fix(files): preserve upload history across creator handoff

Author: mzxchandra

apps/sim/app/api/v1/admin/workspaces/[id]/members/[memberId]/route.ts

@@ -33,6 +33,7 @@ import {
 } from '@/lib/api/contracts/v1/admin'
 import { parseRequest } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { ProjectConflictError } from '@/lib/projects/membership'
 import { revokeWorkspaceAccessTx } from '@/lib/workspaces/access/workspace-access'
 import { getWorkspaceById } from '@/lib/workspaces/permissions/utils'
 import { WorkspaceBillingAccountRemovalError } from '@/lib/workspaces/utils'
@@ -309,7 +310,10 @@ export const DELETE = withRouteHandler(
         workspaceId,
       })
     } catch (error) {
-      if (error instanceof WorkspaceBillingAccountRemovalError) {
+      if (
+        error instanceof WorkspaceBillingAccountRemovalError ||
+        error instanceof ProjectConflictError
+      ) {
         return badRequestResponse(error.message)
       }
       logger.error('Admin API: Failed to remove workspace member', { error, workspaceId, memberId })

apps/sim/app/api/v1/admin/workspaces/[id]/members/route.ts

@@ -50,6 +50,7 @@ import {
 import { parseRequest } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { syncWorkspaceEnvCredentials } from '@/lib/credentials/environment'
+import { ProjectConflictError } from '@/lib/projects/membership'
 import { revokeWorkspaceAccessTx } from '@/lib/workspaces/access/workspace-access'
 import { getWorkspaceById } from '@/lib/workspaces/permissions/utils'
 import { WorkspaceBillingAccountRemovalError } from '@/lib/workspaces/utils'
@@ -389,10 +390,19 @@ export const DELETE = withRouteHandler(
         return notFoundResponse('Workspace member')
       }
 
-      await db.transaction(async (tx) => {
-        const result = await revokeWorkspaceAccessTx(tx, { workspaceId, userId: userId })
-        if (!result.revoked) throw new WorkspaceBillingAccountRemovalError()
+      const removed = await db.transaction(async (tx) => {
+        const result = await revokeWorkspaceAccessTx(tx, {
+          workspaceId,
+          userId,
+          expectedPermissionId: existingPermission.id,
+        })
+        if (!result.revoked) {
+          if (result.reason === 'membership-changed') return false
+          throw new WorkspaceBillingAccountRemovalError()
+        }
+        return true
       })
+      if (!removed) return notFoundResponse('Workspace member')
 
       logger.info(`Admin API: Removed user ${userId} from workspace ${workspaceId}`)
 
@@ -409,7 +419,10 @@ export const DELETE = withRouteHandler(
 
       return singleResponse({ removed: true, userId, workspaceId })
     } catch (error) {
-      if (error instanceof WorkspaceBillingAccountRemovalError) {
+      if (
+        error instanceof WorkspaceBillingAccountRemovalError ||
+        error instanceof ProjectConflictError
+      ) {
         return badRequestResponse(error.message)
       }
       logger.error('Admin API: Failed to remove workspace member', {

apps/sim/lib/projects/resource-handoff.ts

@@ -18,6 +18,7 @@ import {
   ProjectConflictError,
   tryLockProjects,
 } from '@/lib/projects/membership'
+import { handoffFileCreatorsInTx } from '@/lib/uploads/contexts/workspace/creator-handoff'
 
 /**
  * An org admin, else a teammate who administers every surviving environment. With `hold`,
@@ -140,10 +141,11 @@ export async function handoffProjectCreatorReferencesTx(
         'Project successor must administer every surviving environment'
       )
   }
-  await tx
-    .update(workspaceFiles)
-    .set({ userId: successorId })
-    .where(and(eq(workspaceFiles.projectId, record.id), eq(workspaceFiles.userId, departingUserId)))
+  await handoffFileCreatorsInTx(
+    tx,
+    and(eq(workspaceFiles.projectId, record.id), eq(workspaceFiles.userId, departingUserId)),
+    successorId
+  )
   await tx
     .update(folder)
     .set({ userId: successorId })

apps/sim/lib/uploads/contexts/workspace/__integration__/file-versions.integration.ts

