@agent-native/core 0.114.0 → 0.114.2

package/corpus/templates/content/actions/_database-source-utils.ts

@@ -86,6 +86,7 @@ import {
   organizationContentSpaceId,
   provisionContentSpaces,
 } from "./_content-spaces.js";
+import { ensureFilesSystemPropertyDefinitions } from "./_files-system-properties.js";
 import {
   databaseItemsPositionScope,
   documentsPositionScope,
@@ -6258,6 +6259,13 @@ export async function ensureDatabaseSourceProperty(args: {
   database: ContentDatabaseRow;
   now: string;
 }) {
+  if (args.database.systemRole === "files") {
+    await ensureFilesSystemPropertyDefinitions({
+      database: args.database,
+      now: args.now,
+    });
+    return;
+  }
   const db = getDb();
   const sources = await db
     .select({

package/corpus/templates/content/actions/_database-utils.ts

@@ -1,8 +1,18 @@
-import { and, asc, eq, inArray, isNull, sql } from "drizzle-orm";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server/request-context";
+import {
+  accessFilter,
+  ROLE_RANK,
+  type ShareRole,
+} from "@agent-native/core/sharing";
+import { and, asc, eq, inArray, isNull, or, sql } from "drizzle-orm";
 
 import { getDb, schema } from "../server/db/index.js";
 import { getDocumentContextPath } from "../server/lib/document-context.js";
 import {
+  documentDiscoveryFilter,
   parseDocumentFavorite,
   parseDocumentHideFromSearch,
 } from "../server/lib/documents.js";
@@ -11,11 +21,17 @@ import type {
   ContentDatabaseMembership,
   ContentDatabaseResponse,
 } from "../shared/api.js";
+import { favoriteDocumentIds } from "./_content-favorites.js";
+import { listContentOrganizationMemberships } from "./_content-space-access.js";
 import { getAllContentDatabaseSourceSnapshots } from "./_database-source-utils.js";
 import {
   applyFederatedOverlayValues,
   federateSources,
 } from "./_federation-join.js";
+import {
+  applyFilesSystemPropertyProjection,
+  filesSystemPropertyProjection,
+} from "./_files-system-properties.js";
 import {
   listPropertiesForDatabaseDocuments,
   listPropertiesForDatabase,
@@ -29,6 +45,15 @@ function canManageRole(role: string) {
   return role === "owner" || role === "admin";
 }
 
+function canEditRole(role: string) {
+  return role === "owner" || role === "admin" || role === "editor";
+}
+
+function strongerRole(current: ShareRole | null, next: ShareRole): ShareRole {
+  if (!current || ROLE_RANK[next] > ROLE_RANK[current]) return next;
+  return current;
+}
+
 type DatabaseMembershipRow = {
   item: typeof schema.contentDatabaseItems.$inferSelect;
   database: typeof schema.contentDatabases.$inferSelect;
@@ -195,10 +220,34 @@ export function filterContentDatabaseSourceRowsForPage<
   );
 }
 
+export function filterContentDatabaseSourceForVisibleDocuments<
+  TSource extends {
+    rows: Array<{ documentId: string }>;
+    changeSets: Array<{ documentId: string | null }>;
+  },
+>(source: TSource, visibleDocumentIds: ReadonlySet<string>): TSource {
+  return {
+    ...source,
+    rows: source.rows.filter(
+      (row) => !row.documentId || visibleDocumentIds.has(row.documentId),
+    ),
+    changeSets: source.changeSets.filter(
+      (changeSet) =>
+        !changeSet.documentId || visibleDocumentIds.has(changeSet.documentId),
+    ),
+  };
+}
+
 function serializeDocument(
   doc: DocumentListRow,
   membership?: DatabaseMembershipRow,
+  shareRole?: ShareRole,
+  isFavorite?: boolean,
 ) {
+  const isOwner =
+    doc.ownerEmail.trim().toLowerCase() ===
+    getRequestUserEmail()?.trim().toLowerCase();
+  const accessRole = isOwner ? ("owner" as const) : (shareRole ?? "viewer");
   return {
     id: doc.id,
     parentId: doc.parentId,
@@ -209,12 +258,12 @@ function serializeDocument(
     description: doc.description,
     icon: doc.icon,
     position: doc.position,
-    isFavorite: parseDocumentFavorite(doc.isFavorite),
+    isFavorite: isFavorite ?? parseDocumentFavorite(doc.isFavorite),
     hideFromSearch: parseDocumentHideFromSearch(doc.hideFromSearch),
     visibility: doc.visibility,
-    accessRole: "owner" as const,
-    canEdit: true,
-    canManage: canManageRole("owner"),
+    accessRole,
+    canEdit: canEditRole(accessRole),
+    canManage: canManageRole(accessRole),
     databaseMembership: membership
       ? serializeDatabaseMembership(membership)
       : undefined,
@@ -250,15 +299,77 @@ export async function getContentDatabaseResponse(
   // shared one a viewer is opening) must not mutate schema.
 
