fix(account-deletion): read durable storage keys before the deletion locks

- collectAccountStorageObjects runs the exact-key keyset reads before the
  transaction, beside collectAccountStorageKeys; inside it,
  enqueueAccountStorageCleanupInTx now only inserts the prefix-sweep events and
  the pre-collected exact-key events, so teammates' writes in shared workspaces
  never wait on those reads
- Project prefix cleanup completes on a short listing page again, as before
- the file-serve route keeps its original public-prefix check

Author: waleedlatif1

apps/sim/app/api/files/serve/[...path]/route.ts

@@ -25,11 +25,7 @@ import { FILE_CACHE_CONTROL, workspaceFileCacheControl } from '@/lib/uploads/ser
 import { resolveServableImageBytes } from '@/lib/uploads/server/image-derivative'
 import { resolveStoredFileContext } from '@/lib/uploads/server/metadata'
 import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
-import {
-  inferContextFromKey,
-  isPublicStorageKey,
-  resolveEffectiveMimeType,
-} from '@/lib/uploads/utils/file'
+import { inferContextFromKey, resolveEffectiveMimeType } from '@/lib/uploads/utils/file'
 import { internalWorkspaceFileServeAuth } from '@/lib/workspace-files/api'
 import { fetchAuthorizedServableWorkspaceFileBuffer } from '@/lib/workspace-files/application/fetch-servable-workspace-file-buffer'
 import { finishFileDelivery } from '@/lib/workspace-files/application/finish-file-delivery'
@@ -303,7 +299,13 @@ export const GET = withRouteHandler(
         })
       }
 
-      if (isPublicStorageKey(cloudKey)) {
+      const isPublicByKeyPrefix =
+        cloudKey.startsWith('profile-pictures/') ||
+        cloudKey.startsWith('og-images/') ||
+        cloudKey.startsWith('workspace-logos/') ||
+        cloudKey.startsWith('organization-logos/')
+
+      if (isPublicByKeyPrefix) {
         const context = inferContextFromKey(cloudKey)
         logger.info(`Serving public ${context}:`, { cloudKey })
         if (isUsingCloudStorage() || isCloudPath) {
@@ -387,6 +389,7 @@ export const GET = withRouteHandler(
         request.method === 'HEAD'
       )
     } catch (error) {
+      if (request.signal.aborted) throw error
       if (error instanceof InternalUnauthenticatedError) {
         logger.warn('Unauthorized file access attempt', { error: error.message })
         return NextResponse.json(
@@ -597,6 +600,7 @@ async function handleLocalFile(
       options.ifNoneMatch
     )
   } catch (error) {
+    if (signal?.aborted) throw error
     logServeFailure('Error reading local file:', error)
     throw error
   }
@@ -687,6 +691,7 @@ async function handleCloudProxy(
       options.ifNoneMatch
     )
   } catch (error) {
+    if (signal?.aborted) throw error
     logServeFailure('Error downloading from cloud storage:', error)
     throw error
   }

apps/sim/lib/projects/files/prefix-cleanup.ts

@@ -21,6 +21,7 @@ import {
   deleteStorageKeysUnderPrefix,
   listStorageKeyPage,
   outboxDeadlineNear,
+  STORAGE_KEY_PAGE_SIZE,
   storageCleanupAvailableAt,
 } from '@/lib/uploads/core/prefix-sweep'
 import { abortProviderUpload } from '@/lib/uploads/upload-session/provider'
@@ -214,7 +215,7 @@ async function sweepPrefix(
     page.keys,
     context
   )
-  if (complete && page.done) return 'done'
+  if (complete && page.keys.length < STORAGE_KEY_PAGE_SIZE) return 'done'
   return deleted > 0 ? 'continue' : 'stalled'
 }
 

apps/sim/lib/uploads/core/prefix-sweep.ts

@@ -14,7 +14,8 @@ import { UPLOAD_DIR_SERVER } from '@/lib/uploads/core/setup.server'
 import { deleteFile } from '@/lib/uploads/core/storage-service'
 import { UPLOAD_URL_TTL_MS } from '@/lib/uploads/upload-session/provider'
 
-const PAGE_SIZE = 500
+/** Most keys one {@link listStorageKeyPage} call returns. */
+export const STORAGE_KEY_PAGE_SIZE = 500
 const CLOCK_SKEW_MS = 60_000
 const DEADLINE_MARGIN_MS = 5000
 
