@realtimex/folio 0.1.15 → 0.1.17

package/dist/api/src/routes/ingestions.js

@@ -7,6 +7,7 @@ import crypto from "crypto";
 import { asyncHandler } from "../middleware/errorHandler.js";
 import { optionalAuth } from "../middleware/auth.js";
 import { IngestionService } from "../services/IngestionService.js";
+import { SDKService } from "../services/SDKService.js";
 const router = Router();
 const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: 20 * 1024 * 1024 } });
 router.use(optionalAuth);
@@ -16,10 +17,14 @@ router.get("/", asyncHandler(async (req, res) => {
         res.status(401).json({ success: false, error: "Authentication required" });
         return;
     }
+    if (!req.workspaceId) {
+        res.status(403).json({ success: false, error: "Workspace membership required" });
+        return;
+    }
     const page = Math.max(1, parseInt(req.query["page"]) || 1);
     const pageSize = Math.min(100, Math.max(1, parseInt(req.query["pageSize"]) || 20));
     const query = req.query["q"]?.trim() || undefined;
-    const { ingestions, total } = await IngestionService.list(req.supabase, req.user.id, { page, pageSize, query });
+    const { ingestions, total } = await IngestionService.list(req.supabase, req.workspaceId, { page, pageSize, query });
     res.json({ success: true, ingestions, total, page, pageSize });
 }));
 // GET /api/ingestions/:id — get single ingestion
@@ -28,7 +33,11 @@ router.get("/:id", asyncHandler(async (req, res) => {
         res.status(401).json({ success: false, error: "Authentication required" });
         return;
     }
-    const ingestion = await IngestionService.get(req.params["id"], req.supabase, req.user.id);
+    if (!req.workspaceId) {
+        res.status(403).json({ success: false, error: "Workspace membership required" });
+        return;
+    }
+    const ingestion = await IngestionService.get(req.params["id"], req.supabase, req.workspaceId);
     if (!ingestion) {
         res.status(404).json({ success: false, error: "Not found" });
         return;
@@ -41,6 +50,10 @@ router.post("/upload", upload.single("file"), asyncHandler(async (req, res) => {
         res.status(401).json({ success: false, error: "Authentication required" });
         return;
     }
+    if (!req.workspaceId) {
+        res.status(403).json({ success: false, error: "Workspace membership required" });
+        return;
+    }
     const file = req.file;
     if (!file) {
         res.status(400).json({ success: false, error: "No file uploaded" });
@@ -52,7 +65,11 @@ router.post("/upload", upload.single("file"), asyncHandler(async (req, res) => {
         .select("storage_path")
         .eq("user_id", req.user.id)
         .maybeSingle();
-    const dropzoneDir = settings?.storage_path || path.join(os.homedir(), ".realtimex", "folio", "dropzone");
+    const configuredStoragePath = typeof settings?.storage_path === "string" ? settings.storage_path.trim() : "";
+    const legacyDefaultDropzoneDir = path.join(os.homedir(), ".realtimex", "folio", "dropzone");
+    const dropzoneDir = !configuredStoragePath || configuredStoragePath === legacyDefaultDropzoneDir
+        ? await SDKService.getDefaultDropzoneDir()
+        : configuredStoragePath;
     await fs.mkdir(dropzoneDir, { recursive: true });
     // Compute SHA-256 hash before writing — used for deduplication
     const fileHash = crypto.createHash("sha256").update(file.buffer).digest("hex");
@@ -65,6 +82,7 @@ router.post("/upload", upload.single("file"), asyncHandler(async (req, res) => {
     const ingestion = await IngestionService.ingest({
         supabase: req.supabase,
         userId: req.user.id,
+        workspaceId: req.workspaceId,
         filename: file.originalname,
         mimeType: file.mimetype,
         fileSize: file.size,
@@ -81,7 +99,11 @@ router.post("/:id/rerun", asyncHandler(async (req, res) => {
         res.status(401).json({ success: false, error: "Authentication required" });
         return;
     }
-    const matched = await IngestionService.rerun(req.params["id"], req.supabase, req.user.id);
+    if (!req.workspaceId) {
