@bevel-software/platform-core-backend 0.21.0 → 0.22.0

package/dist/modules/access/access-requests.routes.js

@@ -0,0 +1,237 @@
+import express from 'express';
+import { logger } from '../../shared/logging.js';
+import { branchForWorkspaceId } from '../../shared/workspace-id.js';
+import { AccessMutationError, AccessMutationService, fileCarriesAccessRules, governingFolderOf, } from './access-mutation.service.js';
+import { toHttpError as sharedToHttpError } from './admin-route-helpers.js';
+import { isRequestLevel, rulesFileFor, REQUEST_NOTE_MAX, } from './access-requests.contract.js';
+import { AccessRequestsService, extractRequestNote, itemNameOf, } from './access-requests.service.js';
+import '../auth/auth.middleware.js'; // Express Request.userId augmentation
+const log = logger('access.request');
+/**
+ * Asking for Can edit or Owner on one item, and the editors' answer.
+ *
+ *   POST /api/workspace/:id/access/request                  → { ok, number, state, level }
+ *   GET  /api/workspace/:id/access/request?path=&kind=      → { state, level?, number? }
+ *   GET  /api/workspace/:id/access/requests?path=&kind=     → { requests }   (editors)
+ *   POST /api/workspace/:id/access/requests/:n/reconcile    → { closed }
+ *
+ * LIVE WORKSPACE ONLY. A draft branch's rules may differ from the ones the
+ * person is asking about, and a request opened against a draft would propose a
+ * grant into a branch nobody merges — so every route here refuses any
+ * workspace but the default one, rather than quietly retargeting.
+ *
+ * Fail-closed like the rest of the access family: an item the caller cannot
+ * read answers as unknown, and the editors' listing answers `[]` to everyone
+ * else rather than 403 — "am I an editor here" stays a question only the
+ * server answers.
+ */
+export function createAccessRequestRoutes(deps) {
+    const { accessControl, workspaceService, authService, workflow, lifecycle, kb } = deps;
+    const { kbDirName } = kb;
+    const router = express.Router({ mergeParams: true });
+    const mutation = new AccessMutationService(workspaceService, accessControl, kbDirName);
+    const requests = new AccessRequestsService({ workflow, workspaceService, lifecycle, kb });
+    async function requireUser(req, res) {
+        if (!req.userId) {
+            res.status(401).json({ error: 'Unauthenticated' });
+            return null;
+        }
+        const user = await authService.getUserById(req.userId);
+        if (!user) {
+            res.status(401).json({ error: 'User not found' });
+            return null;
+        }
+        return user;
+    }
+    /** Workspace-relative (what the dialog holds) → repo-relative (what the model speaks). */
+    function toRepoRelative(p) {
+        const prefix = `${kbDirName}/`;
+        if (p === kbDirName)
+            return '';
+        return p.startsWith(prefix) ? p.slice(prefix.length) : p;
+    }
+    /**
+     * Refuse a target that could escape the KB repo, or that is spelled in more
+     * than one way. Mirrors the grant route's guard — the branch name and the
+     * spliced path are both derived from this string, so two spellings of one
+     * item would be two different requests.
+     */
+    function assertSafeTarget(repoRelTarget, kind) {
+        if (kind === 'file' && !repoRelTarget) {
+            throw new AccessMutationError('file path is required');
+        }
+        if (repoRelTarget.startsWith('/') ||
+            repoRelTarget.includes('\\') ||
+            repoRelTarget.includes('\0') ||
+            repoRelTarget.split('/').some((s) => s === '..' || s === '.')) {
+            throw new AccessMutationError('path must stay inside the KB repo');
+        }
+    }
+    /**
+     * The (live workspace, readable item) pair every route here needs, or null
+     * after the refusal has been answered.
+     *
+     * The two refusals are deliberately different shapes: a non-default
+     * workspace is the CALLER asking the wrong question (400), while an item the
+     * caller cannot read answers exactly as one that does not exist (404) — a
+     * 403 would confirm the item is there.
