@burdenoff/microfe-assethandler 2026.1110.1 → 2026.1111.2

package/dist/assethandler/components/AttachmentsPanel.d.ts

@@ -5,6 +5,29 @@
  * `initiateUpload` → presigned PUT → `completeUpload` flow, and mints public
  * share links via `createFileShareLink`. All entries are live data.
  *
+ * Sharing follows the files service's rules, which depend on visibility:
+ *
+ * - PRIVATE and TEAM files can only be shared by their uploader or someone
+ *   holding a SHARE/MANAGE grant or a MANAGER share. For these the panel asks
+ *   `getUserFilePermissions(fileId).canShare` before minting a link. The check
+ *   runs lazily (on each desktop click and each time the mobile menu opens), so
+ *   a long file list never fans out into one permission query per row.
+ * - WORKSPACE and PUBLIC files are governed only by the gateway's
+ *   `@rbac(share, file)` check. `canShare` reflects explicit grants alone for
+ *   these files, so it is not consulted: the panel calls `createFileShareLink`
+ *   directly and treats its FORBIDDEN as the denial.
+ *
+ * The two denials arrive differently and get different copy. The gateway's
+ * role check answers HTTP 403 (an Apollo `ServerError`), so the caller is told
+ * their workspace role cannot share. The service's per-file rule answers HTTP
+ * 200 with a `FORBIDDEN` GraphQL error, so the caller is told who can share
+ * the file. A 503 `RBAC_SERVICE_UNAVAILABLE` is an outage, not a denial.
+ *
+ * `getUserFilePermissions` needs its own `@rbac(read, file-permission)`, which
+ * some roles lack. A FORBIDDEN from that query, from either source, means
+ * "unknown", never "cannot share": the panel falls through and lets the share
+ * mutation decide.
+ *
  * `entityType`/`entityId` scope the panel to the record it is mounted on and
  * are used for context labelling; uploaded files land in the workspace file
  * store so they can be shared and reused.

package/dist/assethandler/components/AttachmentsPanel.js

@@ -1,12 +1,13 @@
 import { notify as e } from "../utils/toast.js";
-import { useMemo as t, useRef as n, useState as r } from "react";
-import { Download as i, File as a, FileArchive as o, FileAudio as s, FileCode2 as c, FileSpreadsheet as l, FileText as u, FileVideo as d, Image as f, Link2 as p, Loader2 as m, MoreHorizontal as h, Paperclip as g, Upload as _ } from "lucide-react";
-import { gql as v } from "@apollo/client";
-import { useMutation as y, useQuery as b } from "@apollo/client/react";
-import { jsx as x, jsxs as S } from "react/jsx-runtime";
-import { Button as C, Card as w, CardContent as T, CardHeader as E, CardTitle as D, DropdownMenu as O, DropdownMenuContent as k, DropdownMenuItem as A, DropdownMenuTrigger as j, IllustratedEmptyState as M } from "@burdenoff/fe-libs/ui";
+import { getForbiddenSource as t, isForbiddenError as n } from "../utils/graphqlErrors.js";
+import { useCallback as r, useMemo as i, useRef as a, useState as o } from "react";
+import { Download as s, File as c, FileArchive as l, FileAudio as u, FileCode2 as d, FileSpreadsheet as f, FileText as p, FileVideo as m, Image as h, Link2 as g, Loader2 as _, Lock as v, MoreHorizontal as y, Paperclip as b, Upload as ee } from "lucide-react";
+import { gql as x } from "@apollo/client";
+import { useApolloClient as te, useMutation as S, useQuery as C } from "@apollo/client/react";
+import { jsx as w, jsxs as T } from "react/jsx-runtime";
