@agent-native/core 0.164.4 → 0.164.12

package/corpus/templates/slides/actions/request-deck-access.ts

@@ -2,17 +2,96 @@ import { createHash, randomUUID } from "node:crypto";
 
 import { defineAction } from "@agent-native/core";
 import { notifyWithDelivery } from "@agent-native/core/notifications";
-import { isEmailConfigured } from "@agent-native/core/server";
+import {
+  isEmailConfigured,
+  sendEmail,
+  signScopedAgentAccessToken,
+  verifyScopedAgentAccessToken,
+} from "@agent-native/core/server";
 import {
   getRequestUserEmail,
   getRequestUserName,
 } from "@agent-native/core/server/request-context";
 import { currentAccess, resolveAccess } from "@agent-native/core/sharing";
-import { and, eq } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
-import { getDeckUrl } from "./_app-url.js";
+import {
+  renderDeckAccessRequestEmail,
+  SLIDES_DECK_ACCESS_REQUEST_EMAIL_ID,
+} from "../server/lib/access-request-email.js";
+import {
+  SLIDES_ACCESS_REQUEST_FALLBACK_TOKEN_PREFIX,
+  SLIDES_ACCESS_REQUEST_TOKEN_PREFIX,
+  deckAccessApprovalPath,
+  SLIDES_ACCESS_APPROVAL_TOKEN_PREFIX,
+  SLIDES_ACCESS_APPROVAL_TOKEN_TTL_SECONDS,
+} from "../shared/deck-access.js";
+import { getDeckUrl, getSlidesAppUrl } from "./_app-url.js";
+
+const ANONYMOUS_ACCESS_REQUEST_WINDOW_MS = 10 * 60 * 1000;
+const ANONYMOUS_ACCESS_REQUEST_MAX = 5;
+
+async function claimAnonymousAccessRequestSlot(
+  db: ReturnType<typeof getDb>,
+  deckId: string,
+): Promise<{ windowStartedAt: string }> {
+  const now = new Date();
+  const windowStartedAt = now.toISOString();
+  const resetBefore = new Date(
+    now.getTime() - ANONYMOUS_ACCESS_REQUEST_WINDOW_MS,
+  ).toISOString();
+  const limits = schema.deckAccessRequestLimits;
+  const [bucket] = await db
+    .insert(limits)
+    .values({
+      deckId,
+      windowStartedAt,
+      requestCount: 1,
+    })
+    .onConflictDoUpdate({
+      target: limits.deckId,
+      set: {
+        windowStartedAt: sql`CASE WHEN ${limits.windowStartedAt} <= ${resetBefore} THEN ${windowStartedAt} ELSE ${limits.windowStartedAt} END`,
+        requestCount: sql`CASE WHEN ${limits.windowStartedAt} <= ${resetBefore} THEN 1 ELSE ${limits.requestCount} + 1 END`,
+      },
+      where: sql`${limits.windowStartedAt} <= ${resetBefore} OR ${limits.requestCount} < ${ANONYMOUS_ACCESS_REQUEST_MAX}`,
+    })
+    .returning({
+      requestCount: limits.requestCount,
+      windowStartedAt: limits.windowStartedAt,
+    });
+
+  if (!bucket) {
+    throw httpError(
+      "Too many anonymous access requests for this deck. Try again later.",
+      429,
+    );
+  }
+  return { windowStartedAt: bucket.windowStartedAt };
+}
+
+async function refundAnonymousAccessRequestSlot(
+  db: ReturnType<typeof getDb>,
+  deckId: string,
+  windowStartedAt: string,
+): Promise<void> {
+  const limits = schema.deckAccessRequestLimits;
+  await db
+    .update(limits)
+    .set({
+      requestCount: sql`${limits.requestCount} - 1`,
+    })
+    .where(
+      and(
+        eq(limits.deckId, deckId),
+        eq(limits.windowStartedAt, windowStartedAt),
+        sql`${limits.requestCount} > 0`,
+      ),
+    )
+    .returning({ deckId: limits.deckId });
+}
 
 function httpError(message: string, statusCode: number): Error {
   return Object.assign(new Error(message), { statusCode });
@@ -35,8 +114,11 @@ function normalizeEmail(email: string): string {
   return email.trim().toLowerCase();
 }
 