+        res.status(403).json({ success: false, error: "Workspace membership required" });
+        return;
+    }
+    const matched = await IngestionService.rerun(req.params["id"], req.supabase, req.user.id, req.workspaceId);
     res.json({ success: true, matched });
 }));
 // POST /api/ingestions/:id/match — manually assign a policy and optionally learn from it
@@ -90,6 +112,10 @@ router.post("/:id/match", asyncHandler(async (req, res) => {
         res.status(401).json({ success: false, error: "Authentication required" });
         return;
     }
+    if (!req.workspaceId) {
+        res.status(403).json({ success: false, error: "Workspace membership required" });
+        return;
+    }
     const policyId = typeof req.body?.policy_id === "string" ? req.body.policy_id.trim() : "";
     if (!policyId) {
         res.status(400).json({ success: false, error: "policy_id is required" });
@@ -99,7 +125,7 @@ router.post("/:id/match", asyncHandler(async (req, res) => {
     const rerun = req.body?.rerun !== false;
     const allowSideEffects = req.body?.allow_side_effects === true;
     try {
-        const ingestion = await IngestionService.matchToPolicy(req.params["id"], policyId, req.supabase, req.user.id, {
+        const ingestion = await IngestionService.matchToPolicy(req.params["id"], policyId, req.supabase, req.user.id, req.workspaceId, {
             learn,
             rerun,
             allowSideEffects,
@@ -125,13 +151,17 @@ router.post("/:id/refine-policy", asyncHandler(async (req, res) => {
         res.status(401).json({ success: false, error: "Authentication required" });
         return;
     }
+    if (!req.workspaceId) {
+        res.status(403).json({ success: false, error: "Workspace membership required" });
+        return;
+    }
     const policyId = typeof req.body?.policy_id === "string" ? req.body.policy_id.trim() : "";
     if (!policyId) {
         res.status(400).json({ success: false, error: "policy_id is required" });
         return;
     }
     try {
-        const suggestion = await IngestionService.suggestPolicyRefinement(req.params["id"], policyId, req.supabase, req.user.id, {
+        const suggestion = await IngestionService.suggestPolicyRefinement(req.params["id"], policyId, req.supabase, req.user.id, req.workspaceId, {
             provider: typeof req.body?.provider === "string" ? req.body.provider : undefined,
             model: typeof req.body?.model === "string" ? req.body.model : undefined,
         });
@@ -156,13 +186,17 @@ router.post("/:id/summarize", asyncHandler(async (req, res) => {
         res.status(401).json({ success: false, error: "Authentication required" });
         return;
     }
+    if (!req.workspaceId) {
+        res.status(403).json({ success: false, error: "Workspace membership required" });
+        return;
+    }
     const { data: settingsRow } = await req.supabase
         .from("user_settings")
         .select("llm_provider, llm_model, ingestion_llm_provider, ingestion_llm_model")
         .eq("user_id", req.user.id)
         .maybeSingle();
     const llmSettings = IngestionService.resolveIngestionLlmSettings(settingsRow);
-    const summary = await IngestionService.summarize(req.params["id"], req.supabase, req.user.id, llmSettings);
+    const summary = await IngestionService.summarize(req.params["id"], req.supabase, req.user.id, req.workspaceId, llmSettings);
     res.json({ success: true, summary });
 }));
 // PATCH /api/ingestions/:id/tags — replace tags array (human edits)
@@ -171,6 +205,10 @@ router.patch("/:id/tags", asyncHandler(async (req, res) => {
         res.status(401).json({ success: false, error: "Authentication required" });
         return;
     }
+    if (!req.workspaceId) {
+        res.status(403).json({ success: false, error: "Workspace membership required" });
+        return;
+    }
     const tags = req.body?.tags;
     if (!Array.isArray(tags) || tags.some((t) => typeof t !== "string")) {
         res.status(400).json({ success: false, error: "tags must be an array of strings" });
@@ -181,7 +219,7 @@ router.patch("/:id/tags", asyncHandler(async (req, res) => {
         .from("ingestions")
