studiograph 1.3.47 → 1.3.48-beta.0

package/dist/server/routes/views-api.js

@@ -8,34 +8,51 @@ export async function registerViewsApiRoutes(fastify, authService, workspaceMana
     function getUserId(req) {
         return req.user?.id ?? 0;
     }
-    function hasTasks() {
+    function getEntityTypeCounts() {
+        const counts = {};
         try {
             for (const repo of workspaceManager.getAllRepoConfigs()) {
                 const graph = workspaceManager.getGraph(repo.name);
-                const tasks = graph.search({ entityType: 'task' });
-                if (tasks.length > 0)
-                    return true;
+                const entities = graph.search({});
+                for (const e of entities) {
+                    const type = e.data?.entity_type;
+                    if (type)
+                        counts[type] = (counts[type] ?? 0) + 1;
+                }
             }
         }
         catch { /* ignore */ }
-        return false;
+        return counts;
     }
     // GET /api/views — list user's views (auto-creates defaults on first access)
     fastify.get('/api/views', async (req, reply) => {
         const userId = getUserId(req);
-        authService.ensureDefaultViews(userId, hasTasks());
+        authService.ensureDefaultViews(userId, getEntityTypeCounts());
         return reply.send(authService.getUserViews(userId));
     });
     // POST /api/views — create a new view
     fastify.post('/api/views', async (req, reply) => {
         const userId = getUserId(req);
+        const user = req.user;
         const { name, viewType, config } = req.body ?? {};
         if (!name) {
             return reply.status(400).send({ error: 'name is required' });
         }
-        const view = authService.createUserView(userId, name, viewType ?? 'list', config ?? {});
+        const view = authService.createUserView(userId, name, viewType ?? 'list', config ?? {}, user?.displayName ?? user?.email);
         return reply.send(view);
     });
+    // POST /api/views/:id/share — toggle view visibility
+    fastify.post('/api/views/:id/share', async (req, reply) => {
+        const userId = getUserId(req);
+        const viewId = Number(req.params.id);
+        const existing = authService.getUserView(viewId, userId);
+        if (!existing) {
+            return reply.status(404).send({ error: 'View not found' });
+        }
+        const visibility = req.body?.visibility ?? 'private';
+        authService.setViewVisibility(viewId, userId, visibility);
+        return reply.send({ ok: true, visibility });
+    });
     // PUT /api/views/:id — update a view
     fastify.put('/api/views/:id', async (req, reply) => {
         const userId = getUserId(req);
@@ -62,5 +79,62 @@ export async function registerViewsApiRoutes(fastify, authService, workspaceMana
         authService.deleteUserView(viewId, userId);
         return reply.send({ ok: true });
     });
+    // ── Workspace views (folder-views redesign) ──
+    // Workspace-shared, scope-keyed view sets. Scope is `folder:<id>` |
+    // `type:<entityType>` | `recent`. Not per-user — everyone sees the same set.
+    const VIEW_TYPES = new Set(['list', 'gallery', 'kanban', 'timeline', 'calendar', 'graph']);
+    // GET /api/workspace-views?scope=… — ordered views for a scope (seeds defaults
+    // on first access: a List, plus Calendar+Graph for `recent`).
+    fastify.get('/api/workspace-views', async (req, reply) => {
+        const scope = req.query?.scope;
+        if (!scope)
+            return reply.status(400).send({ error: 'scope is required' });
+        return reply.send(authService.ensureViewsForScope(scope));
+    });
+    // POST /api/workspace-views — add a view to a scope. One-of-each is enforced
+    // by the DB; `recent` is a fixed set and rejects additions.
+    fastify.post('/api/workspace-views', async (req, reply) => {
+        const user = req.user;
+        const { scope, viewType, config } = req.body ?? {};
+        if (!scope)
+            return reply.status(400).send({ error: 'scope is required' });
+        if (!viewType || !VIEW_TYPES.has(viewType)) {
+            return reply.status(400).send({ error: 'valid viewType is required' });
+        }
+        if (scope === 'recent') {
+            return reply.status(400).send({ error: 'The Recent view set is fixed' });
+        }
+        const view = authService.createWorkspaceView(scope, viewType, config ?? {}, user?.displayName ?? user?.email);
+        return reply.send(view);
+    });
+    // PUT /api/workspace-views/:id — update config / position / name.
