@open-mercato/documents 0.6.8-develop.7016.1.4ed7b1e49d

package/src/modules/documents/lib/favorites.ts

@@ -0,0 +1,35 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { DocumentFavorite } from '../data/entities'
+
+export type DocumentFavoriteScope = {
+  tenantId: string
+  organizationId: string
+  userId: string
+}
+
+export async function loadDocumentFavoriteIds(
+  em: EntityManager,
+  scope: DocumentFavoriteScope,
+  documentIds: readonly string[],
+): Promise<Set<string>> {
+  const uniqueDocumentIds = Array.from(new Set(documentIds))
+  if (uniqueDocumentIds.length === 0) return new Set()
+
+  const favorites = await findWithDecryption(em, DocumentFavorite, {
+    documentId: { $in: uniqueDocumentIds },
+    userId: scope.userId,
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    deletedAt: null,
+  }, { fields: ['documentId'] }, { tenantId: scope.tenantId, organizationId: scope.organizationId })
+  return new Set(favorites.map((favorite) => favorite.documentId))
+}
+
+export async function isDocumentFavorite(
+  em: EntityManager,
+  scope: DocumentFavoriteScope,
+  documentId: string,
+): Promise<boolean> {
+  return (await loadDocumentFavoriteIds(em, scope, [documentId])).has(documentId)
+}

package/src/modules/documents/lib/folderHierarchySerialization.ts

@@ -0,0 +1,34 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+
+const FOLDER_HIERARCHY_ADVISORY_LOCK_SQL = 'select pg_advisory_xact_lock(hashtextextended(?, 0))'
+
+type FolderHierarchyMutationScope = {
+  tenantId: string
+  organizationId: string
+}
+
+function folderHierarchyMutationLockKey(scope: FolderHierarchyMutationScope): string {
+  return `documents:folder-hierarchy:${scope.tenantId}:${scope.organizationId}`
+}
+
+/**
+ * Serialize all folder hierarchy writes inside one tenant and organization.
+ * The transaction owns the lock, so PostgreSQL releases it on commit/rollback.
+ */
+export async function acquireFolderHierarchyMutationLock(
+  em: EntityManager,
+  scope: FolderHierarchyMutationScope,
+): Promise<void> {
+  if (!em.isInTransaction()) {
+    throw new Error('[internal] Folder hierarchy mutation lock requires an active transaction')
+  }
+
+  // SqlEntityManager.execute forwards the active transaction context. Calling the
+  // bare connection here would let PostgreSQL release this xact lock immediately.
+  await em.execute(
+    FOLDER_HIERARCHY_ADVISORY_LOCK_SQL,
+    [folderHierarchyMutationLockKey(scope)],
+  )
+}
+
+export { FOLDER_HIERARCHY_ADVISORY_LOCK_SQL, folderHierarchyMutationLockKey }