         .update({ tags: normalized })
         .eq("id", req.params["id"])
-        .eq("user_id", req.user.id);
+        .eq("workspace_id", req.workspaceId);
     if (error) {
         res.status(500).json({ success: false, error: error.message });
         return;
@@ -194,7 +232,11 @@ router.delete("/:id", asyncHandler(async (req, res) => {
         res.status(401).json({ success: false, error: "Authentication required" });
         return;
     }
-    const deleted = await IngestionService.delete(req.params["id"], req.supabase, req.user.id);
+    if (!req.workspaceId) {
+        res.status(403).json({ success: false, error: "Workspace membership required" });
+        return;
+    }
+    const deleted = await IngestionService.delete(req.params["id"], req.supabase, req.workspaceId);
     if (!deleted) {
         res.status(404).json({ success: false, error: "Not found" });
         return;

package/dist/api/src/routes/policies.js

@@ -10,14 +10,24 @@ const router = Router();
 router.use(optionalAuth);
 // GET /api/policies — list all loaded policies
 router.get("/", asyncHandler(async (req, res) => {
-    const policies = await PolicyLoader.load(false, req.supabase);
-    if (!req.supabase || !req.user || policies.length === 0) {
+    if (!req.supabase || !req.user) {
+        const policies = await PolicyLoader.load(false, req.supabase, req.workspaceId);
+        res.json({ success: true, policies });
+        return;
+    }
+    if (!req.workspaceId) {
+        res.status(403).json({ success: false, error: "Workspace membership required" });
+        return;
+    }
+    const policies = await PolicyLoader.load(false, req.supabase, req.workspaceId);
+    if (policies.length === 0) {
         res.json({ success: true, policies });
         return;
     }
     const stats = await PolicyLearningService.getPolicyLearningStats({
         supabase: req.supabase,
         userId: req.user.id,
+        workspaceId: req.workspaceId,
         policyIds: policies.map((policy) => policy.metadata.id),
     });
     const enrichedPolicies = policies.map((policy) => {
@@ -35,17 +45,33 @@ router.get("/", asyncHandler(async (req, res) => {
 }));
 // POST /api/policies — save a new policy
 router.post("/", asyncHandler(async (req, res) => {
+    if (!req.supabase || !req.user) {
+        res.status(401).json({ success: false, error: "Authentication required" });
+        return;
+    }
+    if (!req.workspaceId) {
+        res.status(403).json({ success: false, error: "Workspace membership required" });
+        return;
+    }
     const policy = req.body;
     if (!PolicyLoader.validate(policy)) {
         res.status(400).json({ success: false, error: "Invalid policy schema" });
         return;
     }
-    const filePath = await PolicyLoader.save(policy, req.supabase, req.user?.id);
+    const filePath = await PolicyLoader.save(policy, req.supabase, req.user.id, req.workspaceId);
     res.status(201).json({ success: true, filePath });
 }));
 // DELETE /api/policies/:id — delete a policy by ID
 router.delete("/:id", asyncHandler(async (req, res) => {
-    const deleted = await PolicyLoader.delete(req.params["id"], req.supabase, req.user?.id);
+    if (!req.supabase || !req.user) {
+        res.status(401).json({ success: false, error: "Authentication required" });
+        return;
+    }
+    if (!req.workspaceId) {
+        res.status(403).json({ success: false, error: "Workspace membership required" });
+        return;
+    }
+    const deleted = await PolicyLoader.delete(req.params["id"], req.supabase, req.user.id, req.workspaceId);
     if (!deleted) {
         res.status(404).json({ success: false, error: "Policy not found" });
         return;
@@ -54,14 +80,30 @@ router.delete("/:id", asyncHandler(async (req, res) => {
 }));
 // PATCH /api/policies/:id — partial update (enabled toggle, metadata fields)
 router.patch("/:id", asyncHandler(async (req, res) => {
+    if (!req.supabase || !req.user) {
+        res.status(401).json({ success: false, error: "Authentication required" });
+        return;
+    }
+    if (!req.workspaceId) {
+        res.status(403).json({ success: false, error: "Workspace membership required" });
