fix(project-files): enforce public delivery and share policy safety

Author: mzxchandra

apps/sim/app/api/files/public/[token]/inline/route.ts

@@ -1,5 +1,5 @@
 import { createLogger } from '@sim/logger'
-import { type NextRequest, NextResponse } from 'next/server'
+import type { NextRequest } from 'next/server'
 import { getPublicInlineFileContract } from '@/lib/api/contracts/public-shares'
 import { parseRequest } from '@/lib/api/server'
 import { getClientIp } from '@/lib/core/utils/request'
@@ -33,16 +33,6 @@ export const GET = withRouteHandler(
         credential: await publicFileShareCredential(request.cookies.getAll(), getClientIp(request)),
       })
       if (!auth.authorized) return publicFileAuthDenied(auth)
-      if (request.method === 'HEAD') {
-        return new NextResponse(null, {
-          status: 405,
-          headers: {
-            Allow: 'GET',
-            'Cache-Control': FILE_CACHE_CONTROL.noStore,
-            'X-Content-Type-Options': 'nosniff',
-          },
-        })
-      }
       const result = await readPublicFileShareInline({
         grant: auth.grant,
         ...parsed.data.query,

apps/sim/lib/projects/files/__integration__/content-sharing.integration.ts

@@ -2,7 +2,7 @@ import { mkdtempSync } from 'node:fs'
 import { mkdir, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
-import { db } from '@sim/db'
+import { db, runOutsideTransactionContext } from '@sim/db'
 import {
   folder,
   idempotencyKey,
@@ -17,6 +17,7 @@ import {
   subscription,
   user,
   workspace,
+  workspaceFileSecretProvenance,
   workspaceFiles,
 } from '@sim/db/schema'
 import { deleteWorkspaceFixture, insertWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
@@ -38,6 +39,7 @@ import {
   createProjectFile,
   updateProjectFileContent,
 } from '@/lib/projects/files/application/content'
+import * as shareManager from '@/lib/public-shares/manager'
 import * as storage from '@/lib/uploads/core/storage-service'
 
 vi.mock('@/lib/core/config/feature-flags', () => featureFlagsMock)
@@ -139,6 +141,84 @@ function createInput(projectId: string, content = 'Project architecture') {
 }
 