package/src/modules/documents/lib/historyLimits.ts

@@ -0,0 +1,154 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { type Kysely, sql } from 'kysely'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { DocumentComment, DocumentVersion } from '../data/entities'
+import {
+  DOCUMENTS_MAX_COMMENTS_PER_DOCUMENT,
+  DOCUMENTS_MAX_VERSION_STORAGE_BYTES,
+  DOCUMENTS_MAX_VERSIONS_PER_DOCUMENT,
+} from './historyPolicy'
+
+export {
+  DOCUMENTS_COMMENT_LIST_PAGE_SIZE,
+  DOCUMENTS_MAX_COMMENTS_PER_DOCUMENT,
+  DOCUMENTS_MAX_VERSION_STORAGE_BYTES,
+  DOCUMENTS_MAX_VERSIONS_PER_DOCUMENT,
+  DOCUMENTS_VERSION_LIST_PAGE_SIZE,
+} from './historyPolicy'
+
+export type DocumentHistoryScope = {
+  tenantId: string
+  organizationId: string
+  documentId: string
+}
+
+export type StoredDocumentVersionResource = {
+  id: string
+  createdAt: Date | string
+  storageBytes: number
+}
+
+type HistoryDatabase = {
+  document_versions: {
+    id: string
+    tenant_id: string
+    organization_id: string
+    document_id: string
+    created_at: Date
+    yjs_snapshot: Buffer
+    content_html: string | null
+  }
+}
+
+export function documentVersionStorageBytes(input: {
+  yjsSnapshot: Buffer | Uint8Array
+  contentHtml?: string | null
+}): number {
+  return input.yjsSnapshot.byteLength + Buffer.byteLength(input.contentHtml ?? '', 'utf8')
+}
+
+function quotaExceeded(): never {
+  throw new CrudHttpError(413, { error: 'documents.versions.quotaExceeded' })
+}
+
+export function planDocumentVersionRetention(input: {
+  stored: StoredDocumentVersionResource[]
+  incomingStorageBytes: number
+  protectedIds?: Iterable<string>
+  maxCount?: number
+  maxStorageBytes?: number
+}): string[] {
+  const maxCount = input.maxCount ?? DOCUMENTS_MAX_VERSIONS_PER_DOCUMENT
+  const maxStorageBytes = input.maxStorageBytes ?? DOCUMENTS_MAX_VERSION_STORAGE_BYTES
+  if (
+    !Number.isSafeInteger(input.incomingStorageBytes)
+    || input.incomingStorageBytes < 0
+    || input.incomingStorageBytes > maxStorageBytes
+  ) {
+    return quotaExceeded()
+  }
+
+  const protectedIds = new Set(
+    Array.from(input.protectedIds ?? [], (id) => id.toLowerCase()),
+  )
+  const stored = [...input.stored].sort((left, right) => {
+    const timestampDifference = new Date(left.createdAt).getTime() - new Date(right.createdAt).getTime()
+    return timestampDifference || left.id.localeCompare(right.id)
+  })
+  let retainedCount = stored.length + 1
+  let retainedStorageBytes = stored.reduce((total, row) => {
+    if (!Number.isSafeInteger(row.storageBytes) || row.storageBytes < 0) return quotaExceeded()
+    const nextTotal = total + row.storageBytes
+    if (!Number.isSafeInteger(nextTotal)) return quotaExceeded()
+    return nextTotal
+  }, input.incomingStorageBytes)
+  const pruneIds: string[] = []
+
+  for (const row of stored) {
+    if (retainedCount <= maxCount && retainedStorageBytes <= maxStorageBytes) break
+    if (protectedIds.has(row.id.toLowerCase())) continue
+    pruneIds.push(row.id)
+    retainedCount -= 1
+    retainedStorageBytes -= row.storageBytes
+  }
+
+  if (retainedCount > maxCount || retainedStorageBytes > maxStorageBytes) return quotaExceeded()
+  return pruneIds
+}
+
+export async function enforceDocumentVersionRetention(
+  em: EntityManager,
+  scope: DocumentHistoryScope,
+  incoming: { yjsSnapshot: Buffer | Uint8Array; contentHtml?: string | null },
+  protectedIds: Iterable<string> = [],
+): Promise<string[]> {
+  const db = em.getKysely() as unknown as Kysely<HistoryDatabase>
+  const rows = await db
+    .selectFrom('document_versions')
+    .select(['id', 'created_at'])
+    .select(sql<number>`octet_length(${sql.ref('yjs_snapshot')}) + coalesce(octet_length(${sql.ref('content_html')}), 0)`.as('storage_bytes'))
+    .where('tenant_id', '=', scope.tenantId)
+    .where('organization_id', '=', scope.organizationId)
+    .where('document_id', '=', scope.documentId)
+    .orderBy('created_at', 'asc')
+    .orderBy('id', 'asc')
+    .execute() as Array<{ id: string; created_at: Date | string; storage_bytes: number | string }>
+
+  const stored = rows.map((row) => ({
+    id: String(row.id),
+    createdAt: row.created_at,
+    storageBytes: Number(row.storage_bytes),
+  }))
+  const pruneIds = planDocumentVersionRetention({
+    stored,
+    incomingStorageBytes: documentVersionStorageBytes(incoming),
+    protectedIds,
+  })
+  if (!pruneIds.length) return []
+
+  const deleted = await em.nativeDelete(DocumentVersion, {
+    id: { $in: pruneIds },
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    documentId: scope.documentId,
+  })
+  if (deleted !== pruneIds.length) {
+    throw new CrudHttpError(409, { error: 'Record changed by another user' })
+  }
+  return pruneIds
+}
+
+export async function assertDocumentCommentCapacity(
+  em: EntityManager,
+  scope: DocumentHistoryScope,
+): Promise<void> {
+  const count = await em.count(DocumentComment, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    documentId: scope.documentId,
+    deletedAt: null,
+  })
+  if (count >= DOCUMENTS_MAX_COMMENTS_PER_DOCUMENT) {
+    throw new CrudHttpError(413, { error: 'documents.comments.limitExceeded' })
+  }
+}