   const { limit, offset } = normalizeContentDatabasePageOptions(options);
+  const userEmail = getRequestUserEmail();
+  const activeOrgId = getRequestOrgId();
+  const authorizedOrgIds =
+    database.systemRole === "favorites" && userEmail
+      ? [
+          ...new Set([
+            ...(await listContentOrganizationMemberships(userEmail)).map(
+              (membership) => membership.orgId,
+            ),
+            ...(activeOrgId ? [activeOrgId] : []),
+          ]),
+        ]
+      : [];
+  const favoritesVisibleDocumentIds =
+    database.systemRole === "favorites" && userEmail
+      ? (
+          await db
+            .select({ id: schema.documents.id })
+            .from(schema.documents)
+            .where(
+              and(
+                or(
+                  accessFilter(schema.documents, schema.documentShares, {
+                    userEmail,
+                  }),
+                  ...authorizedOrgIds.map((orgId) =>
+                    accessFilter(schema.documents, schema.documentShares, {
+                      userEmail,
+                      orgId,
+                    }),
+                  ),
+                ),
+                documentDiscoveryFilter({
+                  userEmail,
+                  orgIds: authorizedOrgIds,
+                }),
+              ),
+            )
+        ).map((document) => document.id)
+      : null;
+  const organizationFilesItemFilter =
+    database.systemRole === "files" && database.orgId
+      ? sql`exists (
+          select 1 from ${schema.documents}
+          where ${schema.documents.id} = ${schema.contentDatabaseItems.documentId}
+            and ${schema.documents.orgId} = ${database.orgId}
+            and ${schema.documents.visibility} in ('org', 'public')
+            and (${schema.documents.hideFromSearch} = 0 or ${schema.documents.hideFromSearch} is null)
+        )`
+      : undefined;
+  const visibleItemFilter = and(
+    eq(schema.contentDatabaseItems.databaseId, databaseId),
+    organizationFilesItemFilter,
+    favoritesVisibleDocumentIds
+      ? favoritesVisibleDocumentIds.length > 0
+        ? inArray(
+            schema.contentDatabaseItems.documentId,
+            favoritesVisibleDocumentIds,
+          )
+        : sql`1 = 0`
+      : undefined,
+  );
   const [itemCount] = await db
     .select({ count: sql<number>`COUNT(*)` })
     .from(schema.contentDatabaseItems)
-    .where(eq(schema.contentDatabaseItems.databaseId, databaseId));
+    .where(visibleItemFilter);
 
