@plandesk/api 0.19.0 → 1.0.0-beta.1

package/dist/services/tags.d.ts

@@ -1,9 +1,8 @@
 import { type Db } from '@plandesk/db';
-import type { EventBus } from '../events.js';
 import { type SerializedTag } from '../serialize.js';
-export type TagServiceDeps = {
+import { type OrgScopedDeps } from './org-scope.js';
+export type TagServiceDeps = OrgScopedDeps & {
     db: Db;
-    eventBus: EventBus;
 };
 export type CreateTagInput = {
     name: string;
@@ -18,10 +17,10 @@ export declare class InvalidTagError extends Error {
 }
 export declare function normalizeTagName(name: string): string;
 export declare function createTagService(deps: TagServiceDeps): {
-    list(projectId: string): SerializedTag[] | undefined;
-    create(projectId: string, input: CreateTagInput): SerializedTag | undefined;
-    update(id: string, input: UpdateTagInput): SerializedTag | undefined;
-    delete(id: string): boolean;
+    list(projectId: string): Promise<SerializedTag[] | undefined>;
+    create(projectId: string, input: CreateTagInput): Promise<SerializedTag | undefined>;
+    update(id: string, input: UpdateTagInput): Promise<SerializedTag | undefined>;
+    delete(id: string): Promise<boolean>;
 };
 export type TagService = ReturnType<typeof createTagService>;
 //# sourceMappingURL=tags.d.ts.map

package/dist/services/tags.js

@@ -1,5 +1,7 @@
 import { createTag as dbCreateTag, deleteTag as dbDeleteTag, getProject, getTag as dbGetTag, getTagByName, listTags as dbListTags, updateTag as dbUpdateTag, } from '@plandesk/db';
 import { serializeTag } from '../serialize.js';
+import { assertPermission, resolveOrgId } from './org-scope.js';
+import { assertProjectInOrg, ProjectNotInOrgError } from './scope.js';
 export class InvalidTagError extends Error {
     constructor(message) {
         super(message);
@@ -14,64 +16,74 @@ export function normalizeTagName(name) {
     return trimmed;
 }
 export function createTagService(deps) {
-    const { db, eventBus } = deps;
+    const { db } = deps;
     return {
-        list(projectId) {
-            const project = getProject(db, projectId);
-            if (!project) {
-                return undefined;
+        async list(projectId) {
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
             }
-            return dbListTags(db, projectId).map(serializeTag);
+            return (await dbListTags(db, projectId)).map(serializeTag);
         },
-        create(projectId, input) {
-            const project = getProject(db, projectId);
-            if (!project) {
-                return undefined;
+        async create(projectId, input) {
+            assertPermission(deps, 'task', 'update');
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
             }
             const name = normalizeTagName(input.name);
-            if (getTagByName(db, projectId, name)) {
+            if (await getTagByName(db, projectId, name)) {
                 throw new InvalidTagError(`Tag already exists: ${name}`);
             }
-            const tag = dbCreateTag(db, { projectId, name, color: input.color });
-            eventBus.emit({ type: 'tag_updated', projectId });
+            const tag = await dbCreateTag(db, { projectId, name, color: input.color });
             return serializeTag(tag);
         },
         // Renaming propagates everywhere automatically: tasks reference the single
         // tag row through the join table.
-        update(id, input) {
-            const existing = dbGetTag(db, id);
+        async update(id, input) {
+            assertPermission(deps, 'task', 'update');
+            const existing = await dbGetTag(db, id);
             if (!existing) {
                 return undefined;
             }
             let name;
             if (input.name !== undefined) {
                 name = normalizeTagName(input.name);
-                const conflict = getTagByName(db, existing.projectId, name);
+                const conflict = await getTagByName(db, existing.projectId, name);
                 if (conflict && conflict.id !== id) {
                     throw new InvalidTagError(`Tag already exists: ${name}`);
                 }
             }
-            const tag = dbUpdateTag(db, id, {
+            const tag = await dbUpdateTag(db, id, {
                 ...(name !== undefined ? { name } : {}),
                 ...(input.color !== undefined ? { color: input.color } : {}),
             });
             if (!tag) {
                 return undefined;
             }
-            eventBus.emit({ type: 'tag_updated', projectId: tag.projectId });
             return serializeTag(tag);
         },
         // Deleting a tag removes it from all its tasks (cascade on the join table).
-        delete(id) {
-            const existing = dbGetTag(db, id);
+        async delete(id) {
+            assertPermission(deps, 'task', 'delete');
+            const existing = await dbGetTag(db, id);
             if (!existing) {
                 return false;
             }
-            const deleted = dbDeleteTag(db, id);
+            const deleted = await dbDeleteTag(db, id);
             if (!deleted) {
                 return false;
             }
-            eventBus.emit({ type: 'tag_updated', projectId: existing.projectId });
             return true;
         },
     };

