@plandesk/api 0.20.0 → 1.0.0-beta.2

package/dist/services/projects.js

@@ -1,5 +1,7 @@
-import { clearDocumentParentRefsByProject, clearFolderParentRefsByProject, createDocument, createEdge, createProject as dbCreateProject, createTask, deleteAgentRun, deleteAgentRunEventsByRunId, deleteCommentsByProjectId, deleteDocumentsByProjectId, deleteFoldersByProjectId, deleteNotesByProjectId, deleteEdgesByProjectId, deleteGoalsByProjectId, deleteShareSubmissionsByProjectId, deleteSharesByProjectId, deleteTagsByProjectId, deleteSyncRemoteByProjectId, deleteSyncStateByProjectId, deleteProject as dbDeleteProject, deleteTasksByProjectId, getOrCreateDefaultGoal, getProject as dbGetProject, InvalidTaskStatusError, isTaskStatus, listAgentRuns, listProjects as dbListProjects, listTasks, updateProject as dbUpdateProject, } from '@plandesk/db';
+import { withTransaction, clearDocumentParentRefsByProject, clearFolderParentRefsByProject, createDocument, createEdge, createProject as dbCreateProject, createTask, deleteAgentRun, deleteAgentRunEventsByRunId, deleteCommentsByProjectId, deleteDocumentsByProjectId, deleteFoldersByProjectId, deleteNotesByProjectId, deleteEdgesByProjectId, deleteGoalsByProjectId, deleteShareSubmissionsByProjectId, deleteSharesByProjectId, deleteTagsByProjectId, deleteSyncRemoteByProjectId, deleteSyncStateByProjectId, deleteProject as dbDeleteProject, deleteTasksByProjectId, getOrCreateDefaultGoal, getProject as dbGetProject, InvalidTaskStatusError, isTaskStatus, listAgentRuns, listProjects as dbListProjects, listTasks, updateProject as dbUpdateProject, } from '@plandesk/db';
 import { emptyTaskStatusSummary, serializeDocument, serializeEdge, serializeProject, serializeProjectDetail, serializeTask, } from '../serialize.js';
+import { assertPermission, resolveOrgId } from './org-scope.js';
+import { assertProjectInOrg, ProjectNotInOrgError } from './scope.js';
 export class InvalidScaffoldError extends Error {
     constructor(message) {
         super(message);
@@ -48,80 +50,113 @@ function summarizeTasks(tasks) {
     return summary;
 }
 export function createProjectService(deps) {
-    const { db, eventBus } = deps;
+    const { db } = deps;
     return {
-        create(input) {
-            const project = dbCreateProject(db, input);
+        async create(input) {
+            assertPermission(deps, 'project', 'create');
+            const orgId = resolveOrgId(deps);
+            const project = await dbCreateProject(db, { ...input, orgId });
             return serializeProject(project);
         },
-        list(pagination = {}) {
-            return dbListProjects(db, pagination).map(serializeProject);
+        async list(pagination = {}) {
+            const orgId = resolveOrgId(deps);
+            return (await dbListProjects(db, orgId, pagination)).map(serializeProject);
         },
-        get(id) {
-            const project = dbGetProject(db, id);
-            if (!project) {
-                return undefined;
+        async get(id) {
+            const orgId = resolveOrgId(deps);
+            try {
+                const project = await assertProjectInOrg(db, id, orgId);
+                const summary = summarizeTasks(await listTasks(db, id));
+                return serializeProjectDetail(project, summary);
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
             }
-            const summary = summarizeTasks(listTasks(db, id));
-            return serializeProjectDetail(project, summary);
         },
-        update(id, input) {
-            const project = dbUpdateProject(db, id, input);
+        async update(id, input) {
+            assertPermission(deps, 'task', 'update');
+            const orgId = resolveOrgId(deps);
+            try {
+                await assertProjectInOrg(db, id, orgId);
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
+            const project = await dbUpdateProject(db, id, input);
             if (!project) {
                 return undefined;
             }
             return serializeProject(project);
         },
-        delete(id) {
-            const project = dbGetProject(db, id);
-            if (!project) {
-                return false;
+        async delete(id) {
+            assertPermission(deps, 'project', 'delete');
+            const orgId = resolveOrgId(deps);
+            try {
+                await assertProjectInOrg(db, id, orgId);
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return false;
+                }
+                throw error;
             }
-            db.transaction((tx) => {
-                const runs = listAgentRuns(tx, id);
+            await withTransaction(db, async (tx) => {
+                const runs = await listAgentRuns(tx, id);
                 for (const run of runs) {
-                    deleteAgentRunEventsByRunId(tx, run.id);
+                    await deleteAgentRunEventsByRunId(tx, run.id);
                 }
                 for (const run of runs) {
-                    deleteAgentRun(tx, run.id);
+                    await deleteAgentRun(tx, run.id);
                 }
-                deleteEdgesByProjectId(tx, id);
-                clearDocumentParentRefsByProject(tx, id);
-                deleteCommentsByProjectId(tx, id);
-                deleteDocumentsByProjectId(tx, id);
-                clearFolderParentRefsByProject(tx, id);
-                deleteFoldersByProjectId(tx, id);
-                deleteNotesByProjectId(tx, id);
-                deleteTagsByProjectId(tx, id);
-                deleteTasksByProjectId(tx, id);
-                deleteGoalsByProjectId(tx, id);
-                deleteShareSubmissionsByProjectId(tx, id);
-                deleteSyncStateByProjectId(tx, id);
-                deleteSyncRemoteByProjectId(tx, id);
-                deleteSharesByProjectId(tx, id);
-                dbDeleteProject(tx, id);
+                await deleteEdgesByProjectId(tx, id);
+                await clearDocumentParentRefsByProject(tx, id);
+                await deleteCommentsByProjectId(tx, id);
+                await deleteDocumentsByProjectId(tx, id);
