fix(server): get blob from correct storage (#13374)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved permission checks when adding context blobs to ensure only
authorized users can perform this action.

* **Refactor**
* Streamlined background processing of blob embeddings by removing
user-specific parameters and simplifying job handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/server/src/plugins/copilot/context/resolver.ts

@@ -742,6 +742,12 @@ export class CopilotContextResolver {
 
     const contextSession = await this.context.get(options.contextId);
 
+    await this.ac
+      .user(user.id)
+      .workspace(contextSession.workspaceId)
+      .allowLocal()
+      .assert('Workspace.Copilot');
+
     try {
       const blob = await contextSession.addBlobRecord(options.blobId);
       if (!blob) {
@@ -752,7 +758,6 @@ export class CopilotContextResolver {
       }
 
       await this.jobs.addBlobEmbeddingQueue({
-        userId: user.id,
         workspaceId: contextSession.workspaceId,
         contextId: contextSession.id,
         blobId: options.blobId,

packages/backend/server/src/plugins/copilot/embedding/job.ts

@@ -12,6 +12,7 @@ import {
   OnJob,
 } from '../../../base';
 import { DocReader } from '../../../core/doc';
+import { WorkspaceBlobStorage } from '../../../core/storage';
 import { readAllDocIdsFromWorkspaceSnapshot } from '../../../core/utils/blocksuite';
 import { Models } from '../../../models';
 import { CopilotStorage } from '../storage';
@@ -224,6 +225,20 @@ export class CopilotEmbeddingJob {
     return new File([buffer], fileName);
   }
 
+  private async readWorkspaceBlob(
+    workspaceId: string,
+    blobId: string,
+    fileName: string
+  ) {
+    const workspaceStorage = this.moduleRef.get(WorkspaceBlobStorage, {
+      strict: false,
+    });
+    const { body } = await workspaceStorage.get(workspaceId, blobId);
+    if (!body) throw new BlobNotFound({ spaceId: workspaceId, blobId });
+    const buffer = await readStream(body);
+    return new File([buffer], fileName);
+  }
+
   @OnJob('copilot.embedding.files')
   async embedPendingFile({
     userId,
@@ -289,7 +304,6 @@ export class CopilotEmbeddingJob {
 
   @OnJob('copilot.embedding.blobs')
   async embedPendingBlob({
-    userId,
     workspaceId,
     contextId,
     blobId,
@@ -297,12 +311,7 @@ export class CopilotEmbeddingJob {
     if (!this.supportEmbedding || !this.embeddingClient) return;
 
     try {
-      const file = await this.readCopilotBlob(
-        userId,
-        workspaceId,
-        blobId,
-        'blob'
-      );
+      const file = await this.readWorkspaceBlob(workspaceId, blobId, 'blob');
 
       const chunks = await this.embeddingClient.getFileChunks(file);
       const total = chunks.reduce((acc, c) => acc + c.length, 0);

packages/backend/server/src/plugins/copilot/embedding/types.ts

@@ -76,7 +76,6 @@ declare global {
 
     'copilot.embedding.blobs': {
       contextId?: string;
-      userId: string;
       workspaceId: string;
       blobId: string;
     };