-function cleanSubjectPart(value: string): string {
-  return value.replace(/[\r\n]+/g, " ").trim();
+function absoluteDeckAccessApprovalUrl(
+  deckId: string,
+  approvalToken: string,
+): string {
+  return `${getSlidesAppUrl().replace(/\/+$/, "")}${deckAccessApprovalPath(deckId, approvalToken)}`;
 }
 
 function accessRequestEventId(deckId: string, requesterEmail: string): string {
@@ -55,6 +137,9 @@ type AccessRequestPayload = {
   requesterEmail?: string;
   requesterName?: string;
   requestedAt?: string;
+  approvalTokenHash?: string;
+  accessGrantedAt?: string;
+  accessShareId?: string;
   notifiedOwner?: boolean;
   notifiedAt?: string;
   inAppNotified?: boolean;
@@ -68,6 +153,7 @@ type AccessRequestNotificationState = {
   emailNotified: boolean;
   emailRequired: boolean;
   ownerCanNotify: boolean;
+  approvalTokenHash?: string;
 };
 
 const NOTIFICATION_CLAIM_TTL_MS = 5 * 60 * 1000;
@@ -104,6 +190,7 @@ function notificationStateFor(
     emailNotified: payload.emailNotified ?? legacyNotified,
     emailRequired: ownerCanNotify && emailConfigured,
     ownerCanNotify,
+    approvalTokenHash: payload.approvalTokenHash,
   };
 }
 
@@ -145,63 +232,148 @@ async function notifyAccessRequestOwner(input: {
   const ownerEmail = input.ownerEmail;
   if (!ownerEmail || !input.state.ownerCanNotify) return input.state;
 
-  const emailConfigured = await isEmailConfigured();
-  const state = {
-    ...input.state,
-    emailRequired: input.state.ownerCanNotify && emailConfigured,
-  };
-  const channels: string[] = [];
-  if (!state.inAppNotified) channels.push("inbox");
-  if (state.emailRequired && !state.emailNotified) channels.push("email");
-  if (channels.length === 0) return state;
+  let state = input.state;
+
+  if (!state.inAppNotified) {
+    try {
+      const delivery = await notifyWithDelivery(
+        {
+          severity: "info",
+          title: "Deck access requested",
+          body: `${input.requesterName} requested access to “${input.deckTitle}”.`,
+          channels: ["inbox"],
+          metadata: {
+            deckId: input.deckId,
+            requesterEmail: input.requesterEmail,
+            link: getDeckUrl(input.deckId),
+          },
+        },
+        { owner: ownerEmail },
+      );
+      state = {
+        ...state,
+        inAppNotified:
+          state.inAppNotified || delivery.deliveredChannels.includes("inbox"),
+      };
+    } catch (error) {
+      console.warn(
+        "[deck-access] in-app access request notification failed:",
+        error,
+      );
+    }
+  }
 
-  try {
-    const delivery = await notifyWithDelivery(
-      {
-        severity: "info",
-        title: "Deck access requested",
-        body: `${input.requesterName} requested access to “${input.deckTitle}”.`,
-        channels,
-        metadata: {
-          deckId: input.deckId,
+  if (state.emailRequired && !state.emailNotified) {
+    try {
+      const approvalToken = signScopedAgentAccessToken({
+        resourceKind: SLIDES_ACCESS_APPROVAL_TOKEN_PREFIX,
+        resourceId: input.deckId,
+        viewerEmail: input.requesterEmail,
+        ttlSeconds: SLIDES_ACCESS_APPROVAL_TOKEN_TTL_SECONDS,
+      });
+      await sendEmail({
+        ...renderDeckAccessRequestEmail({
+          requesterName: input.requesterName,
           requesterEmail: input.requesterEmail,
-          link: getDeckUrl(input.deckId),
-          ...(channels.includes("email")
-            ? {
-                emailRecipients: [ownerEmail],
-                emailSubject: `${cleanSubjectPart(input.requesterName)} requested access to "${cleanSubjectPart(input.deckTitle)}"`,
-              }
-            : {}),
-        },
-      },
-      { owner: ownerEmail },
-    );
-    return {
-      ...state,
-      inAppNotified:
-        state.inAppNotified || delivery.deliveredChannels.includes("inbox"),
-      emailNotified:
-        state.emailNotified || delivery.deliveredChannels.includes("email"),
-    };
-  } catch (error) {
-    console.warn("[deck-access] access request notification failed:", error);
-    return state;
+          deckTitle: input.deckTitle,
+          url: getDeckUrl(input.deckId),
+          allowAccessUrl: absoluteDeckAccessApprovalUrl(
+            input.deckId,
+            approvalToken,
+          ),
+        }),
+        to: ownerEmail,
+        replyTo: input.requesterEmail,
+        templateId: SLIDES_DECK_ACCESS_REQUEST_EMAIL_ID,
+      });
+      state = {
+        ...state,
+        emailNotified: true,
+        approvalTokenHash: createHash("sha256")
+          .update(approvalToken)
+          .digest("hex"),
+      };
+    } catch (error) {
+      console.warn("[deck-access] access request email failed:", error);
+    }
   }
+
+  return state;
 }
 
