@anchrd/intel-api 0.6.5 → 0.6.7

package/dist/adapters/db/db-flows.js

@@ -128,6 +128,19 @@ export function createFlowRepository(deps) {
     ORDER BY lower(flow.title), flow.id${bounded ? " LIMIT ?" : ""}`;
     return {
         async listVisible(actor, input = {}) {
+            // ⚠️ `archivedOnly` overrides the folder rather than narrowing within it: somebody looking
+            // for what they archived does not know where it was filed (#113). The visibility predicate
+            // is unchanged, so the archive shows no flow the tree would have hidden.
+            if (input.archivedOnly === true) {
+                const result = await deps.db
+                    .prepare(`${subtreeCte}
+            SELECT ${flowColumns} FROM flows flow
+            WHERE ${flowInSubtree} AND flow.archived_at IS NOT NULL
+            ORDER BY flow.archived_at DESC, lower(flow.title), flow.id`)
+                    .bind(...readableBindings(actor), ...flowInSubtreeBindings(actor))
+                    .all();
+                return (result.results ?? []).map(mapFlow);
+            }
             const scope = scopeOf(input.parentId);
             const result = await deps.db
                 .prepare(visibleFlows(scope.clause, false, input.includeArchived === true))

package/dist/adapters/db/db.js

@@ -102,11 +102,27 @@ export function createKnowledgeRepository(deps) {
     JOIN allowed ON allowed.id = n.id
     WHERE n.parent_id IS ? AND (? = 1 OR n.archived_at IS NULL)
     ORDER BY CASE n.kind WHEN 'folder' THEN 0 ELSE 1 END, lower(n.title), n.id${bounded ? " LIMIT ?" : ""}`;
+    /**
+     * Everything archived that this actor may see, wherever it sits (#113).
+     *
+     * ⚠️ No `parent_id` at all, and that is the point rather than an omission: somebody looking for
+     * what they archived does not know which folder it was in. The visibility predicate is the same
+     * `allowed` set every other read uses, so the archive shows no more than the tree would have.
+     *
+     * `has_children` is answered as 0 without asking: an archived row is not expandable — its
+     * children are reached by restoring it, not by opening it here.
+     */
+    const archivedEverywhere = `${visibleCte}
+    SELECT ${nodeColumns}, 0 AS has_children
+    FROM knowledge_nodes n
+    JOIN allowed ON allowed.id = n.id
+    WHERE n.archived_at IS NOT NULL
+    ORDER BY n.archived_at DESC, lower(n.title), n.id`;
     return {
         async listVisible(actor, input) {
             const result = await deps.db
-                .prepare(visibleChildren(false))
-                .bind(...readBindings(actor), input.parentId, input.includeArchived ? 1 : 0)
+                .prepare(input.archivedOnly ? archivedEverywhere : visibleChildren(false))
+                .bind(...readBindings(actor), ...(input.archivedOnly ? [] : [input.parentId, input.includeArchived ? 1 : 0]))
                 .all();
             const rows = result.results ?? [];
             return {

package/dist/adapters/openid/openid.js

@@ -136,7 +136,12 @@ export function createOpenId(deps) {
                 client_name: input.clientName,
                 redirect_uris: [input.redirectUri],
                 response_types: ["code"],
-                grant_types: ["authorization_code"],
+                // ⚠️ `refresh_token` belongs here, not only in the scope. RFC 7591 §2: `grant_types`
+                // declares which grants this client may USE, and a client registered without it may
+                // not refresh — whatever scope it was granted. That is why the portal connection did
+                // not survive its first access token (#97): `offline_access` was being requested and
+                // the right to act on it never was.
+                grant_types: ["authorization_code", "refresh_token"],
                 ...(isCloudflareAccess(input.issuer)
                     ? {}
                     : { scope: "openid profile email offline_access" }),

package/dist/http/http.js

@@ -101,8 +101,9 @@ export function createHttp(deps) {
         const url = new URL(context.req.url);
         const unknownQuery = [];
         url.searchParams.forEach((_value, key) => {
-            if (key !== "parentId" && key !== "includeArchived")
+            if (key !== "parentId" && key !== "includeArchived" && key !== "archivedOnly") {
                 unknownQuery.push(key);
+            }
         });
         if (unknownQuery.length) {
             throw new IntelError(400, "invalid_request", `Unknown query parameters: ${unknownQuery.join(", ")}`);
@@ -110,6 +111,7 @@ export function createHttp(deps) {
         const input = ListKnowledgeNodesInput.parse({
             parentId: url.searchParams.get("parentId"),
             includeArchived: url.searchParams.get("includeArchived") === "true",
+            ...(url.searchParams.get("archivedOnly") === "true" ? { archivedOnly: true } : {}),
         });
         return context.json(await deps.knowledge.list(asActor(auth), input));
     });
@@ -250,7 +252,7 @@ export function createHttp(deps) {
     app.get("/flows", async (context) => {
         const auth = requireCapability(context, "flows", "read");
         const url = new URL(context.req.url);
-        requireKnownQuery(url, ["parentId", "includeArchived"]);
+        requireKnownQuery(url, ["parentId", "includeArchived", "archivedOnly"]);
         // Absent means "every flow I may see"; present but empty means the root of the shared tree.
         // Without that distinction a tree level and a full list would be the same request.
         const parentId = url.searchParams.get("parentId");
@@ -259,6 +261,7 @@ export function createHttp(deps) {
         const input = ListFlowsInput.parse({
             ...(url.searchParams.has("parentId") ? { parentId: parentId === "" ? null : parentId } : {}),
             ...(url.searchParams.get("includeArchived") === "true" ? { includeArchived: true } : {}),
+            ...(url.searchParams.get("archivedOnly") === "true" ? { archivedOnly: true } : {}),
         });
         return context.json(await deps.flows.list(asFlowActor(auth), input));
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {