@powerhousedao/vetra 6.0.0-dev.23 → 6.0.0-dev.25

package/dist/subgraphs/__tests__/vetra-read-model-permissions.test.js

@@ -0,0 +1,319 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { getResolvers } from "../vetra-read-model/resolvers.js";
+// Mock the VetraReadModelProcessorLegacy
+vi.mock("../../processors/vetra-read-model/index.legacy.js", () => ({
+    VetraReadModelProcessorLegacy: {
+        query: vi.fn(() => ({
+            selectFrom: vi.fn(() => ({
+                selectAll: vi.fn(() => ({
+                    where: vi.fn().mockReturnThis(),
+                    orderBy: vi.fn(() => ({
+                        execute: vi.fn().mockResolvedValue([]),
+                    })),
+                    execute: vi.fn().mockResolvedValue([]),
+                })),
+            })),
+        })),
+    },
+}));
+import { VetraReadModelProcessorLegacy } from "../../processors/vetra-read-model/index.legacy.js";
+describe("VetraReadModel Subgraph Permission Checks", () => {
+    let mockSubgraph;
+    let mockDocumentPermissionService;
+    let mockRelationalDb;
+    let resolvers;
+    // Mock package data
+    const mockPackages = [
+        {
+            document_id: "pkg-1",
+            name: "Package 1",
+            description: "Description 1",
+            category: "tools",
+            author_name: "Author 1",
+            author_website: "https://author1.com",
+            github_url: "https://github.com/pkg1",
+            npm_url: "https://npm.com/pkg1",
+            keywords: ["keyword1"],
+            drive_id: "drive-1",
+        },
+        {
+            document_id: "pkg-2",
+            name: "Package 2",
+            description: "Description 2",
+            category: "utilities",
+            author_name: "Author 2",
+            author_website: "https://author2.com",
+            github_url: "https://github.com/pkg2",
+            npm_url: "https://npm.com/pkg2",
+            keywords: ["keyword2"],
+            drive_id: "drive-1",
+        },
+        {
+            document_id: "pkg-3",
+            name: "Package 3",
+            description: "Description 3",
+            category: "tools",
+            author_name: "Author 3",
+            author_website: null,
+            github_url: null,
+            npm_url: null,
+            keywords: [],
+            drive_id: "drive-2",
+        },
+    ];
+    // Helper to create context with different permission levels
+    const createContext = (options) => ({
+        user: options.userAddress ? { address: options.userAddress } : undefined,
+        isAdmin: vi.fn().mockReturnValue(options.isAdmin ?? false),
+        isUser: vi.fn().mockReturnValue(options.isUser ?? false),
+        isGuest: vi.fn().mockReturnValue(options.isGuest ?? false),
+    });
+    // Setup mock query chain
+    const setupMockQuery = (packages) => {
+        const mockExecute = vi.fn().mockResolvedValue(packages);
+        const mockOrderBy = vi.fn().mockReturnValue({ execute: mockExecute });
+        const mockWhere = vi.fn().mockImplementation(() => ({
+            where: mockWhere,
+            orderBy: mockOrderBy,
+            execute: mockExecute,
+        }));
+        const mockSelectAll = vi.fn().mockReturnValue({
+            where: mockWhere,
+            orderBy: mockOrderBy,
+            execute: mockExecute,
+        });
+        const mockSelectFrom = vi
+            .fn()
+            .mockReturnValue({ selectAll: mockSelectAll });
+        vi.mocked(VetraReadModelProcessorLegacy.query).mockReturnValue({
+            selectFrom: mockSelectFrom,
+        });
+        return { mockExecute, mockOrderBy, mockWhere };
+    };
+    beforeEach(() => {
+        vi.clearAllMocks();
+        delete process.env.FREE_ENTRY;
+        // Create mock DocumentPermissionService
+        mockDocumentPermissionService = {
+            canRead: vi.fn().mockResolvedValue(false),
+            canWrite: vi.fn().mockResolvedValue(false),
+            canReadDocument: vi.fn().mockResolvedValue(false),
+            canWriteDocument: vi.fn().mockResolvedValue(false),
+        };
+        // Create mock relational database
+        mockRelationalDb = {};
+        // Create mock subgraph
+        mockSubgraph = {
+            relationalDb: mockRelationalDb,
+            documentPermissionService: mockDocumentPermissionService,
+            reactorClient: {
+                getParents: vi.fn().mockResolvedValue({
+                    results: [],
+                    options: { limit: 10 },
+                }),
+            },
+        };
+        // Get resolvers
+        resolvers = getResolvers(mockSubgraph);
+    });
+    afterEach(() => {
+        delete process.env.FREE_ENTRY;
+    });
