@taskforcehq/taskforce 0.3.326 → 0.3.328

package/dist/server/routes/documentReviews.js

@@ -4,8 +4,39 @@ function writeJson(res, statusCode, payload) {
     res.writeHead(statusCode, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify(payload));
 }
+function withCommentPermissions(comment, actorId, canModerate, sessionStatus, hasLiveReplies) {
+    const isOwner = actorId.length > 0 && actorId === String(comment.authorActorId || '').trim();
+    const isRoot = !comment.parentCommentId;
+    const threadOpen = comment.threadStatus !== 'resolved';
+    return {
+        ...comment,
+        permissions: {
+            canEdit: isOwner,
+            canDelete: (isOwner && (!isRoot || !hasLiveReplies)) || canModerate,
+            canReply: isRoot && sessionStatus === 'open' && threadOpen,
+            canResolve: isRoot && sessionStatus === 'open' && threadOpen && (isOwner || canModerate),
+            canReopen: isRoot && sessionStatus === 'open' && !threadOpen && (isOwner || canModerate),
+        },
+    };
+}
+function withViewerPermissions(session, actorId, canModerate) {
+    const liveReplyCounts = new Map();
+    for (const comment of session.comments) {
+        if (!comment.parentCommentId)
+            continue;
+        liveReplyCounts.set(comment.parentCommentId, (liveReplyCounts.get(comment.parentCommentId) || 0) + 1);
+    }
+    return {
+        ...session,
+        comments: session.comments.map((comment) => withCommentPermissions(comment, actorId, canModerate, session.status, (liveReplyCounts.get(comment.id) || 0) > 0)),
+    };
+}
 export function registerDocumentReviewRoutes(deps) {
-    const { addRoute, core, requestWorkspaceId, resolveAuthenticatedUserId, ensureAppAccess, } = deps;
+    const { addRoute, core, requestWorkspaceId, resolveAuthenticatedUserId, resolveAuthenticatedMutationUserId, ensureWorkspaceAdminRole, ensureAppAccess, } = deps;
+    const decorateSession = (req, workspaceId, session) => {
+        const actorId = String(resolveAuthenticatedUserId(req) || '').trim();
+        return withViewerPermissions(session, actorId, ensureWorkspaceAdminRole(req, workspaceId));
+    };
     addRoute('GET', '/api/taskforce/document-reviews/sessions', async (req, res) => {
         const workspaceId = requestWorkspaceId(req);
         if (!ensureAppAccess(req, res))
@@ -18,7 +49,9 @@ export function registerDocumentReviewRoutes(deps) {
         }
         try {
             const sessions = core.listDocumentReviewSessions({ workspaceId, assetId });
-            writeJson(res, 200, { sessions });
+            writeJson(res, 200, {
+                sessions: sessions.map((session) => decorateSession(req, workspaceId, session)),
+            });
         }
         catch (error) {
             writeJson(res, resolveErrorStatusCode(error, 400), {
@@ -40,7 +73,7 @@ export function registerDocumentReviewRoutes(deps) {
                 writeJson(res, 404, { error: 'Document review session not found.' });
                 return;
             }
-            writeJson(res, 200, { session });
+            writeJson(res, 200, { session: decorateSession(req, workspaceId, session) });
         }
         catch (error) {
             writeJson(res, resolveErrorStatusCode(error, 400), {
@@ -60,9 +93,9 @@ export function registerDocumentReviewRoutes(deps) {
                 assetId: String(body?.assetId || '').trim(),
                 title: typeof body?.title === 'string' ? body.title : null,
                 status: body?.status === 'resolved' ? 'resolved' : 'open',
-                actorId: resolveAuthenticatedUserId(req),
+                actorId: resolveAuthenticatedMutationUserId(req),
             });
-            writeJson(res, 200, { success: true, session });
+            writeJson(res, 200, { success: true, session: decorateSession(req, workspaceId, session) });
         }
         catch (error) {
             writeJson(res, resolveErrorStatusCode(error, 400), {
@@ -83,9 +116,9 @@ export function registerDocumentReviewRoutes(deps) {
                 sessionId: String(params.id || '').trim(),
                 title: body?.title === null ? null : typeof body?.title === 'string' ? body.title : undefined,
                 status: body?.status === 'resolved' ? 'resolved' : body?.status === 'open' ? 'open' : undefined,
-                actorId: resolveAuthenticatedUserId(req),
+                actorId: resolveAuthenticatedMutationUserId(req),
             });
-            writeJson(res, 200, { success: true, session });
+            writeJson(res, 200, { success: true, session: decorateSession(req, workspaceId, session) });
         }
         catch (error) {
             writeJson(res, resolveErrorStatusCode(error, 400), {
@@ -129,9 +162,9 @@ export function registerDocumentReviewRoutes(deps) {
