fix(uploads): bound Sim-page asset inlining before the bytes are resident

The ceiling on the rendered page checked the finished document, by which point
renderSimPageDocumentWithAssets had already downloaded every referenced image
concurrently with no per-download limit and base64-inlined them — so the
allocation the check exists to prevent had already happened.

Pick the inline set from recorded sizes before fetching anything, against a
per-document budget as well as the existing per-image one, and give each
download its own ceiling in case a row understates its object. An image that
does not fit keeps its URL reference, exactly as an oversized one already did.

Author: icecrasher321

apps/sim/lib/workspace-files/page-document.server.test.ts

@@ -0,0 +1,112 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockDownloadFile, mockGetFileMetadataById, mockRenderSimPageDocument } = vi.hoisted(() => ({
+  mockDownloadFile: vi.fn(),
+  mockGetFileMetadataById: vi.fn(),
+  mockRenderSimPageDocument: vi.fn(),
+}))
+
+vi.mock('@/lib/uploads/core/storage-service', () => ({
+  downloadFile: mockDownloadFile,
+}))
+
+vi.mock('@/lib/uploads/server/metadata', () => ({
+  getFileMetadataById: mockGetFileMetadataById,
+}))
+
+vi.mock('@/lib/workspace-files/page-document', () => ({
+  renderSimPageDocument: mockRenderSimPageDocument,
+}))
+
+import { renderSimPageDocumentWithAssets } from '@/lib/workspace-files/page-document.server'
+
+const WORKSPACE_ID = 'ws-1'
+const MB = 1024 * 1024
+
+function imageRecord(id: string, size: number) {
+  return {
+    id,
+    key: `workspace/${WORKSPACE_ID}/${id}.png`,
+    context: 'workspace',
+    workspaceId: WORKSPACE_ID,
+    contentType: 'image/png',
+    size,
+    sizeBytes: size,
+  }
+}
+
+function documentReferencing(ids: string[]) {
+  return ids.map((id) => `<img src="/api/files/view/${id}">`).join('')
+}
+
+describe('renderSimPageDocumentWithAssets memory bounds', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockDownloadFile.mockImplementation(async ({ maxBytes }) => Buffer.alloc(maxBytes ?? 4 * MB))
+  })
+
+  it('stops inlining once the per-document budget is spent, without fetching the rest', async () => {
+    // Five 8MB images against a 32MB document budget: four fit, the fifth must not
+    // even be downloaded — discovering its size after the fact is the bug.
+    const ids = ['a', 'b', 'c', 'd', 'e']
+    mockRenderSimPageDocument.mockReturnValue(documentReferencing(ids))
+    mockGetFileMetadataById.mockImplementation(async (id: string) => imageRecord(id, 8 * MB))
+    mockDownloadFile.mockImplementation(async () => Buffer.alloc(8 * MB))
+
+    const html = await renderSimPageDocumentWithAssets('source', { workspaceId: WORKSPACE_ID })
+
+    expect(mockDownloadFile).toHaveBeenCalledTimes(4)
+    // The image that did not fit keeps its URL reference rather than failing the render.
+    expect(html).toContain('src="/api/files/view/e"')
+  })
+
+  it('never fetches an image whose recorded size already exceeds the per-image limit', async () => {
+    mockRenderSimPageDocument.mockReturnValue(documentReferencing(['big']))
+    mockGetFileMetadataById.mockResolvedValue(imageRecord('big', 9 * MB))
+
+    const html = await renderSimPageDocumentWithAssets('source', { workspaceId: WORKSPACE_ID })
+
+    expect(mockDownloadFile).not.toHaveBeenCalled()
+    expect(html).toContain('src="/api/files/view/big"')
+  })
+
+  it('caps each download so a row understating its object cannot be inlined', async () => {
+    mockRenderSimPageDocument.mockReturnValue(documentReferencing(['liar']))
+    mockGetFileMetadataById.mockResolvedValue(imageRecord('liar', 1024))
+
+    await renderSimPageDocumentWithAssets('source', { workspaceId: WORKSPACE_ID })
+
+    expect(mockDownloadFile).toHaveBeenCalledWith(
+      expect.objectContaining({ maxBytes: 8 * MB, context: 'workspace' })
+    )
+  })
+
+  it('keeps the URL reference when a capped download rejects', async () => {
+    mockRenderSimPageDocument.mockReturnValue(documentReferencing(['liar']))
+    mockGetFileMetadataById.mockResolvedValue(imageRecord('liar', 1024))
+    mockDownloadFile.mockRejectedValue(new Error('storage download exceeds maximum size'))
+
+    const html = await renderSimPageDocumentWithAssets('source', { workspaceId: WORKSPACE_ID })
+
+    expect(html).toContain('src="/api/files/view/liar"')
+  })
+
+  it('inlines images that fit and leaves cross-workspace references alone', async () => {
+    mockRenderSimPageDocument.mockReturnValue(documentReferencing(['mine', 'theirs']))
+    mockGetFileMetadataById.mockImplementation(async (id: string) =>
+      id === 'mine'
+        ? imageRecord('mine', 1024)
+        : { ...imageRecord('theirs', 1024), workspaceId: 'ws-2' }
+    )
+    mockDownloadFile.mockResolvedValue(Buffer.from('png-bytes'))
+
+    const html = await renderSimPageDocumentWithAssets('source', { workspaceId: WORKSPACE_ID })
+
+    expect(mockDownloadFile).toHaveBeenCalledTimes(1)
+    expect(html).toContain(`data:image/png;base64,${Buffer.from('png-bytes').toString('base64')}`)
+    expect(html).toContain('src="/api/files/view/theirs"')
+  })
+})

