@powerhousedao/reactor-api 6.0.0-dev.153 → 6.0.0-dev.154

package/dist/src/services/document-permission.service.js

@@ -1,791 +0,0 @@
-import { sql } from "kysely";
-/**
- * Service for managing document-level permissions.
- *
- * Permission levels for documents:
- * - READ: Can fetch and read the document
- * - WRITE: Can push updates and modify the document
- * - ADMIN: Can manage document permissions and settings
- *
- * Operation permissions:
- * - Users and groups can be granted permission to execute specific operations
- */
-export class DocumentPermissionService {
-    db;
-    config;
-    constructor(db, config = { defaultProtection: false }) {
-        this.db = db;
-        this.config = config;
-    }
-    // ============================================
-    // User Permission Operations
-    // ============================================
-    /**
-     * Get the permission level for a user on a specific document.
-     * Returns null if no permission is set.
-     */
-    async getUserPermission(documentId, userAddress) {
-        const result = await this.db
-            .selectFrom("DocumentPermission")
-            .select("permission")
-            .where("documentId", "=", documentId)
-            .where("userAddress", "=", userAddress.toLowerCase())
-            .executeTakeFirst();
-        return result?.permission ?? null;
-    }
-    /**
-     * Get all permissions for a document
-     */
-    async getDocumentPermissions(documentId) {
-        const results = await this.db
-            .selectFrom("DocumentPermission")
-            .select([
-            "documentId",
-            "userAddress",
-            "permission",
-            "grantedBy",
-            "createdAt",
-            "updatedAt",
-        ])
-            .where("documentId", "=", documentId)
-            .execute();
-        return results;
-    }
-    /**
-     * Get all documents a user has explicit access to
-     */
-    async getUserDocuments(userAddress) {
-        const results = await this.db
-            .selectFrom("DocumentPermission")
-            .select([
-            "documentId",
-            "userAddress",
-            "permission",
-            "grantedBy",
-            "createdAt",
-            "updatedAt",
-        ])
-            .where("userAddress", "=", userAddress.toLowerCase())
-            .execute();
-        return results;
-    }
-    /**
-     * Grant or update a user's permission on a document.
-     */
-    async grantPermission(documentId, userAddress, permission, grantedBy) {
-        const now = new Date();
-        const normalizedAddress = userAddress.toLowerCase();
-        await this.db
-            .insertInto("DocumentPermission")
-            .values({
-            documentId,
-            userAddress: normalizedAddress,
-            permission,
-            grantedBy: grantedBy.toLowerCase(),
-            createdAt: now,
-            updatedAt: now,
-        })
-            .onConflict((oc) => oc.columns(["documentId", "userAddress"]).doUpdateSet({
-            permission,
-            grantedBy: grantedBy.toLowerCase(),
-            updatedAt: now,
-        }))
-            .execute();
-        const result = await this.db
-            .selectFrom("DocumentPermission")
-            .select([
-            "documentId",
-            "userAddress",
-            "permission",
-            "grantedBy",
-            "createdAt",
-            "updatedAt",
-        ])
-            .where("documentId", "=", documentId)
-            .where("userAddress", "=", normalizedAddress)
-            .executeTakeFirstOrThrow();
-        return result;
-    }
-    /**
-     * Revoke a user's permission on a document
-     */
-    async revokePermission(documentId, userAddress) {
-        await this.db
-            .deleteFrom("DocumentPermission")
-            .where("documentId", "=", documentId)
-            .where("userAddress", "=", userAddress.toLowerCase())
-            .execute();
-    }
-    /**
-     * Delete all permissions for a document (used when deleting a document)
-     */
-    async deleteAllDocumentPermissions(documentId) {
-        await this.db
-            .deleteFrom("DocumentPermission")
-            .where("documentId", "=", documentId)
-            .execute();
-        await this.db
-            .deleteFrom("DocumentGroupPermission")
-            .where("documentId", "=", documentId)
-            .execute();
-        await this.db
-            .deleteFrom("OperationUserPermission")
-            .where("documentId", "=", documentId)
-            .execute();
-        await this.db
-            .deleteFrom("OperationGroupPermission")
-            .where("documentId", "=", documentId)
-            .execute();
-    }
-    // ============================================
-    // Access Control Checks
-    // ============================================
-    /**
-     * Check if a user can read a document.
