fix(mothership): fix mothership file uploads

[Sg312]

Summary

Fixes mothership file uploads

Type of Change

• Bug fix

Testing

How has this been tested? What should reviewers focus on?

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Mar 17, 2026 11:11pm

[greptile-apps]

Greptile Summary

This PR fixes two bugs in the mothership file upload flow: (1) corrects the previewUrl serve-context query parameter from ?context=copilot to ?context=mothership so that the authorization layer dispatches to the correct handler, and (2) changes trackChatUpload from always inserting a duplicate workspaceFiles record to first attempting to update the existing record that was created by the presigned-upload step, falling back to an insert only when no record is found.

Key changes:

• use-chat.ts: ?context=copilot → ?context=mothership in toDisplayAttachment — necessary for verifyFileAccess to route mothership files through verifyWorkspaceFileAccess instead of verifyCopilotFileAccess.
• workspace-file-manager.ts: trackChatUpload now issues an UPDATE … RETURNING before falling back to INSERT, preventing duplicate rows for the same S3 key.
• The UPDATE WHERE clause omits a workspaceId filter, which is a minor gap compared to the rest of the file's patterns.
• Mutating the record's context to 'mothership' causes verifyWorkspaceFileAccess to miss it in its DB lookup path (which only queries context='workspace'). In cloud environments authorization falls back to object-storage metadata and succeeds; in local-storage environments this fallback may not carry workspaceId, potentially causing authorization failures.

Confidence Score: 3/5

• Safe to merge for cloud deployments; may cause authorization regressions in local-storage environments.
• The use-chat.ts fix is clearly correct. The trackChatUpload upsert logic is correct in concept, but the context mutation from 'workspace' to 'mothership' breaks the DB-lookup path inside verifyWorkspaceFileAccess for local storage, and the UPDATE is missing a workspaceId scope guard.
• apps/sim/lib/uploads/contexts/workspace/workspace-file-manager.ts — the UPDATE query and authorization implications of the context change.

Important Files Changed

Filename	Overview
apps/sim/lib/uploads/contexts/workspace/workspace-file-manager.ts	Adds an upsert pattern to trackChatUpload — updates the existing workspace-context record to mothership instead of always inserting a duplicate. The UPDATE WHERE clause is missing a workspaceId filter, and mutating the context from 'workspace' to 'mothership' breaks the authorization DB-lookup path in local-storage environments.
apps/sim/app/workspace/[workspaceId]/home/hooks/use-chat.ts	Single-line fix: corrects the previewUrl context query parameter from ?context=copilot to ?context=mothership so that the file-serve route calls verifyWorkspaceFileAccess (which handles mothership) instead of verifyCopilotFileAccess.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Client uploads file via upload API] --> B[Storage service creates workspaceFiles record with context=workspace]
    B --> C[trackChatUpload is called]
    C --> D{Existing record for key?}
    D -- Yes --> E[UPDATE record: set chatId and context=mothership]
    D -- No --> F[INSERT new record with context=mothership]
    E --> G[Client requests file preview]
    F --> G
    G --> H[serve route receives context=mothership]
    H --> I[verifyWorkspaceFileAccess called]
    I --> J{DB lookup for context=workspace}
    J -- Found --> K[Access granted via DB]
    J -- Not found, record is now context=mothership --> L{Cloud storage metadata lookup}
    L -- Has workspaceId --> M[Access granted via metadata]
    L -- No workspaceId local storage --> N[Access DENIED - 404]

Loading

_{Last reviewed commit: "Fix"}