+    fastify.put('/api/workspace-views/:id', async (req, reply) => {
+        const viewId = Number(req.params.id);
+        const existing = authService.getWorkspaceView(viewId);
+        if (!existing)
+            return reply.status(404).send({ error: 'View not found' });
+        authService.updateWorkspaceView(viewId, {
+            config: req.body?.config,
+            position: req.body?.position,
+            name: req.body?.name,
+        });
+        return reply.send({ ok: true });
+    });
+    // DELETE /api/workspace-views/:id — remove a view. List is un-removable (every
+    // scope keeps ≥1 view) and the `recent` set is fixed.
+    fastify.delete('/api/workspace-views/:id', async (req, reply) => {
+        const viewId = Number(req.params.id);
+        const existing = authService.getWorkspaceView(viewId);
+        if (!existing)
+            return reply.status(404).send({ error: 'View not found' });
+        if (existing.viewType === 'list') {
+            return reply.status(400).send({ error: 'The List view cannot be removed' });
+        }
+        if (existing.scope === 'recent') {
+            return reply.status(400).send({ error: 'The Recent view set is fixed' });
+        }
+        authService.deleteWorkspaceView(viewId);
+        return reply.send({ ok: true });
+    });
 }
 //# sourceMappingURL=views-api.js.map

package/dist/server/routes/views-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"views-api.js","sourceRoot":"","sources":["../../../src/server/routes/views-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAwB,EACxB,WAAwB,EACxB,gBAAkC;IAGlC,SAAS,SAAS,CAAC,GAAQ;QACzB,OAAS,GAAW,CAAC,IAA6B,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,SAAS,QAAQ;QACf,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;gBACnD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6EAA6E;IAC7E,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,WAAW,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,YAAY,EACZ,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,IAAI,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;QACxF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,qCAAqC;IACrC,OAAO,CAAC,GAAG,CACT,gBAAgB,EAChB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE;YACzC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI;YACpB,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM;YACxB,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS;SAC/B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,wCAAwC;IACxC,OAAO,CAAC,MAAM,CACZ,gBAAgB,EAChB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"views-api.js","sourceRoot":"","sources":["../../../src/server/routes/views-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAwB,EACxB,WAAwB,EACxB,gBAAkC;IAGlC,SAAS,SAAS,CAAC,GAAQ;QACzB,OAAS,GAAW,CAAC,IAA6B,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,SAAS,mBAAmB;QAC1B,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,WAAqB,CAAC;oBAC3C,IAAI,IAAI;wBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6EAA6E;IAC7E,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,WAAW,CAAC,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,YAAY,EACZ,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,IAAI,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1H,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,qDAAqD;IACrD,OAAO,CAAC,IAAI,CACV,sBAAsB,EACtB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,SAAS,CAAC;QACrD,WAAW,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9C,CAAC,CACF,CAAC;IAEF,qCAAqC;IACrC,OAAO,CAAC,GAAG,CACT,gBAAgB,EAChB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE;YACzC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI;YACpB,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM;YACxB,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS;SAC/B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,wCAAwC;IACxC,OAAO,CAAC,MAAM,CACZ,gBAAgB,EAChB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,gDAAgD;IAChD,oEAAoE;IACpE,6EAA6E;IAE7E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3F,+EAA+E;IAC/E,8DAA8D;IAC9D,OAAO,CAAC,GAAG,CACT,sBAAsB,EACtB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC;QAC/B,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5D,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,4DAA4D;IAC5D,OAAO,CAAC,IAAI,CACV,sBAAsB,EACtB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9G,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,kEAAkE;IAClE,OAAO,CAAC,GAAG,CACT,0BAA0B,EAC1B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC1E,WAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE;YACtC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM;YACxB,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,+EAA+E;IAC/E,sDAAsD;IACtD,OAAO,CAAC,MAAM,CACZ,0BAA0B,EAC1B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC1E,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/server/routes/workspace-api.d.ts

@@ -6,4 +6,5 @@
 import type { FastifyInstance } from 'fastify';
 import { WorkspaceManager } from '../../core/workspace-manager.js';
 import { GitUser } from '../../services/git.js';
-export declare function registerWorkspaceApiRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, gitUser: GitUser): Promise<void>;
+import { type AuthService } from '../../services/auth-service.js';
+export declare function registerWorkspaceApiRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, gitUser: GitUser, authService: AuthService): Promise<void>;

package/dist/server/routes/workspace-api.js

@@ -3,14 +3,32 @@
  *
  * Git operations: status, commit, push, pull across all repos.
  */
-/** Repo names eligible for local git ops (status, commit, revert) — includes private. */
+import { existsSync, statSync } from 'fs';
+import { join } from 'path';
+import archiver from 'archiver';
+import * as access from '../../services/access-control.js';
+import { log } from '../../utils/log.js';
+/** Repo names eligible for local git ops (status, commit, revert) — includes personal. */
 function getLocalRepoNames(wm) {
     return wm.getAllRepoConfigs().map(r => r.name);
 }
-export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitUser) {
+function getReadableLocalRepoNames(user, wm, authService) {
+    return getLocalRepoNames(wm).filter(name => access.hasRepoAccess(user, name, wm, authService));
+}
+function getWritableLocalRepoNames(user, wm, authService) {
+    return getLocalRepoNames(wm).filter(name => access.canWriteRepo(user, name, wm, authService));
+}
+function getWritableSyncRepoNames(user, wm, authService) {
+    return wm
+        .getAllRepoConfigs()
+        .filter(repo => !repo.personal && access.canWriteRepo(user, repo.name, wm, authService))
+        .map(repo => repo.name);
+}
+export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitUser, authService) {
     // GET /api/status — git status across all repos
-    fastify.get('/api/status', async (_req, reply) => {
-        const repoNames = getLocalRepoNames(workspaceManager);
+    fastify.get('/api/status', async (req, reply) => {
+        const user = req.user;
+        const repoNames = getReadableLocalRepoNames(user, workspaceManager, authService);
         const results = [];
         for (const name of repoNames) {
             try {
@@ -72,7 +90,8 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
         const { message } = req.body ?? {};
         const commitMessage = message || 'Update from web UI';
         try {
-            const repoNames = getLocalRepoNames(workspaceManager);
+            const user = req.user;
+            const repoNames = getWritableLocalRepoNames(user, workspaceManager, authService);
             const committed = [];
             for (const name of repoNames) {
                 try {
@@ -96,19 +115,20 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
             return reply.status(500).send({ error: err.message });
         }
     });
-    // POST /api/push — push all repos (skip private)
-    fastify.post('/api/push', async (_req, reply) => {
+    // POST /api/push — push writable repos (skip personal)
+    fastify.post('/api/push', async (req, reply) => {
         try {
-            const repos = workspaceManager.getAllRepoConfigs().filter(r => !r.private);
+            const user = req.user;
+            const repoNames = getWritableSyncRepoNames(user, workspaceManager, authService);
             const pushed = [];
-            for (const repoConfig of repos) {
+            for (const name of repoNames) {
                 try {
-                    const graph = workspaceManager.getGraph(repoConfig.name);
+                    const graph = workspaceManager.getGraph(name);
                     const git = graph.gitService;
                     if (!git)
                         continue;
                     await git.push();
-                    pushed.push(repoConfig.name);
+                    pushed.push(name);
                 }
                 catch {
                     // Skip individual repo failures
@@ -120,19 +140,20 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
             return reply.status(500).send({ error: err.message });
         }
     });
-    // POST /api/pull — pull all repos (skip private)
-    fastify.post('/api/pull', async (_req, reply) => {
+    // POST /api/pull — pull writable repos (skip personal)
+    fastify.post('/api/pull', async (req, reply) => {
         try {
-            const repos = workspaceManager.getAllRepoConfigs().filter(r => !r.private);
+            const user = req.user;
+            const repoNames = getWritableSyncRepoNames(user, workspaceManager, authService);
             const pulled = [];
-            for (const repoConfig of repos) {
+            for (const name of repoNames) {
                 try {
-                    const graph = workspaceManager.getGraph(repoConfig.name);
+                    const graph = workspaceManager.getGraph(name);
                     const git = graph.gitService;
                     if (!git)
                         continue;
                     await git.pull();
-                    pulled.push(repoConfig.name);
+                    pulled.push(name);
                 }
                 catch {
                     // Skip individual repo failures
@@ -145,9 +166,10 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
         }
     });
     // POST /api/revert — revert all uncommitted changes across all repos
-    fastify.post('/api/revert', async (_req, reply) => {
+    fastify.post('/api/revert', async (req, reply) => {
         try {
-            const repoNames = getLocalRepoNames(workspaceManager);
+            const user = req.user;
+            const repoNames = getWritableLocalRepoNames(user, workspaceManager, authService);
             const reverted = [];
             for (const name of repoNames) {
                 try {
@@ -173,6 +195,10 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
     });
     // GET /api/repos/:repo/status — git status for a single repo
     fastify.get('/api/repos/:repo/status', async (req, reply) => {
+        const user = req.user;
+        if (!access.hasRepoAccess(user, req.params.repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: 'Repo not found' });
+        }
         try {
             const graph = workspaceManager.getGraph(req.params.repo);
             const git = graph.gitService;
@@ -200,6 +226,11 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
     });
     // POST /api/repos/:repo/publish — commit + push a single repo
     fastify.post('/api/repos/:repo/publish', async (req, reply) => {
+        const user = req.user;
+        // Publish writes to the shared remote — require write access.
+        if (!access.canWriteRepo(user, req.params.repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: 'Repo not found' });
+        }
         try {
             const graph = workspaceManager.getGraph(req.params.repo);
             const git = graph.gitService;
@@ -222,6 +253,12 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
     });
     // POST /api/repos/:repo/revert — revert uncommitted changes in a single repo
     fastify.post('/api/repos/:repo/revert', async (req, reply) => {
+        const user = req.user;
+        // Revert is destructive — require write access. A non-member must
+        // not be able to discard another user's uncommitted work.
+        if (!access.canWriteRepo(user, req.params.repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: 'Repo not found' });
+        }
         try {
             const graph = workspaceManager.getGraph(req.params.repo);
             const git = graph.gitService;
@@ -242,7 +279,7 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
         for (const repoConfig of repos) {
             try {
                 const graph = workspaceManager.getGraph(repoConfig.name);
-                const entities = graph.search({}).filter((e) => !e.id.toLowerCase().startsWith('readme'));
+                const entities = graph.search({});
                 totalEntities += entities.length;
                 for (const e of entities) {
                     totalLinks += (e.document?.wikilinks?.length ?? 0);
@@ -257,27 +294,79 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
             links: totalLinks,
         });
     });
-    // GET /api/sync-status — ahead/behind counts for all repos (skip private)
-    fastify.get('/api/sync-status', async (_req, reply) => {
-        const repos = workspaceManager.getAllRepoConfigs().filter(r => !r.private);
-        let totalAhead = 0;
-        let totalBehind = 0;
-        for (const repoConfig of repos) {
+    // GET /api/workspace/export — stream a zip of the caller's accessible
+    // workspace (all shared folders they're a member of + their personal
+    // folder, plus a filtered .studiograph). Honours the same access scope
+    // as `studiograph clone` — owners do NOT see other users' personal
+    // folders, since those are local-only by design.
+    //
+    // The zip preserves each repo's .git directory so users can keep working
+    // from the export (commit history intact). Excluded from .studiograph:
+    // auth.db, server-auth.json, populate-cache/, memory/, *.log — same
+    // exclusion list the CLI clone .gitignore enforces. Secrets and per-user
+    // server state shouldn't leave the server in a portable archive.
+    fastify.get('/api/workspace/export', async (req, reply) => {
+        const user = req.user;
+        const repos = user
+            ? access.getAccessibleRepos(user, workspaceManager, authService)
+            : workspaceManager.getAllRepoConfigs();
+        const workspacePath = workspaceManager.getWorkspacePath();
+        const dateStamp = new Date().toISOString().slice(0, 10);
+        const slug = workspaceManager.config?.team_name
+            ? String(workspaceManager.config.team_name).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '')
+            : 'studiograph';
+        const filename = `${slug || 'studiograph'}-${dateStamp}.zip`;
+        reply.header('Content-Type', 'application/zip');
+        reply.header('Content-Disposition', `attachment; filename="${filename}"`);
+        const archive = archiver('zip', { zlib: { level: 6 } });
+        archive.on('warning', (err) => {
+            // ENOENT on missing optional files is fine; bail on anything else.
+            if (err?.code !== 'ENOENT')
+                log.error('[export] archive warning:', err);
+        });
+        archive.on('error', (err) => {
+            log.error('[export] archive error:', err);
+            reply.raw.destroy(err);
+        });
+        // Pipe directly to the underlying socket — Fastify's reply.send() would
+        // try to serialize the stream and add headers we've already set.
+        archive.pipe(reply.raw);
+        // Each accessible repo, with its .git history. Repos live at
+        // `${workspacePath}/${repo.path}` per WorkspaceManager's layout.
+        for (const repo of repos) {
+            const repoPath = join(workspacePath, repo.path);
+            if (!existsSync(repoPath))
+                continue;
             try {
-                const graph = workspaceManager.getGraph(repoConfig.name);
-                const git = graph.gitService;
-                if (!git)
+                if (!statSync(repoPath).isDirectory())
                     continue;
-                git.fetch();
-                const { ahead, behind } = git.getAheadBehind();
-                totalAhead += ahead;
-                totalBehind += behind;
             }
             catch {
-                // Skip repos without git/remote
+                continue;
             }
+            archive.directory(repoPath, repo.path);
+        }
+        // .studiograph — workspace.json, sources, connectors, ABOUT.md, schema.