-     * Returns true if user has READ, WRITE, or ADMIN permission (direct or via group)
-     */
-    async canReadDocument(documentId, userAddress) {
-        if (!userAddress) {
-            return false;
-        }
-        // Check direct user permission
-        const directPermission = await this.getUserPermission(documentId, userAddress);
-        if (directPermission !== null) {
-            return true;
-        }
-        // Check group permission
-        const groupPermission = await this.getUserGroupPermission(documentId, userAddress);
-        return groupPermission !== null;
-    }
-    /**
-     * Check if a user can write to a document.
-     * Returns true if user has WRITE or ADMIN permission (direct or via group)
-     */
-    async canWriteDocument(documentId, userAddress) {
-        if (!userAddress) {
-            return false;
-        }
-        // Check direct user permission
-        const directPermission = await this.getUserPermission(documentId, userAddress);
-        if (directPermission === "WRITE" || directPermission === "ADMIN") {
-            return true;
-        }
-        // Check group permission
-        const groupPermission = await this.getUserGroupPermission(documentId, userAddress);
-        return groupPermission === "WRITE" || groupPermission === "ADMIN";
-    }
-    /**
-     * Check if a user can manage a document (change permissions, settings).
-     * Returns true if user has ADMIN permission (direct or via group)
-     */
-    async canManageDocument(documentId, userAddress) {
-        if (!userAddress) {
-            return false;
-        }
-        // Check direct user permission
-        const directPermission = await this.getUserPermission(documentId, userAddress);
-        if (directPermission === "ADMIN") {
-            return true;
-        }
-        // Check group permission
-        const groupPermission = await this.getUserGroupPermission(documentId, userAddress);
-        return groupPermission === "ADMIN";
-    }
-    // ============================================
-    // Access Control Checks (With Parent Hierarchy)
-    // ============================================
-    /**
-     * Check if a user can read a document, including parent permission inheritance.
-     * Returns true if user has permission on the document OR any parent in the hierarchy.
-     */
-    async canRead(documentId, userAddress, getParentIds) {
-        // Check if user has direct permission on this document
-        const canReadThis = await this.canReadDocument(documentId, userAddress);
-        if (canReadThis) {
-            return true;
-        }
-        // Check if user has permission on any parent (inheritance)
-        const parentIds = await getParentIds(documentId);
-        for (const parentId of parentIds) {
-            const canReadParent = await this.canRead(parentId, userAddress, getParentIds);
-            if (canReadParent) {
-                return true;
-            }
-        }
-        return false;
-    }
-    /**
-     * Check if a user can write to a document, including parent permission inheritance.
-     * Returns true if user has write permission on the document OR any parent in the hierarchy.
-     */
-    async canWrite(documentId, userAddress, getParentIds) {
-        // Check if user has direct write permission on this document
-        const canWriteThis = await this.canWriteDocument(documentId, userAddress);
-        if (canWriteThis) {
-            return true;
-        }
-        // Check if user has write permission on any parent (inheritance)
-        const parentIds = await getParentIds(documentId);
-        for (const parentId of parentIds) {
-            const canWriteParent = await this.canWrite(parentId, userAddress, getParentIds);
-            if (canWriteParent) {
-                return true;
-            }
-        }
-        return false;
-    }
-    /**
-     * Filter a list of document IDs to only include those the user can read.
