@agent-native/core 0.102.2 → 0.103.0

package/corpus/templates/content/actions/_content-files.ts

@@ -0,0 +1,338 @@
+import { createHash } from "node:crypto";
+
+import { accessFilter } from "@agent-native/core/sharing";
+import { and, eq, inArray, isNull, or, sql } from "drizzle-orm";
+
+import { schema } from "../server/db/index.js";
+import {
+  listContentOrganizationMemberships,
+  normalizeContentSpaceEmail,
+  resolveContentSpaceAccess,
+} from "./_content-space-access.js";
+import {
+  organizationContentSpaceId,
+  personalContentSpaceId,
+} from "./_content-spaces.js";
+
+type Db = any;
+
+export type ContentFilesReconciliation = {
+  assignedSpaces: number;
+  insertedMemberships: number;
+  removedMemberships: number;
+  documents: number;
+};
+
+export function contentFilesItemId(databaseId: string, documentId: string) {
+  return `content_database_item_${createHash("sha256")
+    .update(`${databaseId}:${documentId}`)
+    .digest("hex")
+    .slice(0, 32)}`;
+}
+
+async function remapItemReferences(db: Db, replacements: Map<string, string>) {
+  if (!replacements.size) return;
+  const duplicateIds = [...replacements.keys()];
+  const remap = (column: any) => {
+    let expression = sql`CASE ${column}`;
+    for (const [duplicateId, canonicalId] of replacements)
+      expression = sql`${expression} WHEN ${duplicateId} THEN ${canonicalId}`;
+    return sql`${expression} ELSE ${column} END`;
+  };
+  for (const table of [
+    schema.contentSpaceCatalogItems,
+    schema.contentDatabaseBodyHydrationQueue,
+    schema.contentDatabaseSourceRows,
+    schema.contentDatabaseSourceChangeSets,
+  ]) {
+    await db
+      .update(table)
+      .set({ databaseItemId: remap(table.databaseItemId) })
+      .where(inArray(table.databaseItemId, duplicateIds));
+  }
+}
+
+async function reconcileDocuments(args: {
+  db: Db;
+  documents: Array<typeof schema.documents.$inferSelect>;
+  filesDatabases: Array<typeof schema.contentDatabases.$inferSelect>;
+  now: string;
+}) {
+  const filesBySpace = new Map(
+    args.filesDatabases.map((database) => [database.spaceId, database]),
+  );
+  const filesDatabaseIds = args.filesDatabases.map((database) => database.id);
+  const filesBackingDocumentIds = new Set(
+    args.filesDatabases.map((database) => database.documentId),
+  );
+  const existingItems = filesDatabaseIds.length
+    ? await args.db
+        .select()
+        .from(schema.contentDatabaseItems)
+        .where(
+          inArray(schema.contentDatabaseItems.databaseId, filesDatabaseIds),
+        )
+    : [];
+  const itemsByDocument = new Map<
+    string,
+    Array<typeof schema.contentDatabaseItems.$inferSelect>
+  >();
+  const nextPosition = new Map<string, number>();
+  for (const item of existingItems) {
+    const documentItems = itemsByDocument.get(item.documentId) ?? [];
+    documentItems.push(item);
+    itemsByDocument.set(item.documentId, documentItems);
+    nextPosition.set(
+      item.databaseId,
+      Math.max(nextPosition.get(item.databaseId) ?? 0, item.position + 1),
+    );
+  }
+
+  const deleteIds = new Set<string>();
+  const replacements = new Map<string, string>();
+  const inserts: Array<typeof schema.contentDatabaseItems.$inferInsert> = [];
+  for (const document of args.documents) {
+    const existing = itemsByDocument.get(document.id) ?? [];
+    if (filesBackingDocumentIds.has(document.id)) {
+      for (const item of existing) deleteIds.add(item.id);
+      continue;
+    }
+    const canonicalDatabase = filesBySpace.get(document.spaceId);
+    if (!canonicalDatabase) {
+      throw new Error(
+        `Content space for document "${document.id}" has no Files database`,
+      );
+    }
+    const canonicalItems = existing
+      .filter((item) => item.databaseId === canonicalDatabase.id)
+      .sort((left, right) => left.id.localeCompare(right.id));
+    const canonicalItemId =
+      canonicalItems[0]?.id ??