package/src/modules/documents/lib/historyPolicy.ts

@@ -0,0 +1,7 @@
+const MEBIBYTE = 1024 * 1024
+
+export const DOCUMENTS_MAX_VERSIONS_PER_DOCUMENT = 100
+export const DOCUMENTS_MAX_VERSION_STORAGE_BYTES = 256 * MEBIBYTE
+export const DOCUMENTS_VERSION_LIST_PAGE_SIZE = DOCUMENTS_MAX_VERSIONS_PER_DOCUMENT
+export const DOCUMENTS_MAX_COMMENTS_PER_DOCUMENT = 500
+export const DOCUMENTS_COMMENT_LIST_PAGE_SIZE = 100

package/src/modules/documents/lib/organizationAccess.ts

@@ -0,0 +1,44 @@
+export type DocumentsOrganizationAcl = {
+  isSuperAdmin: boolean
+  organizations: string[] | null
+}
+
+export type ResolvedDocumentsOrganizationScope = {
+  selectedId?: string | null
+  allowedIds?: string[] | null
+}
+
+function normalizeIds(values: unknown): string[] {
+  if (!Array.isArray(values)) return []
+  return Array.from(new Set(values
+    .map((value) => (typeof value === 'string' ? value.trim() : ''))
+    .filter((value) => value.length > 0)))
+}
+
+/**
+ * Validate a Documents organization decision against the raw, current ACL.
+ *
+ * The shared organization resolver intentionally falls back to the account
+ * organization when an allowlist expands to no persisted organizations. That
+ * behavior is useful for ordinary account navigation, but an authorization
+ * boundary must not let an empty or stale allowlist acquire access through
+ * that fallback. Requiring both the selected organization and at least one
+ * original grant in the expanded set preserves parent-to-child grants while
+ * failing closed for empty or unresolved grant lists.
+ */
+export function hasResolvedDocumentsOrganizationAccess(
+  acl: DocumentsOrganizationAcl,
+  organizationId: string,
+  scope?: ResolvedDocumentsOrganizationScope | null,
+): boolean {
+  if (acl.isSuperAdmin || acl.organizations === null) return true
+
+  const grants = normalizeIds(acl.organizations)
+  if (grants.includes('__all__')) return true
+  if (grants.includes(organizationId)) return true
+  if (grants.length === 0) return false
+
+  const allowedIds = normalizeIds(scope?.allowedIds)
+  return allowedIds.includes(organizationId)
+    && grants.some((grant) => allowedIds.includes(grant))
+}

package/src/modules/documents/lib/pdfHtml.ts

@@ -0,0 +1,65 @@
+const PDF_CSP = "default-src 'none'; img-src data:; style-src 'unsafe-inline'; script-src 'none'; frame-src 'none'; connect-src 'none'; base-uri 'none'; form-action 'none'"
+
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;')
+}
+
+export function buildDocumentPdfHtml(title: string, contentHtml: string): string {
+  const safeTitle = escapeHtml(title)
+  return `<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <meta http-equiv="Content-Security-Policy" content="${PDF_CSP}">
+  <title>${safeTitle}</title>
+  <style>
+    @page { size: A4; margin: 22mm 20mm; }
+    *, *::before, *::after { box-sizing: border-box; }
+    html { color: #172033; background: #fff; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; font-size: 11pt; line-height: 1.55; }
+    body { margin: 0; overflow-wrap: anywhere; }
+    .document-title { margin: 0 0 9mm; color: #111827; font-size: 25pt; font-weight: 650; line-height: 1.18; }
+    .document-content > :first-child { margin-top: 0; }
+    .document-content > :last-child { margin-bottom: 0; }
+    h1, h2, h3, h4, h5, h6 { break-after: avoid-page; color: #111827; font-weight: 650; line-height: 1.25; }
+    h1 { margin: 8mm 0 3mm; font-size: 21pt; }
+    h2 { margin: 7mm 0 2.5mm; font-size: 17pt; }
+    h3 { margin: 6mm 0 2mm; font-size: 14pt; }
+    h4, h5, h6 { margin: 5mm 0 2mm; font-size: 11.5pt; }
+    p { margin: 0 0 3.5mm; }
+    ul, ol { margin: 0 0 4mm; padding-left: 7mm; }
+    li { margin: 1mm 0; padding-left: 1mm; }
+    li > p { margin: 0; }
+    ul:has(input[type="checkbox"]) { list-style: none; padding-left: 0; }
+    ul:has(input[type="checkbox"]) li { display: flex; align-items: flex-start; gap: 2.5mm; padding-left: 0; }
+    ul:has(input[type="checkbox"]) li > label { flex: none; padding-top: 0.5mm; }
+    ul:has(input[type="checkbox"]) li > div { min-width: 0; flex: 1; }
+    input[type="checkbox"] { width: 3.5mm; height: 3.5mm; margin: 0; accent-color: #4f46e5; }
+    blockquote { margin: 5mm 0; border-left: 1.2mm solid #cbd5e1; padding: 1mm 0 1mm 5mm; color: #475569; }
+    pre { margin: 5mm 0; border: 0.25mm solid #dbe3ee; border-radius: 1.5mm; background: #f8fafc; padding: 4mm; break-inside: avoid-page; color: #172033; font: 9.5pt/1.5 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; white-space: pre-wrap; }
+    code { border-radius: 1mm; background: #f1f5f9; padding: 0.2mm 1mm; font: 0.9em ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; }
+    pre code { background: transparent; padding: 0; font: inherit; }
+    a { color: #4338ca; text-decoration: underline; text-underline-offset: 1px; }
+    span[style*="background-color"] { border-radius: 0.5mm; padding: 0 0.4mm; }
+    hr { margin: 7mm 0; border: 0; border-top: 0.25mm solid #cbd5e1; }
+    img { display: block; max-width: 100%; height: auto; margin: 5mm auto; break-inside: avoid-page; }
+    table { width: 100%; margin: 5mm 0; border-collapse: collapse; table-layout: fixed; font-size: 9.5pt; }
+    thead { display: table-header-group; }
+    tfoot { display: table-footer-group; }
+    tr { break-inside: avoid-page; }
+    th, td { border: 0.25mm solid #94a3b8; padding: 2.5mm 3mm; text-align: left; vertical-align: top; overflow-wrap: anywhere; }
+    th { background: #eef2f7; color: #111827; font-weight: 650; }
+    strong > code:only-child { background: transparent; padding: 0; font: inherit; }
+    strong > code:only-child > span:only-child { display: inline-block; max-width: 100%; border: 0.25mm solid #a5b4fc; border-radius: 1.2mm; background: #eef2ff; padding: 0.15mm 1.5mm; break-inside: avoid-page; color: #3730a3; font-weight: 600; line-height: 1.55; text-decoration: none; vertical-align: baseline; }
+  </style>
+</head>
+<body>
+  <h1 class="document-title">${safeTitle}</h1>
+  <main class="document-content">${contentHtml}</main>
+</body>
+</html>`
+}