@@ -32,6 +32,7 @@ import {
 } from '@/lib/knowledge/__integration__/seed-source-access-fixture'
 import { createFileReadTransport } from '@/lib/mothership/agent-cli/file-read-transport'
 import { runCli } from '@/lib/mothership/agent-cli/run-cli'
+import { handoffFileCreatorsInTx } from '@/lib/uploads/contexts/workspace/creator-handoff'
 import {
   deleteWorkspaceFileVersion,
   fetchWorkspaceFileBuffer,
@@ -133,6 +134,110 @@ describe('workspace file version history in PostgreSQL', () => {
     expect(await versionRows(fixture.fileId)).toEqual([])
   })
 
+  it('keeps original attribution, bytes and revision through repeated creator handoff and a later edit', async () => {
+    const fixture = await seedFile('original')
+    const [before] = await db
+      .select()
+      .from(workspaceFiles)
+      .where(eq(workspaceFiles.id, fixture.fileId))
+    for (const successor of [fixture.bobId, fixture.aliceId, fixture.bobId]) {
+      await db.transaction((tx) =>
+        handoffFileCreatorsInTx(tx, eq(workspaceFiles.id, fixture.fileId), successor)
+      )
+    }
+    const [after] = await db
+      .select()
+      .from(workspaceFiles)
+      .where(eq(workspaceFiles.id, fixture.fileId))
+    expect(after).toMatchObject({
+      key: before.key,
+      contentUpdatedAt: before.contentUpdatedAt,
+      uploadedAt: before.uploadedAt,
+      sizeBytes: before.sizeBytes,
+      userId: fixture.bobId,
+    })
+    expect(await versionRows(fixture.fileId)).toHaveLength(1)
+    await updateWorkspaceFileContent(
+      fixture.workspaceId,
+      fixture.fileId,
+      fixture.bobId,
+      Buffer.from('second'),
+      undefined,
+      { version: { source: 'api', authorUserId: fixture.bobId } }
+    )
+    const rows = await versionRows(fixture.fileId)
+    expect(rows.map((row) => [row.version, row.source, row.authorUserIds])).toEqual([
+      [1, 'upload', [fixture.aliceId]],
+      [2, 'api', [fixture.bobId]],
+    ])
+    expect(await readVersionBytes(fixture.workspaceId, fixture.fileId, rows[0].key)).toBe(
+      'original'
+    )
+    await db.transaction((tx) =>
+      handoffFileCreatorsInTx(tx, eq(workspaceFiles.id, fixture.fileId), fixture.aliceId)
+    )
+    expect(await versionRows(fixture.fileId)).toEqual(rows)
+  })
+
+  it('does not manufacture original authorship for previously overwritten unrecorded content', async () => {
+    const fixture = await seedFile('overwritten')
+    await db
+      .update(workspaceFiles)
+      .set({ contentUpdatedAt: new Date(Date.now() + 5000) })
+      .where(eq(workspaceFiles.id, fixture.fileId))
+    await db.transaction((tx) =>
+      handoffFileCreatorsInTx(tx, eq(workspaceFiles.id, fixture.fileId), fixture.bobId)
+    )
+    expect(await versionRows(fixture.fileId)).toMatchObject([
+      { version: 1, source: 'unknown', authorUserIds: [] },
+    ])
+  })
+
+  it('keeps an empty shell unversioned until its first content write after handoff', async () => {
+    const fixture = await seedFile('')
+    await db.transaction((tx) =>
+      handoffFileCreatorsInTx(tx, eq(workspaceFiles.id, fixture.fileId), fixture.bobId)
+    )
+    expect(await versionRows(fixture.fileId)).toEqual([])
+    await updateWorkspaceFileContent(
+      fixture.workspaceId,
+      fixture.fileId,
+      fixture.bobId,
+      Buffer.from('first'),
+      undefined,
+      { version: { source: 'api', authorUserId: fixture.bobId } }
+    )
+    expect(await versionRows(fixture.fileId)).toMatchObject([
+      { version: 1, source: 'api', authorUserIds: [fixture.bobId] },
+    ])
+  })
+
+  it('serializes content writes with creator handoff without duplicate or misattributed history', async () => {
+    const fixture = await seedFile('original')
+    await Promise.all([
+      db.transaction((tx) =>
+        handoffFileCreatorsInTx(tx, eq(workspaceFiles.id, fixture.fileId), fixture.bobId)
+      ),
+      updateWorkspaceFileContent(
+        fixture.workspaceId,
+        fixture.fileId,
+        fixture.aliceId,
+        Buffer.from('second'),
+        undefined,
+        { version: { source: 'api', authorUserId: fixture.aliceId } }
+      ),
+    ])
+    const rows = await versionRows(fixture.fileId)
+    expect(rows.map((row) => [row.version, row.authorUserIds])).toEqual([
+      [1, [fixture.aliceId]],
+      [2, [fixture.aliceId]],
+    ])
+    expect(rows.filter((row) => row.supersededAt === null)).toHaveLength(1)
+    expect(await readVersionBytes(fixture.workspaceId, fixture.fileId, rows[0].key)).toBe(
+      'original'
+    )
+  })
+
   it.each([
     ['named', 'download'],
     ['anonymous', 'download'],