+     */
+    async function resolveTarget(req, res, rawPath, rawKind) {
+        const user = await requireUser(req, res);
+        if (!user)
+            return null;
+        const wsId = kb.defaultWorkspaceId();
+        if (branchForWorkspaceId(String(req.params.id)) !== kb.defaultBranch) {
+            res.status(400).json({
+                error: 'Access requests are only made on the live workspace.',
+                kind: 'not-live-workspace',
+            });
+            return null;
+        }
+        if (typeof rawPath !== 'string') {
+            res.status(400).json({ error: 'path is required', kind: 'access-error' });
+            return null;
+        }
+        const kind = rawKind === 'folder' ? 'folder' : 'file';
+        const target = { path: toRepoRelative(rawPath), kind };
+        try {
+            assertSafeTarget(target.path, kind);
+        }
+        catch (err) {
+            const { status, body } = sharedToHttpError(err, 'access');
+            res.status(status).json(body);
+            return null;
+        }
+        if (!(await accessControl.canRead(wsId, user.email, target.path))) {
+            res.status(404).json({ error: 'Not found', kind: 'unknown-target' });
+            return null;
+        }
+        return { user, target, wsId };
+    }
+    /** Can the caller change this item's rules — the gate an Accept runs through. */
+    const isEditor = (wsId, email, target) => accessControl.canWrite(wsId, email, rulesFileFor(target));
+    /**
+     * A FILE that cannot hold rules of its own is governed by its folder, and
+     * there is nothing here to request. The dialog already points at the folder
+     * for these; the route says the same thing rather than splicing YAML into a
+     * PDF. Content counts as much as the name — bytes that are not text refuse
+     * too, exactly as the grant route refuses them.
+     */
+    async function assertCanCarryRules(wsId, target) {
+        if (target.kind !== 'file')
+            return;
+        if (fileCarriesAccessRules(target.path) && (await mutation.targetHoldsText(wsId, target.path))) {
+            return;
+        }
+        throw new AccessMutationError(`Access for this file is managed on its folder. Ask there instead.`, 409, { kind: 'folder-governs', folder: governingFolderOf(target.path) });
+    }
+    router.post('/workspace/:id/access/request', async (req, res) => {
+        const body = (req.body ?? {});
+        const ctx = await resolveTarget(req, res, body.path, body.kind);
+        if (!ctx)
+            return;
+        const { user, target, wsId } = ctx;
+        try {
+            if (!isRequestLevel(body.level)) {
+                throw new AccessMutationError('level must be "write" or "owner"');
+            }
+            const note = typeof body.note === 'string' ? body.note : '';
+            if (typeof body.note !== 'undefined' && typeof body.note !== 'string') {
+                throw new AccessMutationError('note must be text');
+            }
+            if (note.length > REQUEST_NOTE_MAX) {
+                throw new AccessMutationError(`A note can be at most ${REQUEST_NOTE_MAX} characters.`);
+            }
+            await assertCanCarryRules(wsId, target);
+            if (await isEditor(wsId, user.email, target)) {
+                throw new AccessMutationError(`You can already change who can use this ${target.kind}.`, 409, { kind: 'already-writable' });
+            }
+            const opened = await requests.open({
+                user,
+                target,
+                itemName: itemNameOf(target.path),
+                level: body.level,
+                note,
+            });
+            res.json({ ok: true, state: 'pending', number: opened.number, level: opened.level });
+        }
+        catch (err) {
+            const { status, body: errBody } = sharedToHttpError(err, 'access');
+            if (status >= 500)
+                log.error('failed to open an access request:', { err });
+            res.status(status).json(errBody);
+        }
+    });
+    router.get('/workspace/:id/access/request', async (req, res) => {
+        const ctx = await resolveTarget(req, res, req.query.path, req.query.kind);
+        if (!ctx)
+            return;
+        try {
+            res.json(await requests.status(ctx.user, ctx.target));
+        }
+        catch (err) {
+            log.error('failed to read an access request:', { err });
+            res.status(500).json({ error: 'Failed to read the request' });
+        }
+    });
+    router.get('/workspace/:id/access/requests', async (req, res) => {
+        const ctx = await resolveTarget(req, res, req.query.path, req.query.kind);
+        if (!ctx)
+            return;
+        const { user, target, wsId } = ctx;
+        try {
+            if (!(await isEditor(wsId, user.email, target))) {
+                res.json({ requests: [] });
+                return;
+            }
+            const crs = await workflow.listChangeRequests();
+            const rows = await lifecycle.list(target.path, target, crs, user);
+            // The note lives in the request's description and nowhere else, so it
+            // is read back per request. Bounded by the open requests on ONE item —
+            // a handful at most — and a detail that cannot be fetched costs the
+            // note, never the line it belongs to.