+import { Button as ne, Card as E, CardContent as D, CardHeader as O, CardTitle as k, DropdownMenu as A, DropdownMenuContent as j, DropdownMenuItem as M, DropdownMenuTrigger as re, IllustratedEmptyState as ie } from "@burdenoff/fe-libs/ui";
 // src/assethandler/components/AttachmentsPanel.tsx
-var N = v`
+var ae = x`
   query AssetHandlerGetFiles($pagination: PaginationInput, $sort: FileSortInput) {
     getFiles(pagination: $pagination, sort: $sort) {
       total
@@ -19,10 +20,11 @@ var N = v`
         size
         downloadUrl
         createdAt
+        visibility
       }
     }
   }
-`, P = v`
+`, oe = x`
   mutation AssetHandlerInitiateUpload($input: InitiateUploadInput!) {
     initiateUpload(input: $input) {
       uploadUrl
@@ -31,7 +33,7 @@ var N = v`
       }
     }
   }
-`, F = v`
+`, se = x`
   mutation AssetHandlerCompleteUpload($input: CompleteUploadInput!) {
     completeUpload(input: $input) {
       fileId
@@ -41,15 +43,40 @@ var N = v`
       }
     }
   }
-`, I = v`
+`, ce = x`
   mutation AssetHandlerCreateFileShareLink($input: CreateShareGrantLinkInput!) {
     createFileShareLink(input: $input) {
       id
       shareUrl
     }
   }
+`, N = x`
+  query AssetHandlerUserFilePermissions($fileId: ID!) {
+    getUserFilePermissions(fileId: $fileId) {
+      fileId
+      canShare
+    }
+  }
 `;
-function L(e) {
+function P(e) {
+	return e === "PRIVATE" || e === "TEAM";
+}
+var F = "You can't share this file", I = "Only the uploader, or someone with share or manage access to this file, can create a share link. Ask one of them to share it or to grant you access.", L = "Your workspace role doesn't allow sharing files. Ask a workspace admin for share access.", R = "You don't have permission to share this file. Ask the file's uploader or a workspace admin.";
+function z(e) {
+	return e === "denied-role" || e === "denied-restricted" || e === "denied-other";
+}
+function B(e) {
+	switch (e) {
+		case "denied-role": return L;
+		case "denied-restricted": return I;
+		case "denied-other": return R;
+	}
+}
+function V(e, n) {
+	let r = t(e);
+	return r === "gateway" ? "denied-role" : r === "service" ? P(n) ? "denied-restricted" : "denied-other" : null;
+}
+function H(e) {
 	if (!e) return "0 B";
 	let t = [
 		"B",
@@ -59,11 +86,11 @@ function L(e) {
 	], n = Math.min(Math.floor(Math.log(e) / Math.log(1024)), t.length - 1);
 	return `${(e / 1024 ** n).toFixed(n === 0 ? 0 : 1)} ${t[n]}`;
 }
-function R(e) {
+function U(e) {
 	let t = e.lastIndexOf(".");
 	return t >= 0 ? e.slice(t + 1).toLowerCase() : "bin";
 }
-function z(e) {
+function W(e) {
 	let t = new Date(e).getTime();
 	if (Number.isNaN(t)) return "";
 	let n = Date.now() - t, r = Math.round(n / 1e3);
@@ -75,8 +102,8 @@ function z(e) {
 	let o = Math.round(a / 24);
 	return o < 30 ? `${o} day${o === 1 ? "" : "s"} ago` : new Date(e).toLocaleDateString();
 }
-function B(e) {
-	let t = (e.mimeType || "").toLowerCase(), n = (e.extension || R(e.name)).toLowerCase();
+function G(e) {
+	let t = (e.mimeType || "").toLowerCase(), n = (e.extension || U(e.name)).toLowerCase();
 	return t.startsWith("image/") || [
 		"png",
 		"jpg",
@@ -135,68 +162,68 @@ function B(e) {
 		"pages"
 	].includes(n) ? "doc" : "other";
 }
-var V = {
+var K = {
 	image: {
-		Icon: f,
+		Icon: h,
 		iconClass: "text-status-success-text",
 		tileClass: "bg-status-success-bg-subtle"
 	},
 	pdf: {
-		Icon: u,
+		Icon: p,
 		iconClass: "text-status-error-text",
 		tileClass: "bg-status-error-bg-subtle"
 	},
 	sheet: {
-		Icon: l,
+		Icon: f,
 		iconClass: "text-status-success-text",
