@powerhousedao/vetra 6.0.0-dev.6 → 6.0.0-dev.61

package/dist/subgraphs/index.d.ts

@@ -1,7 +1,2 @@
-export * as AppModuleSubgraph from "./app-module/index.js";
-export * as ProcessorModuleSubgraph from "./processor-module/index.js";
-export * as SubgraphModuleSubgraph from "./subgraph-module/index.js";
-export * as VetraPackageSubgraph from "./vetra-package/index.js";
 export * as VetraReadModelSubgraph from "./vetra-read-model/index.js";
-export * as DocumentEditorSubgraph from "./document-editor/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/subgraphs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../subgraphs/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,iBAAiB,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,uBAAuB,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,sBAAsB,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,oBAAoB,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,sBAAsB,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,sBAAsB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../subgraphs/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,sBAAsB,MAAM,6BAA6B,CAAC"}

package/dist/subgraphs/index.js

@@ -1,6 +1 @@
-export * as AppModuleSubgraph from "./app-module/index.js";
-export * as ProcessorModuleSubgraph from "./processor-module/index.js";
-export * as SubgraphModuleSubgraph from "./subgraph-module/index.js";
-export * as VetraPackageSubgraph from "./vetra-package/index.js";
 export * as VetraReadModelSubgraph from "./vetra-read-model/index.js";
-export * as DocumentEditorSubgraph from "./document-editor/index.js";

package/dist/subgraphs/permission-utils.d.ts

@@ -0,0 +1,30 @@
+import type { BaseSubgraph, Context } from "@powerhousedao/reactor-api";
+/**
+ * Check if user has global admin access.
+ * Legacy fallback when authorizationService is not available.
+ */
+export declare function hasGlobalAdminAccess(ctx: Context): boolean;
+/**
+ * Check if user can read a document (with hierarchy).
+ * Delegates to AuthorizationService when available.
+ */
+export declare function canReadDocument(subgraph: BaseSubgraph, documentId: string, ctx: Context): Promise<boolean>;
+/**
+ * Check if user can write to a document (with hierarchy).
+ * Delegates to AuthorizationService when available.
+ */
+export declare function canWriteDocument(subgraph: BaseSubgraph, documentId: string, ctx: Context): Promise<boolean>;
+/**
+ * Throw an error if user cannot read the document
+ */
+export declare function assertCanRead(subgraph: BaseSubgraph, documentId: string, ctx: Context): Promise<void>;
+/**
+ * Throw an error if user cannot write to the document
+ */
+export declare function assertCanWrite(subgraph: BaseSubgraph, documentId: string, ctx: Context): Promise<void>;
+/**
+ * Check if user can execute a specific operation on a document.
+ * Delegates to AuthorizationService.canMutate when available.
+ */
+export declare function assertCanExecuteOperation(subgraph: BaseSubgraph, documentId: string, operationType: string, ctx: Context): Promise<void>;
+//# sourceMappingURL=permission-utils.d.ts.map

package/dist/subgraphs/permission-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-utils.d.ts","sourceRoot":"","sources":["../../subgraphs/permission-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAiBxE;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE1D;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAwCf"}

package/dist/subgraphs/permission-utils.js

@@ -0,0 +1,97 @@
+import { GraphQLError } from "graphql";
+/**
+ * Get the parent IDs function for hierarchical permission checks
+ */
+function getParentIdsFn(subgraph) {
+    return async (documentId) => {
+        try {
+            const result = await subgraph.reactorClient.getParents(documentId);
+            return result.results.map((doc) => doc.header.id);
+        }
+        catch {
+            return [];
+        }
+    };
+}
+/**
+ * Check if user has global admin access.
+ * Legacy fallback when authorizationService is not available.
+ */
+export function hasGlobalAdminAccess(ctx) {
+    return !!ctx.isAdmin?.(ctx.user?.address ?? "");
+}
+/**
+ * Check if user can read a document (with hierarchy).
+ * Delegates to AuthorizationService when available.
+ */
+export async function canReadDocument(subgraph, documentId, ctx) {
+    if (subgraph.authorizationService) {
+        return subgraph.authorizationService.canRead(documentId, ctx.user?.address, getParentIdsFn(subgraph));
+    }
+    // Legacy fallback
+    if (hasGlobalAdminAccess(ctx))
+        return true;
+    if (subgraph.documentPermissionService) {
+        return subgraph.documentPermissionService.canRead(documentId, ctx.user?.address, getParentIdsFn(subgraph));
+    }
+    return false;
+}
+/**
+ * Check if user can write to a document (with hierarchy).
+ * Delegates to AuthorizationService when available.
+ */
+export async function canWriteDocument(subgraph, documentId, ctx) {
+    if (subgraph.authorizationService) {
+        return subgraph.authorizationService.canWrite(documentId, ctx.user?.address, getParentIdsFn(subgraph));
+    }
+    // Legacy fallback
+    if (hasGlobalAdminAccess(ctx))
+        return true;
+    if (subgraph.documentPermissionService) {
+        return subgraph.documentPermissionService.canWrite(documentId, ctx.user?.address, getParentIdsFn(subgraph));
+    }
+    return false;
+}
+/**
+ * Throw an error if user cannot read the document
+ */
+export async function assertCanRead(subgraph, documentId, ctx) {
+    const canRead = await canReadDocument(subgraph, documentId, ctx);
+    if (!canRead) {
+        throw new GraphQLError("Forbidden: insufficient permissions to read this document");
+    }
+}
+/**
+ * Throw an error if user cannot write to the document
+ */
+export async function assertCanWrite(subgraph, documentId, ctx) {
+    const canWrite = await canWriteDocument(subgraph, documentId, ctx);
+    if (!canWrite) {
+        throw new GraphQLError("Forbidden: insufficient permissions to write to this document");
+    }
+}
+/**
+ * Check if user can execute a specific operation on a document.
+ * Delegates to AuthorizationService.canMutate when available.
+ */
+export async function assertCanExecuteOperation(subgraph, documentId, operationType, ctx) {
+    if (subgraph.authorizationService) {
+        const canMutate = await subgraph.authorizationService.canMutate(documentId, operationType, ctx.user?.address, getParentIdsFn(subgraph));
+        if (!canMutate) {
+            throw new GraphQLError(`Forbidden: insufficient permissions to execute operation "${operationType}" on this document`);
+        }
+        return;
+    }
+    // Legacy fallback
+    if (!subgraph.documentPermissionService)
+        return;
+    if (ctx.isAdmin?.(ctx.user?.address ?? ""))
+        return;
+    const isRestricted = await subgraph.documentPermissionService.isOperationRestricted(documentId, operationType);
+    if (isRestricted) {
+        const canExecute = await subgraph.documentPermissionService.canExecuteOperation(documentId, operationType, ctx.user?.address);
+        if (!canExecute) {
+            throw new GraphQLError(`Forbidden: insufficient permissions to execute operation "${operationType}" on this document`);
+        }
+    }
+}