+                await clearFolderParentRefsByProject(tx, id);
+                await deleteFoldersByProjectId(tx, id);
+                await deleteNotesByProjectId(tx, id);
+                await deleteTagsByProjectId(tx, id);
+                await deleteTasksByProjectId(tx, id);
+                await deleteGoalsByProjectId(tx, id);
+                await deleteShareSubmissionsByProjectId(tx, id);
+                await deleteSyncStateByProjectId(tx, id);
+                await deleteSyncRemoteByProjectId(tx, id);
+                await deleteSharesByProjectId(tx, id);
+                await dbDeleteProject(tx, id);
             });
-            eventBus.emit({ type: 'canvas_updated', projectId: id });
             return true;
         },
-        scaffoldFromPlan(input) {
+        async scaffoldFromPlan(input) {
+            // New project needs manager; adding plan content to an existing project needs editor.
+            assertPermission(deps, input.projectId === undefined ? 'project' : 'task', input.projectId === undefined ? 'create' : 'create');
             validateScaffoldInput(input);
+            const orgId = resolveOrgId(deps);
             const taskRows = [];
             const edgeRows = [];
             const documentRows = [];
             const keyToId = new Map();
             let projectId = '';
-            db.transaction((tx) => {
-                // Row offset so tasks scaffolded INTO a non-empty project are laid out
-                // below its existing nodes instead of stacking on top of them.
+            await withTransaction(db, async (tx) => {
                 let startRow = 0;
                 if (input.projectId !== undefined) {
-                    const existing = dbGetProject(tx, input.projectId);
-                    if (!existing) {
-                        throw new InvalidScaffoldError(`project not found: ${input.projectId}`);
+                    let existing;
+                    try {
+                        existing = await assertProjectInOrg(tx, input.projectId, orgId);
+                    }
+                    catch (error) {
+                        if (error instanceof ProjectNotInOrgError) {
+                            throw new InvalidScaffoldError(`project not found: ${input.projectId}`);
+                        }
+                        throw error;
                     }
                     projectId = existing.id;
-                    const existingTasks = listTasks(tx, existing.id);
+                    const existingTasks = await listTasks(tx, existing.id);
                     if (existingTasks.length > 0) {
                         const maxY = existingTasks.reduce((m, t) => Math.max(m, t.y ?? 0), 0);
                         startRow = Math.floor(maxY / 160) + 1;
@@ -131,17 +166,18 @@ export function createProjectService(deps) {
                     if (input.name === undefined || input.name.trim() === '') {
                         throw new InvalidScaffoldError('name is required to create a new project (or pass projectId to add to an existing one)');
                     }
-                    const project = dbCreateProject(tx, {
+                    const project = await dbCreateProject(tx, {
                         name: input.name,
                         description: input.description,
+                        orgId,
                     });
                     projectId = project.id;
                 }
-                const defaultGoal = getOrCreateDefaultGoal(tx, projectId);
-                input.tasks.forEach((taskInput, i) => {
+                const defaultGoal = await getOrCreateDefaultGoal(tx, projectId);
+                for (const [i, taskInput] of input.tasks.entries()) {
                     const x = taskInput.x ?? (i % 4) * 240;
                     const y = taskInput.y ?? (startRow + Math.floor(i / 4)) * 160;
-                    const task = createTask(tx, {
+                    const task = await createTask(tx, {
                         projectId,
                         goalId: defaultGoal.id,
                         label: taskInput.label,
@@ -152,14 +188,14 @@ export function createProjectService(deps) {
                     });
                     keyToId.set(taskInput.key, task.id);
                     taskRows.push(task);
-                });
+                }
                 for (const edgeInput of input.edges ?? []) {
                     const fromTaskId = keyToId.get(edgeInput.from);
                     const toTaskId = keyToId.get(edgeInput.to);
                     if (fromTaskId === undefined || toTaskId === undefined) {
                         throw new InvalidScaffoldError('edge references unknown task key');
                     }
-                    const edge = createEdge(tx, {
+                    const edge = await createEdge(tx, {
                         projectId,
                         fromTaskId,
                         toTaskId,
@@ -170,7 +206,7 @@ export function createProjectService(deps) {
                 }
                 for (const docInput of input.documents ?? []) {
                     const linkedTaskId = docInput.linkTo !== undefined ? keyToId.get(docInput.linkTo) : undefined;
-                    const document = createDocument(tx, {
+                    const document = await createDocument(tx, {
                         projectId,
                         title: docInput.title,
                         body: docInput.body,
@@ -180,11 +216,7 @@ export function createProjectService(deps) {
                     documentRows.push(document);
                 }
             });
-            eventBus.emit({ type: 'canvas_updated', projectId });
-            for (const doc of documentRows) {
-                eventBus.emit({ type: 'document_created', documentId: doc.id, projectId });
-            }
-            const project = dbGetProject(db, projectId);
+            const project = await dbGetProject(db, projectId);
             if (!project) {
                 throw new Error('scaffolded project missing after transaction');
             }

