@wildo-ai/saas-backend-lib 1.1.0 → 1.1.2

package/dist/esm/files/services/files.backend.service.js

@@ -24,8 +24,8 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { injectable, inject, optional } from 'inversify';
-import { CoreResourceOperation, CoreResourceType, ErrorType, ErrorCustomMessageReference, ResourcePrimaryScope, PRIMARY_SCOPE_TO_FIELD_IDENTIFIER, CORE_APP_ROLES, Resources_SharedUtils, isWildoBackendError, WildoHeaderKeys } from '@wildo-ai/saas-models';
-import { FileStatus, FILE_STATUS_TRANSITIONS, FileScopeUtils, FileServeVariant, ERASED_FILE_NAME_PLACEHOLDER } from '@wildo-ai/saas-models';
+import { CoreResourceOperation, CoreResourceType, ErrorType, ErrorCustomMessageReference, ResourcePrimaryScope, PRIMARY_SCOPE_TO_FIELD_IDENTIFIER, CORE_APP_ROLES, Resources_SharedUtils, isOrganizationWideRoleInfo, isWildoBackendError, WildoHeaderKeys } from '@wildo-ai/saas-models';
+import { FileStatus, FILE_STATUS_TRANSITIONS, FILE_LINKABLE_STATUSES, FileScopeUtils, FileServeVariant, ERASED_FILE_NAME_PLACEHOLDER } from '@wildo-ai/saas-models';
 import { resolveFileDisplayNature } from '@wildo-ai/zod-decorators';
 import { SAAS_SERVICE_TYPES } from '../../inject/models/service-types.js';
 import { ErrorBuilderBackendService } from '../../errors/services/error-builder.backend.service.js';
@@ -832,7 +832,8 @@ let FilesBackendService = class FilesBackendService {
          */
         const updatedFile = await this.filesRepository.update(internalContext, {
             _id: fileId,
-            status: { $in: [FileStatus.UPLOADED, FileStatus.CLEAN] },
+            // The linkable set is the same one the link-time validators consult (issue #320) — one copy.
+            status: { $in: [...FILE_LINKABLE_STATUSES] },
         }, {
             linkedResourceType: resourceType,
             linkedResourceId: resourceId,
@@ -889,14 +890,18 @@ let FilesBackendService = class FilesBackendService {
                     },
                 });
             }
-            // Wrong status (not UPLOADED)
+            // Not a linkable status. The guarded update above admits exactly FILE_LINKABLE_STATUSES, so
+            // reaching here means the row is outside that set (or moved out of it between read and write).
+            // SCANNING is named on its own: the file is not wrong, only not yet known to be safe — retry.
             throw this.errorBuilder.buildError(ErrorType.BUSINESS_RULE, executionContext, {
-                customMessageReference: ErrorCustomMessageReference.FILE_NOT_IN_UPLOADED_STATUS,
+                customMessageReference: currentFile.status === FileStatus.SCANNING
+                    ? ErrorCustomMessageReference.FILE_SCAN_IN_PROGRESS
+                    : ErrorCustomMessageReference.FILE_NOT_LINKABLE,
                 context: {
                     // diagnostic (log-only)
                     fileId,
                     fileStatus: currentFile.status,
-                    expectedStatus: FileStatus.UPLOADED,
+                    linkableStatuses: [...FILE_LINKABLE_STATUSES],
                     resourceType,
                     resourceId,
                 },
@@ -1285,16 +1290,40 @@ let FilesBackendService = class FilesBackendService {
                     return false;
                 }
                 return true;
-            case ResourcePrimaryScope.ORGANIZATIONS:
-                // ORGANIZATIONS scope: user must belong to the organization
-                if (file.organizationId !== accessScope.organizationId) {
-                    this.logDebug('File access denied: organization mismatch', {
-                        fileOrganizationId: file.organizationId,
-                        requestOrganizationId: accessScope.organizationId,
-                    });
-                    return false;
+            case ResourcePrimaryScope.ORGANIZATIONS: {
+                // The caller is ACTING IN an organization: it must be the file's. Unchanged, and deliberately
+                // not widened — a principal acting in organization A must not reach organization B's file
+                // through this route merely because it also belongs to B. The acting scope is the confinement.
