@bevel-software/platform-core-backend 0.13.6 → 0.15.1

package/src/modules/workflow/workflow.routes.ts

@@ -26,6 +26,8 @@ import type {
   PostChangeRequestCommentInput,
 } from '@bevel-software/platform-shared';
 import type { AuthService } from '../auth/auth.service.js';
+import type { IAccessControl } from '../access/access-control.interface.js';
+import { canReadWorkspacePath, toKbRelative } from '../access-model/kb-read-filter.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
 import { branchForWorkspaceId } from '../../shared/workspace-id.js';
 import type { WorkflowEventBus } from './event-bus.js';
@@ -60,6 +62,8 @@ export function createWorkflowRoutes(
   workspaceService: WorkspaceService,
   authService: AuthService,
   events: WorkflowEventBus,
+  accessControl: IAccessControl,
+  kbDirName: string,
 ): express.Router {
   const router = express.Router({ mergeParams: true });
 
@@ -93,6 +97,62 @@ export function createWorkflowRoutes(
     }
   }
 
+  /**
+   * Gate a history read on the same `read:` verb the content routes enforce.
+   * The history endpoints below serve a file's past — its commit list, its
+   * diffs, its full content at a commit — and a file's past IS its content,
+   * with a time axis. They used to check only "is authenticated", so any
+   * logged-in user could pull a read-denied file's history by path, straight
+   * past the default-deny read model that hides the file everywhere else.
+   * Same rules as the content read (`workspace.routes` /
+   * `diff.routes.canReadPath`): the FULL `canRead` (per-node frontmatter
+   * honoured), non-KB paths ungated (they carry no `read:` rules), and both
+   * denial and any error fail closed with the content route's 403.
+   */
+  async function requireReadPermission(
+    req: express.Request,
+    res: express.Response,
+    workspaceId: string,
+    relativePath: string,
+  ): Promise<boolean> {
+    const user = await requireUser(req, res);
+    if (!user) return false;
+    // No ungated path form here, unlike the content routes: the git layer
+    // accepts BOTH the workspace-relative form (`knowledge-base/GTM/x.md`)
+    // and the repo-relative one (`GTM/x.md` — it strips the prefix when
+    // present, `stripRepoPrefix`), so treating an unprefixed path as
+    // "non-KB, no rules" would let the same repository object through
+    // without its gate. History exists only for tracked files and every
+    // tracked file lives in the repository — a path without the prefix is
+    // refused, not exempted. (Workspace scratch files outside the repo are
+    // untracked; their "history" was always an empty list.)
+    if (toKbRelative(relativePath, kbDirName) === null) {
+      res.status(400).json({
+        error: `History is served for repository files — pass the workspace-relative path (starting "${kbDirName}/").`,
+      });
+      return false;
+    }
+    let allowed: boolean;
+    try {
+      allowed = await canReadWorkspacePath(
+        (w, e, p) => accessControl.canRead(w, e, p),
+        workspaceId,
+        user.email,
+        kbDirName,
+        relativePath,
+      );
+    } catch (err) {
+      const { status, body } = toHttpError(err);
+      res.status(status).json(body);
+      return false;
+    }
+    if (!allowed) {
+      res.status(403).json({ error: `You don't have permission to read "${relativePath}".` });
+      return false;
+    }
+    return true;
+  }
+
   // ── Branches ──────────────────────────────────────────────────────────────
 
   router.get('/workspace/:id/workflow/branches', async (req, res) => {
@@ -250,12 +310,12 @@ export function createWorkflowRoutes(
   });
 
   router.get('/workspace/:id/workflow/changes', async (req, res) => {
-    if (!(await requireUser(req, res))) return;
     const pathParam = typeof req.query.path === 'string' ? req.query.path : '';
     if (!pathParam) {
       res.status(400).json({ error: 'path is required' });
       return;
     }
+    if (!(await requireReadPermission(req, res, req.params.id, pathParam))) return;
     const rawLimit = Number.parseInt(String(req.query.limit ?? '20'), 10);
     const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.min(rawLimit, 100)) : 20;
     try {
@@ -267,7 +327,6 @@ export function createWorkflowRoutes(
   });
 
   router.get('/workspace/:id/workflow/compare-file', async (req, res) => {
-    if (!(await requireUser(req, res))) return;
     const pathParam = typeof req.query.path === 'string' ? req.query.path : '';
     const fromBranch = typeof req.query.from === 'string' ? req.query.from : '';
     const toBranch = typeof req.query.to === 'string' ? req.query.to : '';
@@ -275,6 +334,47 @@ export function createWorkflowRoutes(
       res.status(400).json({ error: 'path, from, and to are required' });
       return;
     }
+    if (!(await requireReadPermission(req, res, req.params.id, pathParam))) return;
+    // The other history endpoints serve commits of the URL workspace's own
+    // branch, so its working-tree verdict covers what they return. This one
+    // serves content of TWO caller-named branches — the verdict must come
+    // from the refs actually being served, or a caller could pick a
+    // workspace whose tree grants what the compared branches' trees deny.
+    //
+    // The comparison prefers a LOCAL ref (and the working tree for the
+    // checked-out branch) over `origin/<branch>`, so both candidate refs are
+    // authorized: every ref that RESOLVES must grant the read, and a branch
+    // none of whose refs resolve is denied — never serve a ref that cannot
+    // be authorized. (The working-tree side is additionally covered by the
+    // workspace `canRead` above.)
+    {
+      const user = await requireUser(req, res);
+      if (!user) return;
+      const repoRelative = toKbRelative(pathParam, kbDirName)!;
+      for (const branch of [fromBranch, toBranch]) {
+        const verdicts: (boolean | null)[] = [];
+        for (const ref of [`origin/${branch}`, branch]) {
+          try {
+            verdicts.push(await accessControl.canReadAtRef(req.params.id, ref, user.email, repoRelative));
+          } catch (err) {
+            // An access-model FAILURE is not an unresolvable ref: mapped to
+            // null it would let the other candidate's grant serve a ref
+            // whose authorization errored. Fail closed — but keep the
+            // error's own status: an unreadable access tree is the
+            // documented 503 a client retries, not a permanent 403 denial.
+            const { status, body } = toHttpError(err);
+            res.status(status).json(body);
+            return;
+          }
+        }
+        const denied = verdicts.some((v) => v === false);
+        const unresolvable = verdicts.every((v) => v === null);
+        if (denied || unresolvable) {
+          res.status(403).json({ error: `You don't have permission to read "${pathParam}" on "${branch}".` });
+          return;
+        }
+      }
+    }
     try {
       const diff = await workflow.compareFile(req.params.id, pathParam, fromBranch, toBranch);
       res.json({ diff });
@@ -285,13 +385,13 @@ export function createWorkflowRoutes(
   });
 
   router.get('/workspace/:id/workflow/show-file', async (req, res) => {
-    if (!(await requireUser(req, res))) return;
     const pathParam = typeof req.query.path === 'string' ? req.query.path : '';
     const sha = typeof req.query.sha === 'string' ? req.query.sha : '';
     if (!pathParam || !sha) {
       res.status(400).json({ error: 'path and sha are required' });
       return;
     }
+    if (!(await requireReadPermission(req, res, req.params.id, pathParam))) return;
     try {
       const diff = await workflow.showFileAtChange(req.params.id, pathParam, sha);
       res.json({ diff });
@@ -302,13 +402,13 @@ export function createWorkflowRoutes(
   });
 
   router.get('/workspace/:id/workflow/file-at-change', async (req, res) => {
-    if (!(await requireUser(req, res))) return;
     const pathParam = typeof req.query.path === 'string' ? req.query.path : '';
     const sha = typeof req.query.sha === 'string' ? req.query.sha : '';
     if (!pathParam || !sha) {
       res.status(400).json({ error: 'path and sha are required' });
       return;
     }
+    if (!(await requireReadPermission(req, res, req.params.id, pathParam))) return;
     try {
       const { baseline, current } = await workflow.fileAtChange(req.params.id, pathParam, sha);
       res.json({ baseline, current });