fix

Author: icecrasher321

apps/sim/app/api/files/download/route.ts

@@ -4,8 +4,8 @@ import { fileDownloadContract } from '@/lib/api/contracts/storage-transfer'
 import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import type { StorageContext } from '@/lib/uploads/config'
 import { hasCloudStorage } from '@/lib/uploads/core/storage-service'
+import { resolveTrustedFileContext } from '@/lib/uploads/utils/file-utils'
 import { verifyFileAccess } from '@/app/api/files/authorization'
 import { createErrorResponse, FileNotFoundError } from '@/app/api/files/utils'
 
@@ -58,12 +58,10 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       })
     }
 
-    let storageContext: StorageContext | 'general' | undefined = context
-
-    if (isExecutionFile && !context) {
-      storageContext = 'execution'
-      logger.info(`Using execution context for file: ${key}`)
-    }
+    const storageContext = resolveTrustedFileContext(
+      key,
+      isExecutionFile && !context ? 'execution' : context
+    )
 
     const hasAccess = await verifyFileAccess(
       key,
@@ -79,10 +77,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     }
 
     const { getBaseUrl } = await import('@/lib/core/utils/urls')
-    const contextQuery = storageContext ? `?context=${storageContext}` : ''
-    const downloadUrl = `${getBaseUrl()}/api/files/serve/${encodeURIComponent(key)}${contextQuery}`
+    const downloadUrl = `${getBaseUrl()}/api/files/serve/${encodeURIComponent(key)}?context=${storageContext}`
 
-    logger.info(`Generated download URL for ${storageContext ?? 'inferred'} file: ${key}`)
+    logger.info(`Generated download URL for ${storageContext} file: ${key}`)
 
     return NextResponse.json({
       downloadUrl,

apps/sim/lib/uploads/utils/file-utils.server.test.ts

@@ -0,0 +1,47 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockDownloadFile } = vi.hoisted(() => ({
+  mockDownloadFile: vi.fn(),
+}))
+
+vi.mock('@/lib/uploads/core/storage-service', () => ({
+  downloadFile: mockDownloadFile,
+  hasCloudStorage: vi.fn(() => true),
+}))
+
+vi.mock('@/app/api/files/authorization', () => ({
+  verifyFileAccess: vi.fn(),
+}))
+
+import { createLogger } from '@sim/logger'
+import { downloadFileFromStorage } from '@/lib/uploads/utils/file-utils.server'
+import type { UserFile } from '@/executor/types'
+
+describe('downloadFileFromStorage context derivation', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockDownloadFile.mockResolvedValue(Buffer.from('bytes'))
+  })
+
+  it('downloads with the key-derived context, ignoring a caller-supplied public context', async () => {
+    const userFile: UserFile = {
+      id: 'f1',
+      name: 'report.pdf',
+      url: '',
+      size: 5,
+      type: 'application/pdf',
+      key: 'workspace/ws-1/1700000000000-abc1234-report.pdf',
+      context: 'og-images',
+    }
+
+    await downloadFileFromStorage(userFile, 'req-1', createLogger('test'))
+
+    expect(mockDownloadFile).toHaveBeenCalledTimes(1)
+    expect(mockDownloadFile).toHaveBeenCalledWith(
+      expect.objectContaining({ key: userFile.key, context: 'workspace' })
+    )
+  })
+})