apps/sim/lib/uploads/contexts/workspace/creator-handoff.ts

@@ -0,0 +1,50 @@
+import { workspaceFiles } from '@sim/db/schema'
+import { asc, inArray, type SQL } from 'drizzle-orm'
+import type { DbTransaction } from '@/lib/db/types'
+import { snapshotWorkspaceFileSecretProvenanceInTx } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import {
+  isVersionHeadCurrent,
+  loadWorkspaceFileVersionHead,
+  materializeWorkspaceFileVersionInTx,
+} from '@/lib/uploads/contexts/workspace/workspace-file-versions'
+import { getWorkspaceFileSize } from '@/lib/uploads/shared/types'
+
+/** Freezes implicit history under the writer lock before replacing a shared file's live creator. */
+export async function handoffFileCreatorsInTx(
+  tx: DbTransaction,
+  condition: SQL | undefined,
+  successorId: string
+) {
+  if (!condition) throw new Error('File creator handoff requires a scope')
+  const files = await tx
+    .select()
+    .from(workspaceFiles)
+    .where(condition)
+    .orderBy(asc(workspaceFiles.id))
+    .for('update')
+  for (const file of files) {
+    if (file.context !== 'workspace' && file.context !== 'project') continue
+    const head = await loadWorkspaceFileVersionHead(file.id, tx)
+    if (isVersionHeadCurrent(head, file) || (!head && getWorkspaceFileSize(file) === 0)) continue
+    const provenance =
+      file.projectId && file.secretProvenanceVersion === null
+        ? { status: 'unknown' as const, entries: [] }
+        : await snapshotWorkspaceFileSecretProvenanceInTx(
+            tx,
+            file.id,
+            file.contentUpdatedAt,
+            file.secretProvenanceVersion
+          )
+    await materializeWorkspaceFileVersionInTx(tx, file, head, provenance, new Date())
+  }
+  if (!files.length) return
+  await tx
+    .update(workspaceFiles)
+    .set({ userId: successorId, updatedAt: new Date() })
+    .where(
+      inArray(
+        workspaceFiles.id,
+        files.map((file) => file.id)
+      )
+    )
+}

apps/sim/lib/uploads/contexts/workspace/workspace-file-versions.ts

@@ -191,6 +191,35 @@ interface RecordedWorkspaceFileVersion {
   releasedKeys: string[]
 }
 