+      contentFilesItemId(canonicalDatabase.id, document.id);
+    for (const item of existing) {
+      if (item.databaseId !== canonicalDatabase.id) {
+        deleteIds.add(item.id);
+        replacements.set(item.id, canonicalItemId);
+      }
+    }
+    for (const duplicate of canonicalItems.slice(1)) {
+      deleteIds.add(duplicate.id);
+      replacements.set(duplicate.id, canonicalItemId);
+    }
+    if (canonicalItems.length === 0) {
+      const position = nextPosition.get(canonicalDatabase.id) ?? 0;
+      nextPosition.set(canonicalDatabase.id, position + 1);
+      inserts.push({
+        id: contentFilesItemId(canonicalDatabase.id, document.id),
+        ownerEmail: document.ownerEmail,
+        orgId: document.orgId,
+        databaseId: canonicalDatabase.id,
+        documentId: document.id,
+        position,
+        createdAt: args.now,
+        updatedAt: args.now,
+      });
+    }
+  }
+  await remapItemReferences(args.db, replacements);
+  if (deleteIds.size) {
+    await args.db
+      .delete(schema.contentDatabaseItems)
+      .where(inArray(schema.contentDatabaseItems.id, [...deleteIds]));
+  }
+  if (inserts.length) {
+    await args.db
+      .insert(schema.contentDatabaseItems)
+      .values(inserts)
+      .onConflictDoNothing();
+  }
+  return { inserted: inserts.length, removed: deleteIds.size };
+}
+
+export async function ensureDocumentFilesMembership(
+  db: Db,
+  documentId: string,
+  now = new Date().toISOString(),
+  accessContext?: { userEmail?: string; orgId?: string },
+) {
+  const [document] = await db
+    .select()
+    .from(schema.documents)
+    .where(
+      and(
+        eq(schema.documents.id, documentId),
+        accessFilter(schema.documents, schema.documentShares, accessContext),
+      ),
+    );
+  if (!document) throw new Error(`Document "${documentId}" not found`);
+  if (!document.spaceId)
+    throw new Error(`Document "${documentId}" does not have a Content space`);
+  const filesDatabases = await db
+    .select()
+    .from(schema.contentDatabases)
+    .where(
+      and(
+        eq(schema.contentDatabases.systemRole, "files"),
+        eq(schema.contentDatabases.spaceId, document.spaceId),
+      ),
+    );
+  return reconcileDocuments({ db, documents: [document], filesDatabases, now });
+}
+
+export async function ensureDocumentsFilesMembership(
+  db: Db,
+  documentIds: string[],
+  now = new Date().toISOString(),
+  ownerEmail?: string,
+) {
+  const ids = [...new Set(documentIds)];
+  if (ids.length === 0) return { inserted: 0, removed: 0 };
+  const documents = await db
+    .select()
+    .from(schema.documents)
+    .where(
+      and(
+        inArray(schema.documents.id, ids),
+        ownerEmail
+          ? or(
+              eq(schema.documents.ownerEmail, ownerEmail),
+              accessFilter(schema.documents, schema.documentShares),
+            )
+          : accessFilter(schema.documents, schema.documentShares),
+      ),
+    );
+  if (documents.length !== ids.length) {
+    const found = new Set(documents.map((document: any) => document.id));
+    const missing = ids.filter((id) => !found.has(id));
+    throw new Error(`Documents not found: ${missing.join(", ")}`);
+  }
+  for (const document of documents) {
+    if (!document.spaceId) {
+      throw new Error(
+        `Document "${document.id}" does not have a Content space`,
+      );
+    }
+  }
+  const spaceIds: string[] = Array.from(
+    new Set<string>(documents.map((document: any) => String(document.spaceId))),
+  );
+  const filesDatabases = await db
+    .select()
+    .from(schema.contentDatabases)
+    .where(
+      and(
+        eq(schema.contentDatabases.systemRole, "files"),
+        or(
+          ...spaceIds.map((spaceId) =>
+            eq(schema.contentDatabases.spaceId, spaceId),
+          ),
+        ),
+      ),
+    );
+  return reconcileDocuments({ db, documents, filesDatabases, now });
+}
+
+export async function reconcileContentFilesMemberships(
+  db: Db,
+  userEmail: string,
+): Promise<ContentFilesReconciliation> {
+  const email = normalizeContentSpaceEmail(userEmail);
+  const memberships = await listContentOrganizationMemberships(email);
