@ossy/resources 3.4.0 → 3.5.0

package/src/resource-upload-access.spec.js

@@ -0,0 +1,100 @@
+import { beforeEach, describe, expect, it, jest } from '@jest/globals'
+
+const viewResource = jest.fn()
+const workspaceView = jest.fn()
+
+jest.unstable_mockModule('./resource-stream.helpers.js', () => ({
+  viewResource,
+}))
+
+jest.unstable_mockModule('@ossy/event-store', () => ({
+  Aggregate: {
+    Of: jest.fn(async () => ({})),
+    View: () => workspaceView,
+  },
+}))
+
+jest.unstable_mockModule('@ossy/workspaces/server', () => ({
+  Workspace: {},
+}))
+
+const {
+  resourceIdFromStorageKey,
+  assertResourceUploadAccess,
+  assertUploadAccessForStorageKey,
+} = await import('./resource-upload-access.js')
+
+describe('resourceIdFromStorageKey', () => {
+  it('returns the resource id for original keys', () => {
+    expect(resourceIdFromStorageKey('abc123')).toBe('abc123')
+  })
+
+  it('strips derivative variants', () => {
+    expect(resourceIdFromStorageKey('abc123:thumb')).toBe('abc123')
+  })
+
+  it('rejects empty keys', () => {
+    expect(() => resourceIdFromStorageKey('')).toThrow(/Invalid storage key/)
+  })
+})
+
+describe('assertResourceUploadAccess', () => {
+  beforeEach(() => {
+    workspaceView.mockReset()
+  })
+
+  it('rejects anonymous callers', async () => {
+    await expect(
+      assertResourceUploadAccess({ id: 'r1', belongsTo: 'ws1' }, { userId: 'anonymous', workspaceId: 'ws1' }),
+    ).rejects.toMatchObject({ status: 401 })
+  })
+
+  it('rejects missing workspace context', async () => {
+    await expect(
+      assertResourceUploadAccess({ id: 'r1', belongsTo: 'ws1' }, { userId: 'u1' }),
+    ).rejects.toMatchObject({ status: 403 })
+  })
+
+  it('rejects cross-workspace resources', async () => {
+    await expect(
+      assertResourceUploadAccess({ id: 'r1', belongsTo: 'ws-other' }, { userId: 'u1', workspaceId: 'ws1' }),
+    ).rejects.toMatchObject({ status: 403 })
+  })
+
+  it('rejects non-members', async () => {
+    workspaceView.mockReturnValue({ users: ['someone-else'] })
+    await expect(
+      assertResourceUploadAccess({ id: 'r1', belongsTo: 'ws1' }, { userId: 'u1', workspaceId: 'ws1' }),
+    ).rejects.toMatchObject({ status: 403 })
+  })
+
+  it('allows workspace members', async () => {
+    workspaceView.mockReturnValue({ users: ['u1', 'u2'] })
+    await expect(
+      assertResourceUploadAccess({ id: 'r1', belongsTo: 'ws1' }, { userId: 'u1', workspaceId: 'ws1' }),
+    ).resolves.toBeUndefined()
+  })
+})
+
+describe('assertUploadAccessForStorageKey', () => {
+  beforeEach(() => {
+    viewResource.mockReset()
+    workspaceView.mockReset()
+  })
+
+  it('returns 404 when the resource is missing', async () => {
+    viewResource.mockResolvedValue(null)
+    await expect(
+      assertUploadAccessForStorageKey('missing', { userId: 'u1', workspaceId: 'ws1' }),
+    ).rejects.toMatchObject({ status: 404 })
+  })
+
+  it('loads the resource and asserts membership', async () => {
+    viewResource.mockResolvedValue({ id: 'abc', belongsTo: 'ws1' })
+    workspaceView.mockReturnValue({ users: ['u1'] })
+    await expect(
+      assertUploadAccessForStorageKey('abc:thumb', { userId: 'u1', workspaceId: 'ws1' }),
+    ).resolves.toEqual({ id: 'abc', belongsTo: 'ws1' })
+    expect(viewResource).toHaveBeenCalledWith('abc')
+  })
+})

package/src/resource.helpers.js

@@ -1,3 +1,4 @@
+import { isLocalStorageUploadUrl } from '@ossy/sdk'
 import { cacheKey, normalizeLocation } from '@ossy/sdk-react'
 import { metadata as CreateResource } from './create.action.js'
 import { metadata as DeleteResource } from './delete.action.js'
@@ -7,6 +8,25 @@ import { metadata as UpdateResourceContent } from './update-content.action.js'
 import { metadata as UpdateResourceLocation } from './update-location.action.js'
 import { metadata as UpdateResourceName } from './update-name.action.js'
 