package/dist/services/tasks.d.ts

@@ -1,6 +1,6 @@
 import { type Db, type TaskStatus } from '@plandesk/db';
-import type { EventBus } from '../events.js';
 import { serializeTask, type PaginationParams } from '../serialize.js';
+import { type OrgScopedDeps } from './org-scope.js';
 type SerializedTask = ReturnType<typeof serializeTask>;
 export declare class InvalidGoalReferenceError extends Error {
     constructor(goalId: string);
@@ -14,9 +14,15 @@ export type NextActionableResult = {
         waiting_on: SerializedTask[];
     }>;
 };
-export type TaskServiceDeps = {
+export type ClaimTaskResult = {
+    claimed: true;
+    task: SerializedTask;
+} | {
+    claimed: false;
+    reason: 'taken_or_not_actionable';
+};
+export type TaskServiceDeps = OrgScopedDeps & {
     db: Db;
-    eventBus: EventBus;
 };
 export type CreateTaskInput = {
     label: string;
@@ -42,13 +48,13 @@ export type ListTasksFilter = {
     tags?: string[];
 };
 export declare function createTaskService(deps: TaskServiceDeps): {
-    get(id: string): {
+    get(id: string): Promise<{
         tags?: import("../serialize.js").SerializedTag[] | undefined;
         id: string;
         project_id: string;
         goal_id: string;
         label: string;
-        status: "scope" | "todo" | "in_progress" | "done" | "backlog";
+        status: "in_progress" | "done" | "todo" | "scope" | "backlog";
         description: string | null;
         x: number;
         y: number;
@@ -56,14 +62,14 @@ export declare function createTaskService(deps: TaskServiceDeps): {
         due_date: string | null;
         created_at: string;
         updated_at: string;
-    } | undefined;
-    listByProject(projectId: string, filter?: ListTasksFilter, pagination?: PaginationParams): {
+    } | undefined>;
+    listByProject(projectId: string, filter?: ListTasksFilter, pagination?: PaginationParams): Promise<{
         tags?: import("../serialize.js").SerializedTag[] | undefined;
         id: string;
         project_id: string;
         goal_id: string;
         label: string;
-        status: "scope" | "todo" | "in_progress" | "done" | "backlog";
+        status: "in_progress" | "done" | "todo" | "scope" | "backlog";
         description: string | null;
         x: number;
         y: number;
@@ -71,14 +77,14 @@ export declare function createTaskService(deps: TaskServiceDeps): {
         due_date: string | null;
         created_at: string;
         updated_at: string;
-    }[] | undefined;
-    create(projectId: string, input: CreateTaskInput): {
+    }[] | undefined>;
+    create(projectId: string, input: CreateTaskInput): Promise<{
         tags?: import("../serialize.js").SerializedTag[] | undefined;
         id: string;
         project_id: string;
         goal_id: string;
         label: string;
-        status: "scope" | "todo" | "in_progress" | "done" | "backlog";
+        status: "in_progress" | "done" | "todo" | "scope" | "backlog";
         description: string | null;
         x: number;
         y: number;
@@ -86,14 +92,14 @@ export declare function createTaskService(deps: TaskServiceDeps): {
         due_date: string | null;
         created_at: string;
         updated_at: string;
-    } | undefined;
-    update(id: string, input: UpdateTaskInput): {
+    } | undefined>;
+    update(id: string, input: UpdateTaskInput): Promise<{
         tags?: import("../serialize.js").SerializedTag[] | undefined;
         id: string;
         project_id: string;
         goal_id: string;
         label: string;
-        status: "scope" | "todo" | "in_progress" | "done" | "backlog";
+        status: "in_progress" | "done" | "todo" | "scope" | "backlog";
         description: string | null;
         x: number;
         y: number;
@@ -101,12 +107,13 @@ export declare function createTaskService(deps: TaskServiceDeps): {
         due_date: string | null;
         created_at: string;
         updated_at: string;
-    } | undefined;
-    delete(id: string): boolean;
+    } | undefined>;
+    delete(id: string): Promise<boolean>;
+    claim(taskId: string, agentRef: string): Promise<ClaimTaskResult>;
     nextActionable(projectId: string, filter?: {
         goalId?: string;
         tags?: string[];
-    }): NextActionableResult | undefined;
+    }): Promise<NextActionableResult | undefined>;
 };
 export type TaskService = ReturnType<typeof createTaskService>;
 export {};

package/dist/services/tasks.js

@@ -1,5 +1,7 @@
-import { createTag, createTask, deleteCommentsByTarget, deleteEdgesByTaskId, deleteTask as dbDeleteTask, deleteTaskTagsByTaskId, getOrCreateDefaultGoal, getProject, listGoals, getTagByName, getTask, InvalidTaskStatusError, isTaskStatus, listEdges, listTagsByTaskForProject, listTagsForTask, listTasks, nullDocumentsLinkedTask, setTaskTags, taskIdsWithAnyTagName, updateTask, } from '@plandesk/db';
+import { withTransaction, claimTask, createTag, createTask, deleteCommentsByTarget, deleteEdgesByTaskId, deleteTask as dbDeleteTask, deleteTaskTagsByTaskId, getOrCreateDefaultGoal, getProject, listGoals, getTagByName, getTask, InvalidTaskStatusError, isTaskStatus, listEdges, listTagsByTaskForProject, listTagsForTask, listTasks, nullDocumentsLinkedTask, setTaskTags, taskIdsWithAnyTagName, updateTask, } from '@plandesk/db';
 import { serializeTask } from '../serialize.js';
+import { assertPermission, resolveOrgId } from './org-scope.js';
+import { assertProjectInOrg, ProjectNotInOrgError } from './scope.js';
 import { normalizeTagName } from './tags.js';
 export class InvalidGoalReferenceError extends Error {
     constructor(goalId) {
@@ -18,7 +20,7 @@ function prerequisiteAndDependent(edge) {
     return { prerequisite: edge.fromTaskId, dependent: edge.toTaskId };
 }
 // Resolves tag names to ids, auto-creating tags that do not exist yet.
-function resolveTagIdsByName(db, projectId, names) {
+async function resolveTagIdsByName(db, projectId, names) {
     const seen = new Set();
     const ids = [];
     for (const raw of names) {
@@ -27,53 +29,65 @@ function resolveTagIdsByName(db, projectId, names) {
             continue;
         }
         seen.add(name);
-        const tag = getTagByName(db, projectId, name) ?? createTag(db, { projectId, name });
+        const existing = await getTagByName(db, projectId, name);
+        const tag = existing ?? (await createTag(db, { projectId, name }));
         ids.push(tag.id);
     }
     return ids;
 }
 export function createTaskService(deps) {
-    const { db, eventBus } = deps;
+    const { db } = deps;
     return {
-        get(id) {
-            const task = getTask(db, id);
+        async get(id) {
+            const task = await getTask(db, id);
             if (!task) {
                 return undefined;
             }
-            return serializeTask(task, listTagsForTask(db, id));
+            return serializeTask(task, await listTagsForTask(db, id));
         },
-        listByProject(projectId, filter = {}, pagination = {}) {
+        async listByProject(projectId, filter = {}, pagination = {}) {
             if (filter.status !== undefined && !isTaskStatus(filter.status)) {
                 throw new InvalidTaskStatusError(filter.status);
             }
-            const project = getProject(db, projectId);
-            if (!project) {
-                return undefined;
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
             }
             const statusFilter = filter.status;
-            const tasks = listTasks(db, projectId, {
+            const tasks = await listTasks(db, projectId, {
                 ...(statusFilter !== undefined ? { status: statusFilter } : {}),
                 ...(filter.tags !== undefined ? { tagNames: filter.tags.map(normalizeTagName) } : {}),
                 ...pagination,
             });
-            const tagsByTask = listTagsByTaskForProject(db, projectId);
+            const tagsByTask = await listTagsByTaskForProject(db, projectId);
             return tasks.map((task) => serializeTask(task, tagsByTask.get(task.id) ?? []));
         },
-        create(projectId, input) {
+        async create(projectId, input) {
+            assertPermission(deps, 'task', 'create');
             if (input.status !== undefined && !isTaskStatus(input.status)) {
                 throw new InvalidTaskStatusError(input.status);
             }
-            const project = getProject(db, projectId);
-            if (!project) {
-                return undefined;
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
             }
             if (input.goalId !== undefined &&
-                !listGoals(db, projectId).some((g) => g.id === input.goalId)) {
+                !(await listGoals(db, projectId)).some((g) => g.id === input.goalId)) {
                 throw new InvalidGoalReferenceError(input.goalId);
             }
-            const { task, tags } = db.transaction((tx) => {
-                const goalId = input.goalId ?? getOrCreateDefaultGoal(tx, projectId).id;
-                const row = createTask(tx, {
+            const { task, tags } = await withTransaction(db, async (tx) => {
+                const goalId = input.goalId ?? (await getOrCreateDefaultGoal(tx, projectId)).id;
+                const row = await createTask(tx, {
                     projectId,
                     goalId,
                     label: input.label,
@@ -85,73 +99,98 @@ export function createTaskService(deps) {
                     dueDate: input.dueDate,
                 });
                 if (input.tags !== undefined) {
-                    setTaskTags(tx, row.id, resolveTagIdsByName(tx, projectId, input.tags));
+                    await setTaskTags(tx, row.id, await resolveTagIdsByName(tx, projectId, input.tags));
                 }
-                return { task: row, tags: listTagsForTask(tx, row.id) };
-            });
-            eventBus.emit({
-                type: 'task_updated',
-                taskId: task.id,
-                projectId,
+                return { task: row, tags: await listTagsForTask(tx, row.id) };
             });
             return serializeTask(task, tags);
         },
-        update(id, input) {
