fix(files): fence render names and separate compiler caches

Author: mzxchandra

apps/sim/lib/projects/files/__integration__/content-rendered.integration.ts

@@ -46,7 +46,7 @@ import { searchProjectFileContent } from '@/lib/projects/files/application/searc
 import { revertProjectFileVersion } from '@/lib/projects/files/application/versions'
 import * as storageCleanup from '@/lib/uploads/contexts/workspace/file-storage-cleanup-outbox'
 import * as storage from '@/lib/uploads/core/storage-service'
-import { storeCompiledDoc } from '@/lib/uploads/documents/compiled-store'
+import { compileFileDocument } from '@/lib/uploads/documents/compile'
 import * as heic from '@/lib/uploads/server/heic'
 import { observeWorkspaceFileDelivery } from '@/lib/workspace-files/application/file-delivery-observer'
 import * as searchDelivery from '@/lib/workspace-files/search/delivery'
@@ -705,6 +705,33 @@ describe('Project rendered artifacts against PostgreSQL and private storage', ()
     }
   )
 
+  check('a source renamed during rendering is refused', async () => {
+    const { readProjectFileArtifact } = await import('@/lib/projects/files/application/artifacts')
+    const { renameProjectFile } = await import('@/lib/projects/files/application/lifecycle')
+    const f = await fixture()
+    const source = await createProjectFile.execute({
+      principal: f.principal,
+      input: {
+        ...createInput(f.projectId, 'const title = "test"'),
+        name: 'before.pptx',
+        contentType: 'text/x-pptxgenjs',
+      },
+    })
+    vi.spyOn(sandboxTask, 'runSandboxTask').mockImplementation(async () => {
+      await renameProjectFile.execute({
+        principal: f.principal,
+        input: { projectId: f.projectId, fileId: source.file.id, name: 'after.docx' },
+      })
+      return Buffer.from('PK\u0003\u0004document')
+    })
+    await expect(
+      readProjectFileArtifact.execute({
+        principal: f.principal,
+        input: { projectId: f.projectId, fileId: source.file.id, maxBytes: 1_000_000 },
+      })
+    ).rejects.toMatchObject({ code: 'conflict' })
+  })
+
   check(
     'an asset changed during render cannot be delivered with stale provenance or source identity',
     async () => {
@@ -780,13 +807,15 @@ describe('Project rendered artifacts against PostgreSQL and private storage', ()
           },
         })
         const artifact = Buffer.from(`PK\u0003\u0004${marker}`)
-        await storeCompiledDoc(
-          { entityType: 'project', entityId: f.projectId },
+        vi.spyOn(sandboxTask, 'runSandboxTask').mockResolvedValue(artifact)
+        await compileFileDocument({
+          owner: { entityType: 'project', entityId: f.projectId },
           source,
-          'pptx',
-          mime,
-          artifact
-        )
+          sourceMime: 'text/x-pptxgenjs',
+          fileName: 'architecture.pptx',
+          inputs: [],
+          maxBytes: 1_000_000,
+        })
         prepared.push({ f, created, artifact })
       }
       for (const { f, created, artifact } of prepared) {

apps/sim/lib/projects/files/application/artifacts.ts

@@ -85,6 +85,8 @@ function requireSameRevision(current: WorkspaceFileRow | undefined, expected: Wo
   if (
     !current ||
     current.key !== expected.key ||
+    current.originalName !== expected.originalName ||
+    current.contentType !== expected.contentType ||
     current.contentUpdatedAt.getTime() !== expected.contentUpdatedAt.getTime()
   ) {
     throw new OrchestrationError('conflict', 'A document source or input changed during rendering')

apps/sim/lib/uploads/documents/compile.test.ts

@@ -421,3 +421,25 @@ describe('compileFileDocument source engine', () => {
     expect(executeInSandboxMock).not.toHaveBeenCalled()
   })
 })
+
+it('separates cached PDF artifacts by effective source dialect', async () => {
+  setEnvFlags({ isDocSandboxEnabled: true })
+  const identities: string[] = []
+  loadCompiledDocMock.mockImplementation(async (_owner, _source, _ext, identity) => {
+    identities.push(identity)
+    return Buffer.from(identity.includes('javascript') ? '%PDF-JS' : '%PDF-Python')
+  })
+  const input = {
+    owner: { entityType: 'project' as const, entityId: ID },
+    source: 'shared source',
+    fileName: 'report.pdf',
+    inputs: [],
+    maxBytes: 1024,
+  }
+  const js = await compileFileDocument({ ...input, sourceMime: 'text/x-pdflibjs' })
+  const python = await compileFileDocument({ ...input, sourceMime: 'text/x-python' })
+  expect(js.buffer.toString()).toBe('%PDF-JS')
+  expect(python.buffer.toString()).toBe('%PDF-Python')
+  expect(js.artifactKey).not.toBe(python.artifactKey)
+  expect(identities[0]).not.toBe(identities[1])
+})

apps/sim/lib/uploads/documents/compile.ts

@@ -640,19 +640,25 @@ export async function compileFileDocument(args: {
   ) {
     throw new DocCompileUserError('Document inputs exceed the rendering limit')
   }
-  const cached = await loadCompiledDoc(args.owner, args.source, fmt.ext, args.inputIdentity, {
+  const useDocumentSandbox = isDocSandboxEnabled && args.sourceMime !== 'text/x-pdflibjs'
+  const cacheIdentity = JSON.stringify({
+    sourceLanguage: getDocumentSourceLanguage(args.source, fmt, args.sourceMime),
+    renderer: useDocumentSandbox ? 'document-sandbox' : 'native',
+    inputs: args.inputIdentity ?? null,
+  })
+  const cached = await loadCompiledDoc(args.owner, args.source, fmt.ext, cacheIdentity, {
     maxBytes: args.maxBytes,
     signal: args.signal,
   })
   if (cached)
     return {
       buffer: cached,
-      artifactKey: compiledArtifactKey(args.owner, args.source, fmt.ext, args.inputIdentity),
+      artifactKey: compiledArtifactKey(args.owner, args.source, fmt.ext, cacheIdentity),
       contentType: fmt.contentType,
       dependsOnReferencedFiles: args.inputs.length > 0,
     }
   let buffer: Buffer
-  if (isDocSandboxEnabled && args.sourceMime !== 'text/x-pdflibjs') {
+  if (useDocumentSandbox) {
     buffer = await renderPreparedDocument(
       args.source,
       fmt,
@@ -684,17 +690,10 @@ export async function compileFileDocument(args: {
     )
   }
   assertKnownSizeWithinLimit(buffer.length, args.maxBytes, 'compiled document')
-  await storeCompiledDoc(
-    args.owner,
-    args.source,
-    fmt.ext,
-    fmt.contentType,
-    buffer,
-    args.inputIdentity
-  )
+  await storeCompiledDoc(args.owner, args.source, fmt.ext, fmt.contentType, buffer, cacheIdentity)
   return {
     buffer,
-    artifactKey: compiledArtifactKey(args.owner, args.source, fmt.ext, args.inputIdentity),
+    artifactKey: compiledArtifactKey(args.owner, args.source, fmt.ext, cacheIdentity),
     contentType: fmt.contentType,
     dependsOnReferencedFiles: args.inputs.length > 0,
   }