package/dist/services/scope.d.ts

@@ -0,0 +1,12 @@
+import { type DbClient, type Project } from '@plandesk/db';
+/** Thrown when a project is missing or belongs to another org. Maps to HTTP 404. */
+export declare class ProjectNotInOrgError extends Error {
+    constructor(projectId: string);
+}
+/**
+ * Fail-closed tenant boundary: project must exist and belong to orgId.
+ * Returns 404-shaped error (not 403) so existence is not leaked across orgs.
+ * BA5: agent keys may also carry projectId — wrong project is the same 404.
+ */
+export declare function assertProjectInOrg(db: DbClient, projectId: string, orgId: string): Promise<Project>;
+//# sourceMappingURL=scope.d.ts.map

package/dist/services/scope.js

@@ -0,0 +1,29 @@
+import { getProjectInOrg } from '@plandesk/db';
+import { tryGetAuthContext } from '../auth-context.js';
+/** Thrown when a project is missing or belongs to another org. Maps to HTTP 404. */
+export class ProjectNotInOrgError extends Error {
+    constructor(projectId) {
+        super(`Project not found: ${projectId}`);
+        this.name = 'ProjectNotInOrgError';
+    }
+}
+/**
+ * Fail-closed tenant boundary: project must exist and belong to orgId.
+ * Returns 404-shaped error (not 403) so existence is not leaked across orgs.
+ * BA5: agent keys may also carry projectId — wrong project is the same 404.
+ */
+export async function assertProjectInOrg(db, projectId, orgId) {
+    const project = await getProjectInOrg(db, projectId, orgId);
+    if (!project) {
+        throw new ProjectNotInOrgError(projectId);
+    }
+    const ctx = tryGetAuthContext();
+    if (ctx !== undefined &&
+        ctx.kind === 'apikey' &&
+        ctx.projectId !== undefined &&
+        ctx.projectId !== projectId) {
+        throw new ProjectNotInOrgError(projectId);
+    }
+    return project;
+}
+//# sourceMappingURL=scope.js.map

