@preventive/triage 1.0.0-alpha.32 → 1.0.0-alpha.34

package/server-managed/workspace-shares.ts

@@ -1,5 +1,6 @@
+import { linkRevision } from './link-reports.ts'
 import type { ManagedSql } from './sql.ts'
-import type { ManagedBundle, TeamReportAccessSnapshot, UserTeam } from './db.ts'
+import type { BundleBuildConditions, ManagedBundle, TeamReportAccessSnapshot, UserTeam } from './db.ts'
 import { type TeamUserPermissions, parseTeamUserPermissions } from '../common/managed/permissions.ts'
 
 export const WORKSPACE_SHARE_SCHEMA = `
@@ -47,7 +48,7 @@ export interface WorkspaceShareStore {
 function shareQueries(db: ManagedSql) {
   const manager = db.prepare(`SELECT 1 FROM managed_session s
     JOIN managed_user u ON u.id = s.user_id
-    JOIN managed_team t ON t.id = ?
+    JOIN managed_team t ON t.id = ? AND t.hidden = 0
     WHERE s.id = ? AND s.expires_at > ? AND (u.role = 'admin' OR (u.role = 'manage'
       AND EXISTS (SELECT 1 FROM managed_team_user tu WHERE tu.user_id = u.id AND tu.team_id = t.id)))`)
   const insert = db.prepare(`INSERT INTO managed_workspace_share (token_hash, team_id, created_by, created_at, dependencies, security)
@@ -62,12 +63,12 @@ function shareQueries(db: ManagedSql) {
     WHERE s.id = ? AND s.expires_at > ? AND u.role IN ('manage', 'admin')`)
   const all = db.prepare(`SELECT s.token_hash AS id, s.created_at AS createdAt, u.login AS createdBy, s.dependencies, s.security,
     t.id AS teamId, t.slug AS teamSlug, t.name AS teamName FROM managed_workspace_share s
-    JOIN managed_user u ON u.id = s.created_by JOIN managed_team t ON t.id = s.team_id
+    JOIN managed_user u ON u.id = s.created_by JOIN managed_team t ON t.id = s.team_id AND t.hidden = 0
     WHERE ? = 'admin' OR EXISTS (SELECT 1 FROM managed_team_user tu WHERE tu.user_id = ? AND tu.team_id = s.team_id)
     ORDER BY t.name, t.id, s.created_at DESC, s.token_hash`)
   const shareGrant = `FROM managed_workspace_share s
     JOIN managed_user u ON u.id = s.created_by
-    JOIN managed_team t ON t.id = s.team_id
+    JOIN managed_team t ON t.id = s.team_id AND t.hidden = 0
     WHERE s.token_hash = ? AND (u.role = 'admin' OR (u.role = 'manage'
       AND EXISTS (SELECT 1 FROM managed_team_user tu WHERE tu.user_id = u.id AND tu.team_id = s.team_id)))`
   const share = db.prepare(`SELECT t.id, t.slug, t.name, s.dependencies, s.security ${shareGrant}`)
@@ -88,10 +89,10 @@ function shareQueries(db: ManagedSql) {
   // A raw bundle is visible only when its declared root is inside the team scope.
   // Root bundles remain hidden from directory-only grants.
   const bundles = db.prepare(`SELECT DISTINCT b.id, b.slug, b.integrity, b.filename, b.kind, b.byte_size AS byteSize,
-    b.uploaded_by AS uploadedBy, b.repo_id AS repoId, b.repo_directory AS repoDirectory, b.uploaded_at AS uploadedAt, sr.full_name AS repoFullName
+    b.uploaded_by AS uploadedBy, b.repo_id AS repoId, b.repo_directory AS repoDirectory, b.uploaded_at AS uploadedAt, b.provenance, b.build_conditions AS buildConditions, sr.full_name AS repoFullName
     FROM managed_team_repo tr JOIN managed_bundle b ON b.repo_id = tr.repo_id
     JOIN managed_selected_repo sr ON sr.repo_id = b.repo_id
-    WHERE tr.team_id = ? AND (tr.path = '' OR b.repo_directory = tr.path
+    WHERE tr.team_id = ? AND b.visible = 1 AND (tr.path = '' OR b.repo_directory = tr.path
       OR substr(b.repo_directory, 1, length(tr.path) + 1) = tr.path || '/') ORDER BY b.id`)
   return { manager, insert, remove, update, list, session, all, share, feed, repositories, reports, bundles }
 }
@@ -141,21 +142,24 @@ export function workspaceShareMethods(db: ManagedSql): WorkspaceShareStore {
       const { dependencies, security, ...team } = grant
       const permissions = { dependencies: dependencies === 1, security: security === 1 }
       const rows = await q.reports.all(team.id) as { id: string; slug: string; filename: string; analyzer: string | null; byteSize: number; sha256: string; directory: string; github: string }[]
-      const bundleRows = await q.bundles.all(team.id) as (ManagedBundle & { repoFullName: string })[]
+      const links = await linkRevision(db)
+      const bundleRows = (await q.bundles.all(team.id) as (Omit<ManagedBundle, 'buildConditions'> & { buildConditions: string | null; repoFullName: string })[])
+        .map(row => ({ ...row, buildConditions: row.buildConditions == null ? null : JSON.parse(row.buildConditions) as BundleBuildConditions }))
       return {
         user: { id: `share:${tokenHash}`, login: 'public', name: 'Public workspace', avatarUrl: null, role: 'view' },
         teamId: team.id,
+        linkRevision: links,
         permissions,
         repositories: await q.repositories.all(team.id) as WorkspaceShareSnapshot['repositories'],
         reports: rows.map(row => ({ id: row.id, filename: row.filename, byteSize: row.byteSize, sha256: row.sha256,
           repo: { github: row.github, directory: row.directory }, permissions })),
-        team: { ...team,
-          reports: rows.map(row => ({ id: row.id, slug: row.slug, filename: row.filename, analyzer: row.analyzer, repoFullName: row.github, repoDirectory: row.directory,
-            cacheKey: JSON.stringify([row.sha256, row.github, row.directory, row.filename, permissions]) })),
+        team: { ...team, permissions, cacheKey: links,
+          reports: rows.map(row => ({ id: row.id, slug: row.slug, filename: row.filename, visible: true, analyzer: row.analyzer, repoFullName: row.github, repoDirectory: row.directory,
+            cacheKey: JSON.stringify([row.sha256, row.github, row.directory, row.filename, permissions, links]) })),
           bundles: bundleRows.map(row => ({ id: row.id, slug: row.slug, integrity: row.integrity,
-            filename: row.filename, kind: row.kind, byteSize: row.byteSize, repoId: row.repoId!, repoDirectory: row.repoDirectory, repoFullName: row.repoFullName })),
+            filename: row.filename, visible: true, kind: row.kind, byteSize: row.byteSize, repoId: row.repoId!, repoDirectory: row.repoDirectory, repoFullName: row.repoFullName, provenance: row.provenance })),
         },
-        bundles: bundleRows,
+        bundles: bundleRows.map(row => ({ ...row, visible: true })),
       }
     },
   }