+        async update(id, input) {
+            assertPermission(deps, 'task', 'update');
             if (input.status !== undefined && !isTaskStatus(input.status)) {
                 throw new InvalidTaskStatusError(input.status);
             }
-            const existing = getTask(db, id);
+            const existing = await getTask(db, id);
             if (!existing) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, existing.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             const { tags: tagNames, ...columns } = input;
-            const result = db.transaction((tx) => {
-                const row = updateTask(tx, id, columns);
+            const result = await withTransaction(db, async (tx) => {
+                const row = await updateTask(tx, id, columns);
                 if (!row) {
                     return undefined;
                 }
                 if (tagNames !== undefined) {
-                    setTaskTags(tx, id, resolveTagIdsByName(tx, existing.projectId, tagNames));
+                    await setTaskTags(tx, id, await resolveTagIdsByName(tx, existing.projectId, tagNames));
                 }
-                return { task: row, tags: listTagsForTask(tx, id) };
+                return { task: row, tags: await listTagsForTask(tx, id) };
             });
             if (!result) {
                 return undefined;
             }
-            eventBus.emit({
-                type: 'task_updated',
-                taskId: result.task.id,
-                projectId: result.task.projectId,
-            });
             return serializeTask(result.task, result.tags);
         },
-        delete(id) {
-            const task = getTask(db, id);
+        async delete(id) {
+            assertPermission(deps, 'task', 'delete');
+            const task = await getTask(db, id);
             if (!task) {
                 return false;
             }
+            try {
+                await assertProjectInOrg(db, task.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return false;
+                }
+                throw error;
+            }
             const projectId = task.projectId;
-            db.transaction((tx) => {
-                deleteCommentsByTarget(tx, 'task', id);
-                deleteEdgesByTaskId(tx, id);
-                nullDocumentsLinkedTask(tx, id);
-                deleteTaskTagsByTaskId(tx, id);
-                dbDeleteTask(tx, id);
+            await withTransaction(db, async (tx) => {
+                await deleteCommentsByTarget(tx, 'task', id);
+                await deleteEdgesByTaskId(tx, id);
+                await nullDocumentsLinkedTask(tx, id);
+                await deleteTaskTagsByTaskId(tx, id);
+                await dbDeleteTask(tx, id);
             });
-            eventBus.emit({ type: 'canvas_updated', projectId });
             return true;
         },
+        async claim(taskId, agentRef) {
+            assertPermission(deps, 'task', 'update');
+            const row = await claimTask(db, taskId, resolveOrgId(deps), agentRef);
+            if (!row) {
+                return { claimed: false, reason: 'taken_or_not_actionable' };
+            }
+            return {
+                claimed: true,
+                task: serializeTask(row, await listTagsForTask(db, row.id)),
+            };
+        },
         // filter.goalId scopes candidates to one goal; when omitted, the project's sole
         // active goal is resolved. filter.tags (OR semantics) composes with goal scope;
         // prerequisite completion is still evaluated against all tasks in the project.
-        nextActionable(projectId, filter = {}) {
-            const project = getProject(db, projectId);
-            if (!project) {
-                return undefined;
+        async nextActionable(projectId, filter = {}) {
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
             }
             let goalId = filter.goalId;
             if (goalId === undefined) {
-                const active = listGoals(db, projectId).filter((goal) => goal.status === 'active');
+                const active = (await listGoals(db, projectId)).filter((goal) => goal.status === 'active');
                 if (active.length === 0) {
                     return { next_task: null, reason: 'no_active_goal', blocked: [] };
                 }
@@ -160,15 +199,15 @@ export function createTaskService(deps) {
                 }
                 goalId = active[0]?.id;
             }
-            else if (!listGoals(db, projectId).some((goal) => goal.id === goalId)) {
+            else if (!(await listGoals(db, projectId)).some((goal) => goal.id === goalId)) {
                 return undefined;
             }
-            const tasks = listTasks(db, projectId).sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime());
-            const edges = listEdges(db, projectId);
+            const tasks = (await listTasks(db, projectId)).sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime());
+            const edges = await listEdges(db, projectId);
             const taskById = new Map(tasks.map((task) => [task.id, task]));
-            const tagsByTask = listTagsByTaskForProject(db, projectId);
+            const tagsByTask = await listTagsByTaskForProject(db, projectId);
             const tagMatches = filter.tags !== undefined && filter.tags.length > 0
-                ? taskIdsWithAnyTagName(db, projectId, filter.tags.map(normalizeTagName))
+                ? await taskIdsWithAnyTagName(db, projectId, filter.tags.map(normalizeTagName))
                 : undefined;
             const serialize = (task) => serializeTask(task, tagsByTask.get(task.id) ?? []);
             const prerequisites = new Map();

