@bevel-software/platform-core-backend 0.4.1 → 0.5.1

package/src/modules/access/__tests__/access-md-format.test.ts

@@ -0,0 +1,191 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+
+import type { WorkspaceService } from '../../workspace/workspace.service.js';
+import {
+  AccessControlService,
+  accessMdDeclaresBodyRules,
+  accessMdSelfEntries,
+  parseAccessFile,
+} from '../access-control.service.js';
+import { spliceGrant, spliceRevoke } from '../access-splice.js';
+
+/**
+ * The two-format `access.md` story:
+ *
+ *  - LEGACY: the frontmatter carries the FOLDER's rules; the file cannot
+ *    govern itself (its readability follows the folder chain).
+ *  - NEW: the body carries the folder's rules; the frontmatter — like every
+ *    other file's — is about the FILE itself. `read: everyone` there makes
+ *    the group discoverable (anyone may open the access.md and see who runs
+ *    the folder) while the folder's contents stay locked.
+ *
+ * Compat rule under test: a file whose body is NOT parsable as rules resolves
+ * its frontmatter for the folder, exactly as before.
+ */
+
+const KB = 'knowledge-base';
+
+const ROLES_YAML = `roles:
+  Admin:
+    - razvan@bevel.software
+  GTM Team:
+    - felix@example.com
+`;
+
+/** New-format group access.md: discoverable by everyone, readable by GTM Team. */
+const NEW_FORMAT = `---
+read:
+  - everyone
+---
+read:
+  - GTM Team
+write:
+  - GTM Team
+`;
+
+const LEGACY_FORMAT = `---
+read:
+  - GTM Team
+write:
+  - GTM Team
+---
+Some prose explaining this folder.
+`;
+
+describe('access.md format detection + parsing', () => {
+  it('detects body rules (new format) and parses the BODY for the folder', () => {
+    expect(accessMdDeclaresBodyRules(NEW_FORMAT)).toBe(true);
+    const parsed = parseAccessFile(NEW_FORMAT, 'Groups/GTM/access.md');
+    expect(parsed.ok).toBe(true);
+    if (!parsed.ok) return;
+    expect(parsed.file.entries.read).toEqual([
+      { kind: 'role', role: 'gtm team', displayRole: 'GTM Team', deny: false },
+    ]);
+    // The frontmatter's `everyone` grant is NOT a folder rule.
+    expect(parsed.file.entries.read.some((e) => e.kind === 'role' && e.role === 'everyone')).toBe(
+      false,
+    );
+  });
+
+  it('a prose body stays legacy: the frontmatter governs the folder', () => {
+    expect(accessMdDeclaresBodyRules(LEGACY_FORMAT)).toBe(false);
+    const parsed = parseAccessFile(LEGACY_FORMAT, 'access.md');
+    expect(parsed.ok).toBe(true);
+    if (!parsed.ok) return;
+    expect(parsed.file.entries.read).toEqual([
+      { kind: 'role', role: 'gtm team', displayRole: 'GTM Team', deny: false },
+    ]);
+  });
+
+  it('an empty body stays legacy', () => {
+    expect(accessMdDeclaresBodyRules('---\nread:\n  - GTM Team\n---\n')).toBe(false);
+  });
+
+  it('a body that names a verb but is malformed is a hard ERROR, never a silent fallback', () => {
+    // Falling back to the frontmatter here would hand the folder to the
+    // (possibly `read: everyone`) self-rules — a typo must fail loudly.
+    const typo = '---\nread:\n  - everyone\n---\nread: GTM Team\n';
+    expect(accessMdDeclaresBodyRules(typo)).toBe(true);
+    const parsed = parseAccessFile(typo, 'Groups/GTM/access.md');
+    expect(parsed.ok).toBe(false);
+    if (parsed.ok) return;
+    expect(parsed.errors.join(' ')).toContain("'read:' must be a list");
+  });
+
+  it('self entries: frontmatter in the new format, null for legacy', () => {
+    const self = accessMdSelfEntries(NEW_FORMAT);
+    expect(self?.read).toEqual([
+      { kind: 'role', role: 'everyone', displayRole: 'everyone', deny: false },
+    ]);
+    expect(accessMdSelfEntries(LEGACY_FORMAT)).toBeNull();
+  });
+});
+
+describe('access.md splice targeting', () => {
+  const FELIX = { kind: 'user' as const, email: 'ali@x.eu', displayName: 'Ali Baba' };
+
+  it("target 'folder' on a new-format file lands the grant in the BODY", () => {
+    const r = spliceGrant(NEW_FORMAT, 'read', FELIX, { target: 'folder' });
+    expect(r.changed).toBe(true);
