@agent-native/core 0.164.4 → 0.164.11

package/corpus/templates/slides/actions/approve-deck-access-request.ts

@@ -0,0 +1,234 @@
+import { createHash } from "node:crypto";
+
+import { defineAction } from "@agent-native/core";
+import { verifyScopedAgentAccessToken } from "@agent-native/core/server";
+import { invalidateCollabAccessCache } from "@agent-native/core/server/poll";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server/request-context";
+import { resolveAccess } from "@agent-native/core/sharing";
+import { and, eq, sql } from "drizzle-orm";
+import { z } from "zod";
+
+import { getDb, schema } from "../server/db/index.js";
+import { SLIDES_ACCESS_APPROVAL_TOKEN_PREFIX } from "../shared/deck-access.js";
+
+function httpError(message: string, statusCode: number): Error {
+  return Object.assign(new Error(message), { statusCode });
+}
+
+function normalizeEmail(email: string): string {
+  return email.trim().toLowerCase();
+}
+
+function approvalTokenHash(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+type AccessRequestPayload = {
+  requesterEmail?: string;
+  approvalTokenHash?: string;
+  accessGrantedAt?: string;
+};
+
+function deckViewerShareId(deckId: string, requesterEmail: string): string {
+  return (
+    "deck-share-" +
+    createHash("sha256")
+      .update(deckId)
+      .update("\0")
+      .update(requesterEmail)
+      .digest("hex")
+  );
+}
+
+export default defineAction({
+  description:
+    "Approve a private Slides deck access request and add the requester as a viewer in the deck's standard sharing list.",
+  schema: z.object({
+    deckId: z.string().min(1).describe("Deck ID to share."),
+    approvalToken: z
+      .string()
+      .trim()
+      .min(1)
+      .describe("Signed approval capability from the deck owner email."),
+  }),
+  agentTool: false,
+  run: async ({ deckId, approvalToken }) => {
+    const approverEmail = getRequestUserEmail();
+    if (!approverEmail) {
+      throw httpError("Sign in as the deck owner to allow access.", 401);
+    }
+
+    const token = verifyScopedAgentAccessToken(approvalToken, {
+      resourceKind: SLIDES_ACCESS_APPROVAL_TOKEN_PREFIX,
+      resourceId: deckId,
+    });
+    if (!token.ok || !token.viewerEmail) {
+      throw httpError("This access request is invalid or expired.", 404);
+    }
+
+    const normalizedApproverEmail = normalizeEmail(approverEmail);
+    const access = await resolveAccess("deck", deckId, {
+      userEmail: normalizedApproverEmail,
+      orgId: getRequestOrgId() ?? undefined,
+    });
+    if (!access || !["owner", "admin"].includes(access.role)) {
+      throw httpError("Only a deck owner or admin can allow access.", 403);
+    }
+
+    const db = getDb();
+    const [deck] = await db
+      .select({
+        id: schema.decks.id,
+        title: schema.decks.title,
+        visibility: schema.decks.visibility,
+      })
+      .from(schema.decks)
+      .where(eq(schema.decks.id, deckId))
+      .limit(1);
+    if (!deck || deck.visibility !== "private") {
+      throw httpError(`Deck ${deckId} not found`, 404);
+    }
+
+    const requesterEmail = normalizeEmail(token.viewerEmail);
+    const accessRequests = await db
+      .select({
+        id: schema.deckEvents.id,
+        payload: schema.deckEvents.payload,
+      })
+      .from(schema.deckEvents)
+      .where(
+        and(
+          eq(schema.deckEvents.deckId, deckId),
+          eq(schema.deckEvents.type, "deck.access_requested"),
+        ),
+      );
+    const request = accessRequests.find((event) => {
+      try {
+        const payload = JSON.parse(event.payload ?? "") as AccessRequestPayload;
+        return (
+          typeof payload.requesterEmail === "string" &&
+          normalizeEmail(payload.requesterEmail) === requesterEmail &&
+          payload.approvalTokenHash === approvalTokenHash(approvalToken)
+        );
+      } catch {
+        // coercion-ok: malformed historical event payload cannot authorize a share.
+        return false;
+      }
+    });
+    if (!request) {
+      throw httpError("This access request is invalid or expired.", 404);
+    }
+    let requestPayload: AccessRequestPayload;
+    try {
+      requestPayload = JSON.parse(
+        request.payload ?? "",
+      ) as AccessRequestPayload;
+    } catch {
+      throw httpError("This access request is invalid or expired.", 404);
+    }
+
+    const [existingShare] = await db
+      .select({ id: schema.deckShares.id })
+      .from(schema.deckShares)
+      .where(
+        and(
+          eq(schema.deckShares.resourceId, deckId),
+          eq(schema.deckShares.principalType, "user"),
+          // Share email principals are normalized on write, but this keeps
+          // approval idempotent for rows created before that convention.
+          sql`lower(${schema.deckShares.principalId}) = ${requesterEmail}`,
+        ),
+      )
+      .limit(1);
+    if (existingShare) {
+      return {
+        ok: true as const,
+        alreadyAllowed: true,
+        requesterEmail,
+        deckId,
+        deckTitle: deck.title,
+        shareId: existingShare.id,
+        message: "Access was already granted to this requester.",
+      };
+    }
+    if (requestPayload.accessGrantedAt) {
+      throw httpError("This access request is invalid or expired.", 404);
+    }
+
+    // Use a deterministic primary key as the idempotency key. The generic
+    // shares table predates a composite unique constraint, but concurrent
+    // approvals for this flow still collide atomically on this key.
+    const shareId = deckViewerShareId(deckId, requesterEmail);
+    const [insertedShare] = await db
+      .insert(schema.deckShares)
+      .values({
+        id: shareId,
+        resourceId: deckId,
+        principalType: "user",
+        principalId: requesterEmail,
+        role: "viewer",
+        createdBy: normalizedApproverEmail,
+        createdAt: new Date().toISOString(),
+      })
+      .onConflictDoNothing()
+      .returning({ id: schema.deckShares.id });
+    if (!insertedShare) {
+      const [existingShareAfterConflict] = await db
+        .select({ id: schema.deckShares.id })
+        .from(schema.deckShares)
+        .where(
+          and(
+            eq(schema.deckShares.resourceId, deckId),
+            eq(schema.deckShares.principalType, "user"),
+            sql`lower(${schema.deckShares.principalId}) = ${requesterEmail}`,
+          ),
+        )
+        .limit(1);
+      if (!existingShareAfterConflict) {
+        throw new Error("Deck access share conflict could not be resolved.");
+      }
+      return {
+        ok: true as const,
+        alreadyAllowed: true,
+        requesterEmail,
+        deckId,
+        deckTitle: deck.title,
+        shareId: existingShareAfterConflict.id,
+        message: "Access was already granted to this requester.",
+      };
+    }
+    const [markedRequest] = await db
+      .update(schema.deckEvents)
+      .set({
+        payload: JSON.stringify({
+          ...requestPayload,
+          accessGrantedAt: new Date().toISOString(),
+          accessShareId: insertedShare.id,
+        }),
+      })
+      .where(
+        and(
+          eq(schema.deckEvents.id, request.id),
+          eq(schema.deckEvents.payload, request.payload ?? ""),
+        ),
+      )
+      .returning({ id: schema.deckEvents.id });
+    if (!markedRequest) {
+      throw new Error("Deck access request approval could not be recorded.");
+    }
+    invalidateCollabAccessCache("deck", deckId);
+
+    return {
+      ok: true as const,
+      alreadyAllowed: false,
+      requesterEmail,
+      deckId,
+      deckTitle: deck.title,
+      shareId: insertedShare.id,
+      message: "Access granted. This requester can now open the deck.",
+    };
+  },
+});