package/dist/services/tokens.d.ts

@@ -1,15 +1,16 @@
 import { type Db } from '@plandesk/db';
-export type TokenServiceDeps = {
+import { type OrgScopedDeps } from './org-scope.js';
+export type TokenServiceDeps = OrgScopedDeps & {
     db: Db;
 };
 export declare function createTokenService(deps: TokenServiceDeps): {
-    create(name: string): {
+    create(name: string): Promise<{
         id: string;
         name: string;
         token: string;
-    };
-    list(): import("../serialize.js").SerializedToken[];
-    revoke(id: string): import("../serialize.js").SerializedToken | undefined;
+    }>;
+    list(): Promise<import("../serialize.js").SerializedToken[]>;
+    revoke(id: string): Promise<import("../serialize.js").SerializedToken | undefined>;
 };
 export type TokenService = ReturnType<typeof createTokenService>;
 //# sourceMappingURL=tokens.d.ts.map

package/dist/services/tokens.js

@@ -1,21 +1,28 @@
 import { createToken as dbCreateToken, listTokens as dbListTokens, revokeToken as dbRevokeToken, } from '@plandesk/db';
 import { serializeToken } from '../serialize.js';
+import { assertPermission, resolveOrgId } from './org-scope.js';
 export function createTokenService(deps) {
     const { db } = deps;
     return {
-        create(name) {
-            const result = dbCreateToken(db, { name });
+        async create(name) {
+            assertPermission(deps, 'apiKey', 'create');
+            const orgId = resolveOrgId(deps);
+            const result = await dbCreateToken(db, { name, orgId });
             return {
                 id: result.id,
                 name: result.name,
                 token: result.token,
             };
         },
-        list() {
-            return dbListTokens(db).map(serializeToken);
+        async list() {
+            assertPermission(deps, 'apiKey', 'read');
+            const orgId = resolveOrgId(deps);
+            return (await dbListTokens(db, orgId)).map(serializeToken);
         },
-        revoke(id) {
-            const revoked = dbRevokeToken(db, id);
+        async revoke(id) {
+            assertPermission(deps, 'apiKey', 'delete');
+            const orgId = resolveOrgId(deps);
+            const revoked = await dbRevokeToken(db, id, orgId);
             if (!revoked) {
                 return undefined;
             }