+export {
+  downloadFilenameForResource,
+  filterDownloadableResources,
+  isDirectoryResource,
+  isDownloadableResource,
+  resourceDownloadHref,
+  triggerResourceDownload,
+  triggerResourceBlobDownload,
+  triggerResourceDownloads,
+} from './resource-download.js'
+
+export {
+  applyResourceSelectionGesture,
+  idsInRange,
+  isMultiSelectGesture,
+  isRangeSelectModifier,
+  isToggleSelectModifier,
+} from './resource-selection.js'
+
 function invalidateLocation(sdk, location) {
   sdk.invalidate(cacheKey(ListResources, { location: normalizeLocation(location) }))
 }
@@ -41,11 +61,16 @@ export async function uploadFile(sdk, uploadLocation, file) {
     size: file.size,
   })
   if (resource.content?.uploadUrl) {
-    const response = await fetch(resource.content.uploadUrl, {
-      method: 'PUT',
-      headers: file.type ? { 'Content-Type': file.type } : undefined,
-      body: file,
-    })
+    const uploadUrl = resource.content.uploadUrl
+    const headers = {}
+    if (file.type) headers['Content-Type'] = file.type
+    const init = { method: 'PUT', headers, body: file }
+    if (isLocalStorageUploadUrl(uploadUrl)) {
+      init.credentials = 'include'
+      if (sdk.workspaceId) headers.workspaceId = sdk.workspaceId
+      if (sdk.authorization) headers.Authorization = sdk.authorization
+    }
+    const response = await fetch(uploadUrl, init)
     if (!response.ok) {
       throw Object.assign(
         new Error(`Upload failed: HTTP ${response.status}`),

package/src/resources.attach-reference-links.js

@@ -0,0 +1,100 @@
+import { Aggregate } from '@ossy/event-store'
+import { getPlatformSchema, schemaForWorkspace } from '@ossy/platform'
+import { Workspace } from '@ossy/workspaces/server'
+
+/**
+ * Public read path for a linked document resource.
+ *
+ * @param {string} resourceId
+ * @returns {string}
+ */
+export function documentReferenceHref(resourceId) {
+  return `/r/${resourceId}`
+}
+
+function isResourceRef(value) {
+  return (
+    value !== null &&
+    typeof value === 'object' &&
+    !Array.isArray(value) &&
+    typeof value.resourceId === 'string' &&
+    value.resourceId.trim().length > 0
+  )
+}
+
+function rewriteReferenceValue(value, max = 1) {
+  if (max === 1) {
+    if (!isResourceRef(value)) return value
+    return documentReferenceHref(value.resourceId.trim())
+  }
+  if (!Array.isArray(value)) return value
+  return value.map(item =>
+    isResourceRef(item) ? documentReferenceHref(item.resourceId.trim()) : item,
+  )
+}
+
+/**
+ * Resolve a schema engine for rewriting reference fields.
+ * Falls back to platform schemas when workspace is unavailable.
+ *
+ * @param {{ workspaceId?: string }} context
+ */
+async function resolveSchemaEngine({ workspaceId } = {}) {
+  try {
+    if (workspaceId) {
+      const workspace = await Aggregate.Of(Workspace, workspaceId).then(Aggregate.View())
+      return schemaForWorkspace(workspace?.schemas ?? [])
+    }
+    return getPlatformSchema()
+  } catch {
+    try {
+      return getPlatformSchema()
+    } catch {
+      return null
+    }
+  }
+}
+
+/**
+ * Replace stored `{ resourceId }` reference field values with public document
+ * links (`/r/{id}`) for HTTP read responses. Action `get` keeps the stored shape
+ * for editing.
+ *
+ * @param {object} resource
+ * @param {{ workspaceId?: string }} [context]
+ * @returns {Promise<object>}
+ */
+export async function attachResourceReferenceLinks(resource, { workspaceId } = {}) {
+  if (!resource?.content || typeof resource.content !== 'object') return resource
+  if (!resource.type || typeof resource.type !== 'string') return resource
+
+  const engine = await resolveSchemaEngine({ workspaceId })
+  if (!engine?.has?.(resource.type)) return resource
+
+  let definition
+  try {
+    definition = engine.resolve(resource.type)
+  } catch {
+    return resource
+  }
+
+  const fields = definition?.fields
+  if (!Array.isArray(fields) || !fields.length) return resource
+
+  let changed = false
+  const nextContent = { ...resource.content }
+
+  for (const field of fields) {
+    if (field?.type?.trim?.() !== 'reference') continue
+    const name = field.name
+    if (!name || !Object.prototype.hasOwnProperty.call(nextContent, name)) continue
+
+    const rewritten = rewriteReferenceValue(nextContent[name], field.max ?? 1)
+    if (rewritten !== nextContent[name]) {
+      nextContent[name] = rewritten
+      changed = true
+    }
+  }
+
+  return changed ? { ...resource, content: nextContent } : resource
+}

