fix(files): serve inline images with no-cache so deletion/authorization is enforced per request

Embedded images are authenticated content whose backing file can be deleted or have its
access revoked at any time. Both key= and fileId= embeds serve
private, no-cache, must-revalidate, so every request re-runs the server-side
deletion/authorization check instead of serving a possibly-stale image from cache.

Author: waleedlatif1

apps/sim/app/api/files/serve-inline-image.ts

@@ -8,29 +8,22 @@ import { createFileResponse, FileNotFoundError } from '@/app/api/files/utils'
 const logger = createLogger('InlineImageServe')
 
 /**
- * A `fileId=` embed (or a shared/revocable audience) must never serve stale bytes from its fixed inline
- * URL, so it revalidates on each request. See `immutable` below for the cacheable case.
+ * An embedded image is authenticated content served from a fixed inline URL, and the file behind it can
+ * be DELETED or its access REVOKED at any time — so it always revalidates, letting each request re-run the
+ * server-side deletion/authorization check rather than serving a stale (possibly no-longer-authorized)
+ * image from cache. Private so no shared cache/CDN ever stores it.
  */
 const INLINE_CACHE_CONTROL = 'private, no-cache, must-revalidate'
 
-/**
- * A `key=` embed addresses a CONTENT-ADDRESSED, immutable storage key (a re-upload mints a new key), so
- * its bytes never change — safe to cache hard in the (private) browser cache, avoiding a re-download of
- * every embedded image on each doc re-open/re-render. NEVER use this for the public-share route (a share
- * can be revoked) or a `fileId=` embed (the underlying key can change under a stable fileId).
- */
-const INLINE_IMMUTABLE_CACHE_CONTROL = 'private, max-age=31536000, immutable'
-
 /**
  * Download and respond with an already-workspace-scoped inline image — the single serving tail for both
  * the in-app and public inline routes. When `sniff` is set (public shares, a less-trusted audience), the
  * served content type is derived from the bytes and non-raster content is refused with 404; otherwise the
- * stored content type is served, matching the in-app serve route. `immutable` opts a content-addressed
- * (`key=`) in-app embed into a long private cache; leave it false for `fileId=` embeds and public shares.
+ * stored content type is served, matching the in-app serve route.
  */
 export async function serveInlineImage(
   image: ResolvedInlineImage,
-  { sniff, immutable = false }: { sniff: boolean; immutable?: boolean }
+  { sniff }: { sniff: boolean }
 ): Promise<NextResponse> {
   const buffer = await downloadFile({ key: image.key, context: 'workspace' })
 
@@ -48,6 +41,6 @@ export async function serveInlineImage(
     buffer,
     contentType,
     filename: image.filename,
-    cacheControl: immutable ? INLINE_IMMUTABLE_CACHE_CONTROL : INLINE_CACHE_CONTROL,
+    cacheControl: INLINE_CACHE_CONTROL,
   })
 }

apps/sim/app/api/workspaces/[id]/files/inline/route.test.ts

@@ -38,19 +38,20 @@ describe('GET /api/workspaces/[id]/files/inline', () => {
     mockDownloadFile.mockResolvedValue(PNG)
   })
 
-  it('serves a workspace-scoped image by fileId (revalidated — the key can change on re-upload)', async () => {
+  it('serves a workspace-scoped image by fileId, always revalidating', async () => {
     const res = await GET(req('fileId=wf_abc'), params)
     expect(res.status).toBe(200)
     expect(mockResolveImage).toHaveBeenCalledWith('ws-1', { fileId: 'wf_abc' })
-    // A fileId points at whatever bytes are current, so it must NOT be cached immutably.
+    // Authenticated content: always revalidate so a deletion/revocation is enforced on the next request.
     expect(res.headers.get('Cache-Control')).toBe('private, no-cache, must-revalidate')
   })
 
-  it('serves a workspace-scoped image by key with an immutable (content-addressed) cache', async () => {
+  it('serves a workspace-scoped image by key, always revalidating', async () => {
     const res = await GET(req(`key=${encodeURIComponent('workspace/ws-1/x-photo.png')}`), params)
     expect(res.status).toBe(200)
-    // A `key=` embed addresses an immutable storage key → cache hard (privately) to avoid re-downloads.
-    expect(res.headers.get('Cache-Control')).toBe('private, max-age=31536000, immutable')
+    // Same policy as fileId: authenticated content never cached past a revalidation, so a deleted or
+    // access-revoked image drops out immediately rather than lingering in a private browser cache.
+    expect(res.headers.get('Cache-Control')).toBe('private, no-cache, must-revalidate')
   })
 
   it('404s when the reference does not resolve in the workspace (cross-workspace)', async () => {

apps/sim/app/api/workspaces/[id]/files/inline/route.ts

@@ -47,10 +47,7 @@ export const GET = withRouteHandler(
         throw new FileNotFoundError('Not found')
       }
 
-      // A `key=` embed addresses a content-addressed, immutable storage key → cache it hard (privately)
-      // so re-opening a doc doesn't re-download every embedded image. A `fileId=` embed can point at new
-      // bytes after a re-upload, so it must keep revalidating.
-      return await serveInlineImage(image, { sniff: false, immutable: 'key' in ref })
+      return await serveInlineImage(image, { sniff: false })
     } catch (error) {
       if (error instanceof FileNotFoundError) {
         return createErrorResponse(error)