+  const personalSpaceId = personalContentSpaceId(email);
+  const orgSpaceIds = new Map<string, string>();
+  for (const membership of memberships) {
+    const spaceId = organizationContentSpaceId(membership.orgId);
+    try {
+      await resolveContentSpaceAccess(spaceId, "editor");
+      orgSpaceIds.set(membership.orgId, spaceId);
+    } catch (error) {
+      if (
+        error instanceof Error &&
+        error.message ===
+          `Editor access is required for Content space "${spaceId}"`
+      ) {
+        continue;
+      }
+      throw error;
+    }
+  }
+  const accessibleSpaceIds = [personalSpaceId, ...orgSpaceIds.values()];
+  const now = new Date().toISOString();
+  const result: ContentFilesReconciliation = {
+    assignedSpaces: 0,
+    insertedMemberships: 0,
+    removedMemberships: 0,
+    documents: 0,
+  };
+
+  await db.transaction(async (tx: Db) => {
+    const personalLegacyDocuments = await tx
+      .select({ id: schema.documents.id })
+      .from(schema.documents)
+      .where(
+        and(
+          eq(schema.documents.ownerEmail, email),
+          isNull(schema.documents.orgId),
+          isNull(schema.documents.spaceId),
+        ),
+      );
+    if (personalLegacyDocuments.length) {
+      await tx
+        .update(schema.documents)
+        .set({ spaceId: personalSpaceId, updatedAt: now })
+        .where(
+          inArray(
+            schema.documents.id,
+            personalLegacyDocuments.map((row: any) => row.id),
+          ),
+        );
+      result.assignedSpaces += personalLegacyDocuments.length;
+    }
+    for (const [orgId, spaceId] of orgSpaceIds) {
+      const legacyDocuments = await tx
+        .select({ id: schema.documents.id })
+        .from(schema.documents)
+        .where(
+          and(
+            eq(schema.documents.orgId, orgId),
+            isNull(schema.documents.spaceId),
+          ),
+        );
+      if (!legacyDocuments.length) continue;
+      await tx
+        .update(schema.documents)
+        .set({ spaceId, updatedAt: now })
+        .where(
+          inArray(
+            schema.documents.id,
+            legacyDocuments.map((row: any) => row.id),
+          ),
+        );
+      result.assignedSpaces += legacyDocuments.length;
+    }
+
+    const documents = await tx
+      .select()
+      .from(schema.documents)
+      .where(inArray(schema.documents.spaceId, accessibleSpaceIds));
+    const filesDatabases = await tx
+      .select()
+      .from(schema.contentDatabases)
+      .where(
+        and(
+          eq(schema.contentDatabases.systemRole, "files"),
+          inArray(schema.contentDatabases.spaceId, accessibleSpaceIds),
+        ),
+      );
+    const membershipResult = await reconcileDocuments({
+      db: tx,
+      documents,
+      filesDatabases,
+      now,
+    });
+    result.documents = documents.length;
+    result.insertedMemberships = membershipResult.inserted;
+    result.removedMemberships = membershipResult.removed;
+  });
+  return result;
+}

package/corpus/templates/content/actions/_content-space-access.ts

@@ -0,0 +1,135 @@
+import { getDbExec } from "@agent-native/core/db";
+import { getRequestUserEmail } from "@agent-native/core/server/request-context";
+import { eq } from "drizzle-orm";
+
+import { getDb, schema } from "../server/db/index.js";
+
+export type ContentSpaceRole = "viewer" | "editor" | "owner";
+
+export type ContentSpaceAccess = {
+  space: typeof schema.contentSpaces.$inferSelect;
+  authority: { userEmail: string; orgId: string | null };
+  role: ContentSpaceRole;
+};
+
+export function normalizeContentSpaceEmail(email: string): string {
+  const normalized = email.trim().toLowerCase();
+  if (!normalized) throw new Error("no authenticated user");
+  return normalized;
+}
+
+export async function getContentOrganizationMembership(
+  orgId: string,
+  userEmail: string,
+): Promise<{ role: string; name: string; createdBy: string } | null> {
+  const result = await getDbExec().execute({
+    sql: `SELECT m.role AS role, o.name AS name, o.created_by AS "createdBy"
+          FROM org_members m
+          INNER JOIN organizations o ON o.id = m.org_id
+          WHERE m.org_id = ? AND LOWER(m.email) = ?