 		tileClass: "bg-status-success-bg-subtle"
 	},
 	doc: {
-		Icon: u,
+		Icon: p,
 		iconClass: "text-status-info-text",
 		tileClass: "bg-status-info-bg-subtle"
 	},
 	archive: {
-		Icon: o,
+		Icon: l,
 		iconClass: "text-status-warning-text",
 		tileClass: "bg-status-warning-bg-subtle"
 	},
 	code: {
-		Icon: c,
+		Icon: d,
 		iconClass: "text-status-info-text",
 		tileClass: "bg-status-info-bg-subtle"
 	},
 	video: {
-		Icon: d,
+		Icon: m,
 		iconClass: "text-status-info-text",
 		tileClass: "bg-status-info-bg-subtle"
 	},
 	audio: {
-		Icon: s,
+		Icon: u,
 		iconClass: "text-status-warning-text",
 		tileClass: "bg-status-warning-bg-subtle"
 	},
 	other: {
-		Icon: a,
+		Icon: c,
 		iconClass: "text-text-secondary",
 		tileClass: "bg-bg-sunken"
 	}
 };
-function H({ file: e }) {
-	let t = B(e), { Icon: n, iconClass: r, tileClass: i } = V[t];
-	return t === "image" && e.downloadUrl ? /* @__PURE__ */ x("img", {
+function le({ file: e }) {
+	let t = G(e), { Icon: n, iconClass: r, tileClass: i } = K[t];
+	return t === "image" && e.downloadUrl ? /* @__PURE__ */ w("img", {
 		src: e.downloadUrl,
 		alt: "",
 		loading: "lazy",
 		className: "h-10 w-10 shrink-0 rounded-lg border border-border-subtle object-cover"
-	}) : /* @__PURE__ */ x("span", {
+	}) : /* @__PURE__ */ w("span", {
 		className: `flex h-10 w-10 shrink-0 items-center justify-center rounded-lg ${i}`,
 		"aria-hidden": "true",
-		children: /* @__PURE__ */ x(n, { className: `h-5 w-5 ${r}` })
+		children: /* @__PURE__ */ w(n, { className: `h-5 w-5 ${r}` })
 	});
 }
-function U({ entityType: a, entityId: o }) {
-	let s = n(null), [c, l] = r(!1), [u, d] = r(null), { data: f, loading: v, refetch: B } = b(N, {
+function q({ entityType: t, entityId: c }) {
+	let l = a(null), [u, d] = o(!1), [f, p] = o(null), [m, h] = o({}), x = te(), { data: I, loading: L, refetch: R } = C(ae, {
 		variables: {
 			pagination: {
 				limit: 25,
@@ -209,14 +236,14 @@ function U({ entityType: a, entityId: o }) {
 		},
 		fetchPolicy: "cache-and-network",
 		errorPolicy: "all"
-	}), [V] = y(P), [U] = y(F), [W] = y(I), G = t(() => f?.getFiles.files ?? [], [f]), K = async (t) => {
+	}), [G] = S(oe), [K] = S(se), [q] = S(ce), J = i(() => I?.getFiles.files ?? [], [I]), ue = async (t) => {
 		let n = t.target.files?.[0];
 		if (t.target.value = "", n) {
-			l(!0);
+			d(!0);
 			try {
-				let t = await V({ variables: { input: {
+				let t = await G({ variables: { input: {
 					fileName: n.name,
-					extension: R(n.name),
+					extension: U(n.name),
 					fileSize: n.size,
 					mimeType: n.type || "application/octet-stream",
 					visibility: "WORKSPACE"
@@ -228,150 +255,201 @@ function U({ entityType: a, entityId: o }) {
 					headers: { "Content-Type": n.type || "application/octet-stream" }
 				});
 				if (!a.ok) throw Error(`Storage rejected the upload (HTTP ${a.status}).`);
-				await U({ variables: { input: {
+				await K({ variables: { input: {
 					sessionId: i,
 					fileSize: n.size
-				} } }), e.success("File uploaded", `${n.name} is now available on this record.`), await B();
+				} } }), e.success("File uploaded", `${n.name} is now available on this record.`), await R();
 			} catch (t) {
 				e.error("Upload failed", t instanceof Error ? t.message : "The file could not be uploaded.");
 			} finally {
-				l(!1);
+				d(!1);
 			}
 		}
-	}, q = async (t) => {
-		d(t);
+	}, Y = r((e, t) => {
+		h((n) => {
+			let r = { ...n };
+			return t ? r[e] = t : delete r[e], r;
+		});
+	}, []), X = r(async (e) => {
