fix(knowledge): stop listing workspace knowledge bases on stale creator identity

[waleedlatif1]

Summary

• GET /api/knowledge without a workspaceId ORed on knowledge_base.user_id with no permission check and no workspaceId IS NULL guard, so a user removed from a workspace kept seeing metadata (name, description, docCount, tokenCount, connectors) for every KB they created there — indefinitely, including KBs in archived workspaces under scope=all
• Scoped the creator fallback to legacy KBs with no workspaceId, matching what the workspace-filtered branch and resolveKnowledgeBaseAccess already enforce
• Collapsed the two near-identical or(...) shapes into one so both call paths share the same two authorization predicates
• Added mapWith to the shared drizzle sql test mock so this query is testable at all

Type of Change

• Bug fix

Testing

bun run type-check, bun run lint, and 2054 tests across lib/knowledge, app/api/knowledge, app/api/v1, lib/copilot, lib/table pass. New tests assert the creator disjunct carries the workspaceId IS NULL guard on both branches — verified they go red against the pre-fix predicate.

No client relies on the unfiltered branch: every in-app caller (useKnowledgeBasesList, /api/v1/knowledge, copilot VFS) passes a workspaceId.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 8, 2026 9:46pm

[cursor]

PR Summary

Medium Risk
Changes knowledge-base listing authorization and could hide KBs from callers that relied on the buggy creator-only branch; scope is limited because in-app callers pass workspaceId.

Overview
Fixes an authorization leak in getKnowledgeBases: when listing without a workspaceId, the query could grant access on knowledge_base.user_id alone, so removed workspace members kept seeing metadata for KBs they had created in that workspace (including archived workspaces under scope=all).

The listing predicate is tightened so workspace KBs require current workspace membership (permissions + non-archived workspace), and the creator fallback applies only to legacy KBs with workspaceId IS NULL. The two previously divergent or(...) shapes are merged into one shared authorization structure.

Tests assert the creator disjunct always includes the workspaceId IS NULL guard on both unfiltered and workspace-filtered paths. The shared drizzle sql test mock gains mapWith so the listing query’s typed aggregates can be exercised under mocks.

^{Reviewed by Cursor Bugbot for commit 88f9774. Configure here.}

[greptile-apps]

Greptile Summary

The PR narrows creator-based knowledge-base listing access to legacy records without a workspace, preventing former workspace members from retaining metadata access through stale creator identity.

• Reuses shared predicates for current workspace membership and legacy ownership across filtered and unfiltered listing modes.
• Adds regression tests covering both query modes.
• Extends the shared Drizzle SQL mock with mapWith support.

Confidence Score: 5/5

The PR appears safe to merge because the authorization predicate is correctly narrowed and both filtered and unfiltered paths are covered by regression tests.

The shared predicate preserves current workspace-member access while limiting creator fallback to non-workspace legacy records, and the optional Drizzle condition and SQL mock behavior are compatible with current callers.

Important Files Changed

Filename	Overview
apps/sim/lib/knowledge/service.ts	Consolidates listing authorization while restricting creator fallback to legacy knowledge bases whose workspace ID is null; no changed-code defect was identified.
apps/sim/lib/knowledge/service.test.ts	Adds structural regression tests confirming that both listing modes guard creator access with a null workspace ID.
packages/testing/src/mocks/database.mock.ts	Adds sufficient sql.mapWith support for current mocked query projections without affecting existing mock behavior.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Request["List knowledge bases"] --> Scope{"Workspace filter supplied?"}
  Scope -->|Yes| Match["Require matching workspace ID"]
  Scope -->|No| Membership["Consider all current workspace memberships"]
  Match --> Membership
  Membership --> Current{"Current permission row and workspace active?"}
  Current -->|Yes| Include["Include workspace knowledge base"]
  Current -->|No| Legacy{"Creator and workspaceId is null?"}
  Legacy -->|Yes| IncludeLegacy["Include legacy knowledge base"]
  Legacy -->|No| Exclude["Exclude knowledge base"]

Loading

_{Reviews (1): Last reviewed commit: "fix(knowledge): stop listing workspace k..." | Re-trigger Greptile}