+          LIMIT 1`,
+    args: [orgId, normalizeContentSpaceEmail(userEmail)],
+  });
+  const row = result.rows[0] as
+    | { role?: unknown; name?: unknown; createdBy?: unknown }
+    | undefined;
+  if (
+    !row ||
+    typeof row.name !== "string" ||
+    typeof row.createdBy !== "string"
+  ) {
+    return null;
+  }
+  return {
+    role: String(row.role ?? "member").toLowerCase(),
+    name: row.name,
+    createdBy: row.createdBy,
+  };
+}
+
+export async function listContentOrganizationMemberships(userEmail: string) {
+  let result;
+  try {
+    result = await getDbExec().execute({
+      sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS name,
+                 o.created_by AS "createdBy"
+          FROM org_members m
+          INNER JOIN organizations o ON o.id = m.org_id
+          WHERE LOWER(m.email) = ?
+          ORDER BY m.org_id ASC`,
+      args: [normalizeContentSpaceEmail(userEmail)],
+    });
+  } catch (error) {
+    if (error instanceof Error && error.message.includes("no such table")) {
+      return [];
+    }
+    throw error;
+  }
+  return result.rows
+    .map((row: any) => ({
+      orgId: typeof row.orgId === "string" ? row.orgId : row.org_id,
+      role: String(row.role ?? "member").toLowerCase(),
+      name: row.name,
+      createdBy: row.createdBy ?? row.created_by,
+    }))
+    .filter(
+      (
+        row,
+      ): row is {
+        orgId: string;
+        role: string;
+        name: string;
+        createdBy: string;
+      } =>
+        typeof row.orgId === "string" &&
+        typeof row.name === "string" &&
+        typeof row.createdBy === "string",
+    );
+}
+
+export async function resolveContentSpaceAccess(
+  spaceId: string,
+  requiredRole: "viewer" | "editor" = "viewer",
+): Promise<ContentSpaceAccess> {
+  const userEmail = getRequestUserEmail();
+  if (!userEmail) throw new Error("no authenticated user");
+  const normalizedUserEmail = normalizeContentSpaceEmail(userEmail);
+  const [space] = await getDb()
+    .select()
+    .from(schema.contentSpaces)
+    .where(eq(schema.contentSpaces.id, spaceId));
+  if (!space || space.archivedAt)
+    throw new Error(`Content space "${spaceId}" not found`);
+
+  if (!space.orgId) {
+    if (normalizeContentSpaceEmail(space.ownerEmail) !== normalizedUserEmail) {
+      throw new Error(`Not authorized for Content space "${spaceId}"`);
+    }
+    return {
+      space,
+      authority: { userEmail: normalizedUserEmail, orgId: null },
+      role: "owner",
+    };
+  }
+
+  const membership = await getContentOrganizationMembership(
+    space.orgId,
+    normalizedUserEmail,
+  );
+  if (!membership)
+    throw new Error(`Not authorized for Content space "${spaceId}"`);
+  const role: ContentSpaceRole =
+    membership.role === "owner"
+      ? "owner"
+      : membership.role === "admin"
+        ? "editor"
+        : "viewer";
+  if (requiredRole === "editor" && role === "viewer") {
+    throw new Error(`Editor access is required for Content space "${spaceId}"`);
+  }
+  return {
+    space,
+    authority: { userEmail: normalizedUserEmail, orgId: space.orgId },
+    role,
+  };
+}