fix(file): resolve basic-picker files for manage sharing

The basic file-upload picker stores a workspace file as { name, path, key,
size, type } with no canonical id, so manage_sharing failed those picks with
'Could not determine the file to share'. The block now passes the picked
object as fileInput when it lacks an id, and the route resolves the canonical
id from the storage key via getFileMetadataByKey. Contract accepts fileId OR
fileInput (mirroring read/get content).

Author: TheodoreSpeaks

apps/sim/app/api/tools/file/manage/route.ts

@@ -28,6 +28,7 @@ import {
   updateWorkspaceFileContent,
   uploadWorkspaceFile,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import { getFileMetadataByKey } from '@/lib/uploads/server/metadata'
 import { getFileExtension, getMimeTypeFromExtension } from '@/lib/uploads/utils/file-utils'
 import { downloadFileFromStorage } from '@/lib/uploads/utils/file-utils.server'
 import { performMoveWorkspaceFileItems } from '@/lib/workspace-files/orchestration'
@@ -577,7 +578,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       }
 
       case 'manage_sharing': {
-        const { fileId, isActive, authType, password, allowedEmails } = body
+        const { fileId, fileInput, isActive, authType, password, allowedEmails } = body
 
         // Check permission before probing file existence so a read-only caller
         // can't distinguish 404 from 403 as a file-existence side channel.
@@ -591,10 +592,33 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           )
         }
 
-        const file = await getWorkspaceFile(workspaceId, fileId)
+        // Resolve the canonical file id. The basic file picker provides an object
+        // with a storage `key` but no id, so map the key to the workspace file row.
+        let resolvedFileId = typeof fileId === 'string' ? fileId : undefined
+        if (!resolvedFileId && fileInput) {
+          const single = Array.isArray(fileInput) ? fileInput[0] : fileInput
+          if (single && typeof single === 'object') {
+            const record = single as Record<string, unknown>
+            if (typeof record.id === 'string' && record.id) resolvedFileId = record.id
+            else if (typeof record.fileId === 'string' && record.fileId)
+              resolvedFileId = record.fileId
+            else if (typeof record.key === 'string' && record.key) {
+              const meta = await getFileMetadataByKey(record.key, 'workspace')
+              resolvedFileId = meta?.id
+            }
+          }
+        }
+        if (!resolvedFileId) {
+          return NextResponse.json(
+            { success: false, error: 'A valid file is required to manage sharing' },
+            { status: 400 }
+          )
+        }
+
+        const file = await getWorkspaceFile(workspaceId, resolvedFileId)
         if (!file) {
           return NextResponse.json(
-            { success: false, error: `File not found: "${fileId}"` },
+            { success: false, error: `File not found: "${resolvedFileId}"` },
             { status: 404 }
           )
         }
@@ -605,7 +629,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           // Resolve the auth type the same way upsertFileShare will (falling back
           // to the existing share's type) so the policy gate can't be bypassed by
           // re-enabling a pre-existing restricted share without an explicit authType.
-          const existingShare = await getShareForResource('file', fileId)
+          const existingShare = await getShareForResource('file', resolvedFileId)
           const resolvedAuthType = authType ?? existingShare?.authType ?? 'public'
           try {
             await validatePublicFileSharing(userId, workspaceId, resolvedAuthType)
@@ -619,7 +643,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
         const share = await upsertFileShare({
           workspaceId,
-          fileId,
+          fileId: resolvedFileId,
           userId,
           isActive,
           authType,
@@ -632,13 +656,17 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           actorId: userId,
           action: isActive ? AuditAction.FILE_SHARED : AuditAction.FILE_SHARE_DISABLED,
           resourceType: AuditResourceType.FILE,
-          resourceId: fileId,
+          resourceId: resolvedFileId,
           resourceName: file.name,
           description: `${isActive ? 'Enabled' : 'Disabled'} public share for "${file.name}"`,
           request,
         })
 
-        logger.info('File sharing updated', { fileId, isActive, authType: share.authType })
+        logger.info('File sharing updated', {
+          fileId: resolvedFileId,
+          isActive,
+          authType: share.authType,
+        })
 
         // A disabled link doesn't resolve, so don't hand back a dead URL.
         const responseShare = share.isActive ? share : { ...share, url: '' }

apps/sim/blocks/blocks/file.test.ts

@@ -200,6 +200,28 @@ describe('FileV5Block', () => {
     })
   })
 
+  it('passes a picker file object without an id through as fileInput for manage sharing', () => {
+    const picked = {
+      name: 'report.pdf',
+      key: 'workspace/workspace-1/123-abc-report.pdf',
+      path: '/api/files/serve/workspace%2Fworkspace-1%2F123-abc-report.pdf?context=workspace',
+      size: 10,
+      type: 'application/pdf',
+    }
+    expect(
+      buildParams({
+        operation: 'file_manage_sharing',
+        shareInput: [picked],
+        shareVisibility: 'public',
+        _context: { workspaceId: 'workspace-1' },
+      })
+    ).toMatchObject({
+      fileInput: picked,
+      isActive: true,
+      authType: 'public',
+    })
+  })
+
   it('throws when no file is provided for manage sharing', () => {
     expect(() => buildParams({ operation: 'file_manage_sharing' })).toThrow(
       'File is required to manage sharing'

apps/sim/blocks/blocks/file.ts

@@ -1208,22 +1208,6 @@ export const FileV5Block: BlockConfig<FileParserV3Output> = {
             throw new Error('File is required to manage sharing')
           }
 