+        // Mirrors the CLI clone .gitignore exclusion list so secrets, per-user
+        // server state, caches, and logs stay on the server.
+        const studiographPath = join(workspacePath, '.studiograph');
+        if (existsSync(studiographPath)) {
+            archive.glob('**/*', {
+                cwd: studiographPath,
+                ignore: [
+                    'auth.db',
+                    'auth.db-journal',
+                    'auth-seed.json',
+                    'server-auth.json',
+                    'populate-cache/**',
+                    'memory/**',
+                    'sessions/**',
+                    '*.log',
+                ],
+                dot: true,
+            }, { prefix: '.studiograph' });
         }
-        return reply.send({ ahead: totalAhead, behind: totalBehind });
+        await archive.finalize();
     });
 }
 //# sourceMappingURL=workspace-api.js.map

package/dist/server/routes/workspace-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-api.js","sourceRoot":"","sources":["../../../src/server/routes/workspace-api.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,yFAAyF;AACzF,SAAS,iBAAiB,CAAC,EAAoB;IAC7C,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAwB,EACxB,gBAAkC,EAClC,OAAgB;IAEhB,gDAAgD;IAChD,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,SAAS,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QACtD,MAAM,OAAO,GAAmG,EAAE,CAAC;QAEnH,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC9C,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;gBACtC,IAAI,CAAC,GAAG;oBAAE,SAAS;gBAEnB,qCAAqC;gBACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;gBAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC,CAAC,4BAA4B;gBACzE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,KAAK,GAAI,CAAC,CAAC,IAAI,EAAE,IAAe,IAAI,CAAC,CAAC,EAAE,CAAC;oBAC/C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;oBACzB,MAAM,KAAK,GAAI,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC1C,IAAI,KAAK,EAAE,CAAC;wBACV,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;wBACtC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACjB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBAC3B,CAAC;gBACH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;gBAClC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChC,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,IAAI;wBACV,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;4BAC7B,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;4BAC7B,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC;4BAE1C,gDAAgD;4BAChD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;4BACxE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gCAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gCACvC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oCACvB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gCAChF,CAAC;4BACH,CAAC;4BAED,0EAA0E;4BAC1E,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gCACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gCAC5B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;oCACrC,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,GAAG,GAAG,IAAI,OAAO,KAAK,KAAK,GAAG,IAAI,EAAE,CAAC;wCAC7E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oCAC9E,CAAC;gCACH,CAAC;4BACH,CAAC;4BAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;wBAChD,CAAC,CAAC;qBACH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,aAAa,EACb,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,OAAO,IAAI,oBAAoB,CAAC;QAEtD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;YACtD,MAAM,SAAS,GAAa,EAAE,CAAC;YAE/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC9C,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;oBACtC,IAAI,CAAC,GAAG;wBAAE,SAAS;oBAEnB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;oBAClC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAChC,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;wBAC5C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACvB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,gCAAgC;gBAClC,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,iDAAiD;IACjD,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3E,MAAM,MAAM,GAAa,EAAE,CAAC;YAE5B,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBACzD,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;oBACtC,IAAI,CAAC,GAAG;wBAAE,SAAS;oBAEnB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;oBACjB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC/B,CAAC;gBAAC,MAAM,CAAC;oBACP,gCAAgC;gBAClC,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,iDAAiD;IACjD,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3E,MAAM,MAAM,GAAa,EAAE,CAAC;YAE5B,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBACzD,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;oBACtC,IAAI,CAAC,GAAG;wBAAE,SAAS;oBAEnB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;oBACjB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC/B,CAAC;gBAAC,MAAM,CAAC;oBACP,gCAAgC;gBAClC,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAChD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAE9B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC9C,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;oBACtC,IAAI,CAAC,GAAG;wBAAE,SAAS;oBAEnB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;oBAClC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAChC,GAAG,CAAC,SAAS,EAAE,CAAC;wBAChB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACtB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,gCAAgC;gBAClC,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,OAAO,CAAC,GAAG,CACT,yBAAyB,EACzB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;YACtC,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAErE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAE3C,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC;gBAChC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;gBACjB,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;gBACnB,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CACF,CAAC;IAEF,8DAA8D;IAC9D,OAAO,CAAC,IAAI,CACV,0BAA0B,EAC1B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;YACtC,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAErE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,oBAAoB,CAAC;gBAC1D,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,CAAC;gBAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;YAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,OAAO,CAAC,IAAI,CACV,yBAAyB,EACzB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;YACtC,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAErE,GAAG,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,+DAA+D;IAC/D,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;QACnD,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC/F,aAAa,IAAI,QAAQ,CAAC,MAAM,CAAC;gBACjC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,UAAU,IAAI,CAAE,CAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,QAAQ,EAAE,aAAa;YACvB,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpD,MAAM,KAAK,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,WAAW,GAAG,CAAC,CAAC;QAEpB,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBACzD,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;gBACtC,IAAI,CAAC,GAAG;oBAAE,SAAS;gBAEnB,GAAG,CAAC,KAAK,EAAE,CAAC;gBACZ,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC;gBAC/C,UAAU,IAAI,KAAK,CAAC;gBACpB,WAAW,IAAI,MAAM,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"workspace-api.js","sourceRoot":"","sources":["../../../src/server/routes/workspace-api.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,QAAQ,MAAM,UAAU,CAAC;AAKhC,OAAO,KAAK,MAAM,MAAM,kCAAkC,CAAC;AAC3D,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC,0FAA0F;AAC1F,SAAS,iBAAiB,CAAC,EAAoB;IAC7C,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,yBAAyB,CAAC,IAA0B,EAAE,EAAoB,EAAE,WAAwB;IAC3G,OAAO,iBAAiB,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,yBAAyB,CAAC,IAA0B,EAAE,EAAoB,EAAE,WAAwB;IAC3G,OAAO,iBAAiB,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,wBAAwB,CAAC,IAA0B,EAAE,EAAoB,EAAE,WAAwB;IAC1G,OAAO,EAAE;SACN,iBAAiB,EAAE;SACnB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;SACvF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAwB,EACxB,gBAAkC,EAClC,OAAgB,EAChB,WAAwB;IAExB,gDAAgD;IAChD,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QACjF,MAAM,OAAO,GAAmG,EAAE,CAAC;QAEnH,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC9C,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;gBACtC,IAAI,CAAC,GAAG;oBAAE,SAAS;gBAEnB,qCAAqC;gBACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;gBAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC,CAAC,4BAA4B;gBACzE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,KAAK,GAAI,CAAC,CAAC,IAAI,EAAE,IAAe,IAAI,CAAC,CAAC,EAAE,CAAC;oBAC/C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;oBACzB,MAAM,KAAK,GAAI,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC1C,IAAI,KAAK,EAAE,CAAC;wBACV,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;wBACtC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACjB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBAC3B,CAAC;gBACH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;gBAClC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChC,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,IAAI;wBACV,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;4BAC7B,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;4BAC7B,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC;4BAE1C,gDAAgD;4BAChD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;4BACxE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gCAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gCACvC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oCACvB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gCAChF,CAAC;4BACH,CAAC;4BAED,0EAA0E;4BAC1E,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gCACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gCAC5B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;oCACrC,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,GAAG,GAAG,IAAI,OAAO,KAAK,KAAK,GAAG,IAAI,EAAE,CAAC;wCAC7E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oCAC9E,CAAC;gCACH,CAAC;4BACH,CAAC;4BAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;wBAChD,CAAC,CAAC;qBACH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,aAAa,EACb,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,OAAO,IAAI,oBAAoB,CAAC;QAEtD,IAAI,CAAC;YACH,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;YACvD,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YACjF,MAAM,SAAS,GAAa,EAAE,CAAC;YAE/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC9C,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;oBACtC,IAAI,CAAC,GAAG;wBAAE,SAAS;oBAEnB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;oBAClC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAChC,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;wBAC5C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACvB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,gCAAgC;gBAClC,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,uDAAuD;IACvD,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;YACvD,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAChF,MAAM,MAAM,GAAa,EAAE,CAAC;YAE5B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC9C,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;oBACtC,IAAI,CAAC,GAAG;wBAAE,SAAS;oBAEnB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;oBACjB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACP,gCAAgC;gBAClC,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uDAAuD;IACvD,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;YACvD,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAChF,MAAM,MAAM,GAAa,EAAE,CAAC;YAE5B