@sanity/sdk 3.0.0-rc.0 → 3.0.0-rc.2

package/src/document/permissions.test.ts

@@ -1,14 +1,14 @@
+import {DocumentId, getDraftId, getPublishedId} from '@sanity/id-utils'
 import {type SanityDocument} from '@sanity/types'
 import {evaluateSync, type ExprNode, parse} from 'groq-js'
 import {describe, expect, it} from 'vitest'
 
 import {createSanityInstance} from '../store/createSanityInstance'
-import {getDraftId, getPublishedId} from '../utils/ids'
 import {type DocumentAction} from './actions'
 import {calculatePermissions, createGrantsLookup, type DatasetAcl, type Grant} from './permissions'
 import {type SyncTransactionState} from './reducers'
 
-const instance = createSanityInstance()
+const instance = createSanityInstance({projectId: 'p', dataset: 'd'})
 
 afterAll(() => {
   instance.dispose()
@@ -32,9 +32,11 @@ const alwaysDeny = parse('false')
 const createState = (
   docStates: Record<string, {local: unknown}>,
   grants?: Record<Grant, ExprNode>,
+  identity?: string,
 ): SyncTransactionState => ({
   documentStates: docStates as SyncTransactionState['documentStates'],
   grants,
+  identity,
   queued: [],
   applied: [],
 })
@@ -52,6 +54,18 @@ describe('createGrantsLookup', () => {
       expect(evaluateSync(grants[key], {params: {document: dummyDoc}}).data).toBe(true)
     })
   })
+
+  it('should ignore unknown permissions like "manage"', () => {
+    const datasetAcl = [
+      {filter: '_id != null', permissions: ['history', 'read', 'update', 'create', 'manage']},
+    ] as DatasetAcl
+    const grants = createGrantsLookup(datasetAcl)
+    const dummyDoc = {_id: 'doc1'}
+    ;(['read', 'update', 'create', 'history'] as Grant[]).forEach((key) => {
+      expect(grants[key]).toBeDefined()
+      expect(evaluateSync(grants[key], {params: {document: dummyDoc}}).data).toBe(true)
+    })
+  })
 })
 
 describe('calculatePermissions', () => {
@@ -66,19 +80,16 @@ describe('calculatePermissions', () => {
     // For a document.create action, the selector expects both published and draft keys.
     const state = createState(
       {
-        [getPublishedId('doc1')]: {local: createDoc('doc1', 'Original Title')},
-        [getDraftId('doc1')]: {local: null},
+        [getPublishedId(DocumentId('doc1'))]: {
+          local: createDoc(DocumentId('doc1'), 'Original Title'),
+        },
+        [getDraftId(DocumentId('doc1'))]: {local: null},
       },
       defaultGrants,
     )
 
