fix(uploads): add Zod contracts for workspace presigned/register routes

Author: waleedlatif1

apps/sim/app/api/workspaces/[id]/files/presigned/route.ts

@@ -1,5 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
+import { workspacePresignedUploadContract } from '@/lib/api/contracts/workspace-files'
+import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { checkStorageQuota } from '@/lib/billing/storage'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -11,51 +13,32 @@ import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('WorkspacePresignedAPI')
 
-interface WorkspacePresignedRequest {
-  fileName: string
-  contentType: string
-  fileSize: number
-}
-
 /**
  * POST /api/workspaces/[id]/files/presigned
  * Returns a presigned PUT URL for a workspace-scoped object key. The client
  * uploads the bytes directly to S3/Blob, then calls /files/register to
  * insert metadata.
  */
 export const POST = withRouteHandler(
-  async (request: NextRequest, { params }: { params: Promise<{ id: string }> }) => {
-    const { id: workspaceId } = await params
-
+  async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
     const session = await getSession()
     if (!session?.user?.id) {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
     }
     const userId = session.user.id
 
+    const parsed = await parseRequest(workspacePresignedUploadContract, request, context)
+    if (!parsed.success) return parsed.response
+    const { params, body } = parsed.data
+    const workspaceId = params.id
+    const { fileName, contentType, fileSize } = body
+
     const permission = await getUserEntityPermissions(userId, 'workspace', workspaceId)
     if (permission !== 'admin' && permission !== 'write') {
       logger.warn(`User ${userId} lacks write permission for ${workspaceId}`)
       return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
     }
 
-    let body: WorkspacePresignedRequest
-    try {
-      body = (await request.json()) as WorkspacePresignedRequest
-    } catch {
-      return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })
-    }
-
-    const { fileName, contentType, fileSize } = body
-    if (!fileName?.trim()) {
-      return NextResponse.json({ error: 'fileName is required' }, { status: 400 })
-    }
-    if (!contentType?.trim()) {
-      return NextResponse.json({ error: 'contentType is required' }, { status: 400 })
-    }
-    if (typeof fileSize !== 'number' || !Number.isFinite(fileSize) || fileSize < 0) {
-      return NextResponse.json({ error: 'fileSize must be a non-negative number' }, { status: 400 })
-    }
     if (fileSize > MAX_WORKSPACE_FILE_SIZE) {
       return NextResponse.json(
         { error: `File size exceeds maximum of ${MAX_WORKSPACE_FILE_SIZE} bytes` },

apps/sim/app/api/workspaces/[id]/files/register/route.ts

@@ -1,6 +1,8 @@
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
+import { registerWorkspaceFileContract } from '@/lib/api/contracts/workspace-files'
+import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { captureServerEvent } from '@/lib/posthog/server'
@@ -13,56 +15,32 @@ import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('WorkspaceRegisterAPI')
 
-interface RegisterRequestBody {
-  key: string
-  name: string
-  size: number
-  contentType: string
-}
-
 /**
  * POST /api/workspaces/[id]/files/register
  * Finalize a direct-to-storage upload by inserting metadata, updating quota,
  * and recording an audit log. Validates the storage key belongs to the
  * caller's workspace to prevent cross-tenant key smuggling.
  */
 export const POST = withRouteHandler(
-  async (request: NextRequest, { params }: { params: Promise<{ id: string }> }) => {
-    const { id: workspaceId } = await params
-
+  async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
     const session = await getSession()
     if (!session?.user?.id) {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
     }
     const userId = session.user.id
 
+    const parsed = await parseRequest(registerWorkspaceFileContract, request, context)
+    if (!parsed.success) return parsed.response
+    const { params, body } = parsed.data
+    const workspaceId = params.id
+    const { key, name, size, contentType } = body
+
     const permission = await getUserEntityPermissions(userId, 'workspace', workspaceId)
     if (permission !== 'admin' && permission !== 'write') {
       logger.warn(`User ${userId} lacks write permission for ${workspaceId}`)
       return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
     }
 
-    let body: RegisterRequestBody
-    try {
-      body = (await request.json()) as RegisterRequestBody
-    } catch {
-      return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })
-    }
-
-    const { key, name, size, contentType } = body
-    if (!key?.trim()) {
-      return NextResponse.json({ error: 'key is required' }, { status: 400 })
-    }
-    if (!name?.trim()) {
-      return NextResponse.json({ error: 'name is required' }, { status: 400 })
-    }
-    if (typeof size !== 'number' || !Number.isFinite(size) || size < 0) {
-      return NextResponse.json({ error: 'size must be a non-negative number' }, { status: 400 })
-    }
-    if (!contentType?.trim()) {
-      return NextResponse.json({ error: 'contentType is required' }, { status: 400 })
-    }
-
     if (parseWorkspaceFileKey(key) !== workspaceId) {
       logger.warn(`Key ${key} does not belong to workspace ${workspaceId}`)
       return NextResponse.json(

apps/sim/app/workspace/[workspaceId]/knowledge/hooks/use-knowledge-upload.ts

@@ -353,6 +353,7 @@ export function useKnowledgeUpload(options: UseKnowledgeUploadOptions = {}) {
 
       setUploadProgress((prev) => ({ ...prev, stage: 'processing' }))
 
+      // boundary-raw-fetch: bulk document-processing kickoff with dynamic recipe payload; response is consumed alongside the upload progress lifecycle and not modeled by a single contract
       const processResponse = await fetch(`/api/knowledge/${knowledgeBaseId}/documents`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },

apps/sim/hooks/queries/workspace-files.ts

@@ -7,6 +7,7 @@ import { getUsageLimitsContract } from '@/lib/api/contracts/usage-limits'
 import {
   deleteWorkspaceFileContract,
   listWorkspaceFilesContract,
+  registerWorkspaceFileContract,
   renameWorkspaceFileContract,
   restoreWorkspaceFileContract,
   updateWorkspaceFileContentContract,
@@ -217,6 +218,7 @@ async function uploadViaApiFallback(
   const formData = new FormData()
   formData.append('file', file)
 