+/** Materializes current bytes under the file lock before content or creator attribution changes. */
+export async function materializeWorkspaceFileVersionInTx(
+  tx: DbTransaction,
+  previous: WorkspaceFileRow,
+  head: WorkspaceFileVersionSummaryRow | undefined,
+  provenance: WorkspaceFileSecretProvenanceSnapshot,
+  now: Date
+): Promise<WorkspaceFileVersionSummaryRow> {
+  if (isVersionHeadCurrent(head, previous) && head) return head
+  if (head && head.supersededAt === null) await supersedeVersionInTx(tx, head.id, now)
+  const original = !head && isOriginalUploadContent(previous)
+  const [materialized] = await tx
+    .insert(workspaceFileVersion)
+    .values({
+      id: generateId(),
+      fileId: previous.id,
+      workspaceId: previous.workspaceId,
+      version: head ? head.version + 1 : INITIAL_WORKSPACE_FILE_VERSION,
+      ...contentColumns(previous, provenance),
+      contentHash: null,
+      source: original ? 'upload' : 'unknown',
+      authorUserIds: original && previous.userId ? [previous.userId] : [],
+      createdAt: previous.contentUpdatedAt,
+      updatedAt: previous.contentUpdatedAt,
+    })
+    .returning(versionSummaryColumns)
+  return materialized
+}
+
 /**
  * Records a committed content write in the file's history. Runs inside the content-write
  * transaction, under the file row's lock, which serializes version numbering and coalescing
@@ -215,24 +244,13 @@ export async function recordWorkspaceFileVersionInTx(
     if (!params.previousProvenance) {
       throw new Error('Outgoing workspace file content needs a provenance snapshot to be versioned')
     }
-    if (head && head.supersededAt === null) await supersedeVersionInTx(tx, head.id, now)
-    const original = !head && isOriginalUploadContent(previous)
-    const [materialized] = await tx
-      .insert(workspaceFileVersion)
-      .values({
-        id: generateId(),
-        fileId: previous.id,
-        workspaceId: params.workspaceId,
-        version: head ? head.version + 1 : INITIAL_WORKSPACE_FILE_VERSION,
-        ...contentColumns(previous, params.previousProvenance),
-        contentHash: null,
-        source: original ? 'upload' : 'unknown',
-        authorUserIds: original && previous.userId ? [previous.userId] : [],
-        createdAt: previous.contentUpdatedAt,
-        updatedAt: previous.contentUpdatedAt,
-      })
-      .returning(versionSummaryColumns)
-    head = materialized
+    head = await materializeWorkspaceFileVersionInTx(
+      tx,
+      previous,
+      head,
+      params.previousProvenance,
+      now
+    )
   }
 
   const nextColumns = { ...contentColumns(next, params.nextProvenance), updatedAt: now }

apps/sim/lib/workspace-files/search/owners.integration.ts

@@ -481,31 +481,37 @@ describe('owner-scoped indexed file search on PostgreSQL and stored bytes', () =
     }
   )
 
-  check('keeps empty and recursive folder scopes exact after the creator is detached', async () => {
-    const f = await fixture()
-    const folder = await createFolder(f, 'Architecture')
-    const child = await createFolder(f, 'Backend', folder.folder.id)
-    const created = await create(f, 'folderneedle', { folderId: child.folder.id })
-    await db
-      .update(workspaceFiles)
-      .set({ userId: null })
-      .where(eq(workspaceFiles.id, created.file.id))
-    await indexWorkspaceFileForSearch({ owner: f.owner, ...(await claim(created.file.id)) }, signal)
-    expect((await search(f, 'folderneedle', { folderPaths: [] })).results).toEqual([])
-    expect(
-      (
-        await search(f, 'folderneedle', {
-          folderPaths: ['/Architecture'],
-          includeSubfolders: false,
-        })
-      ).results
-    ).toEqual([])
-    expect(
-      (await search(f, 'folderneedle', { folderPaths: ['/Architecture'] })).results.map(
-        (hit) => hit.fileId
+  check(
+    'keeps empty and recursive folder scopes exact after the creator is reassigned',
+    async () => {
+      const f = await fixture()
+      const folder = await createFolder(f, 'Architecture')
+      const child = await createFolder(f, 'Backend', folder.folder.id)
+      const created = await create(f, 'folderneedle', { folderId: child.folder.id })
+      await db
+        .update(workspaceFiles)
+        .set({ userId: f.readerId })
+        .where(eq(workspaceFiles.id, created.file.id))
+      await indexWorkspaceFileForSearch(
+        { owner: f.owner, ...(await claim(created.file.id)) },
+        signal
       )
-    ).toEqual([created.file.id])
-  })
+      expect((await search(f, 'folderneedle', { folderPaths: [] })).results).toEqual([])
+      expect(
+        (
+          await search(f, 'folderneedle', {
+            folderPaths: ['/Architecture'],
+            includeSubfolders: false,
+          })
+        ).results
+      ).toEqual([])
+      expect(
+        (await search(f, 'folderneedle', { folderPaths: ['/Architecture'] })).results.map(
+          (hit) => hit.fileId
+        )
+      ).toEqual([created.file.id])
+    }
+  )
 
   check('rejects forged owner payloads without changing the current revision', async () => {
     const f = await fixture()