@open-mercato/documents 0.6.8-develop.7016.1.4ed7b1e49d

package/src/modules/documents/lib/platformServices.ts

@@ -0,0 +1,70 @@
+import type {
+  ApiKeyPrincipalService,
+  AuthPrincipalService,
+  OrganizationScopeService,
+} from '@open-mercato/shared/lib/auth/principal-service'
+
+export type DocumentsServiceContainer = {
+  resolve(name: string): unknown
+}
+
+export type DocumentsRbacService = {
+  userHasAllFeatures(
+    userId: string,
+    required: string[],
+    scope: { tenantId: string | null; organizationId: string | null },
+  ): Promise<boolean>
+}
+
+function tryResolve(container: DocumentsServiceContainer | null | undefined, name: string): unknown {
+  if (!container) return null
+  try {
+    return container.resolve(name)
+  } catch {
+    return null
+  }
+}
+
+export function resolveAuthPrincipalService(
+  container: DocumentsServiceContainer | null | undefined,
+): AuthPrincipalService | null {
+  const service = tryResolve(container, 'authPrincipalService') as Partial<AuthPrincipalService> | null
+  if (!service
+    || typeof service.principalExists !== 'function'
+    || typeof service.resolveActiveUserRoleIds !== 'function'
+    || typeof service.filterActiveRoleIds !== 'function'
+    || typeof service.resolveLabels !== 'function'
+    || typeof service.listSuperAdminUserIds !== 'function') return null
+  return service as AuthPrincipalService
+}
+
+export function resolveApiKeyPrincipalService(
+  container: DocumentsServiceContainer | null | undefined,
+): ApiKeyPrincipalService | null {
+  const service = tryResolve(container, 'apiKeyPrincipalService') as Partial<ApiKeyPrincipalService> | null
+  return service && typeof service.resolveAssignedRoleIds === 'function'
+    ? service as ApiKeyPrincipalService
+    : null
+}
+
+export function resolveDocumentsRbacService(
+  container: DocumentsServiceContainer | null | undefined,
+): DocumentsRbacService | null {
+  const service = tryResolve(container, 'rbacService') as Partial<DocumentsRbacService> | null
+  return service && typeof service.userHasAllFeatures === 'function'
+    ? service as DocumentsRbacService
+    : null
+}
+
+export function resolveOrganizationScopeService(
+  container: DocumentsServiceContainer | null | undefined,
+): OrganizationScopeService | null {
+  const service = tryResolve(container, 'organizationScopeService') as Partial<OrganizationScopeService> | null
+  if (!service
+    || typeof service.resolve !== 'function'
+    || typeof service.resolveFresh !== 'function'
+    || typeof service.resolveForRequest !== 'function') {
+    return null
+  }
+  return service as OrganizationScopeService
+}