     const actions: DocumentAction[] = [
-      {
-        documentId: 'doc1',
-        type: 'document.create',
-        documentType: 'article',
-        resource: {projectId: 'p', dataset: 'd'},
-      },
+      {documentId: 'doc1', type: 'document.create', documentType: 'article'},
     ]
     const result = calculatePermissions({instance, state}, {actions})
     expect(result).toEqual({allowed: true})
@@ -88,18 +99,13 @@ describe('calculatePermissions', () => {
     // Missing the draft key will cause documentsSelector to return undefined.
     const state = createState(
       {
-        [getPublishedId('doc1')]: {local: createDoc('doc1', 'Title')},
+        [getPublishedId(DocumentId('doc1'))]: {local: createDoc(DocumentId('doc1'), 'Title')},
         // Missing getDraftId('doc1')
       },
       defaultGrants,
     )
     const actions: DocumentAction[] = [
-      {
-        documentId: 'doc1',
-        type: 'document.create',
-        documentType: 'article',
-        resource: {projectId: 'p', dataset: 'd'},
-      },
+      {documentId: 'doc1', type: 'document.create', documentType: 'article'},
     ]
     expect(calculatePermissions({instance, state}, {actions})).toBeUndefined()
   })
@@ -109,18 +115,13 @@ describe('calculatePermissions', () => {
     const deniedGrants = {...defaultGrants, create: alwaysDeny}
     const state = createState(
       {
-        [getPublishedId('doc1')]: {local: createDoc('doc1', 'Title')},
-        [getDraftId('doc1')]: {local: null},
+        [getPublishedId(DocumentId('doc1'))]: {local: createDoc(DocumentId('doc1'), 'Title')},
+        [getDraftId(DocumentId('doc1'))]: {local: null},
       },
       deniedGrants,
     )
     const actions: DocumentAction[] = [
-      {
-        documentId: 'doc1',
-        type: 'document.create',
-        documentType: 'article',
-        resource: {projectId: 'p', dataset: 'd'},
-      },
+      {documentId: 'doc1', type: 'document.create', documentType: 'article'},
     ]
     const result = calculatePermissions({instance, state}, {actions})
     expect(result).toBeDefined()
@@ -142,18 +143,13 @@ describe('calculatePermissions', () => {
     // Both published and draft documents are present as null.
     const state = createState(
       {
-        [getPublishedId('doc1')]: {local: null},
-        [getDraftId('doc1')]: {local: null},
+        [getPublishedId(DocumentId('doc1'))]: {local: null},
+        [getDraftId(DocumentId('doc1'))]: {local: null},
       },
       defaultGrants,
     )
     const actions: DocumentAction[] = [
-      {
-        documentId: 'doc1',
-        documentType: 'book',
-        type: 'document.edit',
-        resource: {projectId: 'p', dataset: 'd'},
-      },
+      {documentId: 'doc1', documentType: 'book', type: 'document.edit'},
     ]
     const result = calculatePermissions({instance, state}, {actions})
     expect(result).toBeDefined()
@@ -173,18 +169,13 @@ describe('calculatePermissions', () => {
     const deniedGrants = {...defaultGrants, update: alwaysDeny}
     const state = createState(
       {
-        [getPublishedId('doc1')]: {local: createDoc('doc1', 'Title')},
-        [getDraftId('doc1')]: {local: createDoc(getDraftId('doc1'), 'Draft Title')},
+        [getPublishedId(DocumentId('doc1'))]: {local: createDoc(DocumentId('doc1'), 'Title')},
+        [getDraftId(DocumentId('doc1'))]: {local: createDoc(DocumentId('doc1'), 'Draft Title')},
       },
       deniedGrants,
     )
     const actions: DocumentAction[] = [
-      {
-        documentId: 'doc1',
-        documentType: 'book',
-        type: 'document.edit',
-        resource: {projectId: 'p', dataset: 'd'},
-      },
+      {documentId: 'doc1', documentType: 'book', type: 'document.edit'},
     ]
     const result = calculatePermissions({instance, state}, {actions})
     expect(result).toBeDefined()
@@ -204,16 +195,11 @@ describe('calculatePermissions', () => {
 