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC9C,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;oBACtC,IAAI,CAAC,GAAG;wBAAE,SAAS;oBAEnB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;oBACjB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACP,gCAAgC;gBAClC,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;YACvD,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YACjF,MAAM,QAAQ,GAAa,EAAE,CAAC;YAE9B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC9C,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;oBACtC,IAAI,CAAC,GAAG;wBAAE,SAAS;oBAEnB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;oBAClC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAChC,GAAG,CAAC,SAAS,EAAE,CAAC;wBAChB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACtB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,gCAAgC;gBAClC,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,OAAO,CAAC,GAAG,CACT,yBAAyB,EACzB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YAChF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;YACtC,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAErE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAE3C,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC;gBAChC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;gBACjB,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;gBACnB,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CACF,CAAC;IAEF,8DAA8D;IAC9D,OAAO,CAAC,IAAI,CACV,0BAA0B,EAC1B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,8DAA8D;QAC9D,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YAC/E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;YACtC,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAErE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,oBAAoB,CAAC;gBAC1D,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,CAAC;gBAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;YAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,OAAO,CAAC,IAAI,CACV,yBAAyB,EACzB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,kEAAkE;QAClE,0DAA0D;QAC1D,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YAC/E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,GAAG,GAAI,KAAa,CAAC,UAAU,CAAC;YACtC,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAErE,GAAG,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,+DAA+D;IAC/D,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;QACnD,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClC,aAAa,IAAI,QAAQ,CAAC,MAAM,CAAC;gBACjC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,UAAU,IAAI,CAAE,CAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,QAAQ,EAAE,aAAa;YACvB,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,qEAAqE;IACrE,uEAAuE;IACvE,mEAAmE;IACnE,iDAAiD;IACjD,EAAE;IACF,yEAAyE;IACzE,uEAAuE;IACvE,oEAAoE;IACpE,yEAAyE;IACzE,iEAAiE;IACjE,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACxD,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI;YAChB,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC;YAChE,CAAC,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;QACzC,MAAM,aAAa,GAAG,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;QAE1D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAI,gBAAwB,CAAC,MAAM,EAAE,SAAS;YACtD,CAAC,CAAC,MAAM,CAAE,gBAAwB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;YACpH,CAAC,CAAC,aAAa,CAAC;QAClB,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,aAAa,IAAI,SAAS,MAAM,CAAC;QAE7D,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;QAChD,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,yBAAyB,QAAQ,GAAG,CAAC,CAAC;QAE1E,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAQ,EAAE,EAAE;YACjC,mEAAmE;YACnE,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ;gBAAE,GAAG,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAQ,EAAE,EAAE;YAC/B,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;YAC1C,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QAEH,wEAAwE;QACxE,iEAAiE;QACjE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAExB,6DAA6D;QAC7D,iEAAiE;QACjE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACpC,IAAI,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;oBAAE,SAAS;YAClD,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YACrB,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,qDAAqD;QACrD,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE;gBACnB,GAAG,EAAE,eAAe;gBACpB,MAAM,EAAE;oBACN,SAAS;oBACT,iBAAiB;oBACjB,gBAAgB;oBAChB,kBAAkB;oBAClB,mBAAmB;oBACnB,WAAW;oBACX,aAAa;oBACb,OAAO;iBACR;gBACD,GAAG,EAAE,IAAI;aACV,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AAEL,CAAC"}

package/dist/server/routes/ws.d.ts

@@ -4,6 +4,7 @@
  */
 import type { FastifyInstance } from 'fastify';
 import type { AuthService } from '../../services/auth-service.js';
+import type { WorkspaceManager } from '../../core/workspace-manager.js';
 import type { WsHub } from '../ws-hub.js';
 import type { YjsManager } from '../yjs-manager.js';
-export declare function registerWsRoute(fastify: FastifyInstance, wsHub: WsHub, authService: AuthService, yjsManager: YjsManager): Promise<void>;
+export declare function registerWsRoute(fastify: FastifyInstance, wsHub: WsHub, authService: AuthService, workspaceManager: WorkspaceManager, yjsManager: YjsManager): Promise<void>;

package/dist/server/routes/ws.js

@@ -2,7 +2,28 @@
  * WebSocket endpoint — authenticates connections, registers them with the hub,
  * and handles Yjs binary sync/awareness messages via YjsManager.
  */
-export async function registerWsRoute(fastify, wsHub, authService, yjsManager) {
+import * as access from '../../services/access-control.js';
+import { log } from '../../utils/log.js';
+/**
+ * Build a per-connection repo access predicate. In open mode (`user == null`)
+ * everything is allowed. Otherwise we delegate to access-control's
+ * hasRepoAccess so personal-folder restrictions and owner-on-shared-folder
+ * semantics match the HTTP API.