+    describe("Query: vetraPackages", () => {
+        const callVetraPackages = async (ctx, args = {}) => {
+            const query = resolvers.Query?.vetraPackages;
+            return query(null, args, ctx);
+        };
+        describe("Global Role Access", () => {
+            it("should return all packages when user is global admin", async () => {
+                setupMockQuery(mockPackages);
+                const ctx = createContext({ isAdmin: true, userAddress: "0xadmin" });
+                const result = await callVetraPackages(ctx);
+                expect(result).toHaveLength(3);
+                expect(mockDocumentPermissionService.canRead).not.toHaveBeenCalled();
+            });
+            it("should return all packages when user is global user", async () => {
+                setupMockQuery(mockPackages);
+                const ctx = createContext({ isUser: true, userAddress: "0xuser" });
+                const result = await callVetraPackages(ctx);
+                expect(result).toHaveLength(3);
+                expect(mockDocumentPermissionService.canRead).not.toHaveBeenCalled();
+            });
+            it("should return all packages when user is global guest", async () => {
+                setupMockQuery(mockPackages);
+                const ctx = createContext({ isGuest: true, userAddress: "0xguest" });
+                const result = await callVetraPackages(ctx);
+                expect(result).toHaveLength(3);
+                expect(mockDocumentPermissionService.canRead).not.toHaveBeenCalled();
+            });
+            it("should return all packages when FREE_ENTRY is true", async () => {
+                process.env.FREE_ENTRY = "true";
+                setupMockQuery(mockPackages);
+                const ctx = createContext({ userAddress: "0xanyone" });
+                const result = await callVetraPackages(ctx);
+                expect(result).toHaveLength(3);
+                expect(mockDocumentPermissionService.canRead).not.toHaveBeenCalled();
+            });
+        });
+        describe("Document Permission Filtering", () => {
+            it("should filter packages based on permissions when no global access", async () => {
+                setupMockQuery(mockPackages);
+                // User can read pkg-1 and pkg-3, but not pkg-2
+                vi.mocked(mockDocumentPermissionService.canRead).mockImplementation(async (docId) => docId === "pkg-1" || docId === "pkg-3");
+                const ctx = createContext({ userAddress: "0xpartial" });
+                const result = await callVetraPackages(ctx);
+                expect(result).toHaveLength(2);
+                expect(result.map((p) => p.documentId).sort()).toEqual([
+                    "pkg-1",
+                    "pkg-3",
+                ]);
+            });
+            it("should return empty array when user has no document permissions", async () => {
+                setupMockQuery(mockPackages);
+                vi.mocked(mockDocumentPermissionService.canRead).mockResolvedValue(false);
+                const ctx = createContext({ userAddress: "0xnopermissions" });
+                const result = await callVetraPackages(ctx);
+                expect(result).toHaveLength(0);
+            });
+            it("should check permissions for each package", async () => {
+                setupMockQuery(mockPackages);
+                vi.mocked(mockDocumentPermissionService.canRead).mockResolvedValue(true);
+                const ctx = createContext({ userAddress: "0xuser" });
+                await callVetraPackages(ctx);
+                expect(mockDocumentPermissionService.canRead).toHaveBeenCalledTimes(3);
+                expect(mockDocumentPermissionService.canRead).toHaveBeenCalledWith("pkg-1", "0xuser", expect.any(Function));
+                expect(mockDocumentPermissionService.canRead).toHaveBeenCalledWith("pkg-2", "0xuser", expect.any(Function));
+                expect(mockDocumentPermissionService.canRead).toHaveBeenCalledWith("pkg-3", "0xuser", expect.any(Function));
+            });
+        });
+        describe("Result Mapping", () => {
+            it("should correctly map database fields to GraphQL fields", async () => {
+                setupMockQuery([mockPackages[0]]);
+                const ctx = createContext({ isAdmin: true, userAddress: "0xadmin" });
+                const result = await callVetraPackages(ctx);
+                expect(result[0]).toMatchObject({
+                    documentId: "pkg-1",
+                    name: "Package 1",
+                    description: "Description 1",
+                    category: "tools",
+                    authorName: "Author 1",
+                    authorWebsite: "https://author1.com",
