@objectstack/plugin-sharing 9.9.1 → 9.11.0

package/dist/index.mjs

@@ -1412,12 +1412,12 @@ var SysSharingRule = ObjectSchema2.create({
       group: "Target"
     }),
     recipient_type: Field2.select(
-      ["user", "team", "department", "role", "queue"],
+      ["user", "team", "department", "role", "role_and_subordinates", "queue"],
       {
         label: "Recipient Type",
         required: true,
         defaultValue: "department",
-        description: "Kind of principal that receives access \u2014 expanded to user grants at evaluation time. `department` walks the parent_department_id tree; `team` is flat (better-auth).",
+        description: "Kind of principal that receives access \u2014 expanded to user grants at evaluation time. `department` walks the parent_department_id tree; `team` is flat (better-auth); `role` is the role's direct members; `role_and_subordinates` walks the sys_role.parent hierarchy to also include every subordinate role (ADR-0056 D6).",
         group: "Recipient"
       }
     ),
@@ -1675,7 +1675,7 @@ var OWNER_FIELD = "owner_id";
 function effectiveSharingModel(schema) {
   const m = schema?.sharingModel ?? schema?.security?.sharingModel;
   if (m === "private") return "private";
-  if (m === "read") return "read";
+  if (m === "read" || m === "public_read") return "read";
   return "public";
 }
 function hasOwnerField(schema) {
@@ -1942,8 +1942,77 @@ async function expandPrincipal(input, ctx) {
   return [`${t}:${v}`];
 }
 
-// src/department-graph.ts
+// src/role-graph.ts
 var SYSTEM_CTX3 = { isSystem: true, roles: [], permissions: [] };
+var RoleGraphService = class {
+  constructor(opts) {
+    var _a, _b;
+    this.engine = opts.engine;
+    this.organizationId = opts.organizationId ?? null;
+    this.cache = opts.cache ?? {};
+    (_a = this.cache).descendants ?? (_a.descendants = /* @__PURE__ */ new Map());
+    (_b = this.cache).expand ?? (_b.expand = /* @__PURE__ */ new Map());
+    this.teamGraph = opts.teamGraph ?? new TeamGraphService({ engine: this.engine, organizationId: this.organizationId });
+  }
+  /** Direct child roles of `roleName` (`sys_role.parent === roleName`). */
+  async childRoles(roleName) {
+    const filter = { parent: roleName };
+    if (this.organizationId) filter.organization_id = this.organizationId;
+    let rows = [];
+    try {
+      rows = await this.engine.find("sys_role", {
+        filter,
+        fields: ["name"],
+        limit: 5e3,
+        context: SYSTEM_CTX3
+      });
+    } catch {
+      rows = [];
+    }
+    return Array.from(new Set((rows ?? []).map((r) => String(r.name ?? "")).filter(Boolean)));
+  }
+  /** `roleName` plus every role beneath it in the hierarchy (BFS, cycle-safe). */
+  async descendantRoles(roleName) {
+    if (!roleName) return [];
+    const cached = this.cache.descendants.get(roleName);
+    if (cached) return cached;
+    const out = [];
+    const seen = /* @__PURE__ */ new Set();
+    const queue = [roleName];
+    while (queue.length) {
+      const r = queue.shift();
+      if (seen.has(r)) continue;
+      seen.add(r);
+      out.push(r);
+      for (const child of await this.childRoles(r)) {
+        if (!seen.has(child)) queue.push(child);
+      }
+    }
+    this.cache.descendants.set(roleName, out);
+    return out;
+  }
+  /** Users holding `roleName` OR any subordinate role (the `role_and_subordinates` set). */
+  async expandRoleAndSubordinates(roleName, organizationId) {
+    if (!roleName) return [];
+    const org = organizationId ?? this.organizationId ?? "*";
