fix(files): distinguish non-member from read-only in workspace-save skip log

Splits the workspace-save skip branch so non-members (permission === null)
log 'user is not a workspace member' instead of the misleading 'lacks
write permission'. Adds a test covering the null case so the relaxed
behavior (vs. the prior route's hard 'File not found') is explicit.

Author: waleedlatif1

apps/sim/lib/uploads/contexts/workspace/fetch-external-url.test.ts

@@ -148,6 +148,23 @@ describe('fetchExternalUrlToWorkspace', () => {
     expect(mockUploadWorkspaceFile).not.toHaveBeenCalled()
   })
 
+  it('returns parsed bytes but skips save when user is not a workspace member', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('bytes', 'text/plain')
+    )
+    permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue(null)
+
+    const result = await fetchExternalUrlToWorkspace({
+      url: 'https://example.com/file.txt',
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+    })
+
+    expect(result.buffer.toString()).toBe('bytes')
+    expect(result.savedWorkspaceFile).toBeUndefined()
+    expect(mockUploadWorkspaceFile).not.toHaveBeenCalled()
+  })
+
   it('returns the saved workspace file when permission allows save', async () => {
     inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
       makeResponse('bytes', 'text/plain')

apps/sim/lib/uploads/contexts/workspace/fetch-external-url.ts

@@ -137,6 +137,11 @@ export async function fetchExternalUrlToWorkspace(
           saveError,
         })
       }
+    } else if (permission === null) {
+      logger.warn('Skipping workspace save: user is not a workspace member', {
+        userId,
+        workspaceId,
+      })
     } else {
       logger.warn('Skipping workspace save: user lacks write permission', {
         userId,