                 sessionId: String(params.id || '').trim(),
                 body: typeof body?.body === 'string' ? body.body : '',
                 anchor: body?.anchor && typeof body.anchor === 'object' ? body.anchor : null,
-                actorId: resolveAuthenticatedUserId(req),
+                actorId: resolveAuthenticatedMutationUserId(req),
             });
-            writeJson(res, 200, { success: true, session });
+            writeJson(res, 200, { success: true, session: decorateSession(req, workspaceId, session) });
         }
         catch (error) {
             writeJson(res, resolveErrorStatusCode(error, 400), {
@@ -141,6 +174,81 @@ export function registerDocumentReviewRoutes(deps) {
             });
         }
     });
+    addRoute('POST', '/api/taskforce/document-reviews/sessions/:id/comments/:commentId/replies', async (req, res, params) => {
+        const workspaceId = requestWorkspaceId(req);
+        if (!ensureAppAccess(req, res))
+            return;
+        const body = await parseJsonBody(req);
+        try {
+            const session = core.addDocumentReviewReply({
+                workspaceId,
+                sessionId: String(params.id || '').trim(),
+                parentCommentId: String(params.commentId || '').trim(),
+                body: typeof body?.body === 'string' ? body.body : '',
+                actorId: resolveAuthenticatedMutationUserId(req),
+            });
+            writeJson(res, 200, { success: true, session: decorateSession(req, workspaceId, session) });
+        }
+        catch (error) {
+            writeJson(res, resolveErrorStatusCode(error, 400), {
+                success: false,
+                error: String(error?.message || 'Failed to add document review reply.'),
+                code: error?.code,
+            });
+        }
+    });
+    addRoute('PATCH', '/api/taskforce/document-reviews/sessions/:id/comments/:commentId/thread-status', async (req, res, params) => {
+        const workspaceId = requestWorkspaceId(req);
+        if (!ensureAppAccess(req, res))
+            return;
+        const body = await parseJsonBody(req);
+        try {
+            if (body?.status !== 'open' && body?.status !== 'resolved') {
+                writeJson(res, 400, { success: false, error: "status must be 'open' or 'resolved'." });
+                return;
+            }
+            const sessionId = String(params.id || '').trim();
+            const commentId = String(params.commentId || '').trim();
+            const actorId = resolveAuthenticatedMutationUserId(req);
+            const canModerate = ensureWorkspaceAdminRole(req, workspaceId);
+            const existingSession = core.getDocumentReviewSession({ workspaceId, sessionId });
+            const target = existingSession?.comments.find((comment) => comment.id === commentId) || null;
+            const session = core.updateDocumentReviewThreadStatus({
+                workspaceId,
+                sessionId,
+                commentId,
+                status: body.status,
+                actorId,
+                canModerate,
+            });
+            if (target && actorId !== target.authorActorId && canModerate) {
+                const membership = core.listWorkspaceUsers(workspaceId)
+                    .find((candidate) => candidate.userId === actorId);
+                core.addAdminAuditLog({
+                    action: 'document-review-comment-moderated',
+                    actorUserId: actorId,
+                    actorRole: membership?.role === 'owner' ? 'owner' : 'admin',
+                    workspaceId,
+                    details: {
+                        action: 'thread-status',
+                        status: body.status,
+                        sessionId,
+                        commentId,
+                        authorActorId: target.authorActorId,
+                        assetId: session.assetId,
+                    },
+                });
+            }
+            writeJson(res, 200, { success: true, session: decorateSession(req, workspaceId, session) });
+        }
+        catch (error) {
+            writeJson(res, resolveErrorStatusCode(error, 400), {
+                success: false,
+                error: String(error?.message || 'Failed to update document review thread.'),
+                code: error?.code,
+            });
+        }
+    });
     addRoute('PATCH', '/api/taskforce/document-reviews/sessions/:id/comments/:commentId', async (req, res, params) => {
         const workspaceId = requestWorkspaceId(req);
         if (!ensureAppAccess(req, res))
@@ -155,9 +263,9 @@ export function registerDocumentReviewRoutes(deps) {
                 anchor: body?.anchor === undefined
                     ? undefined
                     : (body?.anchor && typeof body.anchor === 'object' ? body.anchor : null),