+            const withNotes = await Promise.all(rows.map(async (row) => {
+                const detail = await workflow
+                    .getChangeRequestDetail(row.number, { patches: false })
+                    .catch(() => null);
+                const note = extractRequestNote(detail?.body);
+                return note ? { ...row, note } : row;
+            }));
+            res.json({ requests: withNotes });
+        }
+        catch (err) {
+            log.error('failed to list access requests:', { err });
+            res.status(500).json({ error: 'Failed to list access requests' });
+        }
+    });
+    router.post('/workspace/:id/access/requests/:number/reconcile', async (req, res) => {
+        const body = (req.body ?? {});
+        const ctx = await resolveTarget(req, res, body.path, body.kind);
+        if (!ctx)
+            return;
+        const { user, target, wsId } = ctx;
+        try {
+            if (!(await isEditor(wsId, user.email, target))) {
+                res.status(404).json({ error: 'Not found' });
+                return;
+            }
+            const number = Number(req.params.number);
+            if (!Number.isSafeInteger(number) || number <= 0) {
+                res.status(400).json({ error: 'Invalid change request number' });
+                return;
+            }
+            const cr = await workflow.getChangeRequest(number);
+            if (!cr) {
+                res.status(404).json({ error: 'Not found' });
+                return;
+            }
+            res.json({ closed: await lifecycle.reconcile(target.path, target, cr, user) });
+        }
+        catch (err) {
+            log.error('failed to reconcile an access request:', { err });
+            res.status(500).json({ error: 'Failed to reconcile the request' });
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=access-requests.routes.js.map

package/dist/modules/access/access-requests.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-requests.routes.js","sourceRoot":"","sources":["../../../src/modules/access/access-requests.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAIpE,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,GAElB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,WAAW,IAAI,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EACL,cAAc,EACd,YAAY,EACZ,gBAAgB,GAGjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,UAAU,GACX,MAAM,8BAA8B,CAAC;AACtC,OAAO,4BAA4B,CAAC,CAAC,sCAAsC;AAE3E,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAErC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAOzC;IACC,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACvF,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,qBAAqB,CAAC,gBAAgB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAE1F,KAAK,UAAU,WAAW,CACxB,GAAoB,EACpB,GAAqB;QAErB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0FAA0F;IAC1F,SAAS,cAAc,CAAC,CAAS;QAC/B,MAAM,MAAM,GAAG,GAAG,SAAS,GAAG,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAC/B,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;OAKG;IACH,SAAS,gBAAgB,CAAC,aAAqB,EAAE,IAAgB;QAC/D,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YACtC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;QACzD,CAAC;QACD,IACE,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC;YAC7B,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC5B,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC5B,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAC7D,CAAC;YACD,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,aAAa,CAC1B,GAAoB,EACpB,GAAqB,EACrB,OAAgB,EAChB,OAAgB;QAEhB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,IAAI,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACrC,IAAI,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,sDAAsD;gBAC7D,IAAI,EAAE,oBAAoB;aAC3B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAe,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAClE,MAAM,MAAM,GAAwB,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC;QAC5E,IAAI,CAAC;YACH,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,iFAAiF;IACjF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,MAA2B,EAAE,EAAE,CAC5E,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAE5D;;;;;;OAMG;IACH,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,MAA2B;QAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO;QACnC,IAAI,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/F,OAAO;QACT,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,mEAAmE,EACnE,GAAG,EACH,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QACnC,IAAI,CAAC;YACH,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBACnC,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,gBAAgB,cAAc,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxC,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,mBAAmB,CAC3B,2CAA2C,MAAM,CAAC,IAAI,GAAG,EACzD,GAAG,EACH,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAC7B,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;gBACjC,IAAI;gBACJ,MAAM;gBACN,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI;aACL,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACnE,IAAI,MAAM,IAAI,GAAG;gBAAE,GAAG,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7D,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,gCAAgC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QACnC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAClE,sEAAsE;YACtE,uEAAuE;YACvE,oEAAoE;YACpE,sCAAsC;YACtC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACrB,MAAM,MAAM,GAAG,MAAM,QAAQ;qBAC1B,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;qBACtD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACrB,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC9C,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YACvC,CAAC,CAAC,CACH,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QACnC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/access/access-requests.service.d.ts

@@ -0,0 +1,123 @@
+import { type AuthUser, type IWorkflowService } from '@bevel-software/platform-shared';
+import type { KbContext } from '../../shared/kb-context.js';
+import type { WorkspaceService } from '../workspace/workspace.service.js';
+import { type AccessRequestTarget, type IAccessRequestLifecycle, type RequestLevel } from './access-requests.contract.js';
+export declare const LEVEL_LABEL: Record<RequestLevel, string>;
+/** What the requester's own dialog shows in place of the control. */
+export interface AccessRequestStatus {
+    /**
+     *  - `none`         nothing outstanding; show the control.
+     *  - `pending`      a request is open and still asking for something.
+     *  - `not-accepted` their last request closed without the access landing.
+     */
+    state: 'none' | 'pending' | 'not-accepted';
+    level?: RequestLevel;
+    number?: number;
+}
+/** The name an item is called by in a title — the last path segment. */
+export declare function itemNameOf(repoRelPath: string): string;
+/**
+ * Neutralise every character a markdown renderer would read as structure.
+ *
+ * The note is somebody's free text and it lands in a change request's
+ * description, which IS rendered. Escaping it is what makes "plain text" true:
+ * without this a note can carry a heading, a link, or an image pointing at a
+ * URL that logs whoever opens the request.
+ */
+export declare function escapeMarkdown(text: string): string;
+/**
+ * The requester's own words, back out of a request's description, or
+ * undefined when they wrote none. Unescaped exactly as they were escaped, so
+ * what the banner shows is what was typed.
+ */
+/**
+ * The level a request asks for, off its own description. Undefined for a
+ * request opened before this marker existed — those are the skill route's,
+ * and the skill route only ever asked for `write`.
+ */
+export declare function extractRequestLevel(body: string | null | undefined): RequestLevel | undefined;
+export declare function extractRequestNote(body: string | null | undefined): string | undefined;
+/**
+ * Asking for Can edit or Owner on ONE item, and reading back what came of it.
+ *
+ * A request is a change request whose branch proposes exactly one grant in the
+ * item's own rules — a folder's `access.md`, or a file's own frontmatter — and
+ * nothing else. There is no request table: the branch IS the request, named
+ * deterministically from (person, item), so a second click finds the first
+ * click's request instead of opening a rival. Editors answer it by granting
+ * through the ordinary access path, and it retires itself
+ * ({@link IAccessRequestLifecycle}) once the access has landed however it
+ * landed.
+ *
+ * Keyed on the ITEM'S PATH, which is what the skill page's "Request write
+ * access" keys on too — so a Can edit request on a skill's folder and that
+ * button open one request, shown on both surfaces.
