@opengeni/documents 0.3.3 → 0.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/documents",
-  "version": "0.3.3",
+  "version": "0.4.1",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -36,10 +36,10 @@
   },
   "dependencies": {
     "@llamaindex/liteparse": "^1.5.3",
-    "@opengeni/config": "^0.10.7",
-    "@opengeni/contracts": "^0.36.0",
-    "@opengeni/db": "^0.27.0",
-    "@opengeni/storage": "^0.2.60",
+    "@opengeni/config": "^0.10.9",
+    "@opengeni/contracts": "^0.37.0",
+    "@opengeni/db": "^0.27.3",
+    "@opengeni/storage": "^0.2.62",
     "drizzle-orm": "^0.45.2",
     "openai": "6.36.0"
   }

package/src/google-drive.ts

@@ -1,8 +1,10 @@
 import type { ScopedKnowledgeScope } from "@opengeni/contracts";
-import type {
-  GoogleDriveSelectedSource,
-  GoogleDriveTargetScope,
-} from "@opengeni/contracts/google-drive";
+import {
+  connectorDestinationDocumentAuthority,
+  resolveConnectorDocumentDestination,
+  type ConnectorDocumentDestination,
+} from "@opengeni/contracts/connector-destinations";
+import type { GoogleDriveSelectedSource } from "@opengeni/contracts/google-drive";
 
 export const GOOGLE_DRIVE_PROVIDER_KEY = "google-drive" as const;
 export const GOOGLE_DRIVE_FOLDER_MIME_TYPE = "application/vnd.google-apps.folder" as const;
@@ -232,36 +234,52 @@ export class GoogleDriveInventoryProviderError extends Error {
 }
 
 export function googleDriveKnowledgeScope(
-  targetScope: GoogleDriveTargetScope,
-  workspaceId: string,
-  initiatingSubjectId: string,
+  destination: ConnectorDocumentDestination,
 ): ScopedKnowledgeScope {
-  const boundedWorkspaceId = boundedText(workspaceId, "workspaceId", 256);
-  const boundedSubjectId = boundedText(initiatingSubjectId, "initiatingSubjectId", 1024);
-  if (targetScope === "organization") {
+  const authority = connectorDestinationDocumentAuthority(destination);
+  if (authority.authorityKind === "organization") {
     return { kind: "organization", workspaceId: null, subjectId: null };
   }
-  if (targetScope === "workspace") {
-    return { kind: "workspace", workspaceId: boundedWorkspaceId, subjectId: null };
+  if (authority.authorityKind === "workspace") {
+    if (!authority.authorityWorkspaceId) {
+      throw new Error("workspace connector destination is missing workspace authority");
+    }
+    return {
+      kind: "workspace",
+      workspaceId: authority.authorityWorkspaceId,
+      subjectId: null,
+    };
+  }
+  if (!authority.authorityWorkspaceId || !authority.authoritySubjectId) {
+    throw new Error("personal connector destination is missing immutable authority");
   }
-  // Google Drive connections are workspace-bound today. Preserve that boundary
-  // for personal knowledge rather than silently widening it across workspaces.
   return {
     kind: "personal",
-    workspaceId: boundedWorkspaceId,
-    subjectId: boundedSubjectId,
+    workspaceId: authority.authorityWorkspaceId,
+    subjectId: authority.authoritySubjectId,
   };
 }
 
 export function googleDriveKnowledgeSourceIdentity(input: {
   googlePermissionId: string;
-  source: Pick<GoogleDriveSelectedSource, "id" | "driveId" | "targetScope">;
+  source: Pick<GoogleDriveSelectedSource, "id" | "driveId" | "destination" | "targetScope">;
+  accountId?: string | undefined;
   workspaceId: string;
-  initiatingSubjectId: string;
+  connectionSubjectId?: string | null | undefined;
+  /** @deprecated Used only to validate old callers while source destinations migrate. */
+  initiatingSubjectId?: string | undefined;
 }): GoogleDriveKnowledgeSourceIdentity {
   const sourceId = driveId(input.source.id, "source.id");
   const externalTenantId = normalizedGooglePermissionId(input.googlePermissionId);
   const sourceDriveId = nullableDriveId(input.source.driveId, "source.driveId");
+  const destination = resolveConnectorDocumentDestination(input.source.destination, {
+    accountId: input.accountId ?? input.workspaceId,
+    workspaceId: input.workspaceId,
+    connectionSubjectId:
+      input.connectionSubjectId !== undefined
+        ? input.connectionSubjectId
+        : (input.initiatingSubjectId ?? null),
+  });
   return {
     providerKey: GOOGLE_DRIVE_PROVIDER_KEY,
     externalTenantId,
@@ -273,11 +291,7 @@ export function googleDriveKnowledgeSourceIdentity(input: {
           ? "google-drive-shared-drive"
           : "google-drive-folder",
     sourceUri: googleDriveSourceUri(sourceId),
-    scope: googleDriveKnowledgeScope(
-      input.source.targetScope,
-      input.workspaceId,
-      input.initiatingSubjectId,
-    ),
+    scope: googleDriveKnowledgeScope(destination),
   };
 }
 