@@ -55,7 +56,7 @@ async function localKeys(prefix: string, signal: AbortSignal): Promise<string[]>
       const child = `${key}${entry.name}`
       if (entry.isDirectory()) await visit(`${child}/`)
       else keys.push(child)
-      if (keys.length >= PAGE_SIZE) return
+      if (keys.length >= STORAGE_KEY_PAGE_SIZE) return
     }
     await removeEmptyDirectory(join(UPLOAD_DIR_SERVER, key))
   }
@@ -94,7 +95,7 @@ export async function listStorageKeyPage(
       new ListObjectsV2Command({
         Bucket: config.bucket,
         Prefix: prefix,
-        MaxKeys: PAGE_SIZE,
+        MaxKeys: STORAGE_KEY_PAGE_SIZE,
         ...(pageToken ? { ContinuationToken: pageToken } : {}),
       }),
       { abortSignal: signal }
@@ -111,7 +112,10 @@ export async function listStorageKeyPage(
     const pages = (await getBlobServiceClient())
       .getContainerClient(config.containerName)
       .listBlobsFlat({ prefix, abortSignal: signal })
-      .byPage({ maxPageSize: PAGE_SIZE, ...(pageToken ? { continuationToken: pageToken } : {}) })
+      .byPage({
+        maxPageSize: STORAGE_KEY_PAGE_SIZE,
+        ...(pageToken ? { continuationToken: pageToken } : {}),
+      })
     const page = await pages.next()
     if (page.done) return { keys: [], done: true }
     return keyPage(
@@ -125,7 +129,7 @@ export async function listStorageKeyPage(
     if (!config.bucket) throw new Error(`Bucket missing for ${context} storage`)
     const [files, nextQuery] = await (await getGcsClient()).bucket(config.bucket).getFiles({
       prefix,
-      maxResults: PAGE_SIZE,
+      maxResults: STORAGE_KEY_PAGE_SIZE,
       autoPaginate: false,
       ...(pageToken ? { pageToken } : {}),
     })
@@ -138,7 +142,7 @@ export async function listStorageKeyPage(
     )
   }
   const keys = await localKeys(prefix, signal)
-  return { keys, done: keys.length < PAGE_SIZE }
+  return { keys, done: keys.length < STORAGE_KEY_PAGE_SIZE }
 }
 
 /**

apps/sim/lib/users/account-deletion.ts

@@ -55,7 +55,10 @@ import {
 import type { StorageContext } from '@/lib/uploads'
 import { isUsingCloudStorage, StorageService } from '@/lib/uploads'
 import { createStorageReferenceGuard } from '@/lib/users/storage-reference-guard'
-import { enqueueAccountStorageCleanupInTx } from '@/lib/users/storage-sweep'
+import {
+  collectAccountStorageObjects,
+  enqueueAccountStorageCleanupInTx,
+} from '@/lib/users/storage-sweep'
 import {
   listSharedResourceWorkspaceIdsForUser,
   listUnresolvedSharedResourceWorkspaces,
@@ -794,6 +797,10 @@ export async function deleteUserAccount(userId: string): Promise<AccountDeletion
   const doomedWorkspaceIds = plan.workspacesToDelete.map((workspace) => workspace.id)
   const doomed = new Set(doomedWorkspaceIds)
   const storageKeys = await collectAccountStorageKeys(userId, doomedWorkspaceIds)
+  const durableStorageObjects = await collectAccountStorageObjects({
+    userId,
+    workspaceIds: doomedWorkspaceIds,
+  })
 
   let cancelledDispatches: CancelledDispatch[] = []
   let cancelledMarkers: CancelledCellMarker[] = []
@@ -877,11 +884,12 @@ export async function deleteUserAccount(userId: string): Promise<AccountDeletion
      * workspace and user deletes cascade their rows away; delivered after commit.
      */
     stoppedRuns = await stopLiveRunsTx(tx, { userId })
-    /**
-     * Queued while the doomed workspaces are locked and their rows still exist: every object
-     * that cascades away below gets a durable, delayed cleanup that commits with the deletion.
-     */
-    await enqueueAccountStorageCleanupInTx(tx, { userId, workspaceIds: doomedWorkspaceIds })
+    /** Inserts only: the exact keys were read before the transaction took its locks. */
+    await enqueueAccountStorageCleanupInTx(tx, {
+      userId,
+      workspaceIds: doomedWorkspaceIds,
+      objects: durableStorageObjects,
+    })
     if (doomedWorkspaceIds.length > 0) {
       /**
        * Re-checked here rather than trusted from the plan: a workspace that