   it('should return undefined if grants are not provided', () => {
     const state = createState({
-      [getPublishedId('doc1')]: {local: createDoc('doc1', 'Title')},
-      [getDraftId('doc1')]: {local: null},
+      [getPublishedId(DocumentId('doc1'))]: {local: createDoc(DocumentId('doc1'), 'Title')},
+      [getDraftId(DocumentId('doc1'))]: {local: null},
     })
     const actions: DocumentAction[] = [
-      {
-        documentId: 'doc1',
-        type: 'document.create',
-        documentType: 'article',
-        resource: {projectId: 'p', dataset: 'd'},
-      },
+      {documentId: 'doc1', type: 'document.create', documentType: 'article'},
     ]
     expect(calculatePermissions({instance, state}, {actions})).toBeUndefined()
   })
@@ -222,18 +208,13 @@ describe('calculatePermissions', () => {
     // For document.delete, if the published document is missing, processActions throws an ActionError.
     const state = createState(
       {
-        [getPublishedId('doc1')]: {local: null},
-        [getDraftId('doc1')]: {local: null},
+        [getPublishedId(DocumentId('doc1'))]: {local: null},
+        [getDraftId(DocumentId('doc1'))]: {local: null},
       },
       defaultGrants,
     )
     const actions: DocumentAction[] = [
-      {
-        documentId: 'doc1',
-        documentType: 'book',
-        type: 'document.delete',
-        resource: {projectId: 'p', dataset: 'd'},
-      },
+      {documentId: 'doc1', documentType: 'book', type: 'document.delete'},
     ]
     const result = calculatePermissions({instance, state}, {actions})
     expect(result).toBeDefined()
@@ -252,8 +233,8 @@ describe('calculatePermissions', () => {
   it('should memoize the result for identical state and actions inputs', () => {
     const state = createState(
       {
-        [getPublishedId('doc1')]: {local: createDoc('doc1', 'Title')},
-        [getDraftId('doc1')]: {local: null},
+        [getPublishedId(DocumentId('doc1'))]: {local: createDoc(DocumentId('doc1'), 'Title')},
+        [getDraftId(DocumentId('doc1'))]: {local: null},
       },
       defaultGrants,
     )
@@ -261,11 +242,77 @@ describe('calculatePermissions', () => {
       documentId: 'doc1',
       type: 'document.create',
       documentType: 'article',
-      resource: {projectId: 'p', dataset: 'd'},
     }
     // notice how the action is a copy
     const result1 = calculatePermissions({instance, state}, {actions: [{...action}]})
     const result2 = calculatePermissions({instance, state}, {actions: [{...action}]})
     expect(result1).toBe(result2)
   })
+
+  describe('identity-aware grants', () => {
+    // Mirrors the canvas ACL filter shape: only the document's creator may
+    // update it. Without an identity passed to groq, `identity()` is null and
+    // the expression collapses to null — which used to read as "denied".
+    const canvasUpdateAcl: DatasetAcl = [
+      {
+        filter: '_type == "sanity.canvas.document" && _system.createdBy == identity()',
+        permissions: ['read', 'update'],
+      },
+    ]
+
+    const canvasDoc = (createdBy: string): SanityDocument => ({
+      _id: 'canvas-1',
+      _type: 'sanity.canvas.document',
+      _createdAt: '2025-01-01T00:00:00.000Z',
+      _updatedAt: '2025-01-01T00:00:00.000Z',
+      _rev: 'rev-1',
+      // Content Lake sets `_system.createdBy` on canvas documents; the public
+      // `DocumentSystem` type doesn't declare it, so the literal needs a cast.
+      _system: {createdBy} as SanityDocument['_system'],
+    })
+
+    const editAction: DocumentAction = {
+      documentId: 'canvas-1',
+      documentType: 'sanity.canvas.document',
+      type: 'document.edit',
+      liveEdit: true,
+    }
+
+    it('allows edits when identity matches the document creator', () => {
+      const state = createState(
+        {'canvas-1': {local: canvasDoc('user-A')}},
+        createGrantsLookup(canvasUpdateAcl),
+        'user-A',
+      )
+      expect(calculatePermissions({instance, state}, {actions: [editAction]})).toEqual({
+        allowed: true,
+      })
+    })
+
+    it('denies edits when identity does not match the document creator', () => {
+      const state = createState(
+        {'canvas-1': {local: canvasDoc('user-A')}},
+        createGrantsLookup(canvasUpdateAcl),
+        'user-B',
+      )
+      const result = calculatePermissions({instance, state}, {actions: [editAction]})
+      expect(result?.allowed).toBe(false)
+      expect(result?.reasons).toEqual(
+        expect.arrayContaining([expect.objectContaining({type: 'access', documentId: 'canvas-1'})]),
+      )
+    })
+
+    it('denies edits when identity is not yet loaded', () => {
+      const state = createState(
+        {'canvas-1': {local: canvasDoc('user-A')}},
+        createGrantsLookup(canvasUpdateAcl),
+        undefined,
+      )
+      const result = calculatePermissions({instance, state}, {actions: [editAction]})
+      expect(result?.allowed).toBe(false)
+      expect(result?.reasons).toEqual(
+        expect.arrayContaining([expect.objectContaining({type: 'access', documentId: 'canvas-1'})]),
+      )
+    })
+  })
 })

package/src/document/permissions.ts

@@ -1,12 +1,14 @@
+import {DocumentId, getDraftId, getPublishedId, getVersionId} from '@sanity/id-utils'
 import {type SanityDocument} from '@sanity/types'
-import {evaluateSync, type ExprNode, parse} from 'groq-js'
+import {type ExprNode, parse} from 'groq-js'
 import {createSelector} from 'reselect'
 
