFileType,
5+
} from '@/lib/uploads/utils/validation'
6+
7+
describe('validateAttachmentFileType', () => {
8+
it('accepts image files (png, jpg, gif, webp, svg)', () => {
9+
expect(validateAttachmentFileType('screenshot.png')).toBeNull()
10+
expect(validateAttachmentFileType('photo.jpg')).toBeNull()
11+
expect(validateAttachmentFileType('photo.JPEG')).toBeNull()
12+
expect(validateAttachmentFileType('animation.gif')).toBeNull()
13+
expect(validateAttachmentFileType('image.webp')).toBeNull()
14+
expect(validateAttachmentFileType('icon.svg')).toBeNull()
15+
})
16+
17+
it('accepts video files (mp4, mov, webm)', () => {
18+
expect(validateAttachmentFileType('clip.mp4')).toBeNull()
19+
expect(validateAttachmentFileType('clip.mov')).toBeNull()
20+
expect(validateAttachmentFileType('clip.webm')).toBeNull()
21+
})
22+
23+
it('accepts audio files (mp3, wav, m4a)', () => {
24+
expect(validateAttachmentFileType('voice.mp3')).toBeNull()
25+
expect(validateAttachmentFileType('voice.wav')).toBeNull()
26+
expect(validateAttachmentFileType('voice.m4a')).toBeNull()
27+
})
28+
29+
it('accepts document files (pdf, docx, csv, md)', () => {
30+
expect(validateAttachmentFileType('report.pdf')).toBeNull()
31+
expect(validateAttachmentFileType('letter.docx')).toBeNull()
32+
expect(validateAttachmentFileType('data.csv')).toBeNull()
33+
expect(validateAttachmentFileType('notes.md')).toBeNull()
34+
})
35+
36+
it('accepts code files (ts, py, sh, json)', () => {
37+
expect(validateAttachmentFileType('app.ts')).toBeNull()
38+
expect(validateAttachmentFileType('main.py')).toBeNull()
39+
expect(validateAttachmentFileType('script.sh')).toBeNull()
40+
expect(validateAttachmentFileType('config.json')).toBeNull()
41+
})
42+
43+
it('rejects executables and unknown extensions', () => {
44+
expect(validateAttachmentFileType('virus.exe')?.code).toBe('UNSUPPORTED_FILE_TYPE')
45+
expect(validateAttachmentFileType('installer.msi')?.code).toBe('UNSUPPORTED_FILE_TYPE')
46+
expect(validateAttachmentFileType('archive.dmg')?.code).toBe('UNSUPPORTED_FILE_TYPE')
47+
expect(validateAttachmentFileType('binary.bin')?.code).toBe('UNSUPPORTED_FILE_TYPE')
48+
})
49+
50+
it('rejects files with no extension', () => {
51+
const result = validateAttachmentFileType('README')
52+
expect(result?.code).toBe('UNSUPPORTED_FILE_TYPE')
53+
expect(result?.message).toContain('README')
54+
})
55+
56+
it('rejects files with non-alphanumeric extensions', () => {
57+
expect(validateAttachmentFileType('odd.<>')?.code).toBe('UNSUPPORTED_FILE_TYPE')
58+
expect(validateAttachmentFileType('foo. ')?.code).toBe('UNSUPPORTED_FILE_TYPE')
59+
})
60+
61+
it('does not contain duplicate extensions (e.g. webm)', () => {
62+
const seen = new Set<string>()
63+
for (const ext of SUPPORTED_ATTACHMENT_EXTENSIONS) {
64+
expect(seen.has(ext)).toBe(false)
65+
seen.add(ext)
66+
}
67+
})
68+
69+
it('returns supportedTypes list in error', () => {
70+
const result = validateAttachmentFileType('foo.exe')
71+
expect(result?.supportedTypes).toEqual(expect.arrayContaining(['png', 'pdf', 'mp4', 'mp3']))
72+
})
73+
})

‎apps/sim/lib/uploads/utils/validation.ts‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -219,15 +219,15 @@ export interface FileValidationError {
219219
supportedTypes: string[]
220220
}
221221

222-
export const SUPPORTED_ATTACHMENT_EXTENSIONS = [
223-
...SUPPORTED_DOCUMENT_EXTENSIONS,
224-
...SUPPORTED_CODE_EXTENSIONS,
225-
...SUPPORTED_IMAGE_EXTENSIONS,
226-
...SUPPORTED_AUDIO_EXTENSIONS,
227-
...SUPPORTED_VIDEO_EXTENSIONS,
228-
] as const
229-
230-
export type SupportedAttachmentExtension = (typeof SUPPORTED_ATTACHMENT_EXTENSIONS)[number]
222+
export const SUPPORTED_ATTACHMENT_EXTENSIONS = Array.from(
223+
new Set<string>([
224+
...SUPPORTED_DOCUMENT_EXTENSIONS,
225+
...SUPPORTED_CODE_EXTENSIONS,
226+
...SUPPORTED_IMAGE_EXTENSIONS,
227+
...SUPPORTED_AUDIO_EXTENSIONS,
228+
...SUPPORTED_VIDEO_EXTENSIONS,
229+
])
230+
) as readonly string[]
231231

232232
/**
233233
* Validate that a file's extension is allowed as a chat/mothership attachment.
@@ -239,7 +239,7 @@ export function validateAttachmentFileType(fileName: string): FileValidationErro
239239
const raw = extractExtension(fileName)
240240
const extension = isAlphanumericExtension(raw) ? raw : ''
241241

242-
if (!SUPPORTED_ATTACHMENT_EXTENSIONS.includes(extension as SupportedAttachmentExtension)) {
242+
if (!SUPPORTED_ATTACHMENT_EXTENSIONS.includes(extension)) {
243243
return {
244244
code: 'UNSUPPORTED_FILE_TYPE',
245245
message: `Unsupported file type${extension ? `: ${extension}` : ` for "${fileName}"`}. Supported types include documents, code, images, audio, and video.`,

0 commit comments

Comments
 (0)