+    const parsed = parseAccessFile(r.text, 'Groups/GTM/access.md');
+    expect(parsed.ok && parsed.file.entries.read.some((e) => e.kind === 'user' && e.email === 'ali@x.eu')).toBe(true);
+    // The self-frontmatter is untouched.
+    expect(accessMdSelfEntries(r.text)?.read).toEqual([
+      { kind: 'role', role: 'everyone', displayRole: 'everyone', deny: false },
+    ]);
+  });
+
+  it("target 'folder' on a legacy file lands the grant in the frontmatter (as before)", () => {
+    const r = spliceGrant(LEGACY_FORMAT, 'read', FELIX, { target: 'folder' });
+    expect(r.changed).toBe(true);
+    const parsed = parseAccessFile(r.text, 'access.md');
+    expect(parsed.ok && parsed.file.entries.read.some((e) => e.kind === 'user' && e.email === 'ali@x.eu')).toBe(true);
+    // Still legacy — the prose body did not become rules.
+    expect(accessMdDeclaresBodyRules(r.text)).toBe(false);
+  });
+
+  it("default target ('node') on a new-format file edits the SELF frontmatter", () => {
+    const r = spliceGrant(NEW_FORMAT, 'read', FELIX);
+    expect(r.changed).toBe(true);
+    expect(accessMdSelfEntries(r.text)?.read.some((e) => e.kind === 'user' && e.email === 'ali@x.eu')).toBe(true);
+    // Folder rules untouched.
+    const parsed = parseAccessFile(r.text, 'Groups/GTM/access.md');
+    expect(parsed.ok && parsed.file.entries.read.some((e) => e.kind === 'user')).toBe(false);
+  });
+
+  it("revoke with target 'folder' removes from the body and round-trips", () => {
+    const granted = spliceGrant(NEW_FORMAT, 'read', FELIX, { target: 'folder' }).text;
+    const revoked = spliceRevoke(granted, 'read', FELIX, { target: 'folder' });
+    expect(revoked.changed).toBe(true);
+    const parsed = parseAccessFile(revoked.text, 'Groups/GTM/access.md');
+    expect(parsed.ok && parsed.file.entries.read.some((e) => e.kind === 'user')).toBe(false);
+  });
+});
+
+describe('end-to-end resolution over a new-format group', () => {
+  let root: string;
+  const workspaceId = 'ws-groups-fmt';
+
+  beforeEach(async () => {
+    root = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-accessfmt-'));
+  });
+  afterEach(async () => {
+    await fs.rm(root, { recursive: true, force: true });
+  });
+
+  async function seed(): Promise<AccessControlService> {
+    const workspaceDir = path.join(root, workspaceId);
+    const repo = path.join(workspaceDir, KB);
+    await fs.mkdir(path.join(repo, 'Groups', 'GTM'), { recursive: true });
+    await fs.writeFile(path.join(repo, 'roles.yaml'), ROLES_YAML);
+    await fs.writeFile(path.join(repo, 'access.md'), '---\nwrite:\n  - Admin\n---\n');
+    await fs.writeFile(path.join(repo, 'Groups', 'GTM', 'access.md'), NEW_FORMAT);
+    await fs.mkdir(path.join(repo, 'Groups', 'GTM', 'outreach'), { recursive: true });
+    await fs.writeFile(path.join(repo, 'Groups', 'GTM', 'outreach', 'SKILL.md'), '# outreach\n');
+    const stub = {
+      getWorkspacePath: async (id: string) => {
+        if (id !== workspaceId) throw new Error(`unexpected workspace ${id}`);
+        return workspaceDir;
+      },
+    } as unknown as WorkspaceService;
+    return new AccessControlService(stub, KB);
+  }
+
+  it('a NON-member can read the access.md itself (discovery) but nothing inside the folder', async () => {
+    const svc = await seed();
+    const outsider = 'sara@example.com';
+    expect(await svc.canRead(workspaceId, outsider, 'Groups/GTM/access.md')).toBe(true);
+    expect(await svc.canRead(workspaceId, outsider, 'Groups/GTM/outreach/SKILL.md')).toBe(false);
+  });
+
+  it('a member reads both; body rules (not frontmatter) decide the folder', async () => {
+    const svc = await seed();
+    const member = 'felix@example.com';
+    expect(await svc.canRead(workspaceId, member, 'Groups/GTM/access.md')).toBe(true);
+    expect(await svc.canRead(workspaceId, member, 'Groups/GTM/outreach/SKILL.md')).toBe(true);
+    expect(await svc.canWrite(workspaceId, member, 'Groups/GTM/outreach/SKILL.md')).toBe(true);
+  });
+});