+    const key = `${org}::${roleName}`;
+    const cached = this.cache.expand.get(key);
+    if (cached) return cached;
+    const roles = await this.descendantRoles(roleName);
+    const users = /* @__PURE__ */ new Set();
+    for (const role of roles) {
+      for (const uid2 of await this.teamGraph.expandRoleUsers(role, organizationId ?? this.organizationId ?? void 0)) {
+        users.add(uid2);
+      }
+    }
+    const result = Array.from(users);
+    this.cache.expand.set(key, result);
+    return result;
+  }
+};
+
+// src/department-graph.ts
+var SYSTEM_CTX4 = { isSystem: true, roles: [], permissions: [] };
 var DepartmentGraphService = class {
   constructor(opts) {
     var _a, _b, _c;
@@ -1965,7 +2034,7 @@ var DepartmentGraphService = class {
         filter: this.orgScope({ id: departmentId }),
         fields: ["id", "active"],
         limit: 1,
-        context: SYSTEM_CTX3
+        context: SYSTEM_CTX4
       });
       const seedRow = Array.isArray(seedRows) ? seedRows[0] : null;
       if (!seedRow) seedActive = false;
@@ -1987,7 +2056,7 @@ var DepartmentGraphService = class {
           filter: this.orgScope({ parent_department_id: parent, active: { $ne: false } }),
           fields: ["id"],
           limit: 1e3,
-          context: SYSTEM_CTX3
+          context: SYSTEM_CTX4
         });
       } catch {
         children = [];
@@ -2016,7 +2085,7 @@ var DepartmentGraphService = class {
         filter: { department_id: { $in: depts } },
         fields: ["user_id"],
         limit: 1e4,
-        context: SYSTEM_CTX3
+        context: SYSTEM_CTX4
       });
     } catch {
       rows = [];
@@ -2036,7 +2105,7 @@ var DepartmentGraphService = class {
         filter: { id: departmentId },
         fields: ["id", "manager_user_id"],
         limit: 1,
-        context: SYSTEM_CTX3
+        context: SYSTEM_CTX4
       });
       row = Array.isArray(rows) ? rows[0] : null;
     } catch {
@@ -2054,7 +2123,7 @@ var DepartmentGraphService = class {
         filter: { id: userId },
         fields: ["id", "manager_id"],
         limit: 1,
-        context: SYSTEM_CTX3
+        context: SYSTEM_CTX4
       });
       const row = Array.isArray(rows) ? rows[0] : null;
       return row?.manager_id ? String(row.manager_id) : null;
@@ -2069,7 +2138,7 @@ var DepartmentGraphService = class {
 };
 
 // src/sharing-rule-service.ts
-var SYSTEM_CTX4 = { isSystem: true, roles: [], permissions: [] };
+var SYSTEM_CTX5 = { isSystem: true, roles: [], permissions: [] };
 function uid(prefix) {
   const g = globalThis;
   if (g.crypto?.randomUUID) return `${prefix}_${g.crypto.randomUUID()}`;
@@ -2125,7 +2194,7 @@ var SharingRuleService = class {
     const existing = await this.engine.find("sys_sharing_rule", {
       filter: orgId ? { name: input.name, organization_id: orgId } : { name: input.name },
       limit: 1,
-      context: SYSTEM_CTX4
+      context: SYSTEM_CTX5
     });
     if (Array.isArray(existing) && existing[0]) {
       const row = existing[0];
@@ -2141,7 +2210,7 @@ var SharingRuleService = class {
         active,
         updated_at: now
       };
-      await this.engine.update("sys_sharing_rule", patch, { context: SYSTEM_CTX4 });
+      await this.engine.update("sys_sharing_rule", patch, { context: SYSTEM_CTX5 });
       return rowFromRule({ ...row, ...patch });
     }
     const newRow = {
@@ -2159,7 +2228,7 @@ var SharingRuleService = class {
       created_at: now,
       updated_at: now
     };
-    await this.engine.insert("sys_sharing_rule", newRow, { context: SYSTEM_CTX4 });