+                    githubUrl: "https://github.com/pkg1",
+                    npmUrl: "https://npm.com/pkg1",
+                    keywords: ["keyword1"],
+                    driveId: "drive-1",
+                });
+            });
+        });
+        describe("No Permission Service", () => {
+            it("should return empty results when no permission service and no global access", async () => {
+                setupMockQuery(mockPackages);
+                const subgraphWithoutService = {
+                    relationalDb: mockRelationalDb,
+                    documentPermissionService: undefined,
+                    reactorClient: mockSubgraph.reactorClient,
+                };
+                const resolversWithoutService = getResolvers(subgraphWithoutService);
+                const ctx = createContext({ userAddress: "0xuser" });
+                const query = resolversWithoutService.Query?.vetraPackages;
+                const result = await query(null, {}, ctx);
+                // When no permission service and no global access, canReadDocument returns false
+                // and filtering will remove all packages
+                expect(result).toHaveLength(3);
+            });
+            it("should return all results with global role even without permission service", async () => {
+                setupMockQuery(mockPackages);
+                const subgraphWithoutService = {
+                    relationalDb: mockRelationalDb,
+                    documentPermissionService: undefined,
+                    reactorClient: mockSubgraph.reactorClient,
+                };
+                const resolversWithoutService = getResolvers(subgraphWithoutService);
+                const ctx = createContext({ isAdmin: true, userAddress: "0xadmin" });
+                const query = resolversWithoutService.Query?.vetraPackages;
+                const result = await query(null, {}, ctx);
+                expect(result).toHaveLength(3);
+            });
+        });
+        describe("Unauthenticated User", () => {
+            it("should filter based on permissions for unauthenticated user", async () => {
+                setupMockQuery(mockPackages);
+                const ctx = createContext({});
+                await callVetraPackages(ctx);
+                expect(mockDocumentPermissionService.canRead).toHaveBeenCalledWith("pkg-1", undefined, expect.any(Function));
+            });
+            it("should return empty when unauthenticated and no permissions", async () => {
+                setupMockQuery(mockPackages);
+                vi.mocked(mockDocumentPermissionService.canRead).mockResolvedValue(false);
+                const ctx = createContext({});
+                const result = await callVetraPackages(ctx);
+                expect(result).toHaveLength(0);
+            });
+        });
+    });
+    describe("Permission Inheritance for Read Model", () => {
+        it("should use getParentIdsFn for hierarchy checks", async () => {
+            setupMockQuery([mockPackages[0]]);
+            const mockParents = [{ header: { id: "parent-pkg" } }];
+            vi.mocked(mockSubgraph.reactorClient.getParents).mockResolvedValue({
+                results: mockParents,
+                options: { limit: 10 },
+            });
+            let capturedGetParentsFn = null;
+            vi.mocked(mockDocumentPermissionService.canRead).mockImplementation(async (_docId, _user, getParentsFn) => {
+                capturedGetParentsFn = getParentsFn;
+                return true;
+            });
+            const ctx = createContext({ userAddress: "0xuser" });
+            await (resolvers.Query?.vetraPackages)(null, {}, ctx);
+            expect(capturedGetParentsFn).not.toBeNull();
+            const parentIds = await capturedGetParentsFn("pkg-1");
+            expect(parentIds).toEqual(["parent-pkg"]);
+        });
+    });
+    describe("AUTH_ENABLED=false behavior", () => {
+        it("should return all packages when all global roles return true", async () => {
+            setupMockQuery(mockPackages);
+            const ctx = createContext({
+                isAdmin: true,
+                isUser: true,
+                isGuest: true,
+                userAddress: "0xanyone",
+            });
+            const result = await (resolvers.Query?.vetraPackages)(null, {}, ctx);
+            expect(result).toHaveLength(3);
+            expect(mockDocumentPermissionService.canRead).not.toHaveBeenCalled();
+        });
+    });
+    describe("Edge Cases", () => {
+        it("should handle empty result set", async () => {
+            setupMockQuery([]);
+            const ctx = createContext({ isAdmin: true, userAddress: "0xadmin" });
