@bevel-software/platform-core-backend 0.30.0 → 0.32.0

package/src/modules/workflow/git/pull-request.service.ts

@@ -253,6 +253,16 @@ export class PullRequestService implements IPullRequestService {
     this.linkBase = changeRequestLinkBase(publicFrontendUrl);
   }
 
+  /**
+   * The link to change request `number`, as every summary and detail carries
+   * it — absolute under the public address, else the in-app path with its
+   * note. Needs no read: a caller holding only the number (an open whose push
+   * was refused, say) builds the same link a listing would.
+   */
+  linkFor(number: number): { url: string; urlNote?: string } {
+    return changeRequestLink(number, this.linkBase);
+  }
+
   setDetailEnricher(enricher: PrDetailEnricher): void {
     this.detailEnricher = enricher;
   }

package/src/modules/workflow/read-on-branch.ts

@@ -0,0 +1,79 @@
+import type { IAccessControl } from '../access/access-control.interface.js';
+import { WorkflowDomainError } from '../../shared/domain-errors.js';
+
+/**
+ * Which of `paths` `userEmail` may read at `origin/<base>`, as a membership
+ * set — ONE rule for the change-request reads (their file lists, judged at
+ * the request's base) and for `branch_status` (the paths a request would
+ * carry). A null answer (the ref, or its `roles.yaml`, does not resolve)
+ * withholds everything, which is the same reading the app's fork-point
+ * route gives it.
+ */
+export async function readablePathsAt(
+  accessControl: Pick<IAccessControl, 'canReadBatchAtRef'>,
+  workspaceId: string,
+  userEmail: string,
+  base: string,
+  paths: string[],
+): Promise<Set<string>> {
+  if (paths.length === 0) return new Set();
+  const verdicts = await accessControl.canReadBatchAtRef(workspaceId, `origin/${base}`, userEmail, [...new Set(paths)]);
+  if (!verdicts) return new Set();
+  return new Set([...verdicts].filter(([, allowed]) => allowed).map(([p]) => p));
+}
+
+/**
+ * Whether `userEmail` may read `repoRelativePath` at EVERY one of `commits`
+ * — ONE rule for content served from another branch, for the app's compare
+ * route and the agent's history tools alike: the commits the service read
+ * the content at, pinned by the service inside its reservation (a diff's two
+ * sides, a file at a branch's published tip, the two commits a merge is of),
+ * so the verdict is about the bytes actually served, never about a branch
+ * ref a fetch may have moved between the verdict and the read. A commit
+ * whose rules cannot be read (null) grants nothing. An access-model FAILURE
+ * is not a null: it propagates with its own status (an unreadable access
+ * tree is the documented 503 a client retries).
+ */
+export async function readableAtCommits(
+  accessControl: Pick<IAccessControl, 'canReadAtRef'>,
+  workspaceId: string,
+  userEmail: string,
+  repoRelativePath: string,
+  commits: readonly string[],
+): Promise<boolean> {
+  for (const sha of commits) {
+    if ((await accessControl.canReadAtRef(workspaceId, sha, userEmail, repoRelativePath)) !== true) return false;
+  }
+  return true;
+}
+
+/** The refusal `readableAtCommits` answers false with, as every caller words it: the branch named, never the commit. */
+export class ReadOnBranchDeniedError extends WorkflowDomainError {
+  constructor(displayPath: string, branch: string) {
+    super(`You don't have permission to read "${displayPath}" on "${branch}".`, 403, {
+      kind: 'read-denied',
+      path: displayPath,
+      branch,
+    });
+    this.name = 'ReadOnBranchDeniedError';
+  }
+}
+
+/**
+ * `readableAtCommits` at every commit `branch` resolves to (the one its
+ * content was served from, and any other its local head or published tip
+ * names), thrown when it answers false.
+ */
+export async function assertReadableAtCommits(
+  accessControl: Pick<IAccessControl, 'canReadAtRef'>,
+  workspaceId: string,
+  userEmail: string,
+  repoRelativePath: string,
+  commits: readonly string[],
+  branch: string,
+  displayPath: string = repoRelativePath,
+): Promise<void> {
+  if (!(await readableAtCommits(accessControl, workspaceId, userEmail, repoRelativePath, commits))) {
+    throw new ReadOnBranchDeniedError(displayPath, branch);
+  }
+}