+        return;
+    }
     const { enabled, name, description, tags, priority } = req.body;
-    await PolicyLoader.patch(req.params["id"], { enabled, name, description, tags, priority }, req.supabase, req.user?.id);
+    await PolicyLoader.patch(req.params["id"], { enabled, name, description, tags, priority }, req.supabase, req.user.id, req.workspaceId);
     res.json({ success: true });
 }));
 // POST /api/policies/reload — force cache invalidation
 router.post("/reload", asyncHandler(async (req, res) => {
-    PolicyLoader.invalidateCache();
-    const policies = await PolicyLoader.load(true, req.supabase);
+    if (!req.supabase || !req.user) {
+        res.status(401).json({ success: false, error: "Authentication required" });
+        return;
+    }
+    if (!req.workspaceId) {
+        res.status(403).json({ success: false, error: "Workspace membership required" });
+        return;
+    }
+    PolicyLoader.invalidateCache(req.workspaceId);
+    const policies = await PolicyLoader.load(true, req.supabase, req.workspaceId);
     res.json({ success: true, count: policies.length });
 }));
 // POST /api/policies/synthesize — NL → Policy via LLM

package/dist/api/src/routes/stats.js

@@ -9,29 +9,33 @@ router.get("/", async (req, res) => {
         return;
     }
     try {
-        const userId = req.user.id;
+        const workspaceId = req.workspaceId;
+        if (!workspaceId) {
+            res.status(403).json({ success: false, error: "Workspace membership required" });
+            return;
+        }
         const s = req.supabase; // the scoped service client
         // 1. Total Documents Ingested
         const { count: totalDocumentsCount, error: err1 } = await s
             .from("ingestions")
             .select("*", { count: 'exact', head: true })
-            .eq("user_id", userId);
+            .eq("workspace_id", workspaceId);
         // 2. Active Policies
         const { count: activePoliciesCount, error: err2 } = await s
             .from("policies")
             .select("*", { count: 'exact', head: true })
-            .eq("user_id", userId)
+            .eq("workspace_id", workspaceId)
             .eq("enabled", true);
         // 3. RAG Knowledge Base (Chunks)
         const { count: ragChunksCount, error: err3 } = await s
             .from("document_chunks")
             .select("*", { count: 'exact', head: true })
-            .eq("user_id", userId);
+            .eq("workspace_id", workspaceId);
         // 4. Automation Runs (Sum of actions taken across ingestions)
         const { data: ingestionsWithActions, error: err4 } = await s
             .from("ingestions")
             .select("actions_taken")
-            .eq("user_id", userId)
+            .eq("workspace_id", workspaceId)
             .not("actions_taken", "is", null);
         let automationRunsCount = 0;
         if (ingestionsWithActions) {

package/dist/api/src/routes/workspaces.js

@@ -0,0 +1,220 @@
+import { Router } from "express";
+import { config } from "../config/index.js";
+import { optionalAuth } from "../middleware/auth.js";
+import { asyncHandler } from "../middleware/errorHandler.js";
+import { getSupabaseConfigFromHeaders } from "../services/supabase.js";
+function mapRpcStatus(errorCode) {
+    if (errorCode === "42501")
+        return 403;
+    if (errorCode === "22023")
+        return 400;
+    return 500;
+}
+const router = Router();
+router.use(optionalAuth);
+router.get("/", asyncHandler(async (req, res) => {
+    if (!req.user || !req.supabase) {
+        res.status(401).json({ success: false, error: "Authentication required" });
+        return;
+    }
+    const { data: membershipsData, error: membershipsError } = await req.supabase
+        .from("workspace_members")
+        .select("workspace_id,role,status,created_at,updated_at")
+        .eq("user_id", req.user.id)
+        .eq("status", "active")
+        .order("created_at", { ascending: true });
+    if (membershipsError) {
+        const code = membershipsError.code;
+        // Backward compatibility for projects before workspace migration.
