fix(kb): force kb uploads to use serve route#1547
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Greptile Overview
Summary
This PR fixes sporadic forbidden errors for knowledge base file uploads by modifying the file serving logic in the presigned URL route. The change removes 'knowledge-base' from the condition that determines whether files should use direct S3 URLs or go through the application's serve route.Previously, knowledge base files were served using direct S3 URLs (https://{bucket}.s3.{region}.amazonaws.com/{key}), which could fail with forbidden errors due to restrictive bucket policies or IAM permissions. Now, knowledge base files will use the /api/files/serve/s3/ endpoint instead, which provides proper authentication and authorization handling.
This change aligns knowledge base file serving with how other file types (except chat and profile pictures) are handled in the system. The serve route, as documented in the codebase context, implements robust error handling, logging, and supports both local and cloud storage with proper access controls. By routing knowledge base files through this endpoint, the application ensures consistent file access regardless of external S3 configuration issues.
Changed Files
| Filename | Score | Overview |
|---|---|---|
apps/sim/app/api/files/presigned/route.ts |
4/5 | Removed 'knowledge-base' from direct S3 URL condition, forcing KB files through serve route |
Confidence score: 4/5
- This PR is safe to merge with minimal risk as it addresses a specific access issue without breaking existing functionality
- Score reflects a targeted fix that improves reliability by using established serve route infrastructure for knowledge base files
- No files require special attention beyond the single modified route handler
Sequence Diagram
sequenceDiagram
participant User
participant API as "/api/files/presigned"
participant Auth as "Auth Service"
participant Validation as "Validation Layer"
participant Storage as "Storage Service"
participant S3 as "AWS S3"
participant Blob as "Azure Blob"
User->>API: "POST /api/files/presigned"
API->>Auth: "getSession()"
Auth-->>API: "session data"
alt User not authenticated
API-->>User: "401 Unauthorized"
else User authenticated
API->>API: "Parse request JSON"
alt Invalid JSON
API-->>User: "400 ValidationError"
else Valid JSON
API->>Validation: "validateFileType(fileName, contentType, fileSize)"
Validation-->>API: "validation result"
alt Validation fails
API-->>User: "400 ValidationError"
else Validation passes
API->>Storage: "getStorageProvider()"
Storage-->>API: "storage provider type"
alt Storage provider is S3
API->>S3: "handleS3PresignedUrl()"
S3->>S3: "Generate presigned URL"
S3-->>API: "presigned URL + file info"
API-->>User: "200 OK with presigned URL"
else Storage provider is Blob
API->>Blob: "handleBlobPresignedUrl()"
Blob->>Blob: "Generate SAS token"
Blob-->>API: "presigned URL + file info"
API-->>User: "200 OK with presigned URL"
else Unknown provider
API-->>User: "500 StorageConfigError"
end
end
end
end
1 file reviewed, no comments
1 participant
Summary
force kb uploads to use serve route instead of direct uploads/GETs since those caused sporadic failures with forbidden errors
Type of Change
Testing
Tested manually.
Checklist