+    await this.engine.insert("sys_sharing_rule", newRow, { context: SYSTEM_CTX5 });
     return rowFromRule(newRow);
   }
   async listRules(filter, context) {
@@ -2172,7 +2241,7 @@ var SharingRuleService = class {
       filter: where,
       orderBy: [{ field: "name", order: "asc" }],
       limit: 1e3,
-      context: SYSTEM_CTX4
+      context: SYSTEM_CTX5
     });
     return Array.isArray(rows) ? rows.map(rowFromRule) : [];
   }
@@ -2182,13 +2251,13 @@ var SharingRuleService = class {
     const byId = await this.engine.find("sys_sharing_rule", {
       filter: { id: idOrName },
       limit: 1,
-      context: SYSTEM_CTX4
+      context: SYSTEM_CTX5
     });
     if (Array.isArray(byId) && byId[0]) return rowFromRule(byId[0]);
     const byName = await this.engine.find("sys_sharing_rule", {
       filter: orgId ? { name: idOrName, organization_id: orgId } : { name: idOrName },
       limit: 1,
-      context: SYSTEM_CTX4
+      context: SYSTEM_CTX5
     });
     if (Array.isArray(byName) && byName[0]) return rowFromRule(byName[0]);
     return null;
@@ -2198,11 +2267,11 @@ var SharingRuleService = class {
     if (!row) return;
     await this.engine.delete("sys_record_share", {
       where: { source: "rule", source_id: row.id },
-      context: SYSTEM_CTX4
+      context: SYSTEM_CTX5
     });
     await this.engine.delete("sys_sharing_rule", {
       where: { id: row.id },
-      context: SYSTEM_CTX4
+      context: SYSTEM_CTX5
     });
   }
   async evaluateRule(idOrName, context) {
@@ -2235,7 +2304,7 @@ var SharingRuleService = class {
         filter,
         fields: ["id"],
         limit: 5e3,
-        context: SYSTEM_CTX4
+        context: SYSTEM_CTX5
       });
       return Array.isArray(rows) ? rows.map((r) => String(r.id)).filter(Boolean) : [];
     } catch (err) {
@@ -2250,7 +2319,7 @@ var SharingRuleService = class {
         filter,
         fields: ["id"],
         limit: 1,
-        context: SYSTEM_CTX4
+        context: SYSTEM_CTX5
       });
       return Array.isArray(rows) && rows.length > 0;
     } catch {
@@ -2273,6 +2342,14 @@ var SharingRuleService = class {
       return dept.expandUsers(rule.recipient_id);
     }
     if (rule.recipient_type === "role") return team.expandRoleUsers(rule.recipient_id, rule.organization_id ?? void 0);
+    if (rule.recipient_type === "role_and_subordinates") {
+      const roleGraph = new RoleGraphService({
+        engine: this.engine,
+        organizationId: rule.organization_id ?? null,
+        teamGraph: team
+      });
+      return roleGraph.expandRoleAndSubordinates(rule.recipient_id, rule.organization_id ?? void 0);
+    }
     return [];
   }
   async reconcile(rule, matchedIds, users) {
@@ -2280,7 +2357,7 @@ var SharingRuleService = class {
       filter: { source: "rule", source_id: rule.id },
       fields: ["id", "record_id", "recipient_id", "access_level"],
       limit: 1e5,
-      context: SYSTEM_CTX4
+      context: SYSTEM_CTX5
     });
     const desired = /* @__PURE__ */ new Map();
     for (const rid of matchedIds) {
@@ -2306,7 +2383,7 @@ var SharingRuleService = class {
               sourceId: rule.id,
               reason: `rule:${rule.name}`
             },
-            SYSTEM_CTX4
+            SYSTEM_CTX5
           );
           updated += 1;
         }
@@ -2323,13 +2400,13 @@ var SharingRuleService = class {
             sourceId: rule.id,
             reason: `rule:${rule.name}`
           },
-          SYSTEM_CTX4
+          SYSTEM_CTX5
         );
         created += 1;
       }
     }