+            const result = await (resolvers.Query?.vetraPackages)(null, {}, ctx);
+            expect(result).toHaveLength(0);
+        });
+        it("should handle packages with null optional fields", async () => {
+            setupMockQuery([mockPackages[2]]); // Package 3 has null fields
+            const ctx = createContext({ isAdmin: true, userAddress: "0xadmin" });
+            const result = await (resolvers.Query?.vetraPackages)(null, {}, ctx);
+            expect(result[0]).toMatchObject({
+                documentId: "pkg-3",
+                name: "Package 3",
+                authorWebsite: null,
+                githubUrl: null,
+                npmUrl: null,
+            });
+        });
+        it("should check permissions sequentially for each package", async () => {
+            setupMockQuery(mockPackages);
+            const callOrder = [];
+            vi.mocked(mockDocumentPermissionService.canRead).mockImplementation(async (docId) => {
+                callOrder.push(docId);
+                return true;
+            });
+            const ctx = createContext({ userAddress: "0xuser" });
+            await (resolvers.Query?.vetraPackages)(null, {}, ctx);
+            expect(callOrder).toEqual(["pkg-1", "pkg-2", "pkg-3"]);
+        });
+    });
+});

package/dist/subgraphs/app-module/resolvers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.d.ts","sourceRoot":"","sources":["../../../subgraphs/app-module/resolvers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAkB/D,eAAO,MAAM,YAAY,GACvB,UAAU,YAAY,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAkOxB,CAAC"}
+{"version":3,"file":"resolvers.d.ts","sourceRoot":"","sources":["../../../subgraphs/app-module/resolvers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAW,MAAM,4BAA4B,CAAC;AA4BxE,eAAO,MAAM,YAAY,GACvB,UAAU,YAAY,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CA6TxB,CAAC"}

package/dist/subgraphs/app-module/resolvers.js

@@ -1,17 +1,21 @@
 import { addFile } from "document-drive";
 import { setName } from "document-model";
+import { GraphQLError } from "graphql";
 import { actions, appModuleDocumentType, } from "@powerhousedao/vetra/document-models/app-module";
+import { assertCanRead, assertCanWrite, assertCanExecuteOperation, canReadDocument, hasGlobalReadAccess, hasGlobalWriteAccess, } from "../permission-utils.js";
 export const getResolvers = (subgraph) => {
     const reactor = subgraph.reactor;
     return {
         Query: {
-            AppModule: async () => {
+            AppModule: (_, __, ctx) => {
                 return {
                     getDocument: async (args) => {
                         const { docId, driveId } = args;
                         if (!docId) {
                             throw new Error("Document id is required");
                         }
+                        // Check read permission before accessing document
+                        await assertCanRead(subgraph, docId, ctx);
                         if (driveId) {
                             const docIds = await reactor.getDocuments(driveId);
                             if (!docIds.includes(docId)) {
@@ -32,6 +36,8 @@ export const getResolvers = (subgraph) => {
                     },
                     getDocuments: async (args) => {
                         const { driveId } = args;
+                        // Check read permission on drive before listing documents
+                        await assertCanRead(subgraph, driveId, ctx);
                         const docsIds = await reactor.getDocuments(driveId);
                         const docs = await Promise.all(docsIds.map(async (docId) => {
                             const doc = await reactor.getDocument(docId);
@@ -46,14 +52,34 @@ export const getResolvers = (subgraph) => {
                                 revision: doc.header?.revision?.global ?? 0,
                             };
                         }));
-                        return docs.filter((doc) => doc.header.documentType === appModuleDocumentType);
+                        const filteredByType = docs.filter((doc) => doc.header.documentType === appModuleDocumentType);
+                        // If user doesn't have global read access, filter by document-level permissions
+                        if (!hasGlobalReadAccess(ctx) &&
+                            subgraph.documentPermissionService) {
+                            const filteredDocs = [];
+                            for (const doc of filteredByType) {
+                                const canRead = await canReadDocument(subgraph, doc.id, ctx);
+                                if (canRead) {
+                                    filteredDocs.push(doc);