+		Y(e, "checking");
+		try {
+			let t = (await x.query({
+				query: N,
+				variables: { fileId: e },
+				fetchPolicy: "network-only"
+			})).data?.getUserFilePermissions.canShare === !0 ? "allowed" : "denied-restricted";
+			return Y(e, t), t;
+		} catch (t) {
+			return n(t) ? (Y(e, "unverified"), "unverified") : (Y(e, null), "failed");
+		}
+	}, [x, Y]), de = (e, t) => {
+		t && (P(e.visibility) ? m[e.id] !== "checking" && X(e.id) : z(m[e.id]) && Y(e.id, null));
+	}, Z = async (t, { recheck: n }) => {
+		let r = t.id;
+		p(r);
 		try {
-			let n = (await W({ variables: { input: {
-				resourceId: t,
+			if (P(t.visibility)) {
+				let t = m[r], i = !n && (t === "allowed" || t === "unverified") ? t : await X(r);
+				if (i === "failed") throw Error("Your share access could not be checked. Please try again.");
+				if (i === "denied-restricted") {
+					e.error(F, B(i));
+					return;
+				}
+			}
+			let i = (await q({ variables: { input: {
+				resourceId: r,
 				role: "VIEWER"
 			} } })).data?.createFileShareLink.shareUrl;
-			if (!n) throw Error("No share link was returned.");
-			navigator.clipboard?.writeText ? (await navigator.clipboard.writeText(n), e.success("Share link copied", "A view-only link is on your clipboard.")) : e.info("Share link ready", n);
-		} catch (t) {
-			e.error("Could not create share link", t instanceof Error ? t.message : "Please try again.");
+			if (!i) throw Error("No share link was returned.");
+			Y(r, "allowed"), navigator.clipboard?.writeText ? (await navigator.clipboard.writeText(i), e.success("Share link copied", "A view-only link is on your clipboard.")) : e.info("Share link ready", i);
+		} catch (n) {
+			let i = V(n, t.visibility);
+			if (i) {
+				Y(r, i), e.error(F, B(i));
+				return;
+			}
+			e.error("Could not create share link", n instanceof Error ? n.message : "Please try again.");
 		} finally {
-			d(null);
+			p(null);
 		}
-	}, J = f?.getFiles.total ?? 0, Y = G.length > 0;
-	return /* @__PURE__ */ S(w, { children: [/* @__PURE__ */ x(E, {
+	}, Q = I?.getFiles.total ?? 0, $ = J.length > 0;
+	return /* @__PURE__ */ T(E, { children: [/* @__PURE__ */ w(O, {
 		className: "flex flex-row items-center justify-between gap-2 space-y-0",
-		children: /* @__PURE__ */ S(D, {
+		children: /* @__PURE__ */ T(k, {
 			className: "flex items-center gap-2 text-base",
 			children: [
-				/* @__PURE__ */ x(g, { className: "h-4 w-4" }),
+				/* @__PURE__ */ w(b, { className: "h-4 w-4" }),
 				"Attachments",
-				J ? /* @__PURE__ */ S("span", {
+				Q ? /* @__PURE__ */ T("span", {
 					className: "text-sm font-normal text-text-secondary",
 					children: [
-						J,
+						Q,
 						" file",
-						J === 1 ? "" : "s"
+						Q === 1 ? "" : "s"
 					]
 				}) : null
 			]
 		})
-	}), /* @__PURE__ */ S(T, {
+	}), /* @__PURE__ */ T(D, {
 		className: "space-y-3",
 		children: [
-			/* @__PURE__ */ x("input", {
-				ref: s,
+			/* @__PURE__ */ w("input", {
+				ref: l,
 				type: "file",
 				className: "hidden",
-				onChange: (e) => void K(e),
-				"aria-label": `Upload a file for ${a} ${o}`
+				onChange: (e) => void ue(e),
+				"aria-label": `Upload a file for ${t} ${c}`
 			}),
-			v && !Y ? /* @__PURE__ */ x("div", {
+			L && !$ ? /* @__PURE__ */ w("div", {
 				className: "space-y-2",
-				children: Array.from({ length: 3 }).map((e, t) => /* @__PURE__ */ x("div", { className: "h-14 rounded-lg bg-bg-sunken motion-safe:animate-vc-shimmer" }, t))
-			}) : Y ? /* @__PURE__ */ x("ul", {