 describe('Public file shares against PostgreSQL and private storage', () => {
+  check(
+    'public delivery rejects unknown and secret-bearing provenance before storage',
+    async () => {
+      const { updateProjectFileShare } = await import('@/lib/projects/files/application/shares')
+      const { authorizePublicFileShare, readPublicFileShareContent } = await import(
+        '@/lib/public-shares/application'
+      )
+      const f = await fixture()
+      for (const secretProvenance of [
+        { status: 'unknown' as const },
+        {
+          status: 'exact' as const,
+          entries: [{ encryptedValue: 'private-fixture', sourceUserId: f.editorId }],
+        },
+      ]) {
+        const { file } = await createProjectFile.execute({
+          principal: f.principal,
+          input: {
+            ...createInput(f.projectId),
+            name: `${generateId()}.md`,
+            secretProvenance,
+          },
+        })
+        const { share } = await updateProjectFileShare.execute({
+          principal: f.principal,
+          input: {
+            projectId: f.projectId,
+            fileId: file.id,
+            isActive: true,
+          },
+        })
+        const access = await authorizePublicFileShare({
+          token: share.token,
+          credential: { method: 'GET' },
+        })
+        if (!access.authorized) throw new Error('Public fixture rejected')
+        const download = vi.spyOn(storage, 'downloadFile')
+        await expect(readPublicFileShareContent({ grant: access.grant })).rejects.toMatchObject({
+          code: 'forbidden',
+        })
+        expect(download).not.toHaveBeenCalled()
+        download.mockRestore()
+      }
+    }
+  )
+
+  check('non-SSO shares do not consult an unavailable session service', async () => {
+    const { updateProjectFileShare } = await import('@/lib/projects/files/application/shares')
+    const { authorizePublicFileShare } = await import('@/lib/public-shares/application')
+    const f = await fixture()
+    const { file } = await createProjectFile.execute({
+      principal: f.principal,
+      input: createInput(f.projectId),
+    })
+    const resolveSessionPrincipal = vi
+      .fn()
+      .mockRejectedValue(new Error('Session service unavailable'))
+    for (const authType of ['public', 'password', 'email'] as const) {
+      const { share } = await updateProjectFileShare.execute({
+        principal: f.principal,
+        input: {
+          projectId: f.projectId,
+          fileId: file.id,
+          isActive: true,
+          authType,
+          password: 'fixture-password',
+          allowedEmails: ['reader@shared.invalid'],
+        },
+      })
+      const result = await authorizePublicFileShare({
+        token: share.token,
+        credential: { method: 'GET', resolveSessionPrincipal },
+      })
+      expect(result.authorized).toBe(authType === 'public')
+    }
+    expect(resolveSessionPrincipal).not.toHaveBeenCalled()
+  })
+
   check(
     'public share configuration requires Project write and the canonical organization sharing policy',
     async () => {
@@ -274,6 +354,21 @@ describe('Public file shares against PostgreSQL and private storage', () => {
           input: { ...input, authType: 'password', password: 'a-valid-share-password' },
         })
         expect(allowed.share.authType).toBe('password')
+        const upsert = shareManager.upsertOwnedFileShare
+        const interleave = vi
+          .spyOn(shareManager, 'upsertOwnedFileShare')
+          .mockImplementationOnce(async (...args) => {
+            await runOutsideTransactionContext(() =>
+              db
+                .update(publicShare)
+                .set({ authType: 'public', isActive: false })
+                .where(eq(publicShare.id, allowed.share.id))
+            )
+            return upsert(...args)
+          })
+        const reenabled = await updateProjectFileShare.execute({ principal: f.principal, input })
+        expect(reenabled.share).toMatchObject({ authType: 'password', isActive: true })
+        interleave.mockRestore()
       } finally {
         await deleteWorkspaceFixture(db, eq(workspace.id, secondId))
       }
@@ -467,6 +562,17 @@ describe('Public file shares against PostgreSQL and private storage', () => {
         await requestPublicFileShareOtp({ token: share.token, email: 'outsider@shared.invalid' })
       ).deliver()
       expect(await otpStore.getOTP('file', share.id, 'outsider@shared.invalid')).toBeNull()
+      const failure = { authorized: false, status: 400, error: 'Invalid verification code' }
+      expect(
+        await verifyPublicFileShareOtp({
+          token: share.token,
+          email: 'outsider@shared.invalid',
+          otp: '000000',
+        })
+      ).toEqual(failure)
+      expect(await verifyPublicFileShareOtp({ token: share.token, email, otp: '000000' })).toEqual(
+        failure
+      )
       await (await requestPublicFileShareOtp({ token: share.token, email })).deliver()
       const stored = await otpStore.getOTP('file', share.id, email)
       if (!stored) throw new Error('Allowed email received no code')
@@ -613,7 +719,7 @@ describe('Public file shares against PostgreSQL and private storage', () => {
         '@/lib/public-shares/application'
       )
       const { encryptSecret } = await import('@/lib/core/security/encryption')
-      for (const change of ['disabled', 'password', 'archived'] as const) {
+      for (const change of ['disabled', 'password', 'archived', 'provenance'] as const) {
         const f = await fixture()
         const { file } = await createProjectFile.execute({
           principal: f.principal,
@@ -648,6 +754,11 @@ describe('Public file shares against PostgreSQL and private storage', () => {
                 .update(publicShare)
                 .set({ password: (await encryptSecret('replacement-password')).encrypted })
                 .where(eq(publicShare.id, share.id))
+            if (change === 'provenance')
+              await db
+                .update(workspaceFileSecretProvenance)
+                .set({ status: 'unknown' })
+                .where(eq(workspaceFileSecretProvenance.fileId, file.id))
             if (change === 'archived')
               await db
                 .update(workspaceFiles)
@@ -657,7 +768,7 @@ describe('Public file shares against PostgreSQL and private storage', () => {
           return result
         })
         await expect(readPublicFileShareContent({ grant: access.grant })).rejects.toMatchObject({
-          code: 'not_found',
+          code: change === 'provenance' ? 'forbidden' : 'not_found',
         })
         spy.mockRestore()
       }

apps/sim/lib/projects/files/application/shares.ts

@@ -117,6 +117,7 @@ export const updateProjectFileShare = defineAuthorizedProjectFileUseCase<
       return {
         share: await upsertOwnedFileShare(tx, context.owner, {
           ...input,
+          authType: effectiveAuthType,
           userId: requirePrincipalSubjectUserId(principal),
         }),
       }

apps/sim/lib/public-shares/api/credentials.ts

@@ -6,17 +6,19 @@ export async function publicFileShareCredential(
   cookies: readonly { name: string; value: string }[],
   clientIp?: string | null
 ) {
-  const session = await getSession()
-  let sessionPrincipal: SessionPrincipal | undefined
-  if (session?.user?.id) {
-    const sessionId = session.session?.id
-    if (!sessionId) throw new Error('Authenticated session is missing its session ID')
-    sessionPrincipal = { kind: 'session', userId: session.user.id, sessionId }
-  }
   return {
     method: 'GET' as const,
     cookies: Object.fromEntries(cookies.map(({ name, value }) => [name, value])),
-    sessionPrincipal,
+    async resolveSessionPrincipal() {
+      const session = await getSession()
+      let sessionPrincipal: SessionPrincipal | undefined
+      if (session?.user?.id) {
+        const sessionId = session.session?.id
+        if (!sessionId) throw new Error('Authenticated session is missing its session ID')
+        sessionPrincipal = { kind: 'session', userId: session.user.id, sessionId }
+      }
+      return sessionPrincipal
+    },
     clientIp,
   }
 }