apps/sim/lib/users/storage-reference-guard.ts

@@ -156,7 +156,8 @@ async function loadUrlReferencedKeys(needles: readonly string[] | null): Promise
  *
  * - a row still names it: `workspace_files.key`, `workspace_file.key`,
  *   `workspace_file_version.key`, `document.storage_key`, `execution_large_values.key`; or
- * - it sits under a world-readable root (`isPublicStorageKey`) and a stored asset URL names it (see
+ * - it sits under a world-readable root (`isPublicStorageKey`, the same prefixes the file-serve
+ *   route's `isPublicByKeyPrefix` answers without a session) and a stored asset URL names it (see
  *   {@link loadUrlReferencedKeys}). Only rows containing the key's longest URL-safe run are read,
  *   each run at most once per guard. No URL column is read for any other key:
  *   `verifyFileAccess` serves it only through a row, by its key path under a workspace that still

apps/sim/lib/users/storage-sweep.test.ts

@@ -21,6 +21,7 @@ import type { OutboxEventContext } from '@/lib/core/outbox/service'
 import type { DbTransaction } from '@/lib/db/types'
 import {
   accountStorageSweepOutboxHandlers,
+  collectAccountStorageObjects,
   enqueueAccountStorageCleanupInTx,
 } from '@/lib/users/storage-sweep'
 import {
@@ -360,6 +361,15 @@ describe('queueing account storage cleanup', () => {
     resetDbChainMock()
   })
 
+  async function queueCleanup(): Promise<void> {
+    const objects = await collectAccountStorageObjects({ userId: 'user-1', workspaceIds: [] })
+    await enqueueAccountStorageCleanupInTx(dbChainMock.db as unknown as DbTransaction, {
+      userId: 'user-1',
+      workspaceIds: [],
+      objects,
+    })
+  }
+
   function queuedObjectKeys(): string[] {
     return dbChainMockFns.values.mock.calls.flatMap(([rows]) =>
       (rows as { payload: { objects?: { key: string }[] } }[]).flatMap(
@@ -381,26 +391,36 @@ describe('queueing account storage cleanup', () => {
     queueTableRows(schemaMock.workspaceFileVersion, versionPage(0, 1000))
     queueTableRows(schemaMock.workspaceFileVersion, versionPage(1000, 5))
 
-    await enqueueAccountStorageCleanupInTx(dbChainMock.db as unknown as DbTransaction, {
-      userId: 'user-1',
-      workspaceIds: [],
-    })
+    await queueCleanup()
 
     const keys = queuedObjectKeys()
     expect(keys).toHaveLength(1006)
     expect(keys).toContain('copilot/abc/v1004.txt')
   })
 
+  it('only inserts inside the deletion transaction', async () => {
+    queueTableRows(schemaMock.workspaceFiles, [
+      { id: 'file-1', key: 'copilot/abc/file.txt', context: 'copilot' },
+    ])
+    const objects = await collectAccountStorageObjects({ userId: 'user-1', workspaceIds: ['ws1'] })
+    const insertOnly = { insert: dbChainMock.db.insert } as unknown as DbTransaction
+
+    await enqueueAccountStorageCleanupInTx(insertOnly, {
+      userId: 'user-1',
+      workspaceIds: ['ws1'],
+      objects,
+    })
+
+    expect(queuedObjectKeys()).toEqual(['copilot/abc/file.txt'])
+  })
+
   it('never queues a profile picture row', async () => {
     queueTableRows(schemaMock.workspaceFiles, [
       { id: 'file-1', key: 'profile-pictures/org-logo.png', context: 'profile-pictures' },
       { id: 'file-2', key: 'copilot/abc/file.txt', context: 'copilot' },
     ])
 
-    await enqueueAccountStorageCleanupInTx(dbChainMock.db as unknown as DbTransaction, {
-      userId: 'user-1',
-      workspaceIds: [],
-    })
+    await queueCleanup()
 
     expect(queuedObjectKeys()).toEqual(['copilot/abc/file.txt'])
   })