package/dist/services/share.d.ts

@@ -1,12 +1,11 @@
 import { type Db, type Share, type ShareMode, type SharePermissions } from '@plandesk/db';
-import type { EventBus } from '../events.js';
 import { type ClientView, type SharePolicy } from '../projection.js';
+import { type OrgScopedDeps } from './org-scope.js';
 export declare class InvalidShareError extends Error {
     constructor(message: string);
 }
-export type ShareServiceDeps = {
+export type ShareServiceDeps = OrgScopedDeps & {
     db: Db;
-    eventBus: EventBus;
 };
 export type SerializedShare = {
     id: string;
@@ -53,16 +52,81 @@ export type ResourceMarkdownResult = {
 } | {
     status: 'gone';
 };
+export type ShareMetaResult = {
+    status: 'ok';
+    audienceName: string;
+    mode: ShareMode;
+} | {
+    status: 'not_found';
+};
+export type JoinShareInput = {
+    name: string;
+    email?: string;
+};
+export type JoinShareResult = {
+    status: 'ok';
+    sessionToken: string;
+    participant: {
+        id: string;
+        name: string;
+    };
+    share: {
+        audienceName: string;
+        permissions: SharePermissions;
+    };
+} | {
+    status: 'unauthorized';
+} | {
+    status: 'name_required';
+} | {
+    status: 'email_not_invited';
+};
+export type GuestSubmission = {
+    id: string;
+    title: string;
+    severity: string | null;
+    status: string;
+    created_at: string;
+};
+export type SubmitIssueInput = {
+    title: string;
+    body?: string;
+    severity?: string;
+    task_ref?: string;
+};
+export type SubmitIssueResult = {
+    status: 'ok';
+    submission: GuestSubmission;
+} | {
+    status: 'unauthorized';
+} | {
+    status: 'submit_not_permitted';
+} | {
+    status: 'title_required';
+} | {
+    status: 'rate_limited';
+};
+export type ListMySubmissionsResult = {
+    status: 'ok';
+    submissions: GuestSubmission[];
+} | {
+    status: 'unauthorized';
+};
 export declare function createShareService(deps: ShareServiceDeps): {
-    createShare(projectId: string, input: CreateShareInput): {
+    createShare(projectId: string, input: CreateShareInput): Promise<{
         share: SerializedShare;
         token: string;
-    } | undefined;
-    listShares(projectId: string): SerializedShare[] | undefined;
-    revokeShare(id: string): boolean;
-    buildClientView(projectId: string, shareId: string): ClientView | undefined;
-    createResourceShare(input: CreateResourceShareInput, origin: string): ResourceShareResult | undefined;
-    getResourceMarkdown(token: string, origin: string): ResourceMarkdownResult;
+    } | undefined>;
+    listShares(projectId: string): Promise<SerializedShare[] | undefined>;
+    revokeShare(id: string): Promise<boolean>;
+    buildClientView(projectId: string, shareId: string): Promise<ClientView | undefined>;
+    createResourceShare(input: CreateResourceShareInput, origin: string): Promise<ResourceShareResult | undefined>;
+    getResourceMarkdown(token: string, origin: string): Promise<ResourceMarkdownResult>;
+    getShareMeta(token: string): Promise<ShareMetaResult>;
+    joinShare(token: string, input: JoinShareInput): Promise<JoinShareResult>;
+    getClientView(token: string): Promise<ClientView | undefined>;
+    submitIssue(token: string, input: SubmitIssueInput): Promise<SubmitIssueResult>;
+    listMySubmissions(token: string): Promise<ListMySubmissionsResult>;
 };
 export type ShareService = ReturnType<typeof createShareService>;
 //# sourceMappingURL=share.d.ts.map