-     */
-    async filterReadableDocuments(documentIds, userAddress, getParentIds) {
-        const results = [];
-        for (const docId of documentIds) {
-            const canReadDoc = await this.canRead(docId, userAddress, getParentIds);
-            if (canReadDoc) {
-                results.push(docId);
-            }
-        }
-        return results;
-    }
-    // ============================================
-    // Group Management
-    // ============================================
-    /**
-     * Create a new group
-     */
-    async createGroup(name, description) {
-        const now = new Date();
-        await this.db
-            .insertInto("Group")
-            .values({
-            name,
-            description: description ?? null,
-            createdAt: now,
-            updatedAt: now,
-        })
-            .execute();
-        const result = await this.db
-            .selectFrom("Group")
-            .select(["id", "name", "description", "createdAt", "updatedAt"])
-            .where("name", "=", name)
-            .executeTakeFirstOrThrow();
-        return result;
-    }
-    /**
-     * Delete a group and all its associations
-     */
-    async deleteGroup(groupId) {
-        // Delete group permissions on operations
-        await this.db
-            .deleteFrom("OperationGroupPermission")
-            .where("groupId", "=", groupId)
-            .execute();
-        // Delete group document permissions
-        await this.db
-            .deleteFrom("DocumentGroupPermission")
-            .where("groupId", "=", groupId)
-            .execute();
-        // Delete user-group memberships
-        await this.db
-            .deleteFrom("UserGroup")
-            .where("groupId", "=", groupId)
-            .execute();
-        // Delete the group
-        await this.db.deleteFrom("Group").where("id", "=", groupId).execute();
-    }
-    /**
-     * Get a group by ID
-     */
-    async getGroup(groupId) {
-        const result = await this.db
-            .selectFrom("Group")
-            .select(["id", "name", "description", "createdAt", "updatedAt"])
-            .where("id", "=", groupId)
-            .executeTakeFirst();
-        return result ?? null;
-    }
-    /**
-     * List all groups
-     */
-    async listGroups() {
-        return this.db
-            .selectFrom("Group")
-            .select(["id", "name", "description", "createdAt", "updatedAt"])
-            .execute();
-    }
-    /**
-     * Add a user to a group
-     */
-    async addUserToGroup(userAddress, groupId) {
-        const now = new Date();
-        const normalizedAddress = userAddress.toLowerCase();
-        await this.db
-            .insertInto("UserGroup")
-            .values({
-            userAddress: normalizedAddress,
-            groupId,
-            createdAt: now,
-        })
-            .onConflict((oc) => oc.columns(["userAddress", "groupId"]).doNothing())
-            .execute();
-    }
-    /**
-     * Remove a user from a group
-     */
-    async removeUserFromGroup(userAddress, groupId) {
-        await this.db
-            .deleteFrom("UserGroup")
-            .where("userAddress", "=", userAddress.toLowerCase())
-            .where("groupId", "=", groupId)
-            .execute();
-    }
-    /**
-     * Get all groups a user belongs to
-     */
-    async getUserGroups(userAddress) {
-        return this.db
-            .selectFrom("UserGroup")
-            .innerJoin("Group", "Group.id", "UserGroup.groupId")
-            .select([
-            "Group.id",
-            "Group.name",
-            "Group.description",
-            "Group.createdAt",
-            "Group.updatedAt",
-        ])
-            .where("UserGroup.userAddress", "=", userAddress.toLowerCase())
-            .execute();
-    }
-    /**
-     * Get all members of a group
-     */
-    async getGroupMembers(groupId) {
-        const results = await this.db
-            .selectFrom("UserGroup")
-            .select("userAddress")
-            .where("groupId", "=", groupId)
-            .execute();
-        return results.map((r) => r.userAddress);
-    }
-    // ============================================
-    // Group Document Permissions
-    // ============================================
-    /**
-     * Grant a group permission on a document
-     */
-    async grantGroupPermission(documentId, groupId, permission, grantedBy) {
-        const now = new Date();
-        await this.db
-            .insertInto("DocumentGroupPermission")
-            .values({
-            documentId,
-            groupId,
-            permission,
-            grantedBy: grantedBy.toLowerCase(),
-            createdAt: now,
-            updatedAt: now,
-        })
-            .onConflict((oc) => oc.columns(["documentId", "groupId"]).doUpdateSet({
-            permission,
-            grantedBy: grantedBy.toLowerCase(),
-            updatedAt: now,
-        }))
-            .execute();
-        const result = await this.db
-            .selectFrom("DocumentGroupPermission")
-            .select([
-            "documentId",
-            "groupId",
-            "permission",
-            "grantedBy",
-            "createdAt",
-            "updatedAt",
-        ])
-            .where("documentId", "=", documentId)
-            .where("groupId", "=", groupId)
-            .executeTakeFirstOrThrow();
-        return result;
-    }
-    /**
-     * Revoke a group's permission on a document
-     */
-    async revokeGroupPermission(documentId, groupId) {
-        await this.db
-            .deleteFrom("DocumentGroupPermission")
-            .where("documentId", "=", documentId)
-            .where("groupId", "=", groupId)
-            .execute();
-    }
-    /**
