@anchrd/intel-api 0.3.1 → 0.3.2

package/dist/adapters/db/db-grants.d.ts

@@ -0,0 +1,47 @@
+import type { ResourceVerb } from "@anchrd/intel-contract";
+export interface GrantActor {
+    id: string;
+    email: string;
+    isAdmin?: boolean;
+}
+export declare const subtreeCte: string;
+export declare function subtreeBindings(actor: GrantActor, verb: ResourceVerb, now: string): unknown[];
+/**
+ * Both walks in one statement: what the actor may open, and what they may run. Its bindings are
+ * `subtreeBindings(actor, "read", now)` followed by `subtreeBindings(actor, "execute", now)`, in
+ * that order.
+ */
+export declare const readableOrRunnableCte: string;
+/**
+ * A flow the actor may open *or* may run, for a statement carrying `readableOrRunnableCte`. It is
+ * the callable rule of ADR-0004 §2/§3 — `execute` without `read` is the library, a building block
+ * anyone may run and few may open — asked of a whole list of flows at once instead of one flow at a
+ * time. Its bindings follow the two CTEs' and are `flowInSubtreeBindings(actor)`.
+ */
+export declare const flowCallable = "(\n  ? = 1\n  OR flow.owner_id = ?\n  OR flow.parent_id IN (SELECT id FROM readable)\n  OR flow.parent_id IN (SELECT id FROM runnable)\n)";
+/**
+ * The point check for one Knowledge node: the node itself and every ancestor above it. Cheaper than
+ * the subtree walk and the same answer, because a grant reaches down and never sideways.
+ *
+ * ⚠️ `UNION`, never `UNION ALL`. The service refuses to move a node into its own descendant, but a
+ * cycle in `parent_id` can still reach the table — a restore, a repair, a future writer. `UNION ALL`
+ * would walk such a ring without end, and this query runs on the authorization path of every
+ * request, so the damage lands in the database rather than in one tab. `UNION` folds the repeated
+ * row away and the recursion stops on its own.
+ */
+export declare const nodeVerbQuery: string;
+export declare function nodeVerbBindings(nodeId: string, actor: GrantActor, verb: ResourceVerb, now: string): unknown[];
+/**
+ * The same question for a flow. A flow carries no grant of its own any more: what reaches it is the
+ * folder it is filed in and that folder's ancestors. Its owner keeps it, the way a Knowledge node's
+ * owner keeps theirs — otherwise a flow at the root of the tree would be unreachable by the person
+ * who created it. `UNION` for the same reason as above.
+ */
+export declare const flowVerbQuery: string;
+export declare function flowVerbBindings(flowId: string, actor: GrantActor, verb: ResourceVerb, now: string): unknown[];
+/**
+ * The predicate a query over `flows` uses when it already carries `subtreeCte` for the same verb.
+ * Its bindings follow the CTE's.
+ */
+export declare const flowInSubtree = "(? = 1 OR flow.owner_id = ? OR flow.parent_id IN (SELECT id FROM allowed))";
+export declare function flowInSubtreeBindings(actor: GrantActor): unknown[];

