Skip to content

fix(files): preserve principals when serving generated documents - #6654

Merged
TheodoreSpeaks merged 2 commits into
stagingfrom
fix/copilot-principal-lifecycle
Aug 13, 2026
Merged

fix(files): preserve principals when serving generated documents#6654
TheodoreSpeaks merged 2 commits into
stagingfrom
fix/copilot-principal-lifecycle

Conversation

@TheodoreSpeaks

@TheodoreSpeaks TheodoreSpeaks commented Aug 13, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • authenticate workspace file serve requests as session or executor Principals and read the canonical file through the workspace-file application boundary
  • preserve the Principal through v2 downloads, workspace ZIPs, and Copilot function mounts so referenced images can be authorized
  • publish an authorized pointer to dependency-bound compiled artifacts so public shares can serve generated documents without minting workspace authority
  • fail fast when a private referenced-document resolver loses its Principal

Validation

  • local test suite not run per request
  • staged files passed the repository pre-commit Biome hook

@vercel

vercel Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
docs Skipped Skipped Aug 13, 2026 2:32am

Request Review

@cursor

cursor Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown

PR Summary

High Risk
Changes authentication and authorization on file serve, v1 downloads, and document compilation paths that touch cross-tenant boundaries and referenced workspace assets.

Overview
Workspace file serving now authenticates workspace/… keys through internalWorkspaceFileServeAuth (session or executor Principal) and loads bytes via readWorkspaceFileContentByKey, bypassing legacy session + verifyFileAccess. The same Principal is passed into document compilation so referenced workspace inputs stay authorized.

v1 API keys build typed Principals (personal_api_key / workspace_api_key); rate limiting exposes them via requireRateLimitPrincipal. v1 file download delegates to downloadWorkspaceFileStream with that Principal instead of ad-hoc buffer fetching.

Downloads and mounts (single-file stream, ZIP bulk, Copilot function_execute) route generated docs through fetchAuthorizedServableWorkspaceFileBuffer, which forwards filePrincipal into resolveServableDocBytes.

Compiled doc publication: dependency-bound artifacts get a published JSON pointer in copilot storage; loadPublishedCompiledDoc lets principal-less or public paths serve pre-authorized output without re-reading referenced files or compiling. Missing Principal on private referenced docs fails fast; published pointers are used when available.

Reviewed by Cursor Bugbot for commit 6c64353. Bugbot is set up for automated code reviews on this repo. Configure here.

@greptile-apps

greptile-apps Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Greptile Summary

The PR fixes Principal propagation when serving and downloading generated workspace documents.

  • Routes workspace-file serving through the canonical authorized application boundary.
  • Preserves session, delegated executor, and API-key Principals through compilation and referenced-file reads.
  • Reuses the shared workspace-file download flow for v1 downloads, ZIP exports, and Copilot function mounts.
  • Publishes authorized compiled artifacts for public-share delivery without granting workspace authority.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the prior v1 Principal-propagation and absolute-import findings are fixed, and the broader delegated workspace scope was explicitly accepted as intentional.

Important Files Changed
Filename Overview
apps/sim/app/api/files/serve/[...path]/route.ts Workspace paths now authenticate a Principal and use the canonical authorized read boundary before resolving generated-document bytes.
apps/sim/app/api/v1/auth.ts V1 authentication now constructs canonical personal and workspace API-key Principals and rejects incomplete key identities.
apps/sim/app/api/v1/middleware.ts Rate-limit context now preserves the authenticated Principal for downstream application operations.
apps/sim/app/api/v1/files/[fileId]/route.ts V1 downloads now delegate to the shared Principal-aware workspace-file download use case.
apps/sim/lib/copilot/tools/server/files/doc-compile.ts Document compilation preserves authorization for dependency reads and uses the required absolute import for the compiled-artifact store.
apps/sim/lib/copilot/tools/server/files/doc-compiled-store.ts Compiled artifacts can be published through an authorized pointer for later public-share serving.
apps/sim/lib/workspace-files/application/download-workspace-file.ts The shared download flow carries the Principal through generated-document rendering and semantic auditing.
apps/sim/lib/workspace-files/application/read-workspace-file-content-by-key.ts Storage keys are resolved through canonical workspace-file metadata and authorization before content is returned.

Sequence Diagram

 
sequenceDiagram
  participant Client
  participant Route as File Route
  participant Auth as Principal Authentication
  participant Files as Workspace File Use Case
  participant Compiler as Document Compiler
  participant Dependency as Referenced File Reader
  Client->>Route: Download generated document
  Route->>Auth: Authenticate request
  Auth-->>Route: Session, API-key, or delegated Principal
  Route->>Files: Read canonical file with Principal
  Files-->>Route: Authorized source bytes
  Route->>Compiler: Resolve servable bytes with Principal
  Compiler->>Dependency: Read referenced files with same Principal
  Dependency-->>Compiler: Authorized dependency bytes
  Compiler-->>Route: Compiled artifact
  Route-->>Client: Generated document
Loading

Reviews (2): Last reviewed commit: "fix(files): address principal serve revi..." | Re-trigger Greptile

greptile-apps[bot]
greptile-apps Bot reviewed Aug 13, 2026
View reviewed changes
Comment thread apps/sim/app/api/files/serve/[...path]/route.ts Outdated
Comment thread apps/sim/lib/copilot/tools/server/files/doc-compile.ts
Comment thread apps/sim/lib/copilot/tools/server/files/doc-compile.ts Outdated
cursor[bot]
cursor Bot reviewed Aug 13, 2026
View reviewed changes
Comment thread apps/sim/lib/copilot/tools/server/files/doc-compile.ts
Comment thread apps/sim/lib/copilot/tools/server/files/doc-compile.ts
@TheodoreSpeaks
TheodoreSpeaks force-pushed the fix/copilot-principal-lifecycle branch from 2deac27 to 6c64353 Compare August 13, 2026 02:32
@TheodoreSpeaks

TheodoreSpeaks commented Aug 13, 2026

Copy link
Copy Markdown
Collaborator Author

@cursor review

@TheodoreSpeaks

TheodoreSpeaks commented Aug 13, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

cursor[bot]
cursor Bot reviewed Aug 13, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit 6c64353. Configure here.

@TheodoreSpeaks
TheodoreSpeaks merged commit e4019fa into staging Aug 13, 2026
30 checks passed
@TheodoreSpeaks
TheodoreSpeaks deleted the fix/copilot-principal-lifecycle branch August 13, 2026 04:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments
@cursor cursor[bot] cursor[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@TheodoreSpeaks