Downloaded pages carry their images

Absolute URLs made LINKS survive a download, but an embedded image
request from a downloaded file is cross-site and carries no session
cookie, so images 401ed outside the app. The standalone renderer now
inlines every workspace image the page references as a data: URI at
serve time — like a pdf carrying its images — capped at 8MB per image,
restricted to the page's own workspace, falling back to the URL
reference on any miss. Applies to serve, download, and public shares.

Author: Sg312

apps/sim/app/api/files/public/[token]/content/route.ts

@@ -13,7 +13,7 @@ import { resolveActiveShareByToken } from '@/lib/public-shares/share-manager'
 import { downloadFile } from '@/lib/uploads/core/storage-service'
 import { resolveServableImageBytes } from '@/lib/uploads/server/image-derivative'
 import { isSimPageSource } from '@/lib/workspace-files/page-compile'
-import { renderSimPageDocument } from '@/lib/workspace-files/page-document'
+import { renderSimPageDocumentWithAssets } from '@/lib/workspace-files/page-document.server'
 import {
   createErrorResponse,
   createFileResponse,
@@ -100,7 +100,7 @@ export const GET = withRouteHandler(
         // routes. sim: links resolve to workspace routes (a viewer without
         // workspace access simply lands on the sign-in gate).
         buffer = Buffer.from(
-          renderSimPageDocument(raw.toString('utf8'), {
+          await renderSimPageDocumentWithAssets(raw.toString('utf8'), {
             workspaceId: file.workspaceId ?? undefined,
           }),
           'utf8'

apps/sim/app/api/files/serve/[...path]/route.ts

@@ -23,7 +23,7 @@ import { inferContextFromKey } from '@/lib/uploads/utils/file-utils'
 import { internalWorkspaceFileServeAuth } from '@/lib/workspace-files/api'
 import { readWorkspaceFileContentByKey } from '@/lib/workspace-files/application/read-workspace-file-content-by-key'
 import { isSimPageSource } from '@/lib/workspace-files/page-compile'
-import { renderSimPageDocument } from '@/lib/workspace-files/page-document'
+import { renderSimPageDocumentWithAssets } from '@/lib/workspace-files/page-document.server'
 import { verifyFileAccess } from '@/app/api/files/authorization'
 import {
   createErrorResponse,
@@ -93,7 +93,7 @@ async function resolveServableBytes(params: {
     const text = buffer.toString('utf8')
     if (isSimPageSource(text)) {
       return {
-        buffer: Buffer.from(renderSimPageDocument(text, { workspaceId }), 'utf8'),
+        buffer: Buffer.from(await renderSimPageDocumentWithAssets(text, { workspaceId }), 'utf8'),
         contentType: 'text/html',
       }
     }

apps/sim/lib/uploads/utils/file-utils.server.ts

@@ -34,7 +34,7 @@ import {
   resolveTrustedFileContext,
 } from '@/lib/uploads/utils/file-utils'
 import { isSimPageSource } from '@/lib/workspace-files/page-compile'
-import { renderSimPageDocument } from '@/lib/workspace-files/page-document'
+import { renderSimPageDocumentWithAssets } from '@/lib/workspace-files/page-document.server'
 import { verifyFileAccess } from '@/app/api/files/authorization'
 import type { UserFile } from '@/executor/types'
 
@@ -430,7 +430,7 @@ export async function downloadServableFileFromStorage(
         ? (parseWorkspaceFileKey(userFile.key) ?? undefined)
         : undefined
       return {
-        buffer: Buffer.from(renderSimPageDocument(text, { workspaceId }), 'utf8'),
+        buffer: Buffer.from(await renderSimPageDocumentWithAssets(text, { workspaceId }), 'utf8'),
         contentType: 'text/html',
       }
     }

apps/sim/lib/workspace-files/page-document.server.ts

@@ -0,0 +1,50 @@
+import { downloadFile } from '@/lib/uploads/core/storage-service'
+import { getFileMetadataById } from '@/lib/uploads/server/metadata'
+import { renderSimPageDocument } from '@/lib/workspace-files/page-document'
+
+/** Images past this size stay as URL references rather than bloating the document. */
+const MAX_INLINE_IMAGE_BYTES = 8 * 1024 * 1024
+
+const IMAGE_SRC = /src="[^"]*\/api\/files\/view\/([^"]+)"/g
+
+/**
+ * The full pdf model for the standalone document: like a pdf carrying its
+ * images, the served page inlines every workspace image it references as a
+ * data: URI. Absolute link URLs already survive a download, but an embedded
+ * image request from a downloaded file is cross-site and carries no session
+ * cookie, so only baked-in bytes render everywhere. Images must live in the
+ * page's own workspace — a reference into another workspace stays a URL and
+ * renders only where the viewer's own session authorizes it.
+ */
+export async function renderSimPageDocumentWithAssets(
+  source: string,
+  options: { workspaceId?: string }
+): Promise<string> {
+  const documentHtml = renderSimPageDocument(source, options)
+  const ids = [...new Set([...documentHtml.matchAll(IMAGE_SRC)].map((match) => match[1]))]
+  if (ids.length === 0 || !options.workspaceId) return documentHtml
+
+  const inlined = new Map<string, string>()
+  await Promise.all(
+    ids.map(async (id) => {
+      try {
+        const record = await getFileMetadataById(id)
+        if (!record || record.context !== 'workspace' || record.workspaceId !== options.workspaceId)
+          return
+        const bytes = await downloadFile({ key: record.key, context: 'workspace' })
+        if (bytes.length > MAX_INLINE_IMAGE_BYTES) return
+        const mime = record.contentType?.startsWith('image/')
+          ? record.contentType
+          : 'application/octet-stream'
+        inlined.set(id, `data:${mime};base64,${bytes.toString('base64')}`)
+      } catch {
+        // A missing or unreadable image keeps its URL reference.
+      }
+    })
+  )
+  if (inlined.size === 0) return documentHtml
+  return documentHtml.replace(IMAGE_SRC, (match, id: string) => {
+    const dataUri = inlined.get(id)
+    return dataUri ? `src="${dataUri}"` : match
+  })
+}