package/dist/adapters/db/db-grants.js

@@ -0,0 +1,125 @@
+const principalMatch = `(
+  (grant_row.principal_type = 'user' AND grant_row.principal_id = ?)
+  OR (grant_row.principal_type = 'email' AND lower(grant_row.principal_id) = lower(?))
+  OR (grant_row.principal_type = 'organization' AND grant_row.principal_id = '*')
+)`;
+function grantExists(nodeColumn) {
+    return `EXISTS (
+    SELECT 1 FROM tree_grants grant_row
+    WHERE grant_row.node_id = ${nodeColumn}
+      AND ${principalMatch}
+      AND grant_row.verb = ?
+      AND (grant_row.expires_at IS NULL OR grant_row.expires_at > ?)
+  )`;
+}
+// Bindings for one `grantExists`: principal (twice), verb, and the moment expiry is measured
+// against. Callers concatenate these in SQL order; the helpers below say which order that is.
+function grantBindings(actor, verb, now) {
+    return [actor.id, actor.email, verb, now];
+}
+/**
+ * Seeds every node the actor reaches for one verb and walks downwards, which is what "a grant
+ * applies to everything beneath it" means in SQL. The name is a parameter because one statement can
+ * need two of these — asking `read` and `execute` at once is what turns "one query per callee" into
+ * one query (#30) — and a second walk written out by hand would be a second copy of the rule.
+ */
+function subtreeWalk(name) {
+    return `${name}(id, parent_id) AS (
+    SELECT seed.id, seed.parent_id
+    FROM knowledge_nodes seed
+    WHERE ? = 1
+       OR seed.owner_id = ?
+       OR ${grantExists("seed.id")}
+    UNION
+    SELECT child.id, child.parent_id
+    FROM knowledge_nodes child
+    JOIN ${name} parent ON child.parent_id = parent.id
+  )`;
+}
+// The walk under the name every single-verb statement already uses. Callers append their own SELECT
+// and may append further CTEs with a comma.
+export const subtreeCte = `WITH RECURSIVE ${subtreeWalk("allowed")}`;
+export function subtreeBindings(actor, verb, now) {
+    return [actor.isAdmin ? 1 : 0, actor.id, ...grantBindings(actor, verb, now)];
+}
+/**
+ * Both walks in one statement: what the actor may open, and what they may run. Its bindings are
+ * `subtreeBindings(actor, "read", now)` followed by `subtreeBindings(actor, "execute", now)`, in
+ * that order.
+ */
+export const readableOrRunnableCte = `WITH RECURSIVE ${subtreeWalk("readable")},
+  ${subtreeWalk("runnable")}`;
+/**
+ * A flow the actor may open *or* may run, for a statement carrying `readableOrRunnableCte`. It is
+ * the callable rule of ADR-0004 §2/§3 — `execute` without `read` is the library, a building block
+ * anyone may run and few may open — asked of a whole list of flows at once instead of one flow at a
+ * time. Its bindings follow the two CTEs' and are `flowInSubtreeBindings(actor)`.
+ */
+export const flowCallable = `(
+  ? = 1
+  OR flow.owner_id = ?
+  OR flow.parent_id IN (SELECT id FROM readable)
+  OR flow.parent_id IN (SELECT id FROM runnable)
+)`;
+/**
+ * The point check for one Knowledge node: the node itself and every ancestor above it. Cheaper than
+ * the subtree walk and the same answer, because a grant reaches down and never sideways.
+ *
+ * ⚠️ `UNION`, never `UNION ALL`. The service refuses to move a node into its own descendant, but a
+ * cycle in `parent_id` can still reach the table — a restore, a repair, a future writer. `UNION ALL`
+ * would walk such a ring without end, and this query runs on the authorization path of every
+ * request, so the damage lands in the database rather than in one tab. `UNION` folds the repeated
+ * row away and the recursion stops on its own.
+ */
+export const nodeVerbQuery = `WITH RECURSIVE ancestors(id, parent_id, owner_id) AS (
+    SELECT id, parent_id, owner_id FROM knowledge_nodes WHERE id = ?
+    UNION
+    SELECT parent.id, parent.parent_id, parent.owner_id
+    FROM knowledge_nodes parent
+    JOIN ancestors child ON child.parent_id = parent.id
+  )
+  SELECT 1 AS allowed
+  FROM ancestors
+  WHERE ? = 1
+     OR owner_id = ?
+     OR ${grantExists("ancestors.id")}
+  LIMIT 1`;
+export function nodeVerbBindings(nodeId, actor, verb, now) {
+    return [nodeId, actor.isAdmin ? 1 : 0, actor.id, ...grantBindings(actor, verb, now)];
+}
+/**
+ * The same question for a flow. A flow carries no grant of its own any more: what reaches it is the
+ * folder it is filed in and that folder's ancestors. Its owner keeps it, the way a Knowledge node's
+ * owner keeps theirs — otherwise a flow at the root of the tree would be unreachable by the person
+ * who created it. `UNION` for the same reason as above.
+ */
+export const flowVerbQuery = `WITH RECURSIVE ancestors(id, parent_id) AS (
+    SELECT folder.id, folder.parent_id
+    FROM knowledge_nodes folder
+    JOIN flows flow ON flow.parent_id = folder.id
+    WHERE flow.id = ?
+    UNION
+    SELECT parent.id, parent.parent_id
+    FROM knowledge_nodes parent
+    JOIN ancestors child ON child.parent_id = parent.id
+  )
+  SELECT 1 AS allowed
+  FROM flows flow
+  WHERE flow.id = ?
+    AND (
+      ? = 1
+      OR flow.owner_id = ?
+      OR EXISTS (SELECT 1 FROM ancestors WHERE ${grantExists("ancestors.id")})
+    )
+  LIMIT 1`;
+export function flowVerbBindings(flowId, actor, verb, now) {
+    return [flowId, flowId, actor.isAdmin ? 1 : 0, actor.id, ...grantBindings(actor, verb, now)];
+}
+/**
+ * The predicate a query over `flows` uses when it already carries `subtreeCte` for the same verb.
+ * Its bindings follow the CTE's.
+ */
+export const flowInSubtree = `(? = 1 OR flow.owner_id = ? OR flow.parent_id IN (SELECT id FROM allowed))`;
+export function flowInSubtreeBindings(actor) {
+    return [actor.isAdmin ? 1 : 0, actor.id];
+}

package/dist/adapters/db/db-indexing.js

@@ -1,9 +1,9 @@
-function mapTarget(row) {
+function mapTarget(row, contentKeys) {
     return {
         nodeId: row.node_id,
         versionId: row.version_id,
         title: row.title,
-        contentKey: row.content_key,
+        contentKeys,
         mediaType: row.media_type,
         kind: row.kind,
         updatedAt: row.updated_at,
@@ -20,7 +20,18 @@ export function createKnowledgeIndexRepository(db) {
           WHERE v.id = ? AND n.current_version_id = v.id AND n.archived_at IS NULL`)
                 .bind(versionId)
                 .first();
-            return row ? mapTarget(row) : null;
+            if (!row)
+                return null;
+            if (row.kind !== "table")
+                return mapTarget(row, [row.content_key]);
+            // A table's rows live in every version, so indexing the newest one alone would make a search
+            // find only what the last append added (#40).
+            const segments = await db
+                .prepare(`SELECT content_key FROM knowledge_versions
+          WHERE node_id = ? ORDER BY sequence`)
+                .bind(row.node_id)
+                .all();
+            return mapTarget(row, (segments.results ?? []).map((segment) => segment.content_key));
         },
         async replace(target, content) {
             await db.batch([