package/src/modules/documents/lib/recordFieldInsertion.ts

@@ -0,0 +1,72 @@
+import type { Editor, JSONContent } from '@tiptap/core'
+import { sanitizeDocumentsDisplayLabel } from './displayLabels'
+
+export type RecordFieldSnapshot = {
+  field: string
+  label: string
+  value: string
+}
+
+export function normalizeRecordFieldSnapshots(
+  fields: readonly RecordFieldSnapshot[],
+): RecordFieldSnapshot[] {
+  const normalized = new Map<string, RecordFieldSnapshot>()
+  for (const field of fields) {
+    const key = field.field.trim()
+    const label = sanitizeDocumentsDisplayLabel(field.label)
+    const value = sanitizeDocumentsDisplayLabel(field.value)
+    if (!key || !label || !value || normalized.has(key)) continue
+    normalized.set(key, { field: key, label, value })
+  }
+  return Array.from(normalized.values())
+}
+
+function text(value: string, bold = false): JSONContent {
+  return {
+    type: 'text',
+    text: value,
+    ...(bold ? { marks: [{ type: 'bold' }] } : {}),
+  }
+}
+
+function paragraph(field: RecordFieldSnapshot): JSONContent {
+  return {
+    type: 'paragraph',
+    content: [text(field.label, true), text(`: ${field.value}`)],
+  }
+}
+
+function tableCell(value: string, bold = false): JSONContent {
+  return {
+    type: 'tableCell',
+    content: [{ type: 'paragraph', content: [text(value, bold)] }],
+  }
+}
+
+export function buildRecordFieldSnapshotContent(
+  input: readonly RecordFieldSnapshot[],
+): JSONContent[] {
+  const fields = normalizeRecordFieldSnapshots(input)
+  if (fields.length === 0) return []
+  if (fields.length === 1) return [paragraph(fields[0]!)]
+  return [
+    {
+      type: 'table',
+      content: fields.map((field) => ({
+        type: 'tableRow',
+        content: [tableCell(field.label, true), tableCell(field.value)],
+      })),
+    },
+    { type: 'paragraph' },
+  ]
+}
+
+export function insertRecordFieldSnapshot(
+  editor: Editor | null,
+  fields: readonly RecordFieldSnapshot[],
+): boolean {
+  if (!editor || editor.isDestroyed || !editor.isEditable) return false
+  const content = buildRecordFieldSnapshotContent(fields)
+  if (content.length === 0) return false
+  return editor.chain().focus().insertContent(content).run()
+}

package/src/modules/documents/lib/requestBody.ts

@@ -0,0 +1,97 @@
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import {
+  DOCUMENTS_MAX_CONTENT_HTML_BYTES,
+  DOCUMENTS_MAX_CONTENT_TEXT_BYTES,
+} from './resourceLimits'
+
+const KIBIBYTE = 1024
+const MEBIBYTE = 1024 * KIBIBYTE
+const JSON_ESCAPE_EXPANSION = 6
+const STREAM_INITIAL_CAPACITY = 64 * KIBIBYTE
+
+export const DOCUMENTS_REQUEST_BODY_TOO_LARGE = 'documents.errors.requestBodyTooLarge'
+
+/**
+ * Request-level limits are intentionally larger than the decoded field limits.
+ * JSON may encode one input byte as a six-byte `\uXXXX` escape, so content
+ * routes retain every payload accepted by their existing schemas while still
+ * bounding buffering before JSON.parse runs.
+ */
+export const DOCUMENTS_JSON_BODY_LIMITS = {
+  standard: 128 * KIBIBYTE,
+  template: 4 * MEBIBYTE,
+  templateRender: 4 * MEBIBYTE,
+  content: (
+    JSON_ESCAPE_EXPANSION
+    * (DOCUMENTS_MAX_CONTENT_HTML_BYTES + DOCUMENTS_MAX_CONTENT_TEXT_BYTES)
+  ) + (256 * KIBIBYTE),
+  exportSnapshot: (JSON_ESCAPE_EXPANSION * DOCUMENTS_MAX_CONTENT_HTML_BYTES) + (64 * KIBIBYTE),
+} as const
+
+function payloadTooLarge(): CrudHttpError {
+  return new CrudHttpError(413, { error: DOCUMENTS_REQUEST_BODY_TOO_LARGE })
+}
+
+function declaredContentLength(request: Request): number | null {
+  const value = request.headers.get('content-length')?.trim()
+  if (!value || !/^\d+$/.test(value)) return null
+  const declaredBytes = Number(value)
+  return Number.isSafeInteger(declaredBytes) ? declaredBytes : Number.POSITIVE_INFINITY
+}
+
+function growBuffer(current: Uint8Array, requiredBytes: number, maxBytes: number): Uint8Array {
+  let capacity = Math.max(1, current.byteLength)
+  while (capacity < requiredBytes) capacity = Math.min(maxBytes, capacity * 2)
+  const next = new Uint8Array(capacity)
+  next.set(current)
+  return next
+}
+
+export async function readBoundedJsonBody<T>(
+  request: Request,
+  maxBytes: number,
+  fallback: T | null = null,
+): Promise<T | null> {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new TypeError('maxBytes must be a positive safe integer')
+  }
+  const contentLength = declaredContentLength(request)
+  if (contentLength !== null && contentLength > maxBytes) {
+    await request.body?.cancel().catch(() => undefined)
+    throw payloadTooLarge()
+  }
+  if (!request.body) return fallback
+
+  const reader = request.body.getReader()
+  let buffer: Uint8Array<ArrayBufferLike> = new Uint8Array(
+    Math.min(maxBytes, STREAM_INITIAL_CAPACITY),
+  )
+  let byteLength = 0
+
+  try {
+    while (true) {
+      const chunk = await reader.read()
+      if (chunk.done) break
+      const nextByteLength = byteLength + chunk.value.byteLength
+      if (nextByteLength > maxBytes) {
+        await reader.cancel().catch(() => undefined)
+        throw payloadTooLarge()
+      }
+      if (nextByteLength > buffer.byteLength) {
+        buffer = growBuffer(buffer, nextByteLength, maxBytes)
+      }
+      buffer.set(chunk.value, byteLength)
+      byteLength = nextByteLength
+    }
+  } finally {
+    reader.releaseLock()
+  }
+
+  if (byteLength === 0) return fallback
+  const raw = new TextDecoder().decode(buffer.subarray(0, byteLength))
+  try {
+    return JSON.parse(raw) as T
+  } catch {
+    return fallback
+  }
+}