-          let fileId: string
-          const fileIds = parseReadFileIds(shareInput)
-          if (fileIds) {
-            if (Array.isArray(fileIds) && fileIds.length > 1) {
-              throw new Error('Manage Sharing accepts a single file at a time')
-            }
-            fileId = Array.isArray(fileIds) ? fileIds[0] : fileIds
-          } else {
-            const normalized = normalizeFileInput(shareInput, { single: true })
-            const file = normalized as Record<string, unknown> | null
-            fileId = (file?.id as string) ?? ''
-          }
-          if (!fileId) {
-            throw new Error('Could not determine the file to share')
-          }
-
           const allowedEmails =
             typeof params.shareAllowedEmails === 'string'
               ? params.shareAllowedEmails
@@ -1234,16 +1218,36 @@ export const FileV5Block: BlockConfig<FileParserV3Output> = {
 
           const visibility = (params.shareVisibility as string) || 'public'
           const isActive = visibility !== 'private'
-
-          return {
-            fileId,
+          const shareParams = {
             isActive,
             // When disabling, leave authType unset so the stored access mode is preserved.
             authType: isActive ? visibility : undefined,
             password: params.sharePassword,
             allowedEmails,
             workspaceId: params._context?.workspaceId,
           }
+
+          // Canonical IDs (advanced mode or upstream references) resolve directly.
+          const fileIds = parseReadFileIds(shareInput)
+          if (fileIds) {
+            if (Array.isArray(fileIds) && fileIds.length > 1) {
+              throw new Error('Manage Sharing accepts a single file at a time')
+            }
+            return { fileId: Array.isArray(fileIds) ? fileIds[0] : fileIds, ...shareParams }
+          }
+
+          // The basic picker yields a file object; it carries an id only sometimes,
+          // so prefer the id when present and otherwise pass the object for the
+          // route to resolve via its storage key.
+          const normalized = normalizeFileInput(shareInput, { single: true })
+          const file = normalized as Record<string, unknown> | null
+          if (!file) {
+            throw new Error('Could not determine the file to share')
+          }
+          if (typeof file.id === 'string' && file.id) {
+            return { fileId: file.id, ...shareParams }
+          }
+          return { fileInput: normalized, ...shareParams }
         }
 
         if (operation === 'file_fetch') {

apps/sim/lib/api/contracts/tools/file.ts

@@ -43,15 +43,20 @@ export const fileManageMoveBodySchema = z.object({
 
 export type FileManageMoveBody = z.input<typeof fileManageMoveBodySchema>
 
-export const fileManageSharingBodySchema = z.object({
-  operation: z.literal('manage_sharing'),
-  workspaceId: z.string().min(1).optional(),
-  fileId: z.string().min(1, 'fileId is required for manage_sharing operation'),
-  isActive: z.boolean({ error: 'isActive is required for manage_sharing operation' }),
-  authType: shareAuthTypeSchema.optional(),
-  password: z.string().min(1).max(1024).optional(),
-  allowedEmails: z.array(z.string().min(1)).max(200).optional(),
-})
+export const fileManageSharingBodySchema = z
+  .object({
+    operation: z.literal('manage_sharing'),
+    workspaceId: z.string().min(1).optional(),
+    fileId: z.string().min(1).optional(),
+    fileInput: z.unknown().optional(),
+    isActive: z.boolean({ error: 'isActive is required for manage_sharing operation' }),
+    authType: shareAuthTypeSchema.optional(),
+    password: z.string().min(1).max(1024).optional(),
+    allowedEmails: z.array(z.string().min(1)).max(200).optional(),
+  })
+  .refine((data) => data.fileId !== undefined || data.fileInput !== undefined, {
+    message: 'Either fileId or fileInput is required for manage_sharing operation',
+  })
 
 export type FileManageSharingBody = z.input<typeof fileManageSharingBodySchema>
 

apps/sim/tools/file/manage-sharing.ts

@@ -2,7 +2,8 @@ import type { ShareAuthType } from '@/lib/api/contracts/public-shares'
 import type { ToolConfig, ToolResponse, WorkflowToolExecutionContext } from '@/tools/types'
 
 interface FileManageSharingParams {
-  fileId: string
+  fileId?: string
+  fileInput?: unknown
   isActive: boolean
   authType?: ShareAuthType
   password?: string
@@ -21,9 +22,15 @@ export const fileManageSharingTool: ToolConfig<FileManageSharingParams, ToolResp
   params: {
     fileId: {
       type: 'string',
-      required: true,
+      required: false,
       visibility: 'user-or-llm',
-      description: 'The ID of the workspace file to update sharing for.',
+      description: 'Canonical ID of the workspace file to update sharing for.',
+    },
+    fileInput: {
+      type: 'file',
+      required: false,
+      visibility: 'user-only',
+      description: 'Selected workspace file object (from the file picker).',
     },
     isActive: {
       type: 'boolean',
@@ -60,6 +67,7 @@ export const fileManageSharingTool: ToolConfig<FileManageSharingParams, ToolResp
     body: (params) => ({
       operation: 'manage_sharing',
       fileId: params.fileId,
+      fileInput: params.fileInput,
       isActive: params.isActive,
       authType: params.authType,
       password: params.password,