+  // boundary-raw-fetch: multipart/form-data fallback upload, requestJson only supports JSON bodies
   const response = await fetch(`/api/workspaces/${workspaceId}/files`, {
     method: 'POST',
     body: formData,
@@ -264,19 +266,21 @@ async function uploadWorkspaceFile(
     throw error
   }
 
-  const registerResponse = await fetch(`/api/workspaces/${workspaceId}/files/register`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({
+  const data = await requestJson(registerWorkspaceFileContract, {
+    params: { id: workspaceId },
+    body: {
       key: result.key,
       name: result.name,
       size: result.size,
       contentType: result.contentType,
-    }),
+    },
     signal,
   })
 
-  return parseUploadResponse(registerResponse, 'Failed to register file')
+  if (!data.success || !data.file) {
+    throw new Error(data.error || 'Failed to register file')
+  }
+  return { success: true, file: data.file }
 }
 
 export function useUploadWorkspaceFile() {

apps/sim/lib/api/contracts/workspace-files.ts

@@ -143,3 +143,67 @@ export const workspaceFileCompiledCheckContract = defineRouteContract({
     schema: compiledCheckResponseSchema,
   },
 })
+
+export const workspacePresignedUploadBodySchema = z.object({
+  fileName: z.string().min(1, 'fileName is required'),
+  contentType: z.string().min(1, 'contentType is required'),
+  fileSize: z.number().nonnegative('fileSize must be a non-negative number'),
+})
+
+export type WorkspacePresignedUploadBody = z.input<typeof workspacePresignedUploadBodySchema>
+
+const workspacePresignedFileInfoSchema = z.object({
+  path: z.string(),
+  key: z.string(),
+  name: z.string(),
+  size: z.number(),
+  type: z.string(),
+})
+
+const workspacePresignedUploadResponseSchema = z.object({
+  fileName: z.string(),
+  presignedUrl: z.string(),
+  fileInfo: workspacePresignedFileInfoSchema,
+  uploadHeaders: z.record(z.string(), z.string()).optional(),
+  directUploadSupported: z.boolean(),
+})
+
+export const workspacePresignedUploadContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/workspaces/[id]/files/presigned',
+  params: workspaceFilesParamsSchema,
+  body: workspacePresignedUploadBodySchema,
+  response: {
+    mode: 'json',
+    schema: workspacePresignedUploadResponseSchema,
+  },
+})
+
+export const registerWorkspaceFileBodySchema = z.object({
+  key: z.string().min(1, 'key is required'),
+  name: z.string().min(1, 'name is required'),
+  size: z.number().nonnegative('size must be a non-negative number'),
+  contentType: z.string().min(1, 'contentType is required'),
+})
+
+export type RegisterWorkspaceFileBody = z.input<typeof registerWorkspaceFileBodySchema>
+
+const registerWorkspaceFileResponseSchema = z.object({
+  success: z.boolean(),
+  file: workspaceFileRecordSchema.optional(),
+  error: z.string().optional(),
+  isDuplicate: z.boolean().optional(),
+})
+
+export type RegisterWorkspaceFileResponse = z.output<typeof registerWorkspaceFileResponseSchema>
+
+export const registerWorkspaceFileContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/workspaces/[id]/files/register',
+  params: workspaceFilesParamsSchema,
+  body: registerWorkspaceFileBodySchema,
+  response: {
+    mode: 'json',
+    schema: registerWorkspaceFileResponseSchema,
+  },
+})

apps/sim/lib/uploads/client/direct-upload.ts

@@ -300,6 +300,7 @@ const uploadViaMultipart = async (
 ): Promise<{ key: string; path: string }> => {
   const { file, workspaceId, context, signal, onProgress } = opts
 
+  // boundary-raw-fetch: multipart upload control plane uses action query strings; client lifecycle (initiate/get-part-urls/complete/abort) is sequenced manually and not modeled by a single contract
   const initiateResponse = await fetch('/api/files/multipart?action=initiate', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
@@ -346,6 +347,7 @@ const uploadViaMultipart = async (
 
   const abortMultipart = async () => {
     try {
+      // boundary-raw-fetch: fire-and-forget abort during multipart cleanup; intentionally avoids contract response parsing so cleanup cannot mask the original error
       await fetch('/api/files/multipart?action=abort', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
@@ -356,6 +358,7 @@ const uploadViaMultipart = async (
     }
   }
 
+  // boundary-raw-fetch: multipart upload control plane uses action query strings; sequenced with initiate/complete/abort outside the contract layer
   const partUrlsResponse = await fetch('/api/files/multipart?action=get-part-urls', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
@@ -443,6 +446,7 @@ const uploadViaMultipart = async (
     throw error
   }
 
+  // boundary-raw-fetch: multipart upload control plane uses action query strings; sequenced with initiate/get-part-urls/abort outside the contract layer
   const completeResponse = await fetch('/api/files/multipart?action=complete', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },

scripts/check-api-validation-contracts.ts

@@ -9,8 +9,8 @@ const QUERY_HOOKS_DIR = path.join(ROOT, 'apps/sim/hooks/queries')
 const SELECTOR_HOOKS_DIR = path.join(ROOT, 'apps/sim/hooks/selectors')
 
 const BASELINE = {
-  totalRoutes: 718,
-  zodRoutes: 718,
+  totalRoutes: 720,
+  zodRoutes: 720,
   nonZodRoutes: 0,
 } as const