+        if (code === "42P01") {
+            res.json({
+                success: true,
+                workspaces: [],
+                activeWorkspaceId: null,
+                activeWorkspaceRole: null,
+            });
+            return;
+        }
+        res.status(500).json({ success: false, error: membershipsError.message });
+        return;
+    }
+    const memberships = (membershipsData ?? []);
+    if (memberships.length === 0) {
+        res.json({
+            success: true,
+            workspaces: [],
+            activeWorkspaceId: null,
+            activeWorkspaceRole: null,
+        });
+        return;
+    }
+    const workspaceIds = memberships.map((membership) => membership.workspace_id);
+    const { data: workspaceData, error: workspaceError } = await req.supabase
+        .from("workspaces")
+        .select("id,name,owner_user_id,created_at,updated_at")
+        .in("id", workspaceIds);
+    if (workspaceError) {
+        res.status(500).json({ success: false, error: workspaceError.message });
+        return;
+    }
+    const workspaceMap = new Map();
+    for (const workspace of (workspaceData ?? [])) {
+        workspaceMap.set(workspace.id, workspace);
+    }
+    const workspaces = memberships
+        .map((membership) => {
+        const workspace = workspaceMap.get(membership.workspace_id);
+        if (!workspace)
+            return null;
+        return {
+            id: workspace.id,
+            name: workspace.name,
+            owner_user_id: workspace.owner_user_id,
+            created_at: workspace.created_at,
+            updated_at: workspace.updated_at,
+            role: membership.role,
+            membership_status: membership.status,
+            membership_created_at: membership.created_at,
+        };
+    })
+        .filter((workspace) => Boolean(workspace));
+    const activeWorkspaceId = req.workspaceId ?? workspaces[0]?.id ?? null;
+    const activeWorkspace = workspaces.find((workspace) => workspace.id === activeWorkspaceId) ?? null;
+    res.json({
+        success: true,
+        workspaces,
+        activeWorkspaceId,
+        activeWorkspaceRole: activeWorkspace?.role ?? null,
+    });
+}));
+router.get("/:workspaceId/members", asyncHandler(async (req, res) => {
+    if (!req.user || !req.supabase) {
+        res.status(401).json({ success: false, error: "Authentication required" });
+        return;
+    }
+    const workspaceId = req.params["workspaceId"];
+    if (!workspaceId) {
+        res.status(400).json({ success: false, error: "workspaceId is required" });
+        return;
+    }
+    const { data, error } = await req.supabase.rpc("workspace_list_members", {
+        p_workspace_id: workspaceId,
+    });
+    if (error) {
+        const status = mapRpcStatus(error.code);
+        res.status(status).json({ success: false, error: error.message });
+        return;
+    }
+    res.json({
+        success: true,
+        members: (data ?? []),
+    });
+}));
+router.post("/:workspaceId/members/invite", asyncHandler(async (req, res) => {
+    if (!req.user || !req.supabase) {
+        res.status(401).json({ success: false, error: "Authentication required" });
+        return;
+    }
+    const workspaceId = req.params["workspaceId"];
+    const email = typeof req.body?.email === "string" ? req.body.email.trim() : "";
+    const role = req.body?.role === "admin" ? "admin" : "member";
+    if (!workspaceId) {
+        res.status(400).json({ success: false, error: "workspaceId is required" });
+        return;
+    }
+    if (!email) {
+        res.status(400).json({ success: false, error: "email is required" });
+        return;
+    }
+    const headerConfig = getSupabaseConfigFromHeaders(req.headers);
+    const envUrl = config.supabase.url;
+    const envKey = config.supabase.anonKey;
+    const envIsValid = envUrl.startsWith("http://") || envUrl.startsWith("https://");
+    const supabaseUrl = envIsValid && envKey ? envUrl : headerConfig?.url;
+    const anonKey = envIsValid && envKey ? envKey : headerConfig?.anonKey;
+    if (!supabaseUrl || !anonKey) {
+        res.status(500).json({ success: false, error: "Supabase config unavailable for invite workflow." });
+        return;
+    }