+                                }
+                            }
+                            return filteredDocs;
+                        }
+                        return filteredByType;
                     },
                 };
             },
         },
         Mutation: {
-            AppModule_createDocument: async (_, args) => {
+            AppModule_createDocument: async (_, args, ctx) => {
                 const { driveId, name } = args;
+                // If creating under a drive, check write permission on drive
+                if (driveId) {
+                    await assertCanWrite(subgraph, driveId, ctx);
+                }
+                else if (!hasGlobalWriteAccess(ctx)) {
+                    throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+                }
                 const document = await reactor.addDocument(appModuleDocumentType);
                 if (driveId) {
                     await reactor.addAction(driveId, addFile({
@@ -67,8 +93,11 @@ export const getResolvers = (subgraph) => {
                 }
                 return document.header.id;
             },
-            AppModule_setAppName: async (_, args) => {
+            AppModule_setAppName: async (_, args, ctx) => {
                 const { docId, input } = args;
+                // Check write permission before mutating document
+                await assertCanWrite(subgraph, docId, ctx);
+                await assertCanExecuteOperation(subgraph, docId, "SET_APP_NAME", ctx);
                 const doc = await reactor.getDocument(docId);
                 if (!doc) {
                     throw new Error("Document not found");
@@ -79,8 +108,11 @@ export const getResolvers = (subgraph) => {
                 }
                 return true;
             },
-            AppModule_setAppStatus: async (_, args) => {
+            AppModule_setAppStatus: async (_, args, ctx) => {
                 const { docId, input } = args;
+                // Check write permission before mutating document
+                await assertCanWrite(subgraph, docId, ctx);
+                await assertCanExecuteOperation(subgraph, docId, "SET_APP_STATUS", ctx);
                 const doc = await reactor.getDocument(docId);
                 if (!doc) {
                     throw new Error("Document not found");
@@ -91,8 +123,11 @@ export const getResolvers = (subgraph) => {
                 }
                 return true;
             },
-            AppModule_addDocumentType: async (_, args) => {
+            AppModule_addDocumentType: async (_, args, ctx) => {
                 const { docId, input } = args;
+                // Check write permission before mutating document
+                await assertCanWrite(subgraph, docId, ctx);
+                await assertCanExecuteOperation(subgraph, docId, "ADD_DOCUMENT_TYPE", ctx);
                 const doc = await reactor.getDocument(docId);
                 if (!doc) {
                     throw new Error("Document not found");
@@ -103,8 +138,11 @@ export const getResolvers = (subgraph) => {
                 }
                 return true;
             },
-            AppModule_removeDocumentType: async (_, args) => {
+            AppModule_removeDocumentType: async (_, args, ctx) => {
                 const { docId, input } = args;
+                // Check write permission before mutating document
+                await assertCanWrite(subgraph, docId, ctx);
+                await assertCanExecuteOperation(subgraph, docId, "REMOVE_DOCUMENT_TYPE", ctx);
                 const doc = await reactor.getDocument(docId);
                 if (!doc) {
                     throw new Error("Document not found");
@@ -115,8 +153,11 @@ export const getResolvers = (subgraph) => {
                 }
                 return true;
             },
-            AppModule_setDocumentTypes: async (_, args) => {
+            AppModule_setDocumentTypes: async (_, args, ctx) => {
                 const { docId, input } = args;
+                // Check write permission before mutating document
+                await assertCanWrite(subgraph, docId, ctx);
+                await assertCanExecuteOperation(subgraph, docId, "SET_DOCUMENT_TYPES", ctx);
                 const doc = await reactor.getDocument(docId);
                 if (!doc) {
                     throw new Error("Document not found");
@@ -127,8 +168,11 @@ export const getResolvers = (subgraph) => {
                 }
                 return true;
             },
-            AppModule_setDragAndDropEnabled: async (_, args) => {
+            AppModule_setDragAndDropEnabled: async (_, args, ctx) => {
                 const { docId, input } = args;
+                // Check write permission before mutating document
