[JHC56]

Fixes #44447

Summary

The web form page checks the form's app before it shows the form. The submit, the upload-token endpoint, and the file upload did not run this check. This PR shares the check with all three endpoints, in the same order as the form page.

• On the form endpoints, an archived workspace or a missing site returns 403, and a deleted app or an app in another workspace returns 404.
• The file upload returns the existing 403 invalid_upload_token error.
• An expired form still returns 412 from every endpoint.

This PR touches the same file as #39661. The two changes do not overlap in logic.

Checklist

• This change requires a documentation update, included: Dify Document
• I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
• I've verified the change and added or updated tests where meaningful regression risk justifies coverage.
• I've updated the documentation accordingly.
• I ran make lint && make type-check (backend) and vp staged (frontend) to appease the lint gods

[github-actions]

Pyrefly Type Coverage

Metric	Base	PR	Delta
Type coverage	76.28%	76.30%	+0.01%
Strict coverage	75.96%	75.97%	+0.01%
Typed symbols	64,406	64,449	+43
Untyped symbols	20,108	20,107	-1
Modules	3834	3834	0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.80%. Comparing base (e7c2c6f) to head (54801da).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #44449   +/-   ##
=======================================
  Coverage   88.80%   88.80%           
=======================================
  Files        5558     5558           
  Lines      332910   332925   +15     
  Branches    66661    66662    +1     
=======================================
+ Hits       295644   295661   +17     
+ Misses      32088    32087    -1     
+ Partials     5178     5177    -1     

Flag	Coverage Δ
api	88.85% <100.00%> (-0.01%)	⬇️
cli	94.01% <ø> (ø)
dify-ui	91.67% <ø> (ø)
web	88.46% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JHC56]

All checks pass. Could you take a look when you get a chance?

The Human Input form page already checks the form's app before it shows the form. This PR runs the same check on the form submit, the upload-token endpoint, and the file upload. These requests are now blocked when the workspace is archived, the site is missing, or the app is deleted.