package/corpus/templates/slides/actions/get-deck-access-status.ts

@@ -1,4 +1,5 @@
 import { defineAction } from "@agent-native/core";
+import { signScopedAgentAccessToken } from "@agent-native/core/server";
 import {
   getRequestUserEmail,
   getRequestUserName,
@@ -8,6 +9,11 @@ import { eq } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
+import {
+  SLIDES_ACCESS_REQUEST_FALLBACK_TOKEN_PREFIX,
+  SLIDES_ACCESS_REQUEST_TOKEN_PREFIX,
+  SLIDES_ACCESS_REQUEST_TOKEN_TTL_SECONDS,
+} from "../shared/deck-access.js";
 
 export type DeckAccessStatus = {
   exists: boolean;
@@ -17,6 +23,7 @@ export type DeckAccessStatus = {
   viewerName: string | null;
   role: "owner" | "viewer" | "commenter" | "editor" | "admin" | null;
   visibility: "private" | "org" | "public" | null;
+  accessRequestToken?: string;
 };
 
 export default defineAction({
@@ -53,7 +60,32 @@ export default defineAction({
       };
     }
 
-    const access = await resolveAccess("deck", deckId, currentAccess());
+    let access: Awaited<ReturnType<typeof resolveAccess>> = null;
+    let accessProbeFailed = false;
+    try {
+      access = await resolveAccess("deck", deckId, currentAccess());
+    } catch (error) {
+      // coercion-ok: an access probe failure must fail closed as no access so
+      // the page stays gated while a separate fallback request capability
+      // keeps the owner-notification path available.
+      accessProbeFailed = true;
+      console.warn(
+        "[slides] deck access probe failed; treating the deck as private:",
+        error,
+      );
+    }
+    const visibility = deck.visibility ?? "private";
+    const accessRequestToken =
+      !access && visibility === "private"
+        ? signScopedAgentAccessToken({
+            resourceKind: accessProbeFailed
+              ? SLIDES_ACCESS_REQUEST_FALLBACK_TOKEN_PREFIX
+              : SLIDES_ACCESS_REQUEST_TOKEN_PREFIX,
+            resourceId: deckId,
+            ...(viewerEmail ? { viewerEmail } : {}),
+            ttlSeconds: SLIDES_ACCESS_REQUEST_TOKEN_TTL_SECONDS,
+          })
+        : undefined;
     return {
       exists: true,
       hasAccess: Boolean(access),
@@ -61,7 +93,8 @@ export default defineAction({
       viewerEmail,
       viewerName,
       role: access?.role ?? null,
-      visibility: deck.visibility ?? "private",
+      visibility,
+      ...(accessRequestToken ? { accessRequestToken } : {}),
     };
   },
 });