 export default defineAction({
   description:
-    "Request access to a private Agent-Native Slides deck. Records an access-request event and notifies the owner when email is configured.",
+    "Request access to a private Agent-Native Slides deck. Signed-in viewers use their account email; anonymous viewers may provide an email address. Records an access-request event and notifies the owner in-app and by email when configured.",
   schema: z.object({
     deckId: z.string().min(1).describe("Deck ID to request access to."),
+    accessRequestToken: z
+      .string()
+      .trim()
+      .min(1)
+      .optional()
+      .describe("Short-lived capability from the private deck page."),
+    requesterEmail: z
+      .string()
+      .trim()
+      .email()
+      .optional()
+      .describe(
+        "Email address to request access for when the viewer is not signed in.",
+      ),
   }),
+  requiresAuth: false,
   agentTool: false,
-  run: async ({ deckId }) => {
-    const rawRequesterEmail = getRequestUserEmail();
-    if (!rawRequesterEmail) {
-      throw httpError("Sign in to request access to this deck.", 401);
+  run: async ({
+    deckId,
+    accessRequestToken,
+    requesterEmail: requesterEmailInput,
+  }) => {
+    const sessionEmail = getRequestUserEmail();
+    let requestToken = accessRequestToken
+      ? verifyScopedAgentAccessToken(accessRequestToken, {
+          resourceKind: SLIDES_ACCESS_REQUEST_TOKEN_PREFIX,
+          resourceId: deckId,
+        })
+      : { ok: false as const, reason: "missing" };
+    let accessProbeWasUnavailable = false;
+    if (accessRequestToken && !requestToken.ok) {
+      const fallbackToken = verifyScopedAgentAccessToken(accessRequestToken, {
+        resourceKind: SLIDES_ACCESS_REQUEST_FALLBACK_TOKEN_PREFIX,
+        resourceId: deckId,
+      });
+      if (fallbackToken.ok) {
+        requestToken = fallbackToken;
+        accessProbeWasUnavailable = true;
+      }
+    }
+    if (accessRequestToken && !requestToken.ok) {
+      throw httpError(`Deck ${deckId} not found`, 404);
+    }
+    if (!sessionEmail && !requestToken.ok) {
+      throw httpError(`Deck ${deckId} not found`, 404);
+    }
+    const normalizedRequesterEmail = sessionEmail
+      ? normalizeEmail(sessionEmail)
+      : requesterEmailInput
+        ? normalizeEmail(requesterEmailInput)
+        : null;
+    if (!normalizedRequesterEmail) {
+      throw httpError(
+        "Sign in or provide an email address to request access to this deck.",
+        401,
+      );
+    }
+    const tokenViewerEmail =
+      requestToken.ok && requestToken.viewerEmail
+        ? normalizeEmail(requestToken.viewerEmail)
+        : null;
+    if (tokenViewerEmail && tokenViewerEmail !== normalizedRequesterEmail) {
+      throw httpError(
+        "This request is tied to a different email. Sign in with the email that opened the link.",
+        403,
+      );
     }
-    const requesterEmail = normalizeEmail(rawRequesterEmail);
+    const requesterEmail = normalizedRequesterEmail;
 
     const db = getDb();
     const claimNotification = async (
@@ -313,6 +485,8 @@ export default defineAction({
         inAppNotified: state.inAppNotified,
         emailNotified: state.emailNotified,
         notifiedOwner: delivered,
+        approvalTokenHash:
+          state.approvalTokenHash ?? claimedPayload.approvalTokenHash,
         notificationClaimedAt: undefined,
         notificationClaimToken: undefined,
         ...(delivered ? { notifiedAt: new Date().toISOString() } : {}),
@@ -355,7 +529,9 @@ export default defineAction({
       throw httpError(`Deck ${deckId} not found`, 404);
     }
 
-    const access = await resolveAccess("deck", deckId, currentAccess());
+    const access = accessProbeWasUnavailable
+      ? null
+      : await resolveAccess("deck", deckId, currentAccess());
     if (access) {
       return {
         ok: true as const,
@@ -491,6 +667,10 @@ export default defineAction({
       };
     }
 
+    const anonymousSlot = sessionEmail
+      ? null
+      : await claimAnonymousAccessRequestSlot(db, deckId);
+
     const requestId = accessRequestEventId(deckId, requesterEmail);
     const requestedAt = new Date().toISOString();
     const initialPayload: AccessRequestPayload = {
@@ -506,21 +686,40 @@ export default defineAction({
     };
     const initialPayloadJson = JSON.stringify(initialPayload);
 