+import {isReleasePerspective} from '../releases/utils/isReleasePerspective'
 import {type SelectorContext} from '../store/createStateSourceAction'
-import {getDraftId, getPublishedId} from '../utils/ids'
 import {MultiKeyWeakMap} from '../utils/MultiKeyWeakMap'
 import {type DocumentAction} from './actions'
-import {ActionError, PermissionActionError, processActions} from './processActions'
+import {ActionError, PermissionActionError, processActions} from './processActions/processActions'
+import {checkGrant} from './processActions/shared'
 import {type DocumentSet} from './processMutations'
 import {type SyncTransactionState} from './reducers'
 
@@ -28,6 +30,8 @@ export function createGrantsLookup(datasetAcl: DatasetAcl): Record<Grant, ExprNo
   for (const entry of datasetAcl) {
     for (const grant of entry.permissions) {
       const set = filtersByGrant[grant]
+      // Ignore permissions we don't model (e.g. "manage")
+      if (!set) continue
       set.add(entry.filter)
       filtersByGrant[grant] = set
     }
@@ -71,7 +75,14 @@ const documentsSelector = createSelector(
           // For liveEdit documents, only fetch the single document
           if (action.liveEdit) return [action.documentId]
           // For standard documents, fetch both draft and published
-          return [getPublishedId(action.documentId), getDraftId(action.documentId)]
+          const ids: string[] = [
+            getPublishedId(DocumentId(action.documentId)),
+            getDraftId(DocumentId(action.documentId)),
+          ]
+          if (isReleasePerspective(action.perspective)) {
+            ids.push(getVersionId(DocumentId(action.documentId), action.perspective.releaseName))
+          }
+          return ids
         })
         .flat(),
     )
@@ -132,11 +143,6 @@ const memoizedActionsSelector = createSelector(
   },
 )
 
-function checkGrant(grantExpr: ExprNode, document: SanityDocument): boolean {
-  const value = evaluateSync(grantExpr, {params: {document}})
-  return value.type === 'boolean' && value.data
-}
-
 /** @beta */
 export interface PermissionDeniedReason {
   type: 'precondition' | 'access'
@@ -164,11 +170,13 @@ export function calculatePermissions(
 const _calculatePermissions = createSelector(
   [
     ({state: {grants}}: SelectorContext<SyncTransactionState>) => grants,
+    ({state: {identity}}: SelectorContext<SyncTransactionState>) => identity,
     documentsSelector,
     memoizedActionsSelector,
   ],
   (
     grants: Record<Grant, ExprNode> | undefined,
+    identity: string | undefined,
     documents: DocumentSet | undefined,
     actions: DocumentAction[] | undefined,
   ): DocumentPermissionsResult | undefined => {
@@ -187,6 +195,7 @@ const _calculatePermissions = createSelector(
         base: documents,
         timestamp,
         grants,
+        identity,
       })
     } catch (error) {
       if (error instanceof PermissionActionError) {
@@ -210,17 +219,33 @@ const _calculatePermissions = createSelector(
       // Check edit actions with no patches
       if (action.type === 'document.edit' && !action.patches?.length) {
         const docId = action.documentId
-        // For liveEdit documents, only check the single document
-        const doc = action.liveEdit
-          ? documents[docId]
-          : (documents[getDraftId(docId)] ?? documents[getPublishedId(docId)])
+        let doc: SanityDocument | null | undefined
+        if (action.liveEdit) {
+          doc = documents[docId]
+        }
+        // don't allow users to edit version documents that don't exist
+        // they should be explicitly created first, as in studio
+        else if (isReleasePerspective(action.perspective)) {
+          doc = documents[getVersionId(DocumentId(docId), action.perspective.releaseName)]
+        } else {
+          doc =
+            documents[getDraftId(DocumentId(docId))] ?? documents[getPublishedId(DocumentId(docId))]
+        }
         if (!doc) {
-          reasons.push({
-            type: 'precondition',
-            message: `The document with ID "${docId}" could not be found. Please check that it exists before editing.`,
-            documentId: docId,
-          })
-        } else if (!checkGrant(grants.update, doc)) {
+          if (isReleasePerspective(action.perspective)) {
+            reasons.push({
+              type: 'precondition',
+              message: `The version document with ID "${docId}" could not be found. Please create it or add it to the release first.`,
+              documentId: docId,
+            })
+          } else {
+            reasons.push({
+              type: 'precondition',
+              message: `The document with ID "${docId}" could not be found. Please check that it exists before editing.`,
+              documentId: docId,
+            })
+          }
+        } else if (!checkGrant(grants.update, doc, identity)) {
           reasons.push({
             type: 'access',
             message: `You are not allowed to edit the document with ID "${docId}".`,

