improvement(files): sniff generated images once and refuse foreign delegations with 403

Generated images are now content-sniffed before they are stored, so every
output field references the same verified object on both the workflow and
chat paths; skipping the re-upload had otherwise skipped the sniff it did.
A delegation minted for another workspace is no longer rebound (which
threw and surfaced a 500); the workspace-file use cases refuse it with
their ordinary 403. The regression test now uses the shared principal
factory and uploads mock.

Author: waleedlatif1

apps/sim/lib/internal/file/delegated-caller-write.integration.ts

@@ -13,16 +13,13 @@ import type { SubjectDelegatedPrincipal } from '@sim/auth/principal'
 import { db } from '@sim/db'
 import { auditLog, organization, user, workspace, workspaceFiles } from '@sim/db/schema'
 import { deleteWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
+import { createDelegatedPrincipal } from '@sim/testing'
+import { setUploadDirServer, uploadsSetupMock } from '@sim/testing/mocks/uploads-setup.mock'
 import { generateId } from '@sim/utils/id'
 import { and, eq, inArray } from 'drizzle-orm'
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
 
-const fixtureStorage = vi.hoisted(() => ({ root: '' }))
-vi.mock('@/lib/uploads/core/setup.server', () => ({
-  get UPLOAD_DIR_SERVER() {
-    return fixtureStorage.root
-  },
-}))
+vi.mock('@/lib/uploads/core/setup.server', () => uploadsSetupMock)
 
 import { executeFileTool } from '@/lib/internal/file/execute-tool'
 import {
@@ -44,18 +41,12 @@ type Fixture = Awaited<ReturnType<typeof seed>>
 
 /** The chat principal `tools execute` hands to the tool layer. */
 function toolExecutionPrincipal(subjectUserId: string, workspaceId: string) {
-  const issuedAt = new Date()
-  return {
-    kind: 'delegated',
-    serviceId: 'copilot',
+  return createDelegatedPrincipal({
     subjectUserId,
     workspaceId,
-    delegationId: generateId(),
     audience: 'sim:tool-execution',
-    issuedAt,
-    expiresAt: new Date(issuedAt.getTime() + 60_000),
     resourceScope: { chatId: generateId() },
-  } satisfies SubjectDelegatedPrincipal
+  })
 }
 
 /** A generated image as `image_generate` stores it outside a workflow run. */
@@ -99,8 +90,10 @@ async function writeCopy(
   return { status: response.status, saved }
 }
 
+const uploadRoot = mkdtempSync(path.join(tmpdir(), 'sim-delegated-caller-write-'))
+
 beforeAll(() => {
-  fixtureStorage.root = mkdtempSync(path.join(tmpdir(), 'sim-delegated-caller-write-'))
+  setUploadDirServer(uploadRoot)
 })
 
 afterAll(async () => {
@@ -114,7 +107,7 @@ afterAll(async () => {
       await db.delete(organization).where(eq(organization.id, ids.organizationId))
       await db.delete(user).where(inArray(user.id, [ids.aliceId, ids.bobId]))
     }
-    await rm(fixtureStorage.root, { recursive: true, force: true })
+    await rm(uploadRoot, { recursive: true, force: true })
   } finally {
     await db.$client.end()
   }
@@ -137,7 +130,7 @@ describe('a File write run directly from a Mothership chat', () => {
 
     const result = await writeCopy(ids, toolExecutionPrincipal(ids.bobId, ids.workspaceId), image)
 
-    expect(result.status).toBeGreaterThanOrEqual(400)
+    expect(result.status).toBe(403)
     expect(result.saved).toBeUndefined()
   })
 
@@ -147,7 +140,7 @@ describe('a File write run directly from a Mothership chat', () => {
 
     const result = await writeCopy(ids, toolExecutionPrincipal(ids.aliceId, generateId()), image)
 
-    expect(result.status).toBeGreaterThanOrEqual(400)
+    expect(result.status).toBe(403)
     expect(result.saved).toBeUndefined()
   })
 })

apps/sim/lib/internal/file/execute-tool.ts

@@ -85,11 +85,9 @@ const fileSearchInputSchema = z
   .strict()
 
 /**
- * A delegated caller reaches a file tool through a use case that authorized it for
- * its own audience (`sim:tool-execution` for a direct tool call), while every
- * workspace-file use case admits only `sim:workspace-files`. Rebinding keeps the
- * subject, workspace, expiry ceiling, and resource scope, so the file use cases
- * still check the subject's current workspace access.
+ * A delegated caller arrives with its calling use case's audience (`sim:tool-execution`),
+ * but workspace-file use cases admit only `sim:workspace-files`; they still check the
+ * subject's access. A delegation for another workspace is left for them to refuse.
  */
 function bindWorkspaceFilePrincipal(
   principal: Principal,
@@ -98,7 +96,8 @@ function bindWorkspaceFilePrincipal(
 ): Principal {
   if (
     principal.kind !== 'delegated' ||
-    principal.audience === WORKSPACE_FILES_DELEGATION_AUDIENCE
+    principal.audience === WORKSPACE_FILES_DELEGATION_AUDIENCE ||
+    principal.workspaceId !== workspaceId
   ) {
     return principal
   }
@@ -107,9 +106,9 @@ function bindWorkspaceFilePrincipal(
     principal,
     workspaceId,
     delegationId: `file-tool:${requestId}`,
-    ...(scope?.fileId ? { fileId: scope.fileId } : {}),
-    ...(scope?.chatId ? { chatId: scope.chatId } : {}),
-    ...(scope?.executionId ? { executionId: scope.executionId } : {}),
+    fileId: scope?.fileId,
+    chatId: scope?.chatId,
+    executionId: scope?.executionId,
   })
 }
 