+				children: Array.from({ length: 3 }).map((e, t) => /* @__PURE__ */ w("div", { className: "h-14 rounded-lg bg-bg-sunken motion-safe:animate-vc-shimmer" }, t))
+			}) : $ ? /* @__PURE__ */ w("ul", {
 				className: "space-y-1.5",
-				children: G.map((e) => {
-					let t = u === e.id;
-					return /* @__PURE__ */ S("li", {
+				children: J.map((e) => {
+					let t = f === e.id, n = m[e.id], r = n === "checking", i = z(n) ? n : null, a = i !== null;
+					return /* @__PURE__ */ T("li", {
 						className: "flex items-center gap-3 rounded-lg border border-border-subtle bg-bg-surface p-2.5",
 						children: [
-							/* @__PURE__ */ x(H, { file: e }),
-							/* @__PURE__ */ S("div", {
+							/* @__PURE__ */ w(le, { file: e }),
+							/* @__PURE__ */ T("div", {
 								className: "min-w-0 flex-1",
-								children: [/* @__PURE__ */ x("p", {
+								children: [/* @__PURE__ */ w("p", {
 									className: "truncate text-sm font-medium",
 									title: e.name,
 									children: e.name
-								}), /* @__PURE__ */ S("p", {
+								}), /* @__PURE__ */ T("p", {
 									className: "truncate text-xs text-text-secondary",
 									children: [
-										L(Number(e.size)),
+										H(Number(e.size)),
 										" · ",
-										z(e.createdAt)
+										W(e.createdAt)
 									]
 								})]
 							}),
-							/* @__PURE__ */ S("div", {
+							/* @__PURE__ */ T("div", {
 								className: "hidden items-center gap-1 sm:flex",
-								children: [e.downloadUrl ? /* @__PURE__ */ x("a", {
+								children: [e.downloadUrl ? /* @__PURE__ */ w("a", {
 									href: e.downloadUrl,
 									target: "_blank",
 									rel: "noreferrer",
 									className: "rounded-md p-1.5 text-text-secondary transition-colors hover:bg-bg-sunken hover:text-text-primary",
 									"aria-label": `Download ${e.name}`,
 									title: "Download",
-									children: /* @__PURE__ */ x(i, { className: "h-4 w-4" })
-								}) : null, /* @__PURE__ */ x("button", {
+									children: /* @__PURE__ */ w(s, { className: "h-4 w-4" })
+								}) : null, /* @__PURE__ */ w("button", {
 									type: "button",
-									disabled: t,
-									onClick: () => void q(e.id),
-									className: "rounded-md p-1.5 text-text-secondary transition-colors hover:bg-bg-sunken hover:text-text-primary disabled:opacity-60",
+									disabled: t || r,
+									"aria-disabled": a ? !0 : void 0,
+									"data-share-state": a ? "denied" : void 0,
+									onClick: () => void Z(e, { recheck: !0 }),
+									className: `rounded-md p-1.5 transition-colors disabled:opacity-60 ${a ? "cursor-not-allowed text-text-tertiary opacity-60" : "text-text-secondary hover:bg-bg-sunken hover:text-text-primary"}`,
 									"aria-label": `Copy share link for ${e.name}`,
-									title: "Copy share link",
-									children: t ? /* @__PURE__ */ x(m, { className: "h-4 w-4 animate-spin" }) : /* @__PURE__ */ x(p, { className: "h-4 w-4" })
+									title: i ? `${F}. ${B(i)}` : "Copy share link",
+									children: t || r ? /* @__PURE__ */ w(_, { className: "h-4 w-4 animate-spin" }) : a ? /* @__PURE__ */ w(v, {
+										className: "h-4 w-4",
+										"aria-hidden": "true"
+									}) : /* @__PURE__ */ w(g, { className: "h-4 w-4" })
 								})]
 							}),
-							/* @__PURE__ */ x("div", {
+							/* @__PURE__ */ w("div", {
 								className: "sm:hidden",
-								children: /* @__PURE__ */ S(O, { children: [/* @__PURE__ */ x(j, {
-									asChild: !0,
-									children: /* @__PURE__ */ x("button", {