+                if (accessScope.organizationId) {
+                    if (file.organizationId !== accessScope.organizationId) {
+                        this.logDebug('File access denied: organization mismatch', {
+                            fileOrganizationId: file.organizationId,
+                            requestOrganizationId: accessScope.organizationId,
+                        });
+                        return false;
+                    }
+                    return true;
                 }
-                return true;
+                /*
+                 * No acting organization — ask the MEMBERSHIP question instead of denying.
+                 *
+                 * The four global file routes (`/files/:fileId` and friends) build their execution context from
+                 * a URL that carries no parameters, and `extractInitiatorIds` populates `initiatorIds.organizationId`
+                 * only from URL critical params. So the context holds `userId` and nothing else, this comparison
+                 * ran against `undefined`, and every ORGANIZATIONS-scoped file 404'd for its own owner (#68) —
+                 * taking `DisplayFieldFile`'s metadata band with it, since that band loads from this endpoint.
+                 *
+                 * The row already names its organization, so the open question is not WHICH organization but
+                 * whether the caller belongs to it. That is answered from `initiatorRoles`, which the request
+                 * cannot author for itself — `execution-context-creator` builds it from memberships, and only
+                 * from `OrganizationMemberStatus.ACTIVE` ones, so a suspended member contributes no entry here.
+                 *
+                 * A caller-supplied `?organizationId=` is deliberately NOT consulted: that resolution exists only
+                 * on the manual-controller path, and reading a tenant identity off the request is the shape this
+                 * check exists to refuse.
+                 */
+                return this.callerHoldsOrganizationWideMembership(file.organizationId, executionContext);
+            }
             case ResourcePrimaryScope.USER_SELF:
                 // USER_SELF scope: access is granted iff the caller IS the owner. USER_SELF and
                 // ORGANIZATIONS are independent primary-scope axes, so there is NO org check here —
@@ -1353,6 +1382,40 @@ let FilesBackendService = class FilesBackendService {
      * @param executionContext - Execution context
      * @returns Access scope information with all identifiers
      */
+    /**
+     * Does the caller hold ORGANIZATION-WIDE membership of this exact organization?
+     *
+     * Answered only from `initiatorRoles`, the one input a request cannot author for itself.
+     *
+     * **A unit-scoped entry does not count, and that is a decision rather than an oversight.**
+     * `ExecutionContext_RoleInfo.organizationUnitId` marks a grant that is live authority inside ONE unit,
+     * and its own schema is explicit that reading such an entry as tenant-wide is "a privilege escalation,
+     * not a convenience". Membership of the tenant is arguably implied either way — a unit member is a
+     * member — but this route serves a file scoped to the WHOLE organization, so the narrower reading is
+     * the safe one and {@link isOrganizationWideRoleInfo} is the single definition of it. If a unit-scoped
+     * caller should reach an organization-scoped file, argue it and change it here, once.
+     *
+     * A platform administrator who is not a member gets nothing from this, which is also deliberate: the
+     * cross-tenant admission model is per-operation-variant (`admitsCrossTenantPlatformAdministration` plus
+     * a usable platform-access grant), these controller routes are not resource operations, and granting
+     * reach by position in the request path is exactly the ambient privilege that model removed.
+     */
+    callerHoldsOrganizationWideMembership(fileOrganizationId, executionContext) {
+        if (!fileOrganizationId) {
+            this.logDebug('File access denied: organization-scoped file carries no organization owner');
+            return false;
+        }
+        const membership = (executionContext.initiatorRoles ?? []).find((roleInfo) => roleInfo.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS &&
+            isOrganizationWideRoleInfo(roleInfo) &&
+            roleInfo.relatedResourceId === fileOrganizationId);
+        if (!membership) {
+            this.logDebug('File access denied: caller holds no organization-wide membership of the file\'s organization', {
+                fileOrganizationId,
+            });
+            return false;
+        }
+        return true;
+    }
     deriveAccessScope(executionContext) {
         const organizationId = this.resourceOperationHelper.getInitiatorId(executionContext, 'organization');
         const userId = this.resourceOperationHelper.getInitiatorId(executionContext, 'user');