improvement(knowledge): make connector-synced document chunks readonly

[waleedlatif1]

Summary

• Make chunks from connector-synced documents readonly so users can't edit content that will be overwritten on next sync
• Disable "Create Chunk" button for connector documents with tooltip explanation
• Change modal title and context menu from "Edit" to "View" for connector docs
• Hide Save button and disable textarea in edit modal for connector chunks

Type of Change

• Enhancement

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Mar 6, 2026 7:24pm

[cursor]

PR Summary

Medium Risk
Enforces new write restrictions on chunk create/update/delete and bulk operations based on document.connectorId, which could block expected workflows if connector detection is incorrect. Changes span both API authorization paths and UI affordances, so regressions would surface as 403s/disabled actions in the document chunks experience.

Overview
Connector-synced documents now treat chunks as read-only. The chunks API rejects create/update/delete and batch enable/disable/delete requests with a 403 when the parent document has a connectorId.

The document chunks UI disables editing-related actions (create, toggle enabled, delete, selection/bulk actions) for connector documents, updates labels from Edit to View, and hides/disables save controls in the chunk modal with clearer read-only tooltips/placeholders.

^{Written by Cursor Bugbot for commit bc504ba. Configure here.}

[greptile-apps]

Greptile Summary

This PR introduces read-only enforcement for chunks belonging to connector-synced documents, applying guards at both the API and UI layers. All four mutation endpoints (POST, PATCH, PUT, DELETE) now return 403 when the target document has a connectorId. The DocumentData interface is extended with connectorId and the field is included in the checkDocumentWriteAccess DB projection. The frontend derives isConnectorDocument from documentData?.connectorId and propagates it through the component tree to disable the Create Chunk button, per-chunk checkboxes, toggle-enabled buttons, delete buttons, bulk action bar operations, and the context menu — while changing the "Edit" label to "View" and hiding the Save button in the chunk modal.

Key observation:

• The PATCH batch-operation endpoint calls checkDocumentAccess (read access) instead of checkDocumentWriteAccess, allowing read-only workspace members to reach the batch logic. This is a pre-existing gap that should be corrected while touching the file.

Confidence Score: 4/5

• Safe to merge after fixing the pre-existing PATCH access control issue.
• The PR implements read-only enforcement for connector-synced chunks consistently across both frontend and backend. All mutation endpoints correctly gate with 403 when a document has a connectorId, and the UI comprehensively disables mutation controls. One pre-existing security gap exists where the PATCH batch-operation endpoint uses read-access check instead of write-access check, allowing read-only users to reach mutation logic — this should be corrected while the file is already under modification.
• apps/sim/app/api/knowledge/[id]/documents/[documentId]/chunks/route.ts — change checkDocumentAccess to checkDocumentWriteAccess at line 281

Sequence Diagram

sequenceDiagram
    participant UI as Frontend (document.tsx / modals)
    participant API as API Route
    participant Utils as knowledge/utils.ts
    participant DB as Database

    UI->>UI: isConnectorDocument = Boolean(documentData?.connectorId)
    note over UI: Disables Create Chunk btn, checkboxes,<br/>toggle-enabled, delete, bulk actions.<br/>Changes "Edit" → "View" label.

    UI->>API: PUT/DELETE/POST/PATCH (mutation request)
    API->>Utils: checkDocumentWriteAccess / checkChunkAccess
    Utils->>DB: SELECT ... connectorId FROM document
    DB-->>Utils: document row (with connectorId)
    Utils-->>API: accessCheck { document: { connectorId } }

    alt document.connectorId is set
        API-->>UI: 403 "Chunks from connector-synced documents are read-only"
    else document.connectorId is null
        API->>DB: perform mutation (update / delete / create / batch)
        DB-->>API: success
        API-->>UI: 200 success
    end

Loading

Comments Outside Diff (1)

1. apps/sim/app/api/knowledge/[id]/documents/[documentId]/chunks/route.ts, line 281 (link)

   The PATCH batch-operation endpoint uses checkDocumentAccess (read-only permission check) instead of checkDocumentWriteAccess. This means a workspace member with only read permission can pass the access gate and reach the batch operation logic, even though operations like enable/disable/delete are mutations that require write access.

   Since the POST endpoint correctly calls checkDocumentWriteAccess, the PATCH should be consistent. This is a pre-existing issue, but since you are touching this handler, it's a good opportunity to fix it.

   checkDocumentWriteAccess is already imported at the top of the file.

_{Last reviewed commit: bc504ba}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR