test(v2-api): align upload concealment test with cross-tenant-only semantics

waleedlatif1 · waleedlatif1 · commit c8498b8eaf6f · 2026-08-11T14:43:21.000-07:00
#6557 narrowed `createV2ResourceConcealmentPolicy` to conceal only the three cross-tenant authorization classes, deliberately letting a same-workspace policy denial keep its 403 so the caller learns why. My test predated that and asserted a workspace-key denial was concealed as 404. Split into two cases that pin the distinction rather than paper over it: a cross-tenant reach conceals, a workspace-key policy denial does not.
diff --git a/apps/sim/app/api/v2/files/uploads/[uploadId]/route.test.ts b/apps/sim/app/api/v2/files/uploads/[uploadId]/route.test.ts
@@ -99,14 +99,8 @@ describe('DELETE /api/v2/files/uploads/[uploadId]', () => {
     expect(await response.json()).toMatchObject({ data: { id: UPLOAD_ID, status: 'aborted' } })
   })
 
-  it.each([
-    ['no workspace access', () => new NoWorkspaceAccessError()],
-    [
-      'a workspace API key barred from the operation',
-      () => new WorkspaceApiKeyAuthorizationError(),
-    ],
-  ])('conceals %s as a missing upload session', async (_label, makeError) => {
-    mocks.abort.mockRejectedValueOnce(makeError())
+  it('conceals a cross-tenant reach as a missing upload session', async () => {
+    mocks.abort.mockRejectedValueOnce(new NoWorkspaceAccessError())
 
     const response = await DELETE(abortRequest(), context)
 
@@ -116,6 +110,19 @@ describe('DELETE /api/v2/files/uploads/[uploadId]', () => {
     })
   })
 
+  /**
+   * Only cross-tenant reaches are concealed. A workspace key barred from this
+   * operation is a same-workspace policy denial — the caller owns the session
+   * and needs to be told why, not handed a misleading 404.
+   */
+  it('keeps a workspace-key policy denial as a 403', async () => {
+    mocks.abort.mockRejectedValueOnce(new WorkspaceApiKeyAuthorizationError())
+
+    const response = await DELETE(abortRequest(), context)
+
+    expect(response.status).toBe(403)
+  })
+
   it('does not conceal a workspace-policy denial behind a not-found', async () => {
     mocks.abort.mockRejectedValueOnce(new InsufficientWorkspacePermissionsError())
 