package/src/modules/workflow/workflow.routes.ts

@@ -38,6 +38,7 @@ import type { WorkspaceService } from '../workspace/workspace.service.js';
 import { branchForWorkspaceId } from '../../shared/workspace-id.js';
 import type { WorkflowEventBus } from './event-bus.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
+import { assertReadableAtCommits } from './read-on-branch.js';
 import { assertValidRelativePath } from '../kb-fs/branch-name.js';
 import { domainErrorBody } from '../../shared/http-errors.js';
 import { canonicalFileIdentity } from '../../shared/canonical-file-identity.js';
@@ -413,46 +414,27 @@ export function createWorkflowRoutes(
     // The other history endpoints serve commits of the URL workspace's own
     // branch, so its working-tree verdict covers what they return. This one
     // serves content of TWO caller-named branches — the verdict must come
-    // from the refs actually being served, or a caller could pick a
-    // workspace whose tree grants what the compared branches' trees deny.
-    //
-    // The comparison prefers a LOCAL ref (and the working tree for the
-    // checked-out branch) over `origin/<branch>`, so both candidate refs are
-    // authorized: every ref that RESOLVES must grant the read, and a branch
-    // none of whose refs resolve is denied — never serve a ref that cannot
-    // be authorized. (The working-tree side is additionally covered by the
-    // workspace `canRead` above.)
-    {
-      const user = await requireUser(req, res);
-      if (!user) return;
-      const repoRelative = toKbRelative(pathParam, kbDirName)!;
-      for (const branch of [fromBranch, toBranch]) {
-        const verdicts: (boolean | null)[] = [];
-        for (const ref of [`origin/${branch}`, branch]) {
-          try {
-            verdicts.push(await accessControl.canReadAtRef(req.params.id, ref, user.email, repoRelative));
-          } catch (err) {
-            // An access-model FAILURE is not an unresolvable ref: mapped to
-            // null it would let the other candidate's grant serve a ref
-            // whose authorization errored. Fail closed — but keep the
-            // error's own status: an unreadable access tree is the
-            // documented 503 a client retries, not a permanent 403 denial.
-            const { status, body } = toHttpError(err);
-            res.status(status).json(body);
-            return;
-          }
-        }
-        const denied = verdicts.some((v) => v === false);
-        const unresolvable = verdicts.every((v) => v === null);
-        if (denied || unresolvable) {
-          res.status(403).json({ error: `You don't have permission to read "${pathParam}" on "${branch}".` });
-          return;
-        }
-      }
-    }
+    // from the commits actually served (`readableAtCommits`, the one rule
+    // this route and the agent's history tools share): the service pins the
+    // commit each side is read at and asks this verdict inside its
+    // reservation, before anything is said about the path at either, with
+    // every commit the branch resolves to — its local head and its published
+    // tip, all of which must grant, as this route has always required of
+    // both refs — never at a branch ref a fetch may move between a verdict
+    // and a read. (The
+    // working-tree side is additionally covered by the workspace `canRead`
+    // above.) An access-model failure keeps its own status: an unreadable
+    // access tree is the documented 503 a client retries, not a permanent
+    // 403 denial.
+    const user = await requireUser(req, res);
+    if (!user) return;
+    const repoRelative = toKbRelative(pathParam, kbDirName)!;
     try {
-      const diff = await workflow.compareFile(req.params.id, pathParam, fromBranch, toBranch);
-      res.json({ diff });
+      const compared = await workflow.compareFile(req.params.id, pathParam, fromBranch, toBranch, async (sides) => {
+        await assertReadableAtCommits(accessControl, req.params.id, user.email, repoRelative, sides.from, fromBranch, pathParam);
+        await assertReadableAtCommits(accessControl, req.params.id, user.email, repoRelative, sides.to, toBranch, pathParam);
+      });
+      res.json({ diff: compared.diff });
     } catch (err) {
       const { status, body } = toHttpError(err);
       res.status(status).json(body);