-										type: "button",
-										className: "rounded-md p-1.5 text-text-secondary hover:bg-bg-sunken hover:text-text-primary",
-										"aria-label": `Actions for ${e.name}`,
-										children: /* @__PURE__ */ x(h, { className: "h-4 w-4" })
-									})
-								}), /* @__PURE__ */ S(k, {
-									align: "end",
-									children: [e.downloadUrl ? /* @__PURE__ */ x(A, {
+								children: /* @__PURE__ */ T(A, {
+									onOpenChange: (t) => de(e, t),
+									children: [/* @__PURE__ */ w(re, {
 										asChild: !0,
-										children: /* @__PURE__ */ S("a", {
-											href: e.downloadUrl,
-											target: "_blank",
-											rel: "noreferrer",
-											children: [/* @__PURE__ */ x(i, { className: "mr-2 h-4 w-4" }), "Download"]
+										children: /* @__PURE__ */ w("button", {
+											type: "button",
+											className: "rounded-md p-1.5 text-text-secondary hover:bg-bg-sunken hover:text-text-primary",
+											"aria-label": `Actions for ${e.name}`,
+											children: /* @__PURE__ */ w(y, { className: "h-4 w-4" })
 										})
-									}) : null, /* @__PURE__ */ S(A, {
-										disabled: t,
-										onSelect: (t) => {
-											t.preventDefault(), q(e.id);
-										},
-										children: [/* @__PURE__ */ x(p, { className: "mr-2 h-4 w-4" }), "Copy share link"]
+									}), /* @__PURE__ */ T(j, {
+										align: "end",
+										children: [
+											e.downloadUrl ? /* @__PURE__ */ w(M, {
+												asChild: !0,
+												children: /* @__PURE__ */ T("a", {
+													href: e.downloadUrl,
+													target: "_blank",
+													rel: "noreferrer",
+													children: [/* @__PURE__ */ w(s, { className: "mr-2 h-4 w-4" }), "Download"]
+												})
+											}) : null,
+											/* @__PURE__ */ T(M, {
+												disabled: t || r || a,
+												onSelect: (t) => {
+													t.preventDefault(), Z(e, { recheck: !1 });
+												},
+												children: [r ? /* @__PURE__ */ w(_, { className: "mr-2 h-4 w-4 animate-spin" }) : a ? /* @__PURE__ */ w(v, {
+													className: "mr-2 h-4 w-4",
+													"aria-hidden": "true"
+												}) : /* @__PURE__ */ w(g, { className: "mr-2 h-4 w-4" }), r ? "Checking share access…" : a ? "No share access" : "Copy share link"]
+											}),
+											i ? /* @__PURE__ */ w("p", {
+												className: "max-w-56 px-2 py-1.5 text-xs text-text-secondary",
+												children: B(i)
+											}) : null
+										]
 									})]
-								})] })
+								})
 							})
 						]
 					}, e.id);
 				})
-			}) : /* @__PURE__ */ x(M, {
+			}) : /* @__PURE__ */ w(ie, {
 				illustration: "empty-data",
 				title: "No files yet",
 				description: "Upload photos, receipts, warranties or documents to keep them with this record."
 			}),
-			/* @__PURE__ */ S(C, {
+			/* @__PURE__ */ T(ne, {
 				className: "w-full",
-				disabled: c,
-				onClick: () => s.current?.click(),
-				children: [c ? /* @__PURE__ */ x(m, { className: "mr-2 h-4 w-4 animate-spin" }) : /* @__PURE__ */ x(_, { className: "mr-2 h-4 w-4" }), c ? "Uploading…" : "Upload files"]
+				disabled: u,
+				onClick: () => l.current?.click(),
+				children: [u ? /* @__PURE__ */ w(_, { className: "mr-2 h-4 w-4 animate-spin" }) : /* @__PURE__ */ w(ee, { className: "mr-2 h-4 w-4" }), u ? "Uploading…" : "Upload files"]
 			})
 		]
 	})] });
 }
-export { U as AttachmentsPanel };
+export { q as AttachmentsPanel };
 
 //# sourceMappingURL=AttachmentsPanel.js.map