Function hasActiveKbDocumentForKey

apps/sim/app/api/files/authorization.ts:477–495

* Whether an active KB document (non-archived/excluded/deleted, in a * non-deleted KB) in the owning workspace references exactly `cloudKey`, matched * on the document's persisted canonical `storageKey`. This is an exact, indexed * lookup — no URL parsing or wildcard matching at read time. It is

(cloudKey: string, workspaceId: string)

 * owns it (ownership comes from the binding).
 */
async function hasActiveKbDocumentForKey(cloudKey: string, workspaceId: string): Promise<boolean> {
  const rows = await db
    .select({ id: document.id })
    .from(document)
    .innerJoin(knowledgeBase, eq(document.knowledgeBaseId, knowledgeBase.id))
    .where(
      and(
        eq(knowledgeBase.workspaceId, workspaceId),
        eq(document.storageKey, cloudKey),
        eq(document.userExcluded, false),
        isNull(document.archivedAt),
        isNull(document.deletedAt),
        isNull(knowledgeBase.deletedAt)
      )
    )
    .limit(1)

  return rows.length > 0
}

/**
 * Verify access to KB files (`kb/<key>`).