-     * Get all group permissions for a document
-     */
-    async getDocumentGroupPermissions(documentId) {
-        return this.db
-            .selectFrom("DocumentGroupPermission")
-            .select([
-            "documentId",
-            "groupId",
-            "permission",
-            "grantedBy",
-            "createdAt",
-            "updatedAt",
-        ])
-            .where("documentId", "=", documentId)
-            .execute();
-    }
-    /**
-     * Get best permission level a user has on a document via groups
-     */
-    async getUserGroupPermission(documentId, userAddress) {
-        const result = await this.db
-            .selectFrom("DocumentGroupPermission")
-            .innerJoin("UserGroup", "UserGroup.groupId", "DocumentGroupPermission.groupId")
-            .select("DocumentGroupPermission.permission")
-            .where("DocumentGroupPermission.documentId", "=", documentId)
-            .where("UserGroup.userAddress", "=", userAddress.toLowerCase())
-            .execute();
-        if (result.length === 0) {
-            return null;
-        }
-        // Return highest permission level
-        if (result.some((r) => r.permission === "ADMIN"))
-            return "ADMIN";
-        if (result.some((r) => r.permission === "WRITE"))
-            return "WRITE";
-        return "READ";
-    }
-    // ============================================
-    // Operation Permissions
-    // ============================================
-    /**
-     * Grant a user permission to execute an operation on a document
-     */
-    async grantOperationPermission(documentId, operationType, userAddress, grantedBy) {
-        const now = new Date();
-        const normalizedAddress = userAddress.toLowerCase();
-        await this.db
-            .insertInto("OperationUserPermission")
-            .values({
-            documentId,
-            operationType,
-            userAddress: normalizedAddress,
-            grantedBy: grantedBy.toLowerCase(),
-            createdAt: now,
-        })
-            .onConflict((oc) => oc.columns(["documentId", "operationType", "userAddress"]).doNothing())
-            .execute();
-        const result = await this.db
-            .selectFrom("OperationUserPermission")
-            .select([
-            "documentId",
-            "operationType",
-            "userAddress",
-            "grantedBy",
-            "createdAt",
-        ])
-            .where("documentId", "=", documentId)
-            .where("operationType", "=", operationType)
-            .where("userAddress", "=", normalizedAddress)
-            .executeTakeFirstOrThrow();
-        return result;
-    }
-    /**
-     * Revoke a user's permission to execute an operation
-     */
-    async revokeOperationPermission(documentId, operationType, userAddress) {
-        await this.db
-            .deleteFrom("OperationUserPermission")
-            .where("documentId", "=", documentId)
-            .where("operationType", "=", operationType)
-            .where("userAddress", "=", userAddress.toLowerCase())
-            .execute();
-    }
-    /**
-     * Grant a group permission to execute an operation on a document
-     */
-    async grantGroupOperationPermission(documentId, operationType, groupId, grantedBy) {
-        const now = new Date();
-        await this.db
-            .insertInto("OperationGroupPermission")
-            .values({
-            documentId,
-            operationType,
-            groupId,
-            grantedBy: grantedBy.toLowerCase(),
-            createdAt: now,
-        })
-            .onConflict((oc) => oc.columns(["documentId", "operationType", "groupId"]).doNothing())
-            .execute();
-        const result = await this.db
-            .selectFrom("OperationGroupPermission")
-            .select([
-            "documentId",
-            "operationType",
-            "groupId",
-            "grantedBy",
-            "createdAt",
-        ])
-            .where("documentId", "=", documentId)
-            .where("operationType", "=", operationType)
-            .where("groupId", "=", groupId)
-            .executeTakeFirstOrThrow();
-        return result;
-    }
-    /**
-     * Revoke a group's permission to execute an operation
-     */
-    async revokeGroupOperationPermission(documentId, operationType, groupId) {
-        await this.db
-            .deleteFrom("OperationGroupPermission")
-            .where("documentId", "=", documentId)
-            .where("operationType", "=", operationType)
-            .where("groupId", "=", groupId)
-            .execute();
-    }
-    /**
-     * Get all users with permission to execute an operation
-     */
-    async getOperationUserPermissions(documentId, operationType) {
-        return this.db
-            .selectFrom("OperationUserPermission")
-            .select([
-            "documentId",
-            "operationType",
-            "userAddress",
-            "grantedBy",
-            "createdAt",
-        ])
-            .where("documentId", "=", documentId)
-            .where("operationType", "=", operationType)
-            .execute();
-    }
-    /**
-     * Get all groups with permission to execute an operation
-     */
-    async getOperationGroupPermissions(documentId, operationType) {
-        return this.db
-            .selectFrom("OperationGroupPermission")
-            .select([
-            "documentId",
-            "operationType",
-            "groupId",
-            "grantedBy",
-            "createdAt",
-        ])
-            .where("documentId", "=", documentId)
-            .where("operationType", "=", operationType)
-            .execute();
-    }
-    /**
-     * Check if a user can execute a specific operation on a document.