package/dist/session.d.ts

@@ -0,0 +1,5 @@
+import type { Context } from 'hono';
+/** Portal guest session after named join (share-scoped; no org membership). */
+export declare const GUEST_SESSION_COOKIE = "plandesk_guest";
+export declare function readGuestSessionCookie(c: Context): string | undefined;
+//# sourceMappingURL=session.d.ts.map

package/dist/session.js

@@ -0,0 +1,8 @@
+import { getCookie } from 'hono/cookie';
+/** Portal guest session after named join (share-scoped; no org membership). */
+export const GUEST_SESSION_COOKIE = 'plandesk_guest';
+export function readGuestSessionCookie(c) {
+    const raw = getCookie(c, GUEST_SESSION_COOKIE);
+    return raw !== undefined && raw.length > 0 ? raw : undefined;
+}
+//# sourceMappingURL=session.js.map

package/dist/storage/local.js

@@ -1,12 +1,13 @@
 import { createHash } from 'node:crypto';
-import { createFile, getFile } from '@plandesk/db';
+import { createFile, getFile, getFileInOrg } from '@plandesk/db';
+import { tryGetAuthContext } from '../auth-context.js';
 import { fileUrl } from './adapter.js';
 export function createLocalBlobAdapter(deps) {
     const { db } = deps;
     return {
-        put(input) {
+        async put(input) {
             const id = createHash('sha256').update(input.bytes).digest('hex');
-            createFile(db, {
+            await createFile(db, {
                 id,
                 projectId: input.projectId,
                 filename: input.filename,
@@ -14,20 +15,25 @@ export function createLocalBlobAdapter(deps) {
                 size: input.bytes.length,
                 bytes: input.bytes,
             });
-            return Promise.resolve({ id, url: fileUrl(id) });
+            return { id, url: fileUrl(id) };
         },
-        resolve(id) {
-            const file = getFile(db, id);
+        async resolve(id) {
+            const auth = tryGetAuthContext();
+            const file = auth !== undefined && auth.kind !== 'guest'
+                ? await getFileInOrg(db, id, auth.orgId)
+                : // Fallback for non-request paths: content hash is not globally unique;
+                    // without org context we cannot safely resolve.
+                    undefined;
             if (!file) {
-                return Promise.resolve(null);
+                return null;
             }
             if (file.externalUrl) {
-                return Promise.resolve({ redirectUrl: file.externalUrl });
+                return { redirectUrl: file.externalUrl };
             }
             if (!file.bytes) {
-                return Promise.resolve(null);
+                return null;
             }
-            return Promise.resolve({ bytes: file.bytes, mime: file.mime, filename: file.filename });
+            return { bytes: file.bytes, mime: file.mime, filename: file.filename };
         },
     };
 }

package/dist/storage/s3.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
-import { getFile } from '@plandesk/db';
-import { fileUrl } from './adapter.js';
+import { getFileInOrg } from '@plandesk/db';
+import { tryGetAuthContext } from '../auth-context.js';
+import {} from './adapter.js';
 export function readS3ConfigFromEnv(env = process.env) {
     const bucket = env.PLANDESK_S3_BUCKET;
     const region = env.PLANDESK_S3_REGION;
@@ -25,12 +26,16 @@ export function createS3Adapter(deps) {
             const key = `${input.projectId}/${id}`;
             return Promise.reject(new Error(`s3 adapter not built: cannot PUT "${key}" to bucket "${config.bucket}"`));
         },
-        resolve(id) {
-            const file = getFile(db, id);
+        async resolve(id) {
+            const auth = tryGetAuthContext();
+            if (auth === undefined || auth.kind === 'guest') {
+                return null;
+            }
+            const file = await getFileInOrg(db, id, auth.orgId);
             if (!file?.externalUrl) {
-                return Promise.resolve(null);
+                return null;
             }
-            return Promise.resolve({ redirectUrl: file.externalUrl });
+            return { redirectUrl: file.externalUrl };
         },
     };
 }