   let itemsQuery = db
     .select()
     .from(schema.contentDatabaseItems)
-    .where(eq(schema.contentDatabaseItems.databaseId, databaseId))
+    .where(visibleItemFilter)
     .orderBy(asc(schema.contentDatabaseItems.position))
     .$dynamic();
   if (limit !== null) {
@@ -277,17 +388,116 @@ export async function getContentDatabaseResponse(
                 schema.documents.id,
                 items.map((item) => item.documentId),
               ),
-              eq(schema.documents.ownerEmail, database.ownerEmail),
+              database.systemRole === "favorites"
+                ? favoritesVisibleDocumentIds?.length
+                  ? inArray(schema.documents.id, favoritesVisibleDocumentIds)
+                  : sql`1 = 0`
+                : database.systemRole === "files" && database.orgId
+                  ? and(
+                      eq(schema.documents.orgId, database.orgId),
+                      or(
+                        eq(schema.documents.visibility, "org"),
+                        eq(schema.documents.visibility, "public"),
+                      ),
+                      or(
+                        eq(schema.documents.hideFromSearch, 0),
+                        isNull(schema.documents.hideFromSearch),
+                      ),
+                    )
+                  : eq(schema.documents.ownerEmail, database.ownerEmail),
             ),
           )
       : [];
   const documentById = new Map(documents.map((doc) => [doc.id, doc]));
+  const favorites =
+    database.systemRole === "favorites"
+      ? new Set(documents.map((document) => document.id))
+      : userEmail
+        ? await favoriteDocumentIds(
+            db,
+            userEmail,
+            documents.map((document) => document.id),
+          )
+        : new Set<string>();
+  const shareRoleByDocumentId = new Map<string, ShareRole>();
+  if (documents.length > 0) {
+    const principalClauses: NonNullable<ReturnType<typeof and>>[] = [];
+    const userEmail = getRequestUserEmail();
+    const orgId = getRequestOrgId();
+    if (userEmail) {
+      principalClauses.push(
+        and(
+          eq(schema.documentShares.principalType, "user"),
+          eq(schema.documentShares.principalId, userEmail),
+        )!,
+      );
+    }
+    if (orgId) {
+      principalClauses.push(
+        and(
+          eq(schema.documentShares.principalType, "org"),
+          eq(schema.documentShares.principalId, orgId),
+        )!,
+      );
+    }
+    const shareRows =
+      principalClauses.length > 0
+        ? await db
+            .select({
+              resourceId: schema.documentShares.resourceId,
+              role: schema.documentShares.role,
+            })
+            .from(schema.documentShares)
+            .where(
+              and(
+                inArray(
+                  schema.documentShares.resourceId,
+                  documents.map((document) => document.id),
+                ),
+                or(...principalClauses),
+              ),
+            )
+        : [];
+    for (const row of shareRows) {
+      shareRoleByDocumentId.set(
+        row.resourceId,
+        strongerRole(
+          shareRoleByDocumentId.get(row.resourceId) ?? null,
+          row.role,
+        ),
+      );
+    }
+  }
   const propertiesByDocumentId = await listPropertiesForDatabaseDocuments(
     databaseId,
     // Property serialization uses metadata only; this list projection carries
     // every document field it consumes except the deliberately omitted body.
     documents as Array<typeof schema.documents.$inferSelect>,
   );
+  const databaseProperties = await listPropertiesForDatabase(databaseId);
+  const filesProjection = await filesSystemPropertyProjection({
+    database,
+    documents,
+    properties: databaseProperties,
+  });
+  const responseProperties = filesProjection
+    ? applyFilesSystemPropertyProjection({
+        properties: databaseProperties,
+        projection: filesProjection,
+      })
+    : databaseProperties;
+  if (filesProjection) {
+    for (const document of documents) {
+      propertiesByDocumentId.set(
+        document.id,
+        applyFilesSystemPropertyProjection({
+          properties: propertiesByDocumentId.get(document.id) ?? [],
+          projection: filesProjection,
+          documentId: document.id,
+        }),
+      );
+    }
+  }
   const queuedBodyHydrationItemIds =
     items.length > 0
       ? new Set(
@@ -316,11 +526,16 @@ export async function getContentDatabaseResponse(
     serializedItems.push({
       id: item.id,
       databaseId: item.databaseId,
-      document: serializeDocument(document, {
-        item,
-        database,
-        bodyHydrationQueueId: bodyHydrationQueued ? item.id : null,
-      }),
+      document: serializeDocument(
+        document,
+        {
+          item,
+          database,
+          bodyHydrationQueueId: bodyHydrationQueued ? item.id : null,
+        },
+        shareRoleByDocumentId.get(document.id),
+        favorites.has(document.id),
+      ),
       position: item.position,
       bodyHydration: serializeBodyHydration(item, {
         queued: bodyHydrationQueued,
@@ -329,7 +544,25 @@ export async function getContentDatabaseResponse(
     });
   }
 