package/src/document/processActions/create.ts

@@ -0,0 +1,138 @@
+import {DocumentId, getDraftId, getPublishedId, getVersionId} from '@sanity/id-utils'
+import {type Mutation, type SanityDocument} from '@sanity/types'
+
+import {isReleasePerspective} from '../../releases/utils/isReleasePerspective'
+import {type CreateDocumentAction} from '../actions'
+import {getId, processMutations} from '../processMutations'
+import {
+  ActionError,
+  type ActionHandlerContext,
+  type ActionHandlerResult,
+  checkGrant,
+  PermissionActionError,
+} from './shared'
+
+export function handleCreate(
+  action: CreateDocumentAction,
+  ctx: ActionHandlerContext,
+): ActionHandlerResult {
+  const {transactionId, timestamp, grants, identity, outgoingActions, outgoingMutations} = ctx
+  let {base, working} = ctx
+
+  const documentId = getId(action.documentId)
+
+  if (action.liveEdit) {
+    if (working[documentId]) {
+      throw new ActionError({
+        documentId,
+        transactionId,
+        message: `This document already exists.`,
+      })
+    }
+
+    const newDocBase = {_type: action.documentType, _id: documentId, ...action.initialValue}
+    const newDocWorking = {
+      _type: action.documentType,
+      _id: documentId,
+      ...action.initialValue,
+    }
+    const mutations: Mutation[] = [{create: newDocWorking}]
+
+    base = processMutations({
+      documents: base,
+      transactionId,
+      mutations: [{create: newDocBase}],
+      timestamp,
+    })
+    working = processMutations({
+      documents: working,
+      transactionId,
+      mutations,
+      timestamp,
+    })
+
+    if (!checkGrant(grants.create, working[documentId] as SanityDocument, identity)) {
+      throw new PermissionActionError({
+        documentId,
+        transactionId,
+        message: `You do not have permission to create document "${documentId}".`,
+      })
+    }
+
+    // liveEdit documents use the mutation endpoint directly -- we don't send actions
+    outgoingMutations.push(...mutations)
+    return {base, working}
+  }
+
+  // Standard draft/published/version logic
+  const versionId = isReleasePerspective(action.perspective)
+    ? getVersionId(DocumentId(documentId), action.perspective.releaseName)
+    : undefined
+  const draftId = getDraftId(DocumentId(documentId))
+  const publishedId = getPublishedId(DocumentId(documentId))
+
+  const alreadyHasVersion = versionId ? working[versionId] : working[draftId]
+
+  if (alreadyHasVersion) {
+    const errorDocType = versionId ? 'release version' : 'draft'
+    throw new ActionError({
+      documentId,
+      transactionId,
+      message: `A ${errorDocType} of this document already exists. Please use or discard the existing ${errorDocType} before creating a new one.`,
+    })
+  }
+
+  // Spread the (possibly undefined) draft or published version directly.
+  // (studio uses the draft version as a base if you are in a release perspective)
+  const newDocBase = {
+    ...(base[draftId] ?? base[publishedId]),
+    _type: action.documentType,
+    _id: versionId ?? draftId,
+    ...action.initialValue,
+  }
+  const newDocWorking = {
+    ...(working[draftId] ?? working[publishedId]),
+    _type: action.documentType,
+    _id: versionId ?? draftId,
+    ...action.initialValue,
+  }
+  const mutations: Mutation[] = [{create: newDocWorking}]
+
+  base = processMutations({
+    documents: base,
+    transactionId,
+    mutations: [{create: newDocBase}],
+    timestamp,
+  })
+  working = processMutations({
+    documents: working,
+    transactionId,
+    mutations,
+    timestamp,
+  })
+
+  if (versionId && !checkGrant(grants.create, working[versionId] as SanityDocument, identity)) {
+    throw new PermissionActionError({
+      documentId,
+      transactionId,
+      message: `You do not have permission to create a release version for document "${documentId}".`,
+    })
+  } else if (
+    !versionId &&
+    !checkGrant(grants.create, working[draftId] as SanityDocument, identity)
+  ) {
+    throw new PermissionActionError({
+      documentId,
+      transactionId,
+      message: `You do not have permission to create a draft for document "${documentId}".`,
+    })
+  }
+
+  outgoingMutations.push(...mutations)
+  outgoingActions.push({
+    actionType: 'sanity.action.document.version.create',
+    publishedId,
+    attributes: newDocWorking,
+  })
+  return {base, working}
+}

