test(supabase): track #7262 permitting a whitespace-only path component

#7262 landed 515b951, narrowing safeUrlPath's empty-segment check from
!segment.trim() to !segment — the fix this suite asked for after flagging the
over-rejection. Rebased onto it.

That changes behaviour under the Supabase storage key, so the suite is updated
rather than left asserting the old error text:

  a/ /b   -> a/%20/b                      (now permitted)
  a//b    -> rejects: empty path segment  (unchanged)

The distinction is the point and both halves are now pinned. A component that
is a single space is a legal, nameable key component; a genuinely empty one
addresses a different object than the caller wrote. Collapsing them again in
either direction is a silent correctness change — one makes a real key
unreachable, the other retargets the request.

Author: waleedlatif1

apps/sim/tools/supabase/path_safety.test.ts

@@ -222,7 +222,32 @@ describe('colon handling inherited from safeUrlPath', () => {
  */
 describe('empty segments in a storage key', () => {
   it.each(['/folder/x.png', 'folder//x.png', 'folder/x.png/'])('rejects %j', (value) => {
-    expect(() => encodeStoragePath(value)).toThrow(/empty or whitespace-only path segment/)
+    expect(() => encodeStoragePath(value)).toThrow(/empty path segment/)
+  })
+
+  /**
+   * A **whitespace-only** component is permitted, and that is not the same rule.
+   *
+   * `safeUrlPath` originally rejected `!segment.trim()`, which lumped `a/ /b` in
+   * with `a//b`. #7262 narrowed it to `!segment` after this suite flagged the
+   * over-rejection, and the distinction is exactly right for an object key: a
+   * component that is a single space is a legal, nameable key component, while a
+   * genuinely empty one addresses a *different* object than the caller wrote.
+   *
+   * Both halves are pinned here, because collapsing them again in either
+   * direction is a silent correctness change — one direction makes a real key
+   * unreachable, the other silently retargets the request.
+   */
+  it.each(['a/ /b', 'a/  /b', 'folder/ /file.png'])(
+    'permits the whitespace-only component in %j',
+    (value) => {
+      expect(decodeURIComponent(encodeStoragePath(value))).toBe(value)
+    }
+  )
+
+  it('keeps a whitespace-only component distinct from an empty one', () => {
+    expect(encodeStoragePath('a/ /b')).toBe('a/%20/b')
+    expect(() => encodeStoragePath('a//b')).toThrow(/empty path segment/)
   })
 
   it('would otherwise have addressed a different object', () => {

apps/sim/tools/supabase/utils.ts

@@ -47,6 +47,15 @@ export function encodeStorageSegment(segment: string, paramName = 'bucket'): str
  * normalizes its own trailing separator before joining `path` and `fileName`,
  * so the only way to produce an empty segment is a typo the caller wants to
  * hear about.
+ *
+ * A **whitespace-only** component is a different case and is permitted: `a/ /b`
+ * encodes to `a/%20/b`. That is a legal, nameable object key component, whereas
+ * `a//b` names something else entirely. `safeUrlPath` originally conflated the
+ * two by testing `!segment.trim()`; #7262 narrowed it to `!segment` after this
+ * suite flagged the over-rejection. Both halves are pinned in
+ * `path_safety.test.ts`, because collapsing them again in either direction is a
+ * silent correctness change — one makes a real key unreachable, the other
+ * retargets the request.
  */
 export function encodeStoragePath(path: string, paramName = 'path'): string {
   return safeUrlPath(path, paramName)