apps/sim/lib/public-shares/application/authorization.ts

@@ -28,6 +28,7 @@ interface PublicFileCredential {
   password?: string
   email?: string
   cookies?: Readonly<Record<string, string>>
+  resolveSessionPrincipal?: () => Promise<Principal | undefined>
   sessionPrincipal?: Principal
   clientIp?: string | null
 }
@@ -151,14 +152,16 @@ export async function authorizePublicFileShare({
 > {
   try {
     if (!/^[A-Za-z0-9_-]{16,64}$/.test(token)) unavailable()
-    const initial = await db.transaction(async (tx) => {
-      const snapshot = await loadSnapshot(tx, token)
-      const session =
-        snapshot.share.authType === 'sso' && credential.sessionPrincipal?.kind === 'session'
-          ? await loadSession(tx, credential.sessionPrincipal.userId)
-          : undefined
-      return { snapshot, session }
-    })
+    const snapshot = await db.transaction((tx) => loadSnapshot(tx, token))
+    const principal =
+      snapshot.share.authType === 'sso'
+        ? (credential.sessionPrincipal ?? (await credential.resolveSessionPrincipal?.()))
+        : undefined
+    const session =
+      principal?.kind === 'session'
+        ? await db.transaction((tx) => loadSession(tx, principal.userId))
+        : undefined
+    const initial = { snapshot, session }
     const result = await validateDeploymentCredentials(
       generateShortId(),
       initial.snapshot.share,

apps/sim/lib/public-shares/application/credentials.ts

@@ -28,7 +28,7 @@ const SSO_RESOURCE_RATE_LIMIT: TokenBucketConfig = {
   refillRate: 100,
   refillIntervalMs: 15 * 60_000,
 }
-const OTP_LOCKED_MESSAGE = 'Too many failed attempts. Please request a new code.'
+const OTP_FAILURE = { authorized: false as const, error: 'Invalid verification code', status: 400 }
 
 /** Exchanges a verified password for a cookie bound to the share's current password slot. */
 export async function authenticatePublicFileSharePassword({
@@ -113,27 +113,18 @@ export async function verifyPublicFileShareOtp({
   const allowed = await challenge.withCurrentPolicy(({ share }) =>
     isEmailAllowed(normalizedEmail, share.allowedEmails)
   )
-  if (!allowed) return { authorized: false as const, error: 'Email not authorized', status: 403 }
+  if (!allowed) return OTP_FAILURE
   const value = await getOTP('file', challenge.shareId, normalizedEmail)
   await challenge.withCurrentPolicy(() => undefined)
-  if (!value)
-    return {
-      authorized: false as const,
-      error: 'No verification code found, request a new one',
-      status: 400,
-    }
+  if (!value) return OTP_FAILURE
   const stored = decodeOTPValue(value)
   if (stored.attempts >= MAX_OTP_ATTEMPTS) {
     await deleteOTP('file', challenge.shareId, normalizedEmail)
-    return { authorized: false as const, error: OTP_LOCKED_MESSAGE, status: 429 }
+    return OTP_FAILURE
   }
   if (!safeCompare(stored.otp, otp)) {
-    const result = await incrementOTPAttempts('file', challenge.shareId, normalizedEmail, value)
-    return {
-      authorized: false as const,
-      error: result === 'locked' ? OTP_LOCKED_MESSAGE : 'Invalid verification code',
-      status: result === 'locked' ? 429 : 400,
-    }
+    await incrementOTPAttempts('file', challenge.shareId, normalizedEmail, value)
+    return OTP_FAILURE
   }
   await deleteOTP('file', challenge.shareId, normalizedEmail)
   const resource = await challenge.withCurrentPolicy(({ share }) => share)

apps/sim/lib/public-shares/application/owner-adapters.ts

@@ -2,7 +2,7 @@ import { project, type WorkspaceFileRow, workspace } from '@sim/db/schema'
 import { eq } from 'drizzle-orm'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import type { DbTransaction } from '@/lib/db/types'
-import { lockProject, lockWorkspaceProject } from '@/lib/projects/membership'
+import { lockProjectShared, lockWorkspaceProject } from '@/lib/projects/membership'
 import { requireProjectApiEnabled } from '@/lib/projects/rollout.server'
 import {
   type E2BDocFormat,
@@ -70,7 +70,7 @@ const adapters: FileOwnerAdapters<PublicFileOwnerAdapter> = {
   project: {
     async load(tx, entityId) {
       await requireProjectApiEnabled()
-      await lockProject(tx, entityId)
+      await lockProjectShared(tx, entityId)
       const [row] = await tx.select().from(project).where(eq(project.id, entityId)).for('share')
       if (!row || row.archivedAt) throw new OrchestrationError('not_found', 'File share not found')
       return {