package/src/modules/documents/lib/resourceLimits.ts

@@ -0,0 +1,94 @@
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+
+const MEBIBYTE = 1024 * 1024
+
+/** Authoritative UTF-8 bounds for every stored representation of a document body. */
+export const DOCUMENTS_MAX_CONTENT_HTML_BYTES = 2 * MEBIBYTE
+export const DOCUMENTS_MAX_CONTENT_TEXT_BYTES = 2 * MEBIBYTE
+export const DOCUMENTS_MAX_YJS_STATE_BYTES = 8 * MEBIBYTE
+
+/** Bound cross-module verification and reverse-widget work per document. */
+export const DOCUMENTS_MAX_ENTITY_LINKS_PER_DOCUMENT = 100
+
+/** WebSocket messages include a small Hocuspocus/Yjs protocol envelope. */
+export const DOCUMENTS_COLLAB_MAX_PAYLOAD_BYTES = DOCUMENTS_MAX_YJS_STATE_BYTES + 64 * 1024
+
+export function utf8ByteLength(value: string): number {
+  return Buffer.byteLength(value, 'utf8')
+}
+
+export function isUtf8WithinLimit(value: string, maxBytes: number): boolean {
+  return utf8ByteLength(value) <= maxBytes
+}
+
+export function maxBase64EncodedLength(maxDecodedBytes: number): number {
+  return Math.ceil(maxDecodedBytes / 3) * 4
+}
+
+/** Validate encoded size before Buffer allocates the decoded payload. */
+export function decodeBoundedCanonicalBase64(
+  value: string,
+  maxDecodedBytes: number,
+  options: { status?: number; error?: string } = {},
+): Buffer {
+  const fail = () => {
+    throw new CrudHttpError(options.status ?? 413, {
+      error: options.error ?? 'documents.content.tooLarge',
+    })
+  }
+  if (
+    value.length > maxBase64EncodedLength(maxDecodedBytes)
+    || value.length % 4 !== 0
+    || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)
+  ) {
+    return fail()
+  }
+  const bytes = Buffer.from(value, 'base64')
+  if (bytes.byteLength > maxDecodedBytes || bytes.toString('base64') !== value) return fail()
+  return bytes
+}
+
+export type DocumentContentResourceInput = {
+  yjsState?: Buffer | Uint8Array | null
+  contentHtml?: string | null
+  contentText?: string | null
+}
+
+export function assertDocumentYjsStateByteLength(
+  byteLength: number,
+  options: { status?: number; error?: string } = {},
+): void {
+  if (byteLength <= DOCUMENTS_MAX_YJS_STATE_BYTES) return
+  throw new CrudHttpError(options.status ?? 413, {
+    error: options.error ?? 'documents.content.tooLarge',
+  })
+}
+
+/**
+ * Enforce the same bound at API, command, collaboration, and version
+ * boundaries. Keeping this check beside persistence prevents an internal or
+ * legacy call site from bypassing request validation and creating a snapshot
+ * that later exhausts the editor or export worker.
+ */
+export function assertDocumentContentResourceLimits(
+  input: DocumentContentResourceInput,
+  options: { status?: number; error?: string } = {},
+): void {
+  if (input.yjsState) assertDocumentYjsStateByteLength(input.yjsState.byteLength, options)
+  if (
+    typeof input.contentHtml === 'string'
+    && !isUtf8WithinLimit(input.contentHtml, DOCUMENTS_MAX_CONTENT_HTML_BYTES)
+  ) {
+    throw new CrudHttpError(options.status ?? 413, {
+      error: options.error ?? 'documents.content.tooLarge',
+    })
+  }
+  if (
+    typeof input.contentText === 'string'
+    && !isUtf8WithinLimit(input.contentText, DOCUMENTS_MAX_CONTENT_TEXT_BYTES)
+  ) {
+    throw new CrudHttpError(options.status ?? 413, {
+      error: options.error ?? 'documents.content.tooLarge',
+    })
+  }
+}