     for (const [, stale] of existingMap.entries()) {
-      await this.sharing.revoke(stale.id, SYSTEM_CTX4);
+      await this.sharing.revoke(stale.id, SYSTEM_CTX5);
       revoked += 1;
     }
     return {
@@ -2346,7 +2423,7 @@ var SharingRuleService = class {
       filter: { source: "rule", source_id: rule.id, record_id: recordId },
       fields: ["id", "record_id", "recipient_id", "access_level"],
       limit: 1e3,
-      context: SYSTEM_CTX4
+      context: SYSTEM_CTX5
     });
     const existingMap = /* @__PURE__ */ new Map();
     for (const row of existing ?? []) existingMap.set(String(row.recipient_id), row);
@@ -2369,7 +2446,7 @@ var SharingRuleService = class {
                 sourceId: rule.id,
                 reason: `rule:${rule.name}`
               },
-              SYSTEM_CTX4
+              SYSTEM_CTX5
             );
             updated += 1;
           }
@@ -2386,14 +2463,14 @@ var SharingRuleService = class {
               sourceId: rule.id,
               reason: `rule:${rule.name}`
             },
-            SYSTEM_CTX4
+            SYSTEM_CTX5
           );
           created += 1;
         }
       }
     }
     for (const [, stale] of existingMap.entries()) {
-      await this.sharing.revoke(stale.id, SYSTEM_CTX4);
+      await this.sharing.revoke(stale.id, SYSTEM_CTX5);
       revoked += 1;
     }
     return {
@@ -2410,11 +2487,11 @@ var SharingRuleService = class {
       filter: { source: "rule", source_id: ruleId },
       fields: ["id"],
       limit: 1e5,
-      context: SYSTEM_CTX4
+      context: SYSTEM_CTX5
     });
     let revoked = 0;
     for (const row of existing ?? []) {
-      await this.sharing.revoke(row.id, SYSTEM_CTX4);
+      await this.sharing.revoke(row.id, SYSTEM_CTX5);
       revoked += 1;
     }
     return revoked;
@@ -2422,7 +2499,7 @@ var SharingRuleService = class {
 };
 
 // src/share-link-service.ts
-var SYSTEM_CTX5 = { isSystem: true, roles: [], permissions: [] };
+var SYSTEM_CTX6 = { isSystem: true, roles: [], permissions: [] };
 var TOKEN_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
 var TOKEN_LENGTH = 24;
 var DEFAULT_MAX_EXPIRY_DAYS = 365;
@@ -2562,7 +2639,7 @@ var ShareLinkService = class {
       where: { id: input.recordId },
       fields: ["id"],
       limit: 1,
-      context: SYSTEM_CTX5
+      context: SYSTEM_CTX6
     });
     if (!Array.isArray(exists) || exists.length === 0) {
       throw makeError(404, "RECORD_NOT_FOUND", `${input.object}/${input.recordId} does not exist`);
@@ -2588,7 +2665,7 @@ var ShareLinkService = class {
       last_used_at: null,
       use_count: 0
     };
-    await this.engine.insert("sys_share_link", row, { context: SYSTEM_CTX5 });
+    await this.engine.insert("sys_share_link", row, { context: SYSTEM_CTX6 });
     return row;
   }
   async revokeLink(idOrToken, _context) {
@@ -2598,7 +2675,7 @@ var ShareLinkService = class {
       where: filter,
       fields: ["id", "revoked_at"],
       limit: 1,
-      context: SYSTEM_CTX5
+      context: SYSTEM_CTX6
     });
     const row = Array.isArray(rows) ? rows[0] : void 0;
     if (!row) return;
@@ -2606,7 +2683,7 @@ var ShareLinkService = class {
     await this.engine.update(
       "sys_share_link",
       { id: row.id, revoked_at: (/* @__PURE__ */ new Date()).toISOString() },
-      { context: SYSTEM_CTX5 }
+      { context: SYSTEM_CTX6 }
     );
   }
   async listLinks(filter, context) {
@@ -2619,7 +2696,7 @@ var ShareLinkService = class {
       where,
       limit: 200,
       sort: [{ field: "created_at", order: "desc" }],