-     * Returns true if user has direct permission or is in a group with permission.
-     */
-    async canExecuteOperation(documentId, operationType, userAddress) {
-        if (!userAddress) {
-            return false;
-        }
-        const normalizedAddress = userAddress.toLowerCase();
-        // Check direct user permission
-        const userPermission = await this.db
-            .selectFrom("OperationUserPermission")
-            .select("userAddress")
-            .where("documentId", "=", documentId)
-            .where("operationType", "=", operationType)
-            .where("userAddress", "=", normalizedAddress)
-            .executeTakeFirst();
-        if (userPermission) {
-            return true;
-        }
-        // Check group permission
-        const groupPermission = await this.db
-            .selectFrom("OperationGroupPermission")
-            .innerJoin("UserGroup", "UserGroup.groupId", "OperationGroupPermission.groupId")
-            .select("OperationGroupPermission.groupId")
-            .where("OperationGroupPermission.documentId", "=", documentId)
-            .where("OperationGroupPermission.operationType", "=", operationType)
-            .where("UserGroup.userAddress", "=", normalizedAddress)
-            .executeTakeFirst();
-        return !!groupPermission;
-    }
-    /**
-     * Check if an operation has any permissions set (is restricted)
-     */
-    async isOperationRestricted(documentId, operationType) {
-        const userPermCount = await this.db
-            .selectFrom("OperationUserPermission")
-            .select(sql `count(*)`.as("count"))
-            .where("documentId", "=", documentId)
-            .where("operationType", "=", operationType)
-            .executeTakeFirst();
-        if (userPermCount && Number(userPermCount.count) > 0) {
-            return true;
-        }
-        const groupPermCount = await this.db
-            .selectFrom("OperationGroupPermission")
-            .select(sql `count(*)`.as("count"))
-            .where("documentId", "=", documentId)
-            .where("operationType", "=", operationType)
-            .executeTakeFirst();
-        return groupPermCount !== undefined && Number(groupPermCount.count) > 0;
-    }
-    // ============================================
-    // Document Protection
-    // ============================================
-    /**
-     * Check if a specific document has a protection row set to true.
-     * Falls back to `config.defaultProtection` if no row exists.
-     */
-    async isDocumentProtected(documentId) {
-        const row = await this.db
-            .selectFrom("DocumentProtection")
-            .select("protected")
-            .where("documentId", "=", documentId)
-            .executeTakeFirst();
-        if (row === undefined) {
-            return this.config.defaultProtection;
-        }
-        return row.protected;
-    }
-    /**
-     * Walk the parent chain: if the document itself or any ancestor is protected, return true.
-     * Collects all ancestor IDs first (with cycle detection), then batch-checks protection.
-     */
-    async isProtectedWithAncestors(documentId, getParentIds) {
-        // Collect all IDs in the hierarchy (document + all ancestors)
-        const allIds = await this.collectAncestorIds(documentId, getParentIds);
-        // Batch-check protection for all IDs at once
-        if (allIds.length === 0) {
-            return this.config.defaultProtection;
-        }
-        const rows = await this.db
-            .selectFrom("DocumentProtection")
-            .select(["documentId", "protected"])
-            .where("documentId", "in", allIds)
-            .execute();
-        const protectionMap = new Map(rows.map((r) => [r.documentId, r.protected]));
-        for (const id of allIds) {
-            const isProtected = protectionMap.get(id);
-            // If no row exists, fall back to defaultProtection
-            if (isProtected ?? this.config.defaultProtection) {
-                return true;
-            }
-        }
-        return false;
-    }
-    /**
-     * Collect all ancestor IDs (including the document itself) with cycle detection.
-     */
-    async collectAncestorIds(documentId, getParentIds) {
-        const visited = new Set();
-        const queue = [documentId];
-        while (queue.length > 0) {
-            const current = queue.shift();
-            if (visited.has(current))
-                continue;
-            visited.add(current);
-            const parentIds = await getParentIds(current);
-            for (const parentId of parentIds) {
-                if (!visited.has(parentId)) {
-                    queue.push(parentId);
-                }
-            }
-        }
-        return Array.from(visited);
-    }
-    /**
-     * Upsert protection status for a document.
-     */
-    async setDocumentProtection(documentId, isProtected) {
-        const now = new Date();
-        await this.db
-            .insertInto("DocumentProtection")
-            .values({
-            documentId,
-            protected: isProtected,
-            ownerAddress: null,
-            createdAt: now,
-            updatedAt: now,
-        })
-            .onConflict((oc) => oc.column("documentId").doUpdateSet({
-            protected: isProtected,
-            updatedAt: now,
-        }))
-            .execute();
-    }
-    /**
-     * Get the owner address for a document, or null if not set.
-     */
-    async getDocumentOwner(documentId) {
-        const row = await this.db
-            .selectFrom("DocumentProtection")
-            .select("ownerAddress")
-            .where("documentId", "=", documentId)
-            .executeTakeFirst();
-        return row?.ownerAddress ?? null;
-    }
-    /**
-     * Upsert owner address for a document.
-     */
-    async setDocumentOwner(documentId, ownerAddress) {
-        const now = new Date();
-        const normalizedAddress = ownerAddress.toLowerCase();
-        await this.db
-            .insertInto("DocumentProtection")
-            .values({
-            documentId,
-            protected: this.config.defaultProtection,
-            ownerAddress: normalizedAddress,
-            createdAt: now,
-            updatedAt: now,
-        })
-            .onConflict((oc) => oc.column("documentId").doUpdateSet({
-            ownerAddress: normalizedAddress,
-            updatedAt: now,
-        }))
-            .execute();
-    }
-    /**
-     * Initialize protection for a newly created document.
-     * Sets protection status and grants ADMIN to the owner.
-     */
-    async initializeDocumentProtection(documentId, ownerAddress, defaultProtection) {
-        const now = new Date();
-        const normalizedAddress = ownerAddress.toLowerCase();
-        const isProtected = defaultProtection ?? this.config.defaultProtection;
-        await this.db
-            .insertInto("DocumentProtection")
-            .values({
-            documentId,
-            protected: isProtected,
-            ownerAddress: normalizedAddress,
-            createdAt: now,
-            updatedAt: now,
-        })
-            .onConflict((oc) => oc.column("documentId").doUpdateSet({
-            ownerAddress: normalizedAddress,
-            updatedAt: now,
-        }))
-            .execute();
-        // Grant ADMIN permission to the owner
-        await this.grantPermission(documentId, normalizedAddress, "ADMIN", normalizedAddress);
-    }
-    /**
-     * Get the full protection info for a document.
-     */
-    async getDocumentProtection(documentId) {
-        const row = await this.db
-            .selectFrom("DocumentProtection")
-            .select(["documentId", "protected", "ownerAddress"])
-            .where("documentId", "=", documentId)
-            .executeTakeFirst();
-        if (!row) {
-            return {
-                documentId,
-                protected: this.config.defaultProtection,
-                ownerAddress: null,
-            };
-        }
-        return row;
-    }
-}
-//# sourceMappingURL=document-permission.service.js.map