feat(files): add presigned URL generation support for execution files

[waleedlatif1]

Summary

• add presigned URL generation support for execution files, to make file URLs accessible to 3P services during the execution itself

Type of Change

• Bug fix

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
docs	Skipped			Nov 14, 2025 3:06am

[greptile-apps]

Greptile Overview

Greptile Summary

Replaced static URL generation (getBaseUrl() + /api/files/serve/) with presigned URLs for execution files. The change improves security by generating time-limited URLs (10 minutes expiration) instead of permanent URLs for file access.

Key changes:

• Removed import of getBaseUrl from @/lib/urls/utils
• Added import of generatePresignedDownloadUrl from storage service
• Changed URL generation from static path to generatePresignedDownloadUrl(fileInfo.key, 'execution', 600)
• Updated comment to reflect presigned URL usage

Issues identified:

• The 10-minute expiration may be insufficient for:
  • Paused executions (human-in-the-loop): Workflows can be paused indefinitely waiting for user input, but the file URLs will expire
  • Long-running workflows: If a workflow takes longer than 10 minutes and passes file URLs to external services later in the execution
  • External service delays: Services like Telegram that receive file URLs may not access them immediately

Confidence Score: 2/5

• This PR has a significant risk: the 10-minute URL expiration will break file access in paused executions and potentially long-running workflows
• The implementation is technically correct and improves security by using presigned URLs. However, the 10-minute expiration is likely too short for this use case. Execution files can be part of paused workflows (human-in-the-loop) that may remain paused for hours or days, and the URLs stored in the execution snapshot will become invalid. Additionally, external services receiving these URLs may not access them immediately within the 10-minute window.
• apps/sim/lib/uploads/contexts/execution/execution-file-manager.ts - The expiration time needs to be reconsidered based on execution lifecycle requirements

Important Files Changed

File Analysis

Filename	Score	Overview
apps/sim/lib/uploads/contexts/execution/execution-file-manager.ts	3/5	Replaced static URL generation with presigned URLs (10 min expiration) for execution files, improving security but potentially causing issues with long-running or paused executions

Sequence Diagram

sequenceDiagram
    participant Tool as Tool/Block Execution
    participant EFM as ExecutionFileManager
    participant SS as StorageService
    participant Storage as Storage Provider (S3/Blob/Local)
    participant External as External Service (e.g., Telegram)
    
    Tool->>EFM: uploadExecutionFile(buffer, fileName)
    EFM->>SS: uploadFile(file, context: 'execution')
    SS->>Storage: Store file with key
    Storage-->>SS: fileInfo with key
    SS->>Storage: generatePresignedDownloadUrl(key, 600s)
    Storage-->>SS: presigned URL (expires in 10 min)
    SS-->>EFM: fileInfo + presigned URL
    EFM-->>Tool: UserFile with presigned URL
    
    Note over Tool,External: URL is passed to downstream blocks/external services
    Tool->>External: Send file URL
    
    rect rgb(255, 220, 220)
        Note over External: If accessed after 10 minutes,<br/>presigned URL will be expired
    end
    
    External->>Storage: GET presigned URL
    alt Within 10 minutes
        Storage-->>External: File data
    else After 10 minutes
        Storage-->>External: 403 Forbidden (URL expired)
    end

Loading

[greptile-apps]

_{1 file reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}