-    const [insertedRequest] = await db
-      .insert(schema.deckEvents)
-      .values({
-        id: requestId,
-        deckId,
-        type: "deck.access_requested",
-        message: `${requesterEmail} requested access to this deck.`,
-        payload: initialPayloadJson,
-        createdBy: "human",
-        createdAt: requestedAt,
-      })
-      .onConflictDoNothing()
-      .returning({ id: schema.deckEvents.id });
+    let insertedRequest: { id: string } | undefined;
+    try {
+      [insertedRequest] = await db
+        .insert(schema.deckEvents)
+        .values({
+          id: requestId,
+          deckId,
+          type: "deck.access_requested",
+          message: `${requesterEmail} requested access to this deck.`,
+          payload: initialPayloadJson,
+          createdBy: "human",
+          createdAt: requestedAt,
+        })
+        .onConflictDoNothing()
+        .returning({ id: schema.deckEvents.id });
+    } catch (error) {
+      if (anonymousSlot) {
+        await refundAnonymousAccessRequestSlot(
+          db,
+          deckId,
+          anonymousSlot.windowStartedAt,
+        );
+      }
+      throw error;
+    }
 
     if (!insertedRequest) {
+      if (anonymousSlot) {
+        await refundAnonymousAccessRequestSlot(
+          db,
+          deckId,
+          anonymousSlot.windowStartedAt,
+        );
+      }
       return {
         ok: true as const,
         alreadyHasAccess: false,