package/src/resources.attach-reference-links.spec.js

@@ -0,0 +1,118 @@
+import { describe, expect, it, jest, beforeEach, afterEach } from '@jest/globals'
+import { Schema } from '@ossy/schema'
+
+const authorSchema = {
+  id: '@ossy/blog/schema/author',
+  name: 'Author',
+  fields: [{ name: 'name', type: 'text', required: true }],
+}
+
+const postSchema = {
+  id: '@ossy/blog/schema/post',
+  name: 'Post',
+  fields: [
+    { name: 'title', type: 'text', required: true },
+    { name: 'author', type: 'reference', of: '@ossy/blog/schema/author', required: true },
+    { name: 'cover', type: 'file' },
+  ],
+}
+
+describe('attachResourceReferenceLinks', () => {
+  let attachResourceReferenceLinks
+  let documentReferenceHref
+  let getPlatformSchema
+
+  beforeEach(async () => {
+    jest.resetModules()
+    getPlatformSchema = jest.fn(() => Schema.of({ schemas: [authorSchema, postSchema] }))
+    jest.unstable_mockModule('@ossy/platform', () => ({
+      getPlatformSchema,
+      schemaForWorkspace: schemas => Schema.of({ schemas: [...schemas, authorSchema, postSchema] }),
+    }))
+    jest.unstable_mockModule('@ossy/event-store', () => ({
+      Aggregate: {
+        Of: jest.fn(),
+        View: jest.fn(),
+      },
+    }))
+    jest.unstable_mockModule('@ossy/workspaces/server', () => ({
+      Workspace: {},
+    }))
+
+    ;({
+      attachResourceReferenceLinks,
+      documentReferenceHref,
+    } = await import('./resources.attach-reference-links.js'))
+  })
+
+  afterEach(() => {
+    jest.restoreAllMocks()
+  })
+
+  it('builds document hrefs', () => {
+    expect(documentReferenceHref('abc')).toBe('/r/abc')
+  })
+
+  it('rewrites reference fields to /r/{id} links and leaves file fields alone', async () => {
+    const resource = {
+      id: 'post-1',
+      type: '@ossy/blog/schema/post',
+      content: {
+        title: 'Hello',
+        author: { resourceId: 'author-9' },
+        cover: { resourceId: 'file-3' },
+      },
+    }
+
+    const next = await attachResourceReferenceLinks(resource, {})
+    expect(next.content.author).toBe('/r/author-9')
+    expect(next.content.cover).toEqual({ resourceId: 'file-3' })
+    expect(next.content.title).toBe('Hello')
+  })
+
+  it('rewrites multi-reference arrays to /r/{id} links', async () => {
+    getPlatformSchema.mockReturnValue(
+      Schema.of({
+        schemas: [
+          authorSchema,
+          {
+            id: '@ossy/blog/schema/post',
+            name: 'Post',
+            fields: [
+              { name: 'title', type: 'text', required: true },
+              {
+                name: 'authors',
+                type: 'reference',
+                of: '@ossy/blog/schema/author',
+                max: 3,
+              },
+            ],
+          },
+        ],
+      }),
+    )
+
+    const resource = {
+      id: 'post-2',
+      type: '@ossy/blog/schema/post',
+      content: {
+        title: 'Team',
+        authors: [{ resourceId: 'a1' }, { resourceId: 'a2' }],
+      },
+    }
+
+    const next = await attachResourceReferenceLinks(resource, {})
+    expect(next.content.authors).toEqual(['/r/a1', '/r/a2'])
+  })
+
+  it('is a no-op when schema is unknown', async () => {
+    getPlatformSchema.mockReturnValue(Schema.of({ schemas: [] }))
+    const resource = {
+      id: 'post-1',
+      type: '@ossy/blog/schema/post',
+      content: { author: { resourceId: 'author-9' } },
+    }
+    const next = await attachResourceReferenceLinks(resource, {})
+    expect(next).toBe(resource)
+  })
+})

