feat(project-files): add public sharing and protected delivery

[mzxchandra]

Summary

• Add Project file share management and shared bearer authorization for workspace and Project public delivery.
• Revalidate current share credentials, canonical ownership, file revisions, and referenced assets before returning bytes. Reuse the renderer-qualified compiled-document cache without compiling on public reads.
• Final backend slice of feat(files): add the Project file backend and APIs #8610, rebased onto staging after feat(project-files): add cross-owner copy and bulk transfers #9018. Project public API/CLI docs remain unpublished; runtime commands are available. Product integration continues in feat(files): Project file browser and Mothership integration #9034.

Type of Change

• Feature / refactor

Testing

• 20 focused security unit tests and 10 disposable PostgreSQL sharing checks passed.
• Scoped TypeScript and changed-file formatting checks passed; cleanup review found no changes needed.
• 34 local HTTP/source-adapter checks passed: public delivery and credentials (22), sharing policy (7), and inline isolation/cache behavior (5). Hosted CI and bot reviews pending.
• Pre-deploy synthetic public/disabled share fixtures prepared; post-promotion verification pending. Projects remains disabled on shared staging.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Focused tests added/updated and passing
• Full hosted CI passed
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 15, 2026 4:02am UTC

[mzxchandra]

@greptile

[mzxchandra]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 52 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[High impact] The changes since the last review appear safe to merge.

Summary

Adds Project file sharing and a shared authorization path for public file delivery.

• Project files can be shared and unshared through the APIs and CLI.
• Share links ask for the access proof their owner selected.
• Shared files deliver current owner-scoped bytes and embedded images.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Public file request] --> B[Check current share credentials]
  B --> C[Create short-lived grant]
  C --> D[Check owner and file]
  D --> E[Read stored bytes or cached document]
  E --> F[Recheck share, file, and referenced assets]
  F --> G[Return bytes]

Loading

_{Reviews (3) · Last reviewed commit: "test(project-files): explicitly retire f..." · Reviewed by Greptile}

[mzxchandra]

@greptile

[mzxchandra]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

1 issue found across 52 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/lib/projects/files/__integration__/content-sharing.integration.ts">

<violation number="1" location="apps/sim/lib/projects/files/__integration__/content-sharing.integration.ts:930">
P2: Project-bound shares have no foreign key to the Project or file, so this teardown leaves their active rows behind. Delete the Project's `publicShare` rows here to keep the integration database clean.</violation>
</file>

[cubic-dev-ai]

All reported issues were addressed across 52 files

_{Turn on auto-fix | Re-trigger cubic}

[mzxchandra]

Post-deploy staging verification passed for the five preserved workspace-share fixtures on October 14 (Pacific), with Projects disabled. Verified HTTPS traffic cutover and running-image correspondence to merge 02cd2f6206bb9af8d8b95e983de5dab9718e09c8. Share identity/protection and stored-content continuity passed; public revocation/re-enable, protected anonymous denials, valid password-cookie access, cross-share denial, and revoked-cookie denial passed. Fixture modes were restored and fixtures retained; the synthetic password was rotated and discarded.

Not covered: successful email/SSO login, old-cookie continuity, native browser interaction, Office/raster artifacts, rate-limit exhaustion, Project-enabled paths, or production. The exact predeployment serving SHA was not established.