+ */
+function makeCanAccess(user, workspaceManager, authService) {
+    if (!user)
+        return () => true;
+    return (repo) => access.hasRepoAccess(user, repo, workspaceManager, authService);
+}
+/** docName encodes `${repo}/${entityType}/${entityId}`. Returns the repo
+ *  segment, or null if the format is malformed. */
+function parseRepoFromDocName(docName) {
+    const slash = docName.indexOf('/');
+    if (slash <= 0)
+        return null;
+    return docName.slice(0, slash);
+}
+export async function registerWsRoute(fastify, wsHub, authService, workspaceManager, yjsManager) {
     fastify.get('/ws', { websocket: true }, (socket, req) => {
         // Authenticate via JWT cookie or ?token= query param
         const cookies = req.cookies;
@@ -21,32 +42,35 @@ export async function registerWsRoute(fastify, wsHub, authService, yjsManager) {
                 socket.close(4001, 'Invalid token');
                 return;
             }
-            const collections = user.role === 'admin'
-                ? null
-                : authService.getUserCollections(user.id);
-            const collectionSet = collections ? new Set(collections) : null;
-            wsHub.addClient(socket, user, collections);
-            wsHub.sendPresenceSnapshot(socket, collectionSet);
+            // Folder membership feeds presence visibility. Per-message access
+            // (Yjs sync, presence write, collab:join/leave) goes through canAccess
+            // which honors personal-folder restrictions even on stale grants.
+            const folders = authService.getUserFolders(user.id);
+            const folderSet = new Set(folders);
+            const canAccess = makeCanAccess(user, workspaceManager, authService);
+            wsHub.addClient(socket, user, folders);
+            wsHub.sendPresenceSnapshot(socket, folderSet);
             socket.on('message', (raw) => {
                 // Binary messages = Yjs sync/awareness protocol
                 if (Buffer.isBuffer(raw) && raw.length >= 3 && raw[0] !== 0x7b) {
-                    handleYjsBinary(yjsManager, socket, raw);
+                    handleYjsBinary(yjsManager, socket, raw, canAccess);
                     return;
                 }
-                handleClientMessage(wsHub, yjsManager, socket, raw, String(user.id), user.displayName);
+                handleClientMessage(wsHub, yjsManager, socket, raw, String(user.id), user.displayName, canAccess);
             });
             socket.on('close', () => yjsManager.removeClientFromAll(socket));
         }
         else {
-            // Open mode — no auth, all collections
+            // Open mode — no auth, all folders
+            const canAccess = makeCanAccess(null, workspaceManager, authService);
             wsHub.addClient(socket, null, null);
             wsHub.sendPresenceSnapshot(socket, null);
             socket.on('message', (raw) => {
                 if (Buffer.isBuffer(raw) && raw.length >= 3 && raw[0] !== 0x7b) {
-                    handleYjsBinary(yjsManager, socket, raw);
+                    handleYjsBinary(yjsManager, socket, raw, canAccess);
                     return;
                 }
-                handleClientMessage(wsHub, yjsManager, socket, raw, 'anon', 'Anonymous');
+                handleClientMessage(wsHub, yjsManager, socket, raw, 'anon', 'Anonymous', canAccess);
             });
             socket.on('close', () => yjsManager.removeClientFromAll(socket));
         }
@@ -58,12 +82,15 @@ export async function registerWsRoute(fastify, wsHub, authService, yjsManager) {
  *
  * Frame format: [2B docName length, uint16 BE][docName UTF-8][1B msgType][payload]
  */
-function handleYjsBinary(yjsManager, sender, raw) {
+function handleYjsBinary(yjsManager, sender, raw, canAccess) {
     try {
         const docNameLen = raw.readUInt16BE(0);
         if (raw.length < 2 + docNameLen + 1)
             return;
         const docName = raw.subarray(2, 2 + docNameLen).toString('utf8');
+        const repo = parseRepoFromDocName(docName);
+        if (!repo || !canAccess(repo))
+            return; // silently drop unauthorized frames
         const msgType = raw[2 + docNameLen];
         const payload = raw.subarray(2 + docNameLen + 1);
         yjsManager.handleMessage(docName, sender, msgType, payload);
@@ -72,13 +99,16 @@ function handleYjsBinary(yjsManager, sender, raw) {
         // ignore malformed binary frames
     }
 }
-function handleClientMessage(wsHub, yjsManager, socket, raw, userId, