fix(files): bound the content-addressed inline-image cache so deletions propagate

A one-year immutable cache on key= embeds bypassed the server-side deletion/revocation
check for up to a year. Content-addressed bytes are stable but availability is not, so
cache them with a short revalidating window (private, max-age=300, must-revalidate)
instead of immutable: still avoids the re-download storm on rapid doc re-opens, but a
deleted or access-revoked image drops out within ~5 minutes. fileId= embeds and the
public-share route are unchanged.

Author: waleedlatif1

apps/sim/app/api/files/serve-inline-image.ts

@@ -9,28 +9,31 @@ const logger = createLogger('InlineImageServe')
 
 /**
  * A `fileId=` embed (or a shared/revocable audience) must never serve stale bytes from its fixed inline
- * URL, so it revalidates on each request. See `immutable` below for the cacheable case.
+ * URL, so it revalidates on each request. See the content-addressed constant below for the cacheable case.
  */
 const INLINE_CACHE_CONTROL = 'private, no-cache, must-revalidate'
 
 /**
- * A `key=` embed addresses a CONTENT-ADDRESSED, immutable storage key (a re-upload mints a new key), so
- * its bytes never change — safe to cache hard in the (private) browser cache, avoiding a re-download of
- * every embedded image on each doc re-open/re-render. NEVER use this for the public-share route (a share
- * can be revoked) or a `fileId=` embed (the underlying key can change under a stable fileId).
+ * A `key=` embed addresses a CONTENT-ADDRESSED storage key (a re-upload mints a new key), so its bytes
+ * never change — safe to reuse briefly from the (private) browser cache, avoiding a re-download of every
+ * embedded image on each doc re-open/re-render. A SHORT window (not `immutable`): the bytes are stable but
+ * the file can still be DELETED or its access REVOKED, and each revalidation re-runs that server-side
+ * check, so a short max-age bounds how long a deleted/revoked image can linger in a client's cache. NEVER
+ * use this for a `fileId=` embed (the underlying key can change under a stable fileId → stale bytes).
  */
-const INLINE_IMMUTABLE_CACHE_CONTROL = 'private, max-age=31536000, immutable'
+const INLINE_CONTENT_ADDRESSED_CACHE_CONTROL = 'private, max-age=300, must-revalidate'
 
 /**
  * Download and respond with an already-workspace-scoped inline image — the single serving tail for both
  * the in-app and public inline routes. When `sniff` is set (public shares, a less-trusted audience), the
  * served content type is derived from the bytes and non-raster content is refused with 404; otherwise the
- * stored content type is served, matching the in-app serve route. `immutable` opts a content-addressed
- * (`key=`) in-app embed into a long private cache; leave it false for `fileId=` embeds and public shares.
+ * stored content type is served, matching the in-app serve route. `contentAddressed` opts a
+ * content-addressed (`key=`) in-app embed into a short private cache; leave it false for `fileId=` embeds
+ * and public shares.
  */
 export async function serveInlineImage(
   image: ResolvedInlineImage,
-  { sniff, immutable = false }: { sniff: boolean; immutable?: boolean }
+  { sniff, contentAddressed = false }: { sniff: boolean; contentAddressed?: boolean }
 ): Promise<NextResponse> {
   const buffer = await downloadFile({ key: image.key, context: 'workspace' })
 
@@ -48,6 +51,6 @@ export async function serveInlineImage(
     buffer,
     contentType,
     filename: image.filename,
-    cacheControl: immutable ? INLINE_IMMUTABLE_CACHE_CONTROL : INLINE_CACHE_CONTROL,
+    cacheControl: contentAddressed ? INLINE_CONTENT_ADDRESSED_CACHE_CONTROL : INLINE_CACHE_CONTROL,
   })
 }

apps/sim/app/api/workspaces/[id]/files/inline/route.test.ts

@@ -46,11 +46,12 @@ describe('GET /api/workspaces/[id]/files/inline', () => {
     expect(res.headers.get('Cache-Control')).toBe('private, no-cache, must-revalidate')
   })
 
-  it('serves a workspace-scoped image by key with an immutable (content-addressed) cache', async () => {
+  it('serves a workspace-scoped image by key with a short content-addressed cache', async () => {
     const res = await GET(req(`key=${encodeURIComponent('workspace/ws-1/x-photo.png')}`), params)
     expect(res.status).toBe(200)
-    // A `key=` embed addresses an immutable storage key → cache hard (privately) to avoid re-downloads.
-    expect(res.headers.get('Cache-Control')).toBe('private, max-age=31536000, immutable')
+    // A `key=` embed addresses a content-addressed storage key → cache briefly (privately) to avoid
+    // re-download storms, but revalidate often enough that a deleted image drops out (not `immutable`).
+    expect(res.headers.get('Cache-Control')).toBe('private, max-age=300, must-revalidate')
   })
 
   it('404s when the reference does not resolve in the workspace (cross-workspace)', async () => {

apps/sim/app/api/workspaces/[id]/files/inline/route.ts

@@ -47,10 +47,11 @@ export const GET = withRouteHandler(
         throw new FileNotFoundError('Not found')
       }
 
-      // A `key=` embed addresses a content-addressed, immutable storage key → cache it hard (privately)
-      // so re-opening a doc doesn't re-download every embedded image. A `fileId=` embed can point at new
-      // bytes after a re-upload, so it must keep revalidating.
-      return await serveInlineImage(image, { sniff: false, immutable: 'key' in ref })
+      // A `key=` embed addresses a content-addressed storage key → cache it briefly (privately) so
+      // re-opening a doc doesn't re-download every embedded image, while still revalidating often enough
+      // that a deleted/revoked image drops out. A `fileId=` embed can point at new bytes after a re-upload,
+      // so it must revalidate every time.
+      return await serveInlineImage(image, { sniff: false, contentAddressed: 'key' in ref })
     } catch (error) {
       if (error instanceof FileNotFoundError) {
         return createErrorResponse(error)