package/src/resources.validate-references.js

@@ -0,0 +1,104 @@
+import {
+  resourceIdFromValue,
+  resourceIdsFromValue,
+} from './reference-field.helpers.js'
+import { viewResource as defaultViewResource } from './resource-stream.helpers.js'
+
+/**
+ * Collect reference field lookups from validated document content.
+ *
+ * @param {object} schema
+ * @param {object} content
+ * @returns {Array<{ fieldName: string, of: string, resourceId: string, path: string }>}
+ */
+export function collectReferenceChecks(schema, content) {
+  const checks = []
+  const fields = schema?.fields
+  if (!Array.isArray(fields) || !content || typeof content !== 'object') return checks
+
+  const schemaLabel = typeof schema.id === 'string' && schema.id ? schema.id : 'schema'
+
+  for (const field of fields) {
+    if (field?.type?.trim?.() !== 'reference') continue
+    const name = field.name
+    const of = typeof field.of === 'string' ? field.of.trim() : ''
+    if (!name || !of) continue
+    if (!Object.prototype.hasOwnProperty.call(content, name)) continue
+
+    const value = content[name]
+    if (value === undefined || value === null) continue
+
+    const max = field.max ?? 1
+    const ids =
+      max === 1
+        ? (() => {
+            const id = resourceIdFromValue(value)
+            return id ? [id] : []
+          })()
+        : resourceIdsFromValue(value)
+
+    for (const resourceId of ids) {
+      checks.push({
+        fieldName: name,
+        of,
+        resourceId,
+        path: `${schemaLabel}.${name}`,
+      })
+    }
+  }
+
+  return checks
+}
+
+function isRemoved(resource) {
+  return Array.isArray(resource?.status) && resource.status.includes('removed')
+}
+
+/**
+ * Ensure every `reference` field points at an existing workspace document of
+ * the declared `of` schema id. Shape checks stay in `@ossy/schema`; this runs
+ * on the write path after sync validation.
+ *
+ * @param {object} schema
+ * @param {object} content
+ * @param {{ workspaceId?: string, viewResource?: (id: string) => Promise<object|null> }} [options]
+ */
+export async function assertResourceReferencesExist(schema, content, options = {}) {
+  const viewResource = options.viewResource ?? defaultViewResource
+  const workspaceId = options.workspaceId
+  const checks = collectReferenceChecks(schema, content)
+  if (!checks.length) return
+
+  const results = await Promise.all(
+    checks.map(async check => {
+      let resource = null
+      try {
+        resource = await viewResource(check.resourceId)
+      } catch {
+        resource = null
+      }
+      return { check, resource }
+    }),
+  )
+
+  for (const { check, resource } of results) {
+    const missing =
+      !resource?.id ||
+      isRemoved(resource) ||
+      (workspaceId && resource.belongsTo && resource.belongsTo !== workspaceId)
+
+    if (missing) {
+      throw Object.assign(
+        new Error(`${check.path} references missing resource "${check.resourceId}"`),
+        { status: 400, type: 'REFERENCE_NOT_FOUND' },
+      )
+    }
+
+    if (resource.type !== check.of) {
+      throw Object.assign(
+        new Error(`${check.path} must reference a document of type "${check.of}"`),
+        { status: 400, type: 'REFERENCE_TYPE_MISMATCH' },
+      )
+    }
+  }
+}

package/src/resources.validate-references.spec.js

@@ -0,0 +1,182 @@
+import { describe, expect, it, jest } from '@jest/globals'
+import {
+  assertResourceReferencesExist,
+  collectReferenceChecks,
+} from './resources.validate-references.js'
+
+const authorSchema = {
+  id: '@ossy/blog/schema/author',
+  name: 'Author',
+  fields: [{ name: 'name', type: 'text', required: true }],
+}
+
+const postSchema = {
+  id: '@ossy/blog/schema/post',
+  name: 'Post',
+  fields: [
+    { name: 'title', type: 'text', required: true },
+    { name: 'author', type: 'reference', of: '@ossy/blog/schema/author', required: true },
+    { name: 'related', type: 'reference', of: '@ossy/blog/schema/post', max: 3 },
+    { name: 'cover', type: 'file' },
+  ],
+}
+
+describe('collectReferenceChecks', () => {
+  it('collects single and multi reference ids and skips file fields', () => {
+    expect(
+      collectReferenceChecks(postSchema, {
+        title: 'Hello',
+        author: { resourceId: 'author-1' },
+        related: [{ resourceId: 'post-2' }, { resourceId: 'post-3' }],
+        cover: { resourceId: 'file-1' },
+      }),
+    ).toEqual([
+      {
+        fieldName: 'author',
+        of: '@ossy/blog/schema/author',
+        resourceId: 'author-1',
+        path: '@ossy/blog/schema/post.author',
+      },
+      {
+        fieldName: 'related',
+        of: '@ossy/blog/schema/post',
+        resourceId: 'post-2',
+        path: '@ossy/blog/schema/post.related',
+      },
+      {
+        fieldName: 'related',
+        of: '@ossy/blog/schema/post',
+        resourceId: 'post-3',
+        path: '@ossy/blog/schema/post.related',
+      },
+    ])
+  })
+
+  it('returns no checks when content has no reference values', () => {
+    expect(collectReferenceChecks(postSchema, { title: 'Hello' })).toEqual([])
+    expect(collectReferenceChecks(authorSchema, { name: 'Ada' })).toEqual([])
+  })
+})
+
+describe('assertResourceReferencesExist', () => {
+  it('resolves when referenced documents exist with matching type and workspace', async () => {
+    const viewResource = jest.fn(async id => {
+      if (id === 'author-1') {
+        return {
+          id: 'author-1',
+          type: '@ossy/blog/schema/author',
+          belongsTo: 'ws-1',
+        }
+      }
+      return null
+    })
+
+    await expect(
+      assertResourceReferencesExist(
+        postSchema,
+        { title: 'Hello', author: { resourceId: 'author-1' } },
+        { workspaceId: 'ws-1', viewResource },
+      ),
+    ).resolves.toBeUndefined()
+
+    expect(viewResource).toHaveBeenCalledWith('author-1')
+  })
+
+  it('rejects missing referenced resources', async () => {
+    const viewResource = jest.fn(async () => null)
+
+    await expect(
+      assertResourceReferencesExist(
+        postSchema,
+        { title: 'Hello', author: { resourceId: 'missing' } },
+        { workspaceId: 'ws-1', viewResource },
+      ),
+    ).rejects.toMatchObject({
+      status: 400,
+      type: 'REFERENCE_NOT_FOUND',
+      message: '@ossy/blog/schema/post.author references missing resource "missing"',
+    })
+  })
+
+  it('rejects deleted referenced resources', async () => {
+    const viewResource = jest.fn(async () => ({
+      status: ['removed'],
+    }))
+
+    await expect(
+      assertResourceReferencesExist(
+        postSchema,
+        { title: 'Hello', author: { resourceId: 'gone' } },
+        { viewResource },
+      ),
+    ).rejects.toMatchObject({ type: 'REFERENCE_NOT_FOUND' })
+  })
+
+  it('rejects references outside the workspace without leaking existence', async () => {
+    const viewResource = jest.fn(async () => ({
+      id: 'author-1',
+      type: '@ossy/blog/schema/author',
+      belongsTo: 'other-ws',
+    }))
+
+    await expect(
+      assertResourceReferencesExist(
+        postSchema,
+        { title: 'Hello', author: { resourceId: 'author-1' } },
+        { workspaceId: 'ws-1', viewResource },
+      ),
+    ).rejects.toMatchObject({ type: 'REFERENCE_NOT_FOUND' })
+  })
+
+  it('rejects references whose document type does not match of', async () => {
+    const viewResource = jest.fn(async () => ({
+      id: 'author-1',
+      type: '@ossy/blog/schema/post',
+      belongsTo: 'ws-1',
+    }))
+
+    await expect(
+      assertResourceReferencesExist(
+        postSchema,
+        { title: 'Hello', author: { resourceId: 'author-1' } },
+        { workspaceId: 'ws-1', viewResource },
+      ),
+    ).rejects.toMatchObject({
+      status: 400,
+      type: 'REFERENCE_TYPE_MISMATCH',
+      message: '@ossy/blog/schema/post.author must reference a document of type "@ossy/blog/schema/author"',
+    })
+  })
+
+  it('validates each id in a multi-reference field', async () => {
+    const viewResource = jest.fn(async id => {
+      if (id === 'post-2') {
+        return { id: 'post-2', type: '@ossy/blog/schema/post', belongsTo: 'ws-1' }
+      }
+      return null
+    })
+
+    await expect(
+      assertResourceReferencesExist(
+        postSchema,
+        {
+          title: 'Hello',
+          author: { resourceId: 'author-1' },
+          related: [{ resourceId: 'post-2' }, { resourceId: 'missing-post' }],
+        },
+        {
+          workspaceId: 'ws-1',
+          viewResource: async id => {
+            if (id === 'author-1') {
+              return { id: 'author-1', type: '@ossy/blog/schema/author', belongsTo: 'ws-1' }
+            }
+            return viewResource(id)
+          },
+        },
+      ),
+    ).rejects.toMatchObject({
+      type: 'REFERENCE_NOT_FOUND',
+      message: '@ossy/blog/schema/post.related references missing resource "missing-post"',
+    })
+  })
+})

