Function assertFileAccessForUpload

apps/sim/providers/file-attachments.server.ts:140–155

* Verifies the caller may read this file before its bytes are uploaded to a provider. Enforced * for every caller of uploadLargeFilesToProvider (not just the agent path), so a forged * storage key in a passthrough request cannot exfiltrate another user's file.

(
  file: UserFile,
  userId: string | undefined
)

 * storage key in a passthrough request cannot exfiltrate another user's file.
 */
async function assertFileAccessForUpload(
  file: UserFile,
  userId: string | undefined
): Promise<void> {
  if (!file.key) {
    throw new Error(`File "${file.name}" has no storage key`)
  }
  if (!userId) {
    throw new Error(`File "${file.name}" requires an authenticated user to upload`)
  }
  const context = (file.context as StorageContext) || inferContextFromKey(file.key)
  const hasAccess = await verifyFileAccess(file.key, userId, undefined, context, false)
  if (!hasAccess) {
    throw new Error(`File "${file.name}" is not accessible`)
  }
}

/**
 * Groups large files needing a Files API upload by storage key so a file referenced across