apps/sim/lib/internal/image/operations.ts

@@ -1,7 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { interruptibleSleep } from '@sim/utils/helpers'
-import { isRecordLike } from '@sim/utils/object'
+import { isRecordLike, omit } from '@sim/utils/object'
 import { getUserFacingErrorMessage } from '@/lib/core/errors/database-query-error'
 import { getMaxExecutionTimeout } from '@/lib/core/execution-limits'
 import {
@@ -23,6 +23,7 @@ import { recordServiceMeteringFailure } from '@/lib/mothership/billing/service-o
 import { type FalAICostMetadata, getFalAICostMetadata } from '@/lib/tools/falai-pricing'
 import { uploadCopilotFile } from '@/lib/uploads/contexts/copilot'
 import { uploadExecutionFile } from '@/lib/uploads/contexts/execution'
+import { resolveStoredFileMetadata } from '@/lib/uploads/utils/stored-file-metadata'
 
 const logger = createLogger('ImageOperations')
 const MAX_IMAGE_BYTES = MAX_REMOTE_IMAGE_BYTES
@@ -595,8 +596,11 @@ async function storeGeneratedImage(
   context: ImageOperationContext
 ): Promise<StoredImageResponse> {
   context.signal?.throwIfAborted()
-  const timestamp = Date.now()
-  const safeFileName = imageResult.fileName || `image-${imageResult.provider}-${timestamp}.png`
+  const { fileName, mimeType: contentType } = resolveStoredFileMetadata(
+    imageResult.fileName || `image-${imageResult.provider}-${Date.now()}.png`,
+    imageResult.contentType,
+    imageResult.buffer
+  )
   const executionContext =
     context.workspaceId && context.workflowId && context.executionId
       ? {
@@ -606,57 +610,32 @@ async function storeGeneratedImage(
         }
       : null
 
-  if (executionContext) {
-    const imageFile = await uploadExecutionFile(
-      executionContext,
-      imageResult.buffer,
-      safeFileName,
-      imageResult.contentType,
-      context.userId
-    )
-    context.signal?.throwIfAborted()
-
-    return {
-      content: imageFile.url,
-      imageUrl: imageFile.url,
-      imageFile,
-      fileName: safeFileName,
-      contentType: imageResult.contentType,
-      provider: imageResult.provider,
-      model: imageResult.model,
-      metadata: {
-        provider: imageResult.provider,
-        model: imageResult.model,
-        description: imageResult.description,
-        revisedPrompt: imageResult.revisedPrompt,
-        seed: imageResult.seed,
-        jobId: imageResult.jobId,
-        contentType: imageResult.contentType,
-      },
-      __falaiCostDollars: imageResult.falaiCost?.costDollars,
-      __falaiBilling: imageResult.falaiCost,
-    }
-  }
-
-  const fileInfo = await uploadCopilotFile({
-    buffer: imageResult.buffer,
-    fileName: safeFileName,
-    contentType: imageResult.contentType,
-    userId: context.userId,
-  })
+  // A stored file output is kept as is; a bare URL would be downloaded and stored again.
+  const imageFile = executionContext
+    ? await uploadExecutionFile(
+        executionContext,
+        imageResult.buffer,
+        fileName,
+        contentType,
+        context.userId
+      )
+    : omit(
+        await uploadCopilotFile({
+          buffer: imageResult.buffer,
+          fileName,
+          contentType,
+          userId: context.userId,
+        }),
+        ['mimeType']
+      )
   context.signal?.throwIfAborted()
-  const imageUrl = fileInfo.url
-  logger.info(`[${context.requestId}] Stored generated image fallback`, {
-    fileName: safeFileName,
-    size: imageResult.buffer.length,
-  })
 
   return {
-    content: imageUrl,
-    imageUrl,
-    imageFile: fileInfo,
-    fileName: safeFileName,
-    contentType: imageResult.contentType,
+    content: imageFile.url,
+    imageUrl: imageFile.url,
+    imageFile,
+    fileName,
+    contentType,
     provider: imageResult.provider,
     model: imageResult.model,
     metadata: {
@@ -666,7 +645,7 @@ async function storeGeneratedImage(
       revisedPrompt: imageResult.revisedPrompt,
       seed: imageResult.seed,
       jobId: imageResult.jobId,
-      contentType: imageResult.contentType,
+      contentType,
     },
     __falaiCostDollars: imageResult.falaiCost?.costDollars,
     __falaiBilling: imageResult.falaiCost,

apps/sim/lib/internal/tool-operations/types.ts

@@ -22,7 +22,10 @@ export interface InternalToolOperationContext {
   executorDelegationOrigin?: ExecutorDelegationOrigin
   /** Trusted source block for saved MCP operation restrictions. */
   mcpBlockId?: string
-  /** Authenticated direct caller, supplied by an authorized use case, never tool input. */
+  /**
+   * Authenticated direct caller, supplied by an authorized use case, never tool input. A
+   * delegated principal carries that use case's audience; rebind it before another use case.
+   */
   callerPrincipal?: Principal
   copilotToolExecution?: boolean
   copilotInteractionMode?: 'interactive' | 'headless'