package/src/schema-field-display.js

@@ -0,0 +1,12 @@
+/**
+ * Whether a schema field value should render as Markdown in detail views.
+ *
+ * @param {{ type?: string } | null | undefined} field
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function shouldRenderFieldAsMarkdown (field, value) {
+  return field?.type === 'richtext'
+    && typeof value === 'string'
+    && value.trim().length > 0
+}

package/src/server.js

@@ -3,3 +3,16 @@ export * from './resource-stream.helpers.js'
 export * from './resources.events.js'
 export * from './resources.queries.js'
 export { attachResourceMediaUrls } from './resources.attach-media-urls.js'
+export {
+  attachResourceReferenceLinks,
+  documentReferenceHref,
+} from './resources.attach-reference-links.js'
+export {
+  assertResourceUploadAccess,
+  assertUploadAccessForStorageKey,
+  resourceIdFromStorageKey,
+} from './resource-upload-access.js'
+export {
+  assertResourceReferencesExist,
+  collectReferenceChecks,
+} from './resources.validate-references.js'

package/src/sv.translations.json

@@ -45,5 +45,8 @@
   "resources.createDirectory.namePlaceholder": "Mappnamn",
   "resources.createDirectory.submit": "Skapa mapp",
   "resources.createDirectory.errorEmpty": "Mappnamn får inte vara tomt",
-  "resources.createDirectory.errorOssyPrefix": "Mappnamn får inte börja med @ossy"
+  "resources.createDirectory.errorOssyPrefix": "Mappnamn får inte börja med @ossy",
+  "resources.panel.download": "Ladda ner",
+  "@ossy/resources/schema/markdown.body.label": "Innehåll",
+  "@ossy/resources/schema/markdown.body.description": "Markdown-innehåll (rubriker, listor, länkar, kod)."
 }