H-6623: Fix uploading and making user and org avatars public

[CiaranMn]

🌟 What is the purpose of this PR?

The public view policy needs to be created at the same time as creating the entity – adding the viewer afterwards is not currently supported, and was causing a crash.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

• does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

• are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

• do not affect the execution graph

❓ How to test this?

1. Try uploading a user or org avatar.
2. To check public status, try switching to another user and checking the avatars are visible.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
hash	Ignored	Preview	Jun 29, 2026 4:54pm
hashdotdesign-tokens	Ignored	Preview	Jun 29, 2026 4:54pm
petrinaut	Skipped		Jun 29, 2026 4:54pm

[cursor]

PR Summary

Medium Risk
Changes how public read access is granted (authorization policies at create time); behavior is opt-in via makePublic but affects file/avatar flows that rely on it.

Overview
Fixes user/org avatar uploads that crashed when visibility was applied after creation by supporting makePublic on createEntity, requestFileUpload, and createFileFromUrl (GraphQL + frontend). When enabled, creation passes a viewEntity permit policy with principal: null alongside a generated entityUuid instead of calling addEntityViewer afterward.

createEntityWithLinks now applies entityUuid and policies only to the root node in a linked tree so nested new entities do not reuse the same UUID. File upload context threads makePublic through file and link-entity creation and drops the separate viewer mutation. An integration test asserts distinct UUIDs for root, linked, and link entities.

^{Reviewed by Cursor Bugbot for commit 1ba9241. Bugbot is set up for automated code reviews on this repo. Configure here.}

[TimDiekmann]

Looks good, that should help until we have a proper public flag or something similar 🚀

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 33ba797. Configure here.}

[Copilot]

Pull request overview

This PR fixes avatar uploads (user + org) by adding a makePublic flag to relevant GraphQL mutations and ensuring public-view policies are created during entity creation (instead of attempting to add a public viewer afterwards, which was crashing).

Changes:

• Add makePublic: Boolean = false to GraphQL schema for createEntity, requestFileUpload, and createFileFromUrl.
• Update frontend upload flows to pass makePublic through mutations and remove the post-create “add public viewer” step.
• Update API resolvers and file creation logic to plumb makePublic down and create a public-view policy at entity creation time.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
libs/@local/hash-isomorphic-utils/src/graphql/type-defs/knowledge/file.typedef.ts	Adds makePublic argument to file upload/link creation mutations in the shared schema.
libs/@local/hash-isomorphic-utils/src/graphql/type-defs/knowledge/entity.typedef.ts	Adds makePublic argument to createEntity in the shared schema.
apps/hash-frontend/src/shared/file-upload-context.tsx	Removes addEntityViewer follow-up mutation and passes makePublic directly to create/upload mutations.
apps/hash-frontend/src/graphql/queries/knowledge/file.queries.ts	Adds $makePublic variable and passes it to requestFileUpload / createFileFromUrl.
apps/hash-frontend/src/graphql/queries/knowledge/entity.queries.ts	Adds $makePublic variable and passes it to createEntity.
apps/hash-api/src/graphql/resolvers/knowledge/file/request-file-upload.ts	Threads makePublic into the underlying file upload creation call.
apps/hash-api/src/graphql/resolvers/knowledge/file/create-file-from-url.ts	Threads makePublic into the underlying external-url file creation call.
apps/hash-api/src/graphql/resolvers/knowledge/entity/entity.ts	Adds makePublic support to createEntityResolver via creation-time policies.
apps/hash-api/src/graph/knowledge/system-types/file.ts	Adds creation-time public-view policy support for file entities created from uploads/URLs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.65%. Comparing base (93903d1) to head (1b76815).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
.../hash-api/src/graph/knowledge/system-types/file.ts	0.00%	5 Missing ⚠️
...s/hash-api/src/graph/knowledge/primitive/entity.ts	0.00%	3 Missing ⚠️
...i/src/graphql/resolvers/knowledge/entity/entity.ts	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8913      +/-   ##
==========================================
- Coverage   59.76%   59.65%   -0.12%     
==========================================
  Files        1348     1350       +2     
  Lines      131800   132047     +247     
  Branches     5943     5950       +7     
==========================================
+ Hits        78772    78773       +1     
- Misses      52120    52366     +246     
  Partials      908      908              

Flag	Coverage Δ
apps.hash-api	3.10% <0.00%> (-0.16%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

apps/hash-api/src/graph/knowledge/system-types/file.ts:418

• In this function makePublic is only applied in the createEntity branch; when existingEntity is present the code updates the entity and does not validate or enforce the requested public visibility. If the Graph can’t add view policies after creation (per PR description), it would be safer to either verify the entity is already public when makePublic is true or fail fast with a clear error so the caller can choose to create a new entity instead.

    return existingEntity
      ? await updateEntity<File>(ctx, authentication, {
          entity: existingEntity,
          entityTypeIds,