-                actorId: resolveAuthenticatedUserId(req),
+                actorId: resolveAuthenticatedMutationUserId(req),
             });
-            writeJson(res, 200, { success: true, session });
+            writeJson(res, 200, { success: true, session: decorateSession(req, workspaceId, session) });
         }
         catch (error) {
             writeJson(res, resolveErrorStatusCode(error, 400), {
@@ -172,13 +280,45 @@ export function registerDocumentReviewRoutes(deps) {
         if (!ensureAppAccess(req, res))
             return;
         try {
+            const actorId = resolveAuthenticatedMutationUserId(req);
+            const url = new URL(req.url || '/', 'http://localhost');
+            const sessionId = String(params.id || '').trim();
+            const commentId = String(params.commentId || '').trim();
+            const existingSession = core.getDocumentReviewSession({ workspaceId, sessionId });
+            const target = existingSession?.comments.find((comment) => comment.id === commentId) || null;
+            const canModerate = ensureWorkspaceAdminRole(req, workspaceId);
             const session = core.deleteDocumentReviewComment({
                 workspaceId,
-                sessionId: String(params.id || '').trim(),
-                commentId: String(params.commentId || '').trim(),
-                actorId: resolveAuthenticatedUserId(req),
+                sessionId,
+                commentId,
+                actorId,
+                canModerate,
+                cascade: url.searchParams.get('cascade') === 'true',
             });
-            writeJson(res, 200, { success: true, session });
+            if (target && actorId !== target.authorActorId && canModerate) {
+                const membership = core.listWorkspaceUsers(workspaceId)
+                    .find((candidate) => candidate.userId === actorId);
+                const actorRole = membership?.role === 'owner' ? 'owner' : 'admin';
+                core.addAdminAuditLog({
+                    action: 'document-review-comment-moderated',
+                    actorUserId: actorId,
+                    actorRole,
+                    workspaceId,
+                    details: {
+                        action: 'delete',
+                        sessionId,
+                        commentId,
+                        cascadeCommentIds: target.parentCommentId
+                            ? [commentId]
+                            : existingSession?.comments
+                                .filter((comment) => comment.id === commentId || comment.parentCommentId === commentId)
+                                .map((comment) => comment.id),
+                        authorActorId: target.authorActorId,
+                        assetId: session.assetId,
+                    },
+                });
+            }
+            writeJson(res, 200, { success: true, session: decorateSession(req, workspaceId, session) });
         }
         catch (error) {
             writeJson(res, resolveErrorStatusCode(error, 400), {

package/dist/server/routes/documents.d.ts

@@ -8,6 +8,8 @@
  *   POST   /api/taskforce/context-upload/init
  *   POST   /api/taskforce/context-upload/finalize
  *   POST   /api/taskforce/context-upload
+ *   POST   /api/taskforce/context-upload/draft/promote
+ *   POST   /api/taskforce/context-upload/draft/discard
  *   GET    /api/taskforce/context/:filename
  *   GET    /api/taskforce/documents/:assetId/content
  *   GET    /api/taskforce/context-link
@@ -39,7 +41,7 @@ type AssetMetadata = DocumentRegistryEntry & {
     originalFilename?: string | null;
 };
 interface CanonicalReadResult {
-    statusCode: 200 | 302 | 404;
+    statusCode: 200 | 302 | 404 | 409;
     headers?: Record<string, string>;
     body?: Buffer;
 }
@@ -62,6 +64,7 @@ export interface DocumentRouteDependencies {
         filename: string;
         folderSegments?: string[];
         now?: Date;
+        assetId?: string;
     }) => {
         relativePath: string;
         assetId: string;
@@ -80,6 +83,7 @@ export interface DocumentRouteDependencies {
         workspaceId?: string;
         taskId?: string | null;
         originalName?: string | null;
+        actorRef?: string | null;
     }) => Promise<{
         scan?: {
             verdict?: string;
@@ -109,7 +113,7 @@ export interface DocumentRouteDependencies {
     sanitizeDownloadFilename: (nameRaw: string, fallback?: string) => string;
     contentTypeForExt: (ext: string) => string;
     inferInlineDocumentFromPath: (pathValue: string | null | undefined) => boolean;
-    resolveCanonicalDocumentRead: (params: {
+    resolveCanonicalContentRead: (params: {
         asset: WorkspaceAssetEntry;
         forceDownload: boolean;
         requestedFilename?: string | null;