+    const authHeader = req.headers.authorization;
+    if (!authHeader?.startsWith("Bearer ")) {
+        res.status(401).json({ success: false, error: "Authentication required" });
+        return;
+    }
+    const response = await fetch(`${supabaseUrl}/functions/v1/workspace-invite`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Authorization: authHeader,
+            apikey: anonKey,
+        },
+        body: JSON.stringify({
+            workspace_id: workspaceId,
+            email,
+            role,
+        }),
+    });
+    const payload = await response.json().catch(() => ({}));
+    if (!response.ok) {
+        res.status(response.status).json({
+            success: false,
+            error: payload?.error?.message || payload?.error || `Invite workflow failed (${response.status})`,
+        });
+        return;
+    }
+    res.json(payload);
+}));
+router.patch("/:workspaceId/members/:userId", asyncHandler(async (req, res) => {
+    if (!req.user || !req.supabase) {
+        res.status(401).json({ success: false, error: "Authentication required" });
+        return;
+    }
+    const workspaceId = req.params["workspaceId"];
+    const userId = req.params["userId"];
+    const role = req.body?.role === "admin" ? "admin" : req.body?.role === "member" ? "member" : "";
+    if (!workspaceId || !userId) {
+        res.status(400).json({ success: false, error: "workspaceId and userId are required" });
+        return;
+    }
+    if (!role) {
+        res.status(400).json({ success: false, error: "role must be admin or member" });
+        return;
+    }
+    const { data, error } = await req.supabase.rpc("workspace_update_member_role", {
+        p_workspace_id: workspaceId,
+        p_target_user_id: userId,
+        p_role: role,
+    });
+    if (error) {
+        const status = mapRpcStatus(error.code);
+        res.status(status).json({ success: false, error: error.message });
+        return;
+    }
+    res.json({
+        success: true,
+        member: Array.isArray(data) ? data[0] ?? null : null,
+    });
+}));
+router.delete("/:workspaceId/members/:userId", asyncHandler(async (req, res) => {
+    if (!req.user || !req.supabase) {
+        res.status(401).json({ success: false, error: "Authentication required" });
+        return;
+    }
+    const workspaceId = req.params["workspaceId"];
+    const userId = req.params["userId"];
+    if (!workspaceId || !userId) {
+        res.status(400).json({ success: false, error: "workspaceId and userId are required" });
+        return;
+    }
+    const { data, error } = await req.supabase.rpc("workspace_remove_member", {
+        p_workspace_id: workspaceId,
+        p_target_user_id: userId,
+    });
+    if (error) {
+        const status = mapRpcStatus(error.code);
+        res.status(status).json({ success: false, error: error.message });
+        return;
+    }
+    res.json({ success: true, removed: data === true });
+}));
+export default router;

package/dist/api/src/services/ChatService.js

@@ -9,7 +9,7 @@ export class ChatService {
      * Send a message to an existing session, augment with RAG context if needed,
      * and stream the AI response back into the database.
      */
-    static async handleMessage(sessionId, userId, content, supabase) {
+    static async handleMessage(sessionId, userId, content, supabase, workspaceId) {
         // 1. Get User/Session Settings (Models to use)
         const { data: settings } = await supabase
             .from("user_settings")
@@ -49,7 +49,12 @@ export class ChatService {
                 embedding_model: embedSettings.embedding_model ?? "auto",
                 query_preview: content.slice(0, 180),
             }, supabase);
-            contextSources = await RAGService.searchDocuments(content, userId, supabase, { topK: 5, similarityThreshold: 0.65, settings: embedSettings });
+            contextSources = await RAGService.searchDocuments(content, userId, supabase, {
+                topK: 5,
+                similarityThreshold: 0.65,
+                settings: embedSettings,
+                workspaceId
+            });
             Actuator.logEvent(null, userId, "analysis", "RAG Retrieval", {
                 action: "RAG query response",
                 session_id: sessionId,