-  const sources = await getAllContentDatabaseSourceSnapshots(database);
+  const sourceSnapshots = await getAllContentDatabaseSourceSnapshots(database);
+  const organizationVisibleDocumentIds = organizationFilesItemFilter
+    ? new Set(
+        (
+          await db
+            .select({ documentId: schema.contentDatabaseItems.documentId })
+            .from(schema.contentDatabaseItems)
+            .where(visibleItemFilter)
+        ).map((item) => item.documentId),
+      )
+    : null;
+  const sources = organizationVisibleDocumentIds
+    ? sourceSnapshots.map((source) =>
+        filterContentDatabaseSourceForVisibleDocuments(
+          source,
+          organizationVisibleDocumentIds,
+        ),
+      )
+    : sourceSnapshots;
   const serializedDocumentIds = new Set(
     serializedItems.map((item) => item.document.id),
   );
@@ -365,7 +598,7 @@ export async function getContentDatabaseResponse(
     contextPath: databaseDocument
       ? await getDocumentContextPath(databaseDocument)
       : [],
-    properties: await listPropertiesForDatabase(databaseId),
+    properties: responseProperties,
     items: itemsWithOverlay,
     source: pagedPrimary,
     sources: pagedSources,
@@ -467,6 +700,7 @@ export async function getDatabaseItemByDocumentId(
     .orderBy(
       sql`CASE WHEN ${schema.contentDatabaseSourceRows.sourceId} IS NOT NULL THEN 0 ELSE 1 END`,
       sql`CASE WHEN ${schema.contentDatabases.systemRole} IS NULL THEN 0 ELSE 1 END`,
+      sql`CASE WHEN ${schema.contentDatabases.systemRole} = 'files' THEN 0 ELSE 1 END`,
       asc(schema.contentDatabases.id),
     );
   return row ?? null;

package/corpus/templates/content/actions/_delete-content-space.ts

@@ -0,0 +1,84 @@
+import { and, eq } from "drizzle-orm";
+
+import { getDb, schema } from "../server/db/index.js";
+import { resolveContentSpaceAccess } from "./_content-space-access.js";
+import { deleteDocumentRecursive } from "./delete-document.js";
+
+type Db = ReturnType<typeof getDb>;
+
+export async function deleteUserContentSpace(db: Db, spaceId: string) {
+  return db.transaction(async (tx) => {
+    const scopedDb = tx as unknown as Db;
+    const access = await resolveContentSpaceAccess(spaceId, "editor", {
+      db: scopedDb,
+    });
+    if (access.role !== "owner" || access.space.kind !== "user") {
+      throw new Error("Only user-created workspaces can be deleted");
+    }
+
+    const [mapping] = await scopedDb
+      .select()
+      .from(schema.contentSpaceCatalogItems)
+      .where(
+        and(
+          eq(schema.contentSpaceCatalogItems.spaceId, spaceId),
+          eq(
+            schema.contentSpaceCatalogItems.ownerEmail,
+            access.authority.userEmail,
+          ),
+        ),
+      );
+    if (!mapping) throw new Error("Workspace catalog entry not found");
+
+    const [filesDatabase] = await scopedDb
+      .select({ documentId: schema.contentDatabases.documentId })
+      .from(schema.contentDatabases)
+      .where(
+        and(
+          eq(schema.contentDatabases.id, access.space.filesDatabaseId),
+          eq(schema.contentDatabases.spaceId, spaceId),
+          eq(schema.contentDatabases.systemRole, "files"),
+        ),
+      );
+    if (!filesDatabase) throw new Error("Workspace Files database not found");
+
+    await scopedDb
+      .delete(schema.contentSpaceCatalogItems)
+      .where(eq(schema.contentSpaceCatalogItems.id, mapping.id));
+    const deletedCatalogDocuments = await deleteDocumentRecursive(
+      scopedDb,
+      mapping.documentId,
+      access.space.ownerEmail,
+    );
+    const deletedWorkspaceDocuments = await deleteDocumentRecursive(
+      scopedDb,
+      filesDatabase.documentId,
+      access.space.ownerEmail,
+    );
+
+    const remainingDocuments = await scopedDb
+      .select({ id: schema.documents.id })
+      .from(schema.documents)
+      .where(
+        and(
+          eq(schema.documents.spaceId, spaceId),
+          eq(schema.documents.ownerEmail, access.space.ownerEmail),
+        ),
+      );
+    if (remainingDocuments.length > 0) {
+      throw new Error(
+        "Workspace contains content outside its canonical Files database",
+      );
+    }
+
+    await scopedDb
+      .delete(schema.contentSpaces)
+      .where(eq(schema.contentSpaces.id, spaceId));
+
+    return {
+      spaceId,
+      deletedDocuments:
+        deletedCatalogDocuments.length + deletedWorkspaceDocuments.length,
+    };
+  });
+}