package/src/modules/documents/lib/shareCounts.ts

@@ -0,0 +1,44 @@
+import { raw } from '@mikro-orm/core'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { DocumentShare } from '../data/entities'
+
+export type DocumentShareCountScope = {
+  tenantId: string
+  organizationId: string
+}
+
+type GroupedShareCountRow = {
+  documentId?: unknown
+  document_id?: unknown
+  shareCount?: unknown
+  share_count?: unknown
+}
+
+export async function loadDocumentShareCounts(
+  em: EntityManager,
+  scope: DocumentShareCountScope,
+  documentIds: readonly string[],
+): Promise<Map<string, number>> {
+  const shareCounts = new Map<string, number>()
+  if (documentIds.length === 0) return shareCounts
+  const groupedShares = await em
+    .createQueryBuilder(DocumentShare, 'document_share')
+    .select([
+      'document_share.documentId',
+      raw('count(*) as "shareCount"'),
+    ])
+    .where({
+      documentId: { $in: [...documentIds] },
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      deletedAt: null,
+    })
+    .groupBy('document_share.documentId')
+    .execute<GroupedShareCountRow[]>('all', false)
+  for (const row of groupedShares) {
+    const documentId = row.documentId ?? row.document_id
+    const count = Number(row.shareCount ?? row.share_count ?? 0)
+    if (typeof documentId === 'string' && Number.isFinite(count)) shareCounts.set(documentId, count)
+  }
+  return shareCounts
+}