@@ -327,8 +341,11 @@ export function planGoogleDriveTransfer(
 export async function inventoryGoogleDriveSource(input: {
   googlePermissionId: string;
   source: GoogleDriveSelectedSource;
+  accountId?: string | undefined;
   workspaceId: string;
-  initiatingSubjectId: string;
+  connectionSubjectId?: string | null | undefined;
+  /** @deprecated Used only to validate old callers while source destinations migrate. */
+  initiatingSubjectId?: string | undefined;
   limits: GoogleDriveInventoryLimits;
   listChildren: GoogleDriveListChildren;
   checkpoint?: GoogleDriveInventoryCheckpoint | null;
@@ -339,8 +356,12 @@ export async function inventoryGoogleDriveSource(input: {
   const source = googleDriveKnowledgeSourceIdentity({
     googlePermissionId,
     source: input.source,
+    ...(input.accountId ? { accountId: input.accountId } : {}),
     workspaceId: input.workspaceId,
-    initiatingSubjectId: input.initiatingSubjectId,
+    ...(input.connectionSubjectId !== undefined
+      ? { connectionSubjectId: input.connectionSubjectId }
+      : {}),
+    ...(input.initiatingSubjectId ? { initiatingSubjectId: input.initiatingSubjectId } : {}),
   });
   const checkpointIdentity: GoogleDriveInventoryCheckpointIdentity = {
     googlePermissionId,

package/src/index.ts

@@ -927,7 +927,7 @@ export async function addDocumentToBase(
         )
         .limit(1);
       if (existing) {
-        if (!documentMatchesAccess(existing, input.access)) {
+        if (!documentMatchesAccess(existing, input.workspaceId, input.access)) {
           throw new Error(`Document not found: ${existing.id}`);
         }
         assertOrganizationDocumentAuthority(
@@ -1878,28 +1878,64 @@ function documentAccessConditions(
 }
 
 function documentMatchesAccess(
-  document: Pick<DocumentAccessRecord, "authorityKind" | "authoritySubjectId" | "agentAccess">,
+  document: Pick<
+    DocumentAccessRecord,
+    "authorityKind" | "authorityWorkspaceId" | "authoritySubjectId" | "agentAccess"
+  >,
+  workspaceId: string,
   access: DocumentAccessFilter | undefined,
 ): boolean {
   if (access?.agentOnly) {
-    return document.agentAccess && canViewDocument(document, access.viewerSubjectId);
+    return document.agentAccess && canViewDocument(document, access.viewerSubjectId, workspaceId);
+  }
+  return canViewDocument(document, access?.viewerSubjectId, workspaceId);
+}
+
+function canonicalDocumentAuthoritySubject(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const subjectId = cleanString(value);
+  if (!subjectId || subjectId !== value) return undefined;
+  if (new TextEncoder().encode(subjectId).byteLength > DOCUMENT_AUTHORITY_SUBJECT_MAX_BYTES) {
+    return undefined;
   }
-  return canViewDocument(document, access?.viewerSubjectId);
+  return subjectId;
 }
 
-/** Whether a single already-fetched document is readable by this human viewer. */
+/**
+ * Whether a single already-fetched document is readable in this workspace.
+ *
+ * Keep this compatibility predicate as strict as SQL/RLS: personal authority
+ * remains anchored to its originating workspace, and unknown or incomplete
+ * authority tuples deny instead of falling through as workspace-visible.
+ */
 export function canViewDocument(
-  document: Pick<DocumentAccessRecord, "authorityKind" | "authoritySubjectId">,
+  document: Pick<DocumentAccessRecord, "authorityKind" | "authoritySubjectId"> & {
+    authorityWorkspaceId?: string | null | undefined;
+  },
   viewerSubjectId: string | null | undefined,
+  workspaceId?: string | null | undefined,
 ): boolean {
-  return (
-    document.authorityKind !== "personal" ||
-    (!!viewerSubjectId && document.authoritySubjectId === viewerSubjectId)
-  );
+  if (document.authorityKind === "organization") {
+    return document.authorityWorkspaceId === null && document.authoritySubjectId === null;
+  }
+  const normalizedWorkspaceId = cleanString(workspaceId ?? null);
+  if (!normalizedWorkspaceId || document.authorityWorkspaceId !== normalizedWorkspaceId) {
+    return false;
+  }
+  if (document.authorityKind === "workspace") {
+    return document.authoritySubjectId === null;
+  }
+  if (document.authorityKind === "personal") {
+    const authoritySubjectId = canonicalDocumentAuthoritySubject(document.authoritySubjectId);
+    const viewer = canonicalDocumentAuthoritySubject(viewerSubjectId);
+    return !!authoritySubjectId && authoritySubjectId === viewer;
+  }
+  return false;
 }
 
 type DocumentAccessRecord = {
   authorityKind: string;
+  authorityWorkspaceId: string | null;
   authoritySubjectId: string | null;
   agentAccess: boolean;
 };