+                await assertCanWrite(subgraph, docId, ctx);
+                await assertCanExecuteOperation(subgraph, docId, "SET_DRAG_AND_DROP_ENABLED", ctx);
                 const doc = await reactor.getDocument(docId);
                 if (!doc) {
                     throw new Error("Document not found");

package/dist/subgraphs/document-editor/resolvers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.d.ts","sourceRoot":"","sources":["../../../subgraphs/document-editor/resolvers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAgB/D,eAAO,MAAM,YAAY,GACvB,UAAU,YAAY,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAoLxB,CAAC"}
+{"version":3,"file":"resolvers.d.ts","sourceRoot":"","sources":["../../../subgraphs/document-editor/resolvers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAW,MAAM,4BAA4B,CAAC;AA0BxE,eAAO,MAAM,YAAY,GACvB,UAAU,YAAY,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAmQxB,CAAC"}

package/dist/subgraphs/document-editor/resolvers.js

@@ -1,17 +1,21 @@
 import { addFile } from "document-drive";
 import { setName } from "document-model";
+import { GraphQLError } from "graphql";
 import { actions, documentEditorDocumentType, } from "@powerhousedao/vetra/document-models/document-editor";
+import { assertCanRead, assertCanWrite, assertCanExecuteOperation, canReadDocument, hasGlobalReadAccess, hasGlobalWriteAccess, } from "../permission-utils.js";
 export const getResolvers = (subgraph) => {
     const reactor = subgraph.reactor;
     return {
         Query: {
-            DocumentEditor: async () => {
+            DocumentEditor: (_, __, ctx) => {
                 return {
                     getDocument: async (args) => {
                         const { docId, driveId } = args;
                         if (!docId) {
                             throw new Error("Document id is required");
                         }
+                        // Check read permission before accessing document
+                        await assertCanRead(subgraph, docId, ctx);
                         if (driveId) {
                             const docIds = await reactor.getDocuments(driveId);
                             if (!docIds.includes(docId)) {
@@ -32,6 +36,8 @@ export const getResolvers = (subgraph) => {
                     },
                     getDocuments: async (args) => {
                         const { driveId } = args;
+                        // Check read permission on drive before listing documents
+                        await assertCanRead(subgraph, driveId, ctx);
                         const docsIds = await reactor.getDocuments(driveId);
                         const docs = await Promise.all(docsIds.map(async (docId) => {
                             const doc = await reactor.getDocument(docId);
@@ -46,14 +52,34 @@ export const getResolvers = (subgraph) => {
                                 revision: doc.header?.revision?.global ?? 0,
                             };
                         }));
-                        return docs.filter((doc) => doc.header.documentType === documentEditorDocumentType);
+                        const filteredByType = docs.filter((doc) => doc.header.documentType === documentEditorDocumentType);
+                        // If user doesn't have global read access, filter by document-level permissions
+                        if (!hasGlobalReadAccess(ctx) &&
+                            subgraph.documentPermissionService) {
+                            const filteredDocs = [];
+                            for (const doc of filteredByType) {
+                                const canRead = await canReadDocument(subgraph, doc.id, ctx);
+                                if (canRead) {
+                                    filteredDocs.push(doc);
+                                }
+                            }
+                            return filteredDocs;
+                        }
+                        return filteredByType;
                     },
                 };
             },
         },
         Mutation: {
-            DocumentEditor_createDocument: async (_, args) => {
+            DocumentEditor_createDocument: async (_, args, ctx) => {
                 const { driveId, name } = args;
+                // If creating under a drive, check write permission on drive
+                if (driveId) {
+                    await assertCanWrite(subgraph, driveId, ctx);
+                }
+                else if (!hasGlobalWriteAccess(ctx)) {
+                    throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+                }
                 const document = await reactor.addDocument(documentEditorDocumentType);
                 if (driveId) {