package/corpus/templates/slides/app/components/editor/MissingDeckAccessPane.tsx

@@ -0,0 +1,196 @@
+import { useT } from "@agent-native/core/client/i18n";
+import {
+  IconArrowLeft,
+  IconAt,
+  IconLock,
+  IconLoader2,
+  IconLogin2,
+  IconRefresh,
+  IconUserPlus,
+  IconUsersGroup,
+} from "@tabler/icons-react";
+import type { FormEvent } from "react";
+
+import { Button } from "@/components/ui/button";
+import type { DeckAccessStatusResponse } from "@/hooks/use-deck-access";
+
+import { RequestDeckAccessDialog } from "./RequestDeckAccessDialog";
+
+export function MissingDeckAccessPane({
+  accessStatus,
+  accessStatusError,
+  accessStatusLoading,
+  hasTeamJoinOption,
+  orgLoading,
+  orgError,
+  requestAccessPending,
+  accessRequestSent,
+  accessRequestNotified,
+  requestAccessDialogOpen,
+  requesterEmail,
+  requestAccessDialogError,
+  signedIn,
+  signInHref,
+  viewerEmail,
+  refreshing,
+  onRequestAccess,
+  onRequestAccessDialogOpenChange,
+  onRequesterEmailChange,
+  onSubmitGuestAccessRequest,
+  onSignIn,
+  onRetry,
+  onBack,
+}: {
+  accessStatus: DeckAccessStatusResponse | null;
+  accessStatusError: boolean;
+  accessStatusLoading: boolean;
+  hasTeamJoinOption: boolean;
+  orgLoading: boolean;
+  orgError: boolean;
+  requestAccessPending: boolean;
+  accessRequestSent: boolean;
+  accessRequestNotified: boolean;
+  requestAccessDialogOpen: boolean;
+  requesterEmail: string;
+  requestAccessDialogError: string | null;
+  signedIn: boolean;
+  signInHref: string;
+  viewerEmail: string | null;
+  refreshing: boolean;
+  onRequestAccess: () => void;
+  onRequestAccessDialogOpenChange: (open: boolean) => void;
+  onRequesterEmailChange: (email: string) => void;
+  onSubmitGuestAccessRequest: (event: FormEvent<HTMLFormElement>) => void;
+  onSignIn: () => void;
+  onRetry: () => void;
+  onBack: () => void;
+}) {
+  const t = useT();
+  const privateDeck = Boolean(
+    accessStatus?.exists &&
+    !accessStatus.hasAccess &&
+    accessStatus.visibility === "private",
+  );
+  const accessCheckFailed = accessStatusError || orgError;
+  const noAccess = privateDeck || accessCheckFailed;
+  const checkingAccess = !noAccess && (accessStatusLoading || orgLoading);
+  const Icon =
+    noAccess || (!hasTeamJoinOption && !checkingAccess)
+      ? IconLock
+      : IconUsersGroup;
+  const title = checkingAccess
+    ? t("deckEditor.lookingForDeck")
+    : noAccess
+      ? t("deckEditor.privateDeckTitle")
+      : hasTeamJoinOption
+        ? t("deckEditor.joinTeamToOpen")
+        : t("deckEditor.deckUnavailable");
+  const description = checkingAccess
+    ? t("deckEditor.checkingSharedAccess")
+    : noAccess
+      ? t("deckEditor.privateDeckDescription")
+      : hasTeamJoinOption
+        ? t("deckEditor.joinTeamDescription")
+        : t("deckEditor.deckUnavailableDescription");
+
+  return (
+    <div className="flex min-h-screen items-center justify-center bg-background px-4 py-10">
+      <div className="w-full max-w-md rounded-lg border border-border bg-card p-6 shadow-sm">
+        <div className="mb-4 flex items-center gap-3">
+          <div className="flex size-10 items-center justify-center rounded-md border border-border bg-background text-muted-foreground">
+            <Icon className="size-5" />
+          </div>
+          <div className="min-w-0">
+            <h1 className="text-base font-semibold text-foreground">{title}</h1>
+          </div>
+        </div>
+        <p className="text-sm leading-6 text-muted-foreground">{description}</p>
+        {noAccess && viewerEmail ? (
+          <div className="mt-4 flex items-center gap-2 rounded-md border border-border bg-muted/35 px-3 py-2 text-sm">
+            <IconAt className="size-4 shrink-0 text-muted-foreground" />
+            <span className="min-w-0 truncate text-muted-foreground">
+              {t("deckEditor.signedInAs")}{" "}
+              <span className="font-medium text-foreground">{viewerEmail}</span>
+            </span>
+          </div>
+        ) : null}
+        {noAccess && accessRequestSent ? (
+          <div className="mt-3 rounded-md border border-emerald-500/25 bg-emerald-500/10 px-3 py-2 text-sm text-emerald-700 dark:text-emerald-300">
+            {t(
+              accessRequestNotified
+                ? "deckEditor.accessRequestSentDescription"
+                : "deckEditor.accessRequestRecordedDescription",
+            )}
+          </div>
+        ) : null}
+        <div className="mt-5 flex flex-col gap-2">
+          {noAccess && !signedIn ? (
+            <>
+              <Button type="button" onClick={onSignIn}>
+                <IconLogin2 className="size-4" />
+                {t("deckEditor.signInToRequestAccess")}
+              </Button>
+              <Button
+                type="button"
+                variant="outline"
+                onClick={() => onRequestAccessDialogOpenChange(true)}
+                disabled={requestAccessPending || accessRequestSent}
+              >
+                <IconUserPlus className="size-4" />
+                {accessRequestSent
+                  ? t("deckEditor.accessRequestSent")
+                  : t("deckEditor.requestAccess")}
+              </Button>
+            </>
+          ) : noAccess ? (
+            <Button
+              type="button"
+              onClick={onRequestAccess}
+              disabled={requestAccessPending || accessRequestSent}
+            >
+              {requestAccessPending ? (
+                <IconLoader2 className="size-4 animate-spin" />
+              ) : (
+                <IconUserPlus className="size-4" />
+              )}
+              {requestAccessPending
+                ? t("deckEditor.requestAccessPending")
+                : accessRequestSent
+                  ? t("deckEditor.accessRequestSent")
+                  : t("deckEditor.requestAccess")}
+            </Button>
+          ) : null}
+          <div className="flex flex-col-reverse gap-2 sm:flex-row sm:justify-end">
+            <Button type="button" variant="outline" onClick={onBack}>
+              <IconArrowLeft className="size-4" />
+              {t("deckEditor.backToDecks")}
+            </Button>
+            <Button
+              type="button"
+              variant={noAccess ? "ghost" : "default"}
+              onClick={onRetry}
+              disabled={refreshing || checkingAccess}
+            >
+              <IconRefresh
+                className={refreshing ? "size-4 animate-spin" : "size-4"}
+              />
+              {t("deckEditor.tryAgain")}
+            </Button>
+          </div>
+        </div>
+      </div>
+      {noAccess && !signedIn ? (
+        <RequestDeckAccessDialog
+          open={requestAccessDialogOpen}
+          onOpenChange={onRequestAccessDialogOpenChange}
+          signInHref={signInHref}
+          email={requesterEmail}
+          onEmailChange={onRequesterEmailChange}
+          onSubmit={onSubmitGuestAccessRequest}
+          isSubmitting={requestAccessPending}
+          error={requestAccessDialogError}
+        />
+      ) : null}
+    </div>
+  );
+}