package/dist/subgraphs/vetra-read-model/resolvers.d.ts

@@ -1,3 +1,3 @@
-import type { ISubgraph } from "@powerhousedao/reactor-api";
-export declare const getResolvers: (subgraph: ISubgraph) => Record<string, unknown>;
+import type { BaseSubgraph } from "@powerhousedao/reactor-api";
+export declare const getResolvers: (subgraph: BaseSubgraph) => Record<string, unknown>;
 //# sourceMappingURL=resolvers.d.ts.map

package/dist/subgraphs/vetra-read-model/resolvers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.d.ts","sourceRoot":"","sources":["../../../subgraphs/vetra-read-model/resolvers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAI5D,eAAO,MAAM,YAAY,GAAI,UAAU,SAAS,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CA+CxE,CAAC"}
+{"version":3,"file":"resolvers.d.ts","sourceRoot":"","sources":["../../../subgraphs/vetra-read-model/resolvers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAW,MAAM,4BAA4B,CAAC;AAKxE,eAAO,MAAM,YAAY,GACvB,UAAU,YAAY,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAsExB,CAAC"}

package/dist/subgraphs/vetra-read-model/resolvers.js

@@ -1,13 +1,13 @@
-import { VetraReadModelProcessor } from "../../processors/vetra-read-model/index.js";
+import { VetraReadModelProcessorLegacy } from "../../processors/vetra-read-model/index.legacy.js";
+import { canReadDocument, hasGlobalAdminAccess } from "../permission-utils.js";
 export const getResolvers = (subgraph) => {
-    const reactor = subgraph.reactor;
     const db = subgraph.relationalDb;
     return {
         Query: {
-            vetraPackages: async (parent, args) => {
+            vetraPackages: async (_parent, args, ctx) => {
                 const { search, documentId_in } = args;
                 const sortOrder = args.sortOrder || "asc";
-                let query = VetraReadModelProcessor.query("vetra-packages", db)
+                let query = VetraReadModelProcessorLegacy.query("vetra-packages", db)
                     .selectFrom("vetra_package")
                     .selectAll();
                 if (search) {
@@ -17,7 +17,8 @@ export const getResolvers = (subgraph) => {
                     query = query.where("document_id", "in", documentId_in);
                 }
                 query = query.orderBy("name", sortOrder);
-                return (await query.execute()).map((pkg) => ({
+                const results = await query.execute();
+                const mappedResults = results.map((pkg) => ({
                     ...pkg,
                     documentId: pkg.document_id,
                     name: pkg.name,
@@ -30,6 +31,18 @@ export const getResolvers = (subgraph) => {
                     keywords: pkg.keywords,
                     driveId: pkg.drive_id,
                 }));
+                // If user doesn't have global read access, filter by document-level permissions
+                if (!hasGlobalAdminAccess(ctx) && subgraph.documentPermissionService) {
+                    const filteredResults = [];
+                    for (const pkg of mappedResults) {
+                        const canRead = await canReadDocument(subgraph, pkg.documentId, ctx);
+                        if (canRead) {
+                            filteredResults.push(pkg);
+                        }
+                    }
+                    return filteredResults;
+                }
+                return mappedResults;
             },
         },
     };