                     await reactor.addAction(driveId, addFile({
@@ -67,8 +93,11 @@ export const getResolvers = (subgraph) => {
                 }
                 return document.header.id;
             },
-            DocumentEditor_setEditorName: async (_, args) => {
+            DocumentEditor_setEditorName: async (_, args, ctx) => {
                 const { docId, input } = args;
+                // Check write permission before mutating document
+                await assertCanWrite(subgraph, docId, ctx);
+                await assertCanExecuteOperation(subgraph, docId, "SET_EDITOR_NAME", ctx);
                 const doc = await reactor.getDocument(docId);
                 if (!doc) {
                     throw new Error("Document not found");
@@ -79,8 +108,11 @@ export const getResolvers = (subgraph) => {
                 }
                 return true;
             },
-            DocumentEditor_addDocumentType: async (_, args) => {
+            DocumentEditor_addDocumentType: async (_, args, ctx) => {
                 const { docId, input } = args;
+                // Check write permission before mutating document
+                await assertCanWrite(subgraph, docId, ctx);
+                await assertCanExecuteOperation(subgraph, docId, "ADD_DOCUMENT_TYPE", ctx);
                 const doc = await reactor.getDocument(docId);
                 if (!doc) {
                     throw new Error("Document not found");
@@ -91,8 +123,11 @@ export const getResolvers = (subgraph) => {
                 }
                 return true;
             },
-            DocumentEditor_removeDocumentType: async (_, args) => {
+            DocumentEditor_removeDocumentType: async (_, args, ctx) => {
                 const { docId, input } = args;
+                // Check write permission before mutating document
+                await assertCanWrite(subgraph, docId, ctx);
+                await assertCanExecuteOperation(subgraph, docId, "REMOVE_DOCUMENT_TYPE", ctx);
                 const doc = await reactor.getDocument(docId);
                 if (!doc) {
                     throw new Error("Document not found");
@@ -103,8 +138,11 @@ export const getResolvers = (subgraph) => {
                 }
                 return true;
             },
-            DocumentEditor_setEditorStatus: async (_, args) => {
+            DocumentEditor_setEditorStatus: async (_, args, ctx) => {
                 const { docId, input } = args;
+                // Check write permission before mutating document
+                await assertCanWrite(subgraph, docId, ctx);
+                await assertCanExecuteOperation(subgraph, docId, "SET_EDITOR_STATUS", ctx);
                 const doc = await reactor.getDocument(docId);
                 if (!doc) {
                     throw new Error("Document not found");

package/dist/subgraphs/permission-utils.d.ts

@@ -0,0 +1,31 @@
+import type { BaseSubgraph, Context } from "@powerhousedao/reactor-api";
+/**
+ * Check if user has global read access (admin, user, or guest)
+ */
+export declare function hasGlobalReadAccess(ctx: Context): boolean;
+/**
+ * Check if user has global write access (admin or user, not guest)
+ */
+export declare function hasGlobalWriteAccess(ctx: Context): boolean;
+/**
+ * Check if user can read a document (with hierarchy)
+ */
+export declare function canReadDocument(subgraph: BaseSubgraph, documentId: string, ctx: Context): Promise<boolean>;
+/**
+ * Check if user can write to a document (with hierarchy)
+ */
+export declare function canWriteDocument(subgraph: BaseSubgraph, documentId: string, ctx: Context): Promise<boolean>;
+/**
+ * Throw an error if user cannot read the document
+ */
+export declare function assertCanRead(subgraph: BaseSubgraph, documentId: string, ctx: Context): Promise<void>;
+/**
+ * Throw an error if user cannot write to the document
+ */
+export declare function assertCanWrite(subgraph: BaseSubgraph, documentId: string, ctx: Context): Promise<void>;
+/**
+ * Check if user can execute a specific operation on a document.
+ * Throws an error if the operation is restricted and user lacks permission.
+ */
+export declare function assertCanExecuteOperation(subgraph: BaseSubgraph, documentId: string, operationType: string, ctx: Context): Promise<void>;
+//# sourceMappingURL=permission-utils.d.ts.map

package/dist/subgraphs/permission-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-utils.d.ts","sourceRoot":"","sources":["../../subgraphs/permission-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAGxE;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAMzD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAI1D;AAgBD;;GAEG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAiCf"}