fix: align runtime attachment authorization

crates/worker-runtime/src/http_server.rs

@@ -3013,6 +3013,10 @@ mod tests {
             ),
             Some("workers:input")
         );
+        assert_eq!(
+            required_runtime_permission(&Method::POST, "/v1/workers/7/workdir-attachments"),
+            Some("workers:input")
+        );
     }
 
     fn test_bundle(profile: ProfileSelector) -> ConfigBundle {

crates/workspace-server/src/hosts.rs

@@ -3569,7 +3569,11 @@ fn workspace_runtime_operation(method: &str, path_and_query: &str) -> &'static s
     if path.ends_with("/workspace-api") {
         return "workers:create";
     }
-    if path.ends_with("/input") || path.ends_with("/restore") || path.contains("/attachments") {
+    if path.ends_with("/input")
+        || path.ends_with("/restore")
+        || path.contains("/attachments")
+        || path.contains("/workdir-attachments")
+    {
         return "workers:input";
     }
     if path.ends_with("/stop") || path.ends_with("/cancel") {
@@ -7300,6 +7304,13 @@ mod tests {
             workspace_runtime_operation("GET", &format!("/v1/workers/{worker_id}/protocol/ws")),
             "workers:protocol"
         );
+        assert_eq!(
+            workspace_runtime_operation(
+                "POST",
+                &format!("/v1/workers/{worker_id}/workdir-attachments")
+            ),
+            "workers:input"
+        );
         assert_eq!(
             workspace_runtime_operation("POST", SSH_HOST_KEY_PROBE_PATH),
             SSH_HOST_KEY_PROBE_OPERATION