package/src/document/processActions/delete.ts

@@ -0,0 +1,100 @@
+import {DocumentId, getDraftId, getPublishedId} from '@sanity/id-utils'
+import {type Mutation} from '@sanity/types'
+
+import {isReleasePerspective} from '../../releases/utils/isReleasePerspective'
+import {type DeleteDocumentAction} from '../actions'
+import {processMutations} from '../processMutations'
+import {
+  ActionError,
+  type ActionHandlerContext,
+  type ActionHandlerResult,
+  checkGrant,
+  PermissionActionError,
+} from './shared'
+
+export function handleDelete(
+  action: DeleteDocumentAction,
+  ctx: ActionHandlerContext,
+): ActionHandlerResult {
+  const {transactionId, timestamp, grants, identity, outgoingActions, outgoingMutations} = ctx
+  let {base, working} = ctx
+
+  const documentId = action.documentId
+
+  if (isReleasePerspective(action.perspective)) {
+    throw new ActionError({
+      documentId,
+      transactionId,
+      message: `Cannot delete a version document. You may want to use the "unpublish" or "discard" actions instead.`,
+    })
+  }
+
+  if (action.liveEdit) {
+    if (!working[documentId]) {
+      throw new ActionError({
+        documentId,
+        transactionId,
+        message: 'The document you are trying to delete does not exist.',
+      })
+    }
+
+    if (!checkGrant(grants.update, working[documentId], identity)) {
+      throw new PermissionActionError({
+        documentId,
+        transactionId,
+        message: `You do not have permission to delete this document.`,
+      })
+    }
+
+    const mutations: Mutation[] = [{delete: {id: documentId}}]
+
+    base = processMutations({documents: base, transactionId, mutations, timestamp})
+    working = processMutations({documents: working, transactionId, mutations, timestamp})
+
+    // although liveEdit documents can use the actions API for deletion,
+    // having this be an action while other operations are mutations creates an inconsistency
+    // (and a possible race condition in document store where mutations might get skipped)
+    outgoingMutations.push(...mutations)
+    return {base, working}
+  }
+
+  // Standard draft/published logic
+  const draftId = getDraftId(DocumentId(documentId))
+  const publishedId = getPublishedId(DocumentId(documentId))
+
+  if (!working[publishedId]) {
+    throw new ActionError({
+      documentId,
+      transactionId,
+      message: working[draftId]
+        ? 'Cannot delete a document without a published version.'
+        : 'The document you are trying to delete does not exist.',
+    })
+  }
+
+  const cantDeleteDraft = working[draftId] && !checkGrant(grants.update, working[draftId], identity)
+  const cantDeletePublished =
+    working[publishedId] && !checkGrant(grants.update, working[publishedId], identity)
+
+  if (cantDeleteDraft || cantDeletePublished) {
+    throw new PermissionActionError({
+      documentId,
+      transactionId,
+      message: `You do not have permission to delete this document.`,
+    })
+  }
+
+  const mutations: Mutation[] = [{delete: {id: publishedId}}, {delete: {id: draftId}}]
+  const includeDrafts = working[draftId] ? [draftId] : undefined
+
+  base = processMutations({documents: base, transactionId, mutations, timestamp})
+  working = processMutations({documents: working, transactionId, mutations, timestamp})
+
+  outgoingMutations.push(...mutations)
+  outgoingActions.push({
+    actionType: 'sanity.action.document.delete',
+    publishedId,
+    ...(includeDrafts ? {includeDrafts} : {}),
+  })
+  return {base, working}
+}