-      context: context.isSystem ? SYSTEM_CTX5 : context
+      context: context.isSystem ? SYSTEM_CTX6 : context
     });
     return Array.isArray(rows) ? rows : [];
   }
@@ -2628,7 +2705,7 @@ var ShareLinkService = class {
     const rows = await this.engine.find("sys_share_link", {
       where: { token },
       limit: 1,
-      context: SYSTEM_CTX5
+      context: SYSTEM_CTX6
     });
     const row = Array.isArray(rows) ? rows[0] : void 0;
     if (!row) return null;
@@ -2658,7 +2735,7 @@ var ShareLinkService = class {
           last_used_at: (/* @__PURE__ */ new Date()).toISOString(),
           use_count: (row.use_count ?? 0) + 1
         },
-        { context: SYSTEM_CTX5 }
+        { context: SYSTEM_CTX6 }
       );
     } catch {
     }
@@ -2667,7 +2744,7 @@ var ShareLinkService = class {
 };
 
 // src/share-link-routes.ts
-var SYSTEM_CTX6 = { isSystem: true, roles: [], permissions: [] };
+var SYSTEM_CTX7 = { isSystem: true, roles: [], permissions: [] };
 var defaultContext = (req) => {
   const header = (name) => {
     const v = req.headers?.[name];
@@ -2768,7 +2845,7 @@ function registerShareLinkRoutes(http, service, engine, opts = {}) {
         const probe = await engine.find("sys_share_link", {
           where: { token: req.params.token },
           limit: 1,
-          context: SYSTEM_CTX6
+          context: SYSTEM_CTX7
         });
         const row = Array.isArray(probe) && probe[0] ? probe[0] : null;
         if (row && !row.revoked_at && (!row.expires_at || Date.parse(row.expires_at) > Date.now())) {
@@ -2792,7 +2869,7 @@ function registerShareLinkRoutes(http, service, engine, opts = {}) {
       const rows = await engine.find(resolved.link.object_name, {
         where: { id: resolved.link.record_id },
         limit: 1,
-        context: SYSTEM_CTX6
+        context: SYSTEM_CTX7
       });
       const record = Array.isArray(rows) && rows[0] ? rows[0] : null;
       if (!record) {
@@ -2829,12 +2906,12 @@ function registerShareLinkRoutes(http, service, engine, opts = {}) {
         sendError(res, 400, "UNSUPPORTED", "This share link does not expose messages");
         return;
       }
-      const SYSTEM_CTX8 = { isSystem: true, roles: [], permissions: [] };
+      const SYSTEM_CTX9 = { isSystem: true, roles: [], permissions: [] };
       const rows = await engine.find("ai_messages", {
         where: { conversation_id: resolved.link.record_id },
         sort: [{ field: "created_at", order: "asc" }],
         limit: 500,
-        context: SYSTEM_CTX8
+        context: SYSTEM_CTX9
       });
       res.status(200).json({ data: rows ?? [] });
     } catch (err) {
@@ -2849,7 +2926,7 @@ function registerShareLinkRoutes(http, service, engine, opts = {}) {
 }
 
 // src/rule-hooks.ts
-var SYSTEM_CTX7 = { isSystem: true, roles: [], permissions: [] };
+var SYSTEM_CTX8 = { isSystem: true, roles: [], permissions: [] };
 var SHARING_RULE_HOOK_PACKAGE = "plugin-sharing:rules";
 function bindRuleHooks(engine, service, rules, logger) {
   const objects = /* @__PURE__ */ new Set();
@@ -2864,7 +2941,7 @@ function bindRuleHooks(engine, service, rules, logger) {
         const data = ctx?.result ?? ctx?.input?.data ?? {};
         const id = String(data?.id ?? ctx?.input?.id ?? "");
         if (!id) return;
-        await service.evaluateAllForRecord(objectName, id, SYSTEM_CTX7);
+        await service.evaluateAllForRecord(objectName, id, SYSTEM_CTX8);
       } catch (err) {
         logger?.warn?.("[sharing-rule] hook evaluation failed", { object: objectName, error: err?.message });
       }