+ */
+export declare class AccessRequestsService {
+    private readonly deps;
+    constructor(deps: {
+        workflow: IWorkflowService;
+        workspaceService: WorkspaceService;
+        lifecycle: IAccessRequestLifecycle;
+        kb: Pick<KbContext, 'defaultBranch' | 'defaultWorkspaceId' | 'kbDirName'>;
+    });
+    /** The branch a request from `email` about `target` always lives on. */
+    branchFor(email: string, target: AccessRequestTarget): string;
+    /**
+     * Open `user`'s request for `level` on `target`, or answer with the one they
+     * already have open. Never opens a second request for the same pair.
+     */
+    open(input: {
+        user: AuthUser;
+        target: AccessRequestTarget;
+        itemName: string;
+        level: RequestLevel;
+        note?: string;
+    }): Promise<{
+        number: number;
+        level: RequestLevel;
+    }>;
+    /**
+     * What `user`'s dialog should say about `target`.
+     *
+     * The two states are answered from DIFFERENT sources, because different
+     * things prove them:
+     *
+     *   pending       an open request on this branch. That is the whole proof,
+     *                 and the level comes off the request itself — asking the
+     *                 branch would make "Requested: …" depend on whether this
+     *                 clone has fetched a ref that may be seconds old.
+     *   not-accepted  a closed request AND a branch that still carries an unmet
+     *                 proposal naming this person. A settled request has no
+     *                 branch left, so an accepted one can never read as
+     *                 declined; a branch that cannot be read proves nothing and
+     *                 reads as `none`, which shows the control rather than
+     *                 claiming a refusal nobody made.
+     */
+    status(user: AuthUser, target: AccessRequestTarget): Promise<AccessRequestStatus>;
+    /**
+     * The level change request `number` asks for, off its own description.
+     *
+     * `write` when the description does not say: every request that predates the
+     * marker came from the skill page's "Request write access", which asks for
+     * exactly that. A detail that cannot be fetched falls there too — the line
+     * it feeds says which level was asked for, and Can edit is the lesser claim.
+     */
+    private levelOf;
+    /**
+     * The level `email`'s branch still asks for on `target`, or null when it
+     * asks for nothing they do not already hold. Owner wins when a branch
+     * somehow carries both — it is the larger of the two, and it is the one the
+     * person is still waiting on.
+     */
+    private levelAskedOn;
+    /**
+     * The live rules text to splice onto. A folder with no `access.md` yet is
+     * normal and reads as empty; a FILE that is not there is not — a request
+     * must not conjure the file it asks about.
+     */
+    private readLive;
+    /** The description an editor reads: who, what, where, the note, and how to answer. */
+    private describe;
+}
+//# sourceMappingURL=access-requests.service.d.ts.map

package/dist/modules/access/access-requests.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-requests.service.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-requests.service.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACtB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAG1E,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,YAAY,EAClB,MAAM,+BAA+B,CAAC;AAKvC,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAGpD,CAAC;AAEF,qEAAqE;AACrE,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CAAC;IAC3C,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AA6BD;;;;GAIG;AACH;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAG7F;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CActF;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE;QACrB,QAAQ,EAAE,gBAAgB,CAAC;QAC3B,gBAAgB,EAAE,gBAAgB,CAAC;QACnC,SAAS,EAAE,uBAAuB,CAAC;QACnC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,eAAe,GAAG,oBAAoB,GAAG,WAAW,CAAC,CAAC;KAC3E;IAGH,wEAAwE;IACxE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,MAAM;IAI7D;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE;QAChB,IAAI,EAAE,QAAQ,CAAC;QACf,MAAM,EAAE,mBAAmB,CAAC;QAC5B,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,YAAY,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,YAAY,CAAA;KAAE,CAAC;IA0IpD;;;;;;;;;;;;;;;;OAgBG;IACG,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAiBvF;;;;;;;OAOG;YACW,OAAO;IAOrB;;;;;OAKG;YACW,YAAY;IAkB1B;;;;OAIG;YACW,QAAQ;IAgBtB,sFAAsF;IACtF,OAAO,CAAC,QAAQ;CA0BjB"}