fix(files-upload): enforce workspace authorization on mothership uploads

[waleedlatif1]

Summary

• The mothership context in POST /api/files/upload was missing the workspace permission check that every other context (workspace, knowledge-base, execution) already enforces
• Added the same write/admin getUserEntityPermissions gate, plus the storage quota check other paths also apply
• Matches the authorization already enforced for mothership in the multipart and presigned upload routes

Type of Change

• Bug fix (security)

Testing

Added a Mothership Context Permission Gate test suite covering missing workspaceId, non-member, read-only member, over-quota, and write/admin-permission cases. Full route test suite passes (25/25).

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 11, 2026 7:41pm

[cursor]

PR Summary

High Risk
Fixes unauthorized file uploads to workspace storage; the change is narrow but touches auth, billing quota, and a previously exposed upload path.

Overview
Closes a security gap on POST /api/files/upload where mothership uploads could proceed without the workspace checks other contexts already use.

mothership now requires workspaceId, write/admin via getUserEntityPermissions, and a checkStorageQuota pass against the combined batch size—all resolved once per request before any file is stored. The per-file upload path only runs after that gate, using the validated workspace id.

Tests add a Mothership Context Permission Gate suite (missing workspace, non-member, read-only, over-quota, write/admin, multi-file quota sizing) and mock checkStorageQuota in shared setup.

^{Reviewed by Cursor Bugbot for commit eb71402. Configure here.}

[greptile-apps]

Greptile Summary

This PR tightens authorization for mothership file uploads. The main changes are:

• Adds a workspace ID requirement for mothership uploads.
• Requires write or admin workspace access before upload.
• Checks storage quota once against the full upload batch.
• Adds route tests for denied and allowed mothership upload cases.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
apps/sim/app/api/files/upload/route.ts	Adds the mothership workspace permission check and combined batch quota check before uploads run.
apps/sim/app/api/files/upload/route.test.ts	Adds tests for mothership permission failures, quota failure, allowed uploads, and combined batch quota handling.

_{Reviews (2): Last reviewed commit: "fix(files-upload): check mothership quot..." | Re-trigger Greptile}

[waleedlatif1]

Addressed both findings in eb71402:

• Batch-quota bypass: fixed (replied inline, thread resolved).
• Missing-workspaceId error naming "Chat" instead of mothership: fixed — now reads "Mothership context requires workspaceId parameter".

[waleedlatif1]

@greptile review

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit eb71402. Configure here.}