package/src/modules/access/__tests__/access-splice.test.ts

@@ -199,6 +199,27 @@ describe('validatePrincipal — injection guard', () => {
     ).toThrow(AccessSpliceError);
   });
 
+  it.each([['\n'], ['\r'], ['\r\n'], [''], ['']])(
+    'rejects a display name carrying the control char %j (frontmatter injection)',
+    (ch) => {
+      expect(() =>
+        validatePrincipal({
+          kind: 'user',
+          email: 'a@b.com',
+          // Interior, so `trim()` cannot quietly rescue it on the way through.
+          displayName: `Ali${ch}read:${ch}  - everyone`,
+        }),
+      ).toThrow(AccessSpliceError);
+    },
+  );
+
+  it('trims a SURROUNDING newline rather than rejecting, and renders the trimmed name', () => {
+    // The guard runs on the trimmed name and the trimmed name is what gets
+    // returned — so a stray edge newline can never reach a rendered line.
+    const p = validatePrincipal({ kind: 'user', email: 'a@b.com', displayName: '\n Ali \n' });
+    expect(p.kind === 'user' && p.displayName).toBe('Ali');
+  });
+
   it('rejects a group name with a colon (would forge a key)', () => {
     expect(() => validatePrincipal({ kind: 'role', role: 'write:\n  - everyone' })).toThrow(
       AccessSpliceError,