apps/sim/lib/workspace-files/page-document.server.ts

@@ -5,6 +5,14 @@ import { renderSimPageDocument } from '@/lib/workspace-files/page-document'
 /** Images past this size stay as URL references rather than bloating the document. */
 const MAX_INLINE_IMAGE_BYTES = 8 * 1024 * 1024
 
+/**
+ * Ceiling on everything a single document inlines. A per-image limit does not bound
+ * the page on its own: N images each just under it still cost N times it, and they
+ * are fetched concurrently, so that product is also the peak. Images that do not fit
+ * the remaining budget keep their URL reference, exactly like an oversized one.
+ */
+const MAX_INLINE_TOTAL_BYTES = 32 * 1024 * 1024
+
 const IMAGE_SRC = /src="[^"]*\/api\/files\/view\/([^"]+)"/g
 
 /**
@@ -24,21 +32,45 @@ export async function renderSimPageDocumentWithAssets(
   const ids = [...new Set([...documentHtml.matchAll(IMAGE_SRC)].map((match) => match[1]))]
   if (ids.length === 0 || !options.workspaceId) return documentHtml
 
+  const candidates = await Promise.all(
+    ids.map(async (id) => {
+      const record = await getFileMetadataById(id).catch(() => null)
+      if (!record || record.context !== 'workspace' || record.workspaceId !== options.workspaceId)
+        return null
+      return { id, record }
+    })
+  )
+
+  // Pick the inline set from recorded sizes BEFORE fetching anything, so the concurrent
+  // downloads below are bounded in count and in total bytes rather than discovering the
+  // size of each image only once it is already resident. These sizes are written by the
+  // upload pipeline, not supplied by the caller, so they are sound to plan against —
+  // each download still carries its own ceiling in case a row understates its object.
+  let remaining = MAX_INLINE_TOTAL_BYTES
+  const eligible: NonNullable<(typeof candidates)[number]>[] = []
+  for (const candidate of candidates) {
+    if (!candidate) continue
+    const size = candidate.record.sizeBytes ?? candidate.record.size
+    if (size > MAX_INLINE_IMAGE_BYTES || size > remaining) continue
+    remaining -= size
+    eligible.push(candidate)
+  }
+
   const inlined = new Map<string, string>()
   await Promise.all(
-    ids.map(async (id) => {
+    eligible.map(async ({ id, record }) => {
       try {
-        const record = await getFileMetadataById(id)
-        if (!record || record.context !== 'workspace' || record.workspaceId !== options.workspaceId)
-          return
-        const bytes = await downloadFile({ key: record.key, context: 'workspace' })
-        if (bytes.length > MAX_INLINE_IMAGE_BYTES) return
+        const bytes = await downloadFile({
+          key: record.key,
+          context: 'workspace',
+          maxBytes: MAX_INLINE_IMAGE_BYTES,
+        })
         const mime = record.contentType?.startsWith('image/')
           ? record.contentType
           : 'application/octet-stream'
         inlined.set(id, `data:${mime};base64,${bytes.toString('base64')}`)
       } catch {
-        // A missing or unreadable image keeps its URL reference.
+        // A missing, unreadable or oversized image keeps its URL reference.
       }
     })
   )