package/src/modules/documents/lib/templateFill.ts

@@ -0,0 +1,138 @@
+import {
+  getEntityRegistryEntry,
+  type DocumentEntityType,
+  type EntityPickerItem,
+} from './entityRegistry'
+
+export type TemplateFillSlot = {
+  slot: string
+  entityType: DocumentEntityType
+  rawItem?: Record<string, unknown> | null
+  entityId?: string
+  label?: string
+  href?: string
+  values?: Record<string, string | number | null>
+}
+
+export type FillTemplateTokensOptions = {
+  locale?: string
+  now?: Date
+}
+
+export type TemplateRenderResult = {
+  html: string
+  unresolvedTokens: string[]
+}
+
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;')
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+function replaceToken(source: string, token: string, replacement: string): string {
+  return source.replace(new RegExp(`{{\\s*${escapeRegExp(token)}\\s*}}`, 'g'), () => replacement)
+}
+
+function resolvePickerItem(slot: TemplateFillSlot): EntityPickerItem | null {
+  const entry = getEntityRegistryEntry(slot.entityType)
+  if (!entry) return null
+  if (slot.rawItem) return entry.mapItem(slot.rawItem)
+  if (!slot.entityId || !slot.label || !slot.href) return null
+  return { id: slot.entityId, label: slot.label, href: slot.href }
+}
+
+function buildEntityChip(slot: TemplateFillSlot): string | null {
+  const entry = getEntityRegistryEntry(slot.entityType)
+  const item = resolvePickerItem(slot)
+  if (!entry || !item) return null
+  const href = entry.resolveHref(item)
+  if (!href || !entry.isCanonicalHref(item, href)) return null
+
+  const escapedType = escapeHtml(slot.entityType)
+  const escapedId = escapeHtml(item.id)
+  const escapedLabel = escapeHtml(item.label)
+  const escapedHref = escapeHtml(href)
+
+  return `<span data-entity-ref data-entity-type="${escapedType}" data-entity-id="${escapedId}" data-label="${escapedLabel}" data-href="${escapedHref}" class="om-entity-ref">${escapedLabel}</span>`
+}
+
+function resolveTokenValue(
+  slot: TemplateFillSlot,
+  field: string,
+): { resolved: boolean; value: string } {
+  if (slot.values && Object.prototype.hasOwnProperty.call(slot.values, field)) {
+    const value = slot.values[field]
+    return { resolved: true, value: value == null ? '' : String(value) }
+  }
+
+  const entry = getEntityRegistryEntry(slot.entityType)
+  const tokenField = entry?.tokenFields.find((candidate) => candidate.field === field)
+  if (!tokenField || !slot.rawItem) return { resolved: false, value: '' }
+  const value = tokenField.extract(slot.rawItem)
+  return value == null ? { resolved: false, value: '' } : { resolved: true, value }
+}
+
+function collectUnresolvedTokens(html: string): string[] {
+  const tokens = new Set<string>()
+  for (const match of html.matchAll(/{{\s*([^{}]+?)\s*}}/g)) {
+    const token = match[1]?.trim()
+    if (token) tokens.add(token)
+  }
+  const withoutValidTokens = html.replace(/{{\s*[^{}]+?\s*}}/g, '')
+  if (withoutValidTokens.includes('{{') || withoutValidTokens.includes('}}')) {
+    tokens.add('invalid-token-syntax')
+  }
+  return Array.from(tokens).sort((left, right) => left < right ? -1 : left > right ? 1 : 0)
+}
+
+export function renderTemplateTokens(
+  bodyHtml: string,
+  slots: TemplateFillSlot[],
+  options: FillTemplateTokensOptions = {},
+): TemplateRenderResult {
+  const date = (options.now ?? new Date()).toLocaleDateString(options.locale, { timeZone: 'UTC' })
+  let filled = replaceToken(bodyHtml, 'date', escapeHtml(date))
+
+  for (const slot of slots) {
+    const entry = getEntityRegistryEntry(slot.entityType)
+    if (!entry) continue
+
+    const chip = buildEntityChip(slot)
+    if (chip != null) filled = replaceToken(filled, `${slot.slot}.chip`, chip)
+
+    for (const tokenField of entry.tokenFields) {
+      const resolved = resolveTokenValue(slot, tokenField.field)
+      if (!resolved.resolved) continue
+      filled = replaceToken(
+        filled,
+        `${slot.slot}.${tokenField.field}`,
+        escapeHtml(resolved.value),
+      )
+    }
+  }
+
+  const unresolvedTokens = collectUnresolvedTokens(filled)
+  const html = unresolvedTokens.includes('invalid-token-syntax')
+    ? ''
+    : filled
+        .replace(/{{\s*[^{}]+?\s*}}/g, '')
+        .replace(/ {2,}/g, ' ')
+
+  return { html, unresolvedTokens }
+}
+
+export function fillTemplateTokens(
+  bodyHtml: string,
+  slots: TemplateFillSlot[],
+  options: FillTemplateTokensOptions = {},
+): string {
+  return renderTemplateTokens(bodyHtml, slots, options).html
+}