package/src/modules/access/__tests__/access.routes.overrides.test.ts

@@ -0,0 +1,214 @@
+import type { Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import express from 'express';
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import type { FileTreeEntry } from '@bevel-software/platform-shared';
+
+import type { IAccessControl } from '../access-control.interface.js';
+import type { WorkspaceService } from '../../workspace/workspace.service.js';
+import type { AuthService } from '../../auth/auth.service.js';
+import type { WorkflowService } from '../../workflow/workflow.service.js';
+import type { WorkflowEventBus } from '../../workflow/event-bus.js';
+import type { Database } from '../../database/connection.js';
+import { createAccessRoutes } from '../access.routes.js';
+
+/**
+ * HTTP contract for `GET /access/overrides`. The scan itself is covered in
+ * `access-declarations.test.ts`; what is under test here is the DISCLOSURE
+ * boundary — the folder-read gate, the per-row read filter, and the path
+ * validation that stops a caller pointing the scan outside the KB.
+ */
+
+const USER = { id: 'u-1', email: 'alice@bevel.software', name: 'Alice' };
+const WS = 'main';
+const KB = 'knowledge-base';
+
+function buildTree(paths: string[]): FileTreeEntry {
+  const root: FileTreeEntry = { name: '', relativePath: '', type: 'directory', children: [] };
+  for (const wsPath of paths) {
+    const segments = wsPath.split('/');
+    let node = root;
+    segments.forEach((segment, i) => {
+      const isLeaf = i === segments.length - 1;
+      let child = node.children?.find((c) => c.name === segment);
+      if (!child) {
+        child = {
+          name: segment,
+          relativePath: segments.slice(0, i + 1).join('/'),
+          type: isLeaf ? 'file' : 'directory',
+          ...(isLeaf ? {} : { children: [] }),
+        };
+        node.children?.push(child);
+      }
+      node = child;
+    });
+  }
+  return root;
+}
+
+interface Harness {
+  server: Server;
+  baseUrl: string;
+  canRead: ReturnType<typeof vi.fn>;
+  canReadBatch: ReturnType<typeof vi.fn>;
+}
+
+async function makeHarness(opts: {
+  files?: Record<string, string>;
+  /** Folder-level read verdict. Defaults to readable. */
+  canRead?: (repoRelPath: string) => boolean;
+  /** Per-row read verdict on `governs`. Defaults to readable. */
+  rowReadable?: (repoRelPath: string) => boolean;
+}): Promise<Harness> {
+  const files = opts.files ?? {};
+
+  const canRead = vi.fn(async (_w: string, _e: string, p: string) =>
+    opts.canRead ? opts.canRead(p) : true,
+  );
+  const canReadBatch = vi.fn(async (_w: string, _e: string, paths: string[]) => {
+    const m = new Map<string, boolean>();
+    for (const p of paths) m.set(p, opts.rowReadable ? opts.rowReadable(p) : true);
+    return m;
+  });
+
+  const accessControl = { canRead, canReadBatch } as unknown as IAccessControl;
+
+  const workspaceService = {
+    listFiles: vi.fn(async () => buildTree(Object.keys(files))),
+    readFile: vi.fn(async (_id: string, wsRel: string) => {
+      const text = files[wsRel];
+      if (text === undefined) throw new Error(`ENOENT ${wsRel}`);
+      return text;
+    }),
+    getOrCreateForBranch: vi.fn(async () => ({ id: WS, name: WS, kbDirName: KB })),
+  } as unknown as WorkspaceService;
+
+  const authService = { getUserById: vi.fn(async () => USER) } as unknown as AuthService;
+  const workflowService = {} as unknown as WorkflowService;
+  const eventBus = { emit: vi.fn() } as unknown as WorkflowEventBus;
+  const db = {} as unknown as Database;
+
+  const app = express();
+  app.use(express.json());
+  app.use('/api', (req, _res, next) => {
+    (req as unknown as { userId: string }).userId = USER.id;
+    next();
+  });
+  app.use(
+    '/api',
+    createAccessRoutes(accessControl, workspaceService, authService, workflowService, eventBus, db, KB),
+  );
+
+  const server = await new Promise<Server>((resolve) => {
+    const s = app.listen(0, () => resolve(s));
+  });
+  const addr = server.address() as AddressInfo;
+  return { server, baseUrl: `http://127.0.0.1:${addr.port}`, canRead, canReadBatch };
+}
+
+function close(s: Server): Promise<void> {
+  return new Promise((resolve, reject) => s.close((e) => (e ? reject(e) : resolve())));
+}
+
+const fm = (body: string) => `---\n${body}\n---\n\n# Body\n`;
+
+const FILES = {
+  [`${KB}/Groups/GTM/access.md`]: fm('read:\n  - GTM Team'),
+  [`${KB}/Groups/GTM/battlecards/access.md`]: fm('read:\n  - deny everyone'),
+  [`${KB}/Groups/GTM/slack.tool`]: fm('owner: Ali <ali@bevel.software>'),
+};
+
+describe('GET /access/overrides', () => {
+  let h: Harness | null = null;
+  afterEach(async () => {
+    if (h) await close(h.server);
+    h = null;
+  });
+
+  const get = (path: string) =>
+    fetch(
+      `${h!.baseUrl}/api/workspace/${encodeURIComponent(WS)}/access/overrides?path=${encodeURIComponent(path)}`,
+    );
+
+  it('returns the declarations under a folder the caller can read', async () => {
+    h = await makeHarness({ files: FILES });
+
+    const res = await get('Groups/GTM');
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({
+      truncated: false,
+      overrides: [
+        {
+          path: 'Groups/GTM/battlecards/access.md',
+          governs: 'Groups/GTM/battlecards',
+          source: 'access-md',
+          entries: [{ verb: 'read', deny: true, principal: { kind: 'everyone' } }],
+        },
+        {
+          path: 'Groups/GTM/slack.tool',
+          governs: 'Groups/GTM/slack.tool',
+          source: 'frontmatter',
+          entries: [
+            {
+              verb: 'owner',
+              deny: false,
+              principal: { kind: 'user', email: 'ali@bevel.software', name: 'Ali' },
+            },
+          ],
+        },
+      ],
+    });
+  });
+
+  it('403s a caller who cannot read the folder', async () => {
+    h = await makeHarness({ files: FILES, canRead: () => false });
+
+    const res = await get('Groups/GTM');
+    expect(res.status).toBe(403);
+    expect(await res.json()).toEqual({ error: 'You do not have access to this folder.' });
+  });
+
+  it('drops rows governing something the caller cannot read', async () => {
+    h = await makeHarness({
+      files: FILES,
+      rowReadable: (p) => p !== 'Groups/GTM/battlecards',
+    });
+
+    const res = await get('Groups/GTM');
+    const body = (await res.json()) as { overrides: { path: string }[] };
+    expect(body.overrides.map((o) => o.path)).toEqual(['Groups/GTM/slack.tool']);
+  });
+
+  it('accepts a workspace-relative path exactly like a repo-relative one', async () => {
+    h = await makeHarness({ files: FILES });
+
+    const repoRel = (await (await get('Groups/GTM')).json()) as unknown;
+    const wsRel = (await (await get(`${KB}/Groups/GTM`)).json()) as unknown;
+    expect(wsRel).toEqual(repoRel);
+    expect(h.canRead).toHaveBeenCalledWith(WS, USER.email, 'Groups/GTM');
+  });
+
+  it('400s a path that escapes the KB repo', async () => {
+    h = await makeHarness({ files: FILES });
+
+    expect((await get(`${KB}/../tmp`)).status).toBe(400);
+    expect((await get('/etc/passwd')).status).toBe(400);
+  });
+
+  it('400s a target that is a file, not a folder', async () => {
+    h = await makeHarness({ files: FILES });
+
+    const res = await get('Groups/GTM/slack.tool');
+    expect(res.status).toBe(400);
+    expect(await res.json()).toEqual({ error: 'path must be a folder' });
+  });
+
+  it('400s a missing path parameter', async () => {
+    h = await makeHarness({ files: FILES });
+
+    const res = await fetch(
+      `${h.baseUrl}/api/workspace/${encodeURIComponent(WS)}/access/overrides`,
+    );
+    expect(res.status).toBe(400);
+  });
+});

package/src/modules/access/access-control.interface.ts

@@ -136,6 +136,17 @@ export interface IAccessControl {
     relativePath: string,
   ): Promise<boolean>;
 
+  /**
+   * Batched `canOwner` — one config load per call, same `owner:`-lists-only
+   * resolution (no admin rescue). Used by group enumeration to answer "which
+   * of these folders does the caller own?" without one model load per group.
+   */
+  canOwnerBatch(
+    workspaceId: string,
+    userEmail: string,
+    relativePaths: string[],
+  ): Promise<Map<string, boolean>>;
+
   /**
    * The set of principals (roles + direct users) that own this path — i.e.
    * who to contact about it. Resolved from `owner:` lists only. Used by the

package/src/modules/access/access-control.service.ts

@@ -157,7 +157,7 @@ export interface UserEntry {
 
 export type ParsedEntry = RoleEntry | UserEntry;
 
-interface AccessFile {
+export interface AccessFile {
   /** repo-relative POSIX path — e.g. `access.md`, `Knowledge/Sales/access.md`. */
   path: string;
   /** repo-relative POSIX directory — `''` for root. */
@@ -353,6 +353,16 @@ export function extractFrontmatter(
   return { ok: false, error: 'unterminated frontmatter — no closing `---` found' };
 }
 
+/** The text AFTER the closing frontmatter fence ('' when there is no fence). */
+export function bodyAfterFrontmatter(text: string): string {
+  const lines = text.split(/\r?\n/);
+  if (lines.length === 0 || lines[0].trim() !== '---') return '';
+  for (let i = 1; i < lines.length; i++) {
+    if (lines[i].trim() === '---') return lines.slice(i + 1).join('\n');
+  }
+  return '';
+}
+
 // ---------------------------------------------------------------------------
 // Canonicalisation
 // ---------------------------------------------------------------------------
@@ -488,18 +498,86 @@ export function parseRolesYaml(
   return { ok: true, index };
 }
 
-function parseAccessFile(
+/**
+ * Does an `access.md` body declare access rules — i.e. is the file in the NEW
+ * (body-governs-the-folder) format?
+ *
+ * The two-format story: historically the FRONTMATTER carried the folder's
+ * rules and the file could not govern itself. The new format follows the
+ * convention every other file uses — frontmatter is about the FILE (who may
+ * read/write `access.md` itself), and the content (the body) is the folder's
+ * rules. The compat rule, applied per file: **when the body is not parsable as
+ * rules, the frontmatter is resolved for the folder as before.**
+ *
+ * "Parsable as rules" is deliberately shallow — the body YAML-parses to a
+ * mapping that names at least one known verb. A prose body (the repo-root
+ * README-style file) fails the YAML parse or carries no verb key and stays
+ * legacy. A body that DOES name a verb has claimed to be rules: shape errors
+ * inside it (a scalar verb, a malformed entry) are then hard parse ERRORS of
+ * the file, never a silent fallback to the frontmatter — falling back would
+ * let a typo in the body hand the folder to the frontmatter's (possibly
+ * `read: everyone`) self-rules.
+ */
+export function accessMdDeclaresBodyRules(text: string): boolean {
+  const body = bodyAfterFrontmatter(text);
+  if (!body.trim()) return false;
+  const parsed = parseYamlSubset(body);
+  if (!parsed.ok) return false;
+  const root = parsed.value;
+  if (root == null || typeof root !== 'object' || Array.isArray(root)) return false;
+  return Object.keys(root as Record<string, YamlValue>).some((k) => KNOWN_VERBS_SET.has(k));
+}
+
+/**
+ * The access verbs an `access.md` declares FOR ITSELF — its frontmatter, and
+ * only in the new format (body-governed). A legacy file cannot govern itself:
+ * its frontmatter IS the folder's rules, so returning them as own-entries
+ * would double-apply them at the file scope.
+ *
+ * Parsed forgivingly (like node frontmatter): the new-format frontmatter may
+ * carry non-access keys, and a typo there must not make the file unreadable.
+ */
+export function accessMdSelfEntries(text: string): Record<Verb, ParsedEntry[]> | null {
+  if (!accessMdDeclaresBodyRules(text)) return null;
+  return parseOwnAccessEntries(text);
+}
+
+/**
+ * Parse one `access.md`'s FOLDER rules into its per-verb entry lists.
+ *
+ * Two formats (see {@link accessMdDeclaresBodyRules}): when the body declares
+ * rules, the body is parsed (new format — frontmatter then governs the file
+ * itself via {@link accessMdSelfEntries}); otherwise the frontmatter is parsed
+ * (legacy format), exactly as before.
+ *
+ * Exported so read-only surfaces can report WHERE rules are declared without
+ * reimplementing the parse (see `access-declarations.ts`). Exporting changes
+ * nothing about resolution — this is the same function the resolver builds its
+ * model from, so a display of declarations can never drift from the rules that
+ * are actually enforced.
+ */
+export function parseAccessFile(
   text: string,
   relativePath: string,
 ): { ok: true; file: AccessFile; warnings: string[] } | { ok: false; errors: string[] } {
-  const fm = extractFrontmatter(text);
-  if (!fm.ok) return { ok: false, errors: [`${relativePath}: ${fm.error}`] };
-  const parsed = parseYamlSubset(fm.frontmatter);
+  const bodyFormat = accessMdDeclaresBodyRules(text);
+  let ruleSource: string;
+  if (bodyFormat) {
+    ruleSource = bodyAfterFrontmatter(text);
+  } else {
+    const fm = extractFrontmatter(text);
+    if (!fm.ok) return { ok: false, errors: [`${relativePath}: ${fm.error}`] };
+    ruleSource = fm.frontmatter;
+  }
+  const parsed = parseYamlSubset(ruleSource);
   if (!parsed.ok) return { ok: false, errors: [`${relativePath}: ${parsed.error}`] };
 
   const root = parsed.value;
   if (root == null || typeof root !== 'object' || Array.isArray(root)) {
-    return { ok: false, errors: [`${relativePath}: frontmatter must be a mapping`] };
+    return {
+      ok: false,
+      errors: [`${relativePath}: ${bodyFormat ? 'body' : 'frontmatter'} must be a mapping`],
+    };
   }
 
   const errors: string[] = [];
@@ -1222,6 +1300,22 @@ export class AccessControlService implements IAccessControl {
     return hasPermissionResolved(model, 'download', userEmail, relativePath, own);
   }
 
+  async canOwnerBatch(
+    workspaceId: string,
+    userEmail: string,
+    relativePaths: string[],
+  ): Promise<Map<string, boolean>> {
+    const model = await this.loadModel(workspaceId);
+    const repoDir = await this.repoDir(workspaceId);
+    // Parallel own-entries reads, memoized — same shape as `canWriteBatch`.
+    const owns = await Promise.all(relativePaths.map((p) => this.cachedOwnEntries(workspaceId, repoDir, p)));
+    const result = new Map<string, boolean>();
+    relativePaths.forEach((p, i) => {
+      result.set(p, hasPermissionResolved(model, 'owner', userEmail, p, owns[i]));
+    });
+    return result;
+  }
+
   async canOwner(
     workspaceId: string,
     userEmail: string,
@@ -1601,23 +1695,25 @@ export class AccessControlService implements IAccessControl {
   }
 
   /**
-   * Read the access verbs a node file declares in its own frontmatter from the
-   * working tree. Returns null when the file has no per-file access config
-   * (the common case). `access.md` and `roles.yaml` are skipped — `access.md`
-   * frontmatter governs its directory (handled by the dir chain), not itself,
-   * and `roles.yaml` is not a node.
+   * Read the access verbs a file declares FOR ITSELF from the working tree.
+   * Returns null when the file has no per-file access config (the common
+   * case). `roles.yaml` is never a node; an `access.md` governs itself only
+   * in the new (body-governed) format, where its frontmatter is self-access —
+   * see {@link accessMdSelfEntries}. A legacy `access.md` still yields null:
+   * its frontmatter IS the folder rules the dir chain already applies.
    */
   private async readOwnEntries(
     repoDir: string,
     relativePath: string,
   ): Promise<OwnEntries | null> {
-    if (isAccessMdPath(relativePath) || relativePath === 'roles.yaml') return null;
+    if (relativePath === 'roles.yaml') return null;
     let text: string;
     try {
       text = await fs.readFile(path.join(repoDir, relativePath), 'utf-8');
     } catch {
       return null;
     }
+    if (isAccessMdPath(relativePath)) return accessMdSelfEntries(text);
     return parseOwnAccessEntries(text);
   }
 
@@ -1632,9 +1728,10 @@ export class AccessControlService implements IAccessControl {
     ref: string,
     relativePath: string,
   ): Promise<OwnEntries | null> {
-    if (isAccessMdPath(relativePath) || relativePath === 'roles.yaml') return null;
+    if (relativePath === 'roles.yaml') return null;
     const text = await this.showAtRef(repoDir, ref, relativePath);
     if (text === null) return null;
+    if (isAccessMdPath(relativePath)) return accessMdSelfEntries(text);
     return parseOwnAccessEntries(text);
   }
 
@@ -1654,14 +1751,15 @@ export class AccessControlService implements IAccessControl {
     const result = new Map<string, OwnEntries | null>();
     const wanted: string[] = [];
     for (const p of relativePaths) {
-      if (isAccessMdPath(p) || p === 'roles.yaml') result.set(p, null);
+      if (p === 'roles.yaml') result.set(p, null);
       else if (!wanted.includes(p)) wanted.push(p);
     }
     if (wanted.length === 0) return result;
     const texts = await catFileBatch(repoDir, wanted.map((p) => `${ref}:${p}`));
     wanted.forEach((p, i) => {
       const text = texts[i];
-      result.set(p, text === null ? null : parseOwnAccessEntries(text));
+      if (text === null) result.set(p, null);
+      else result.set(p, isAccessMdPath(p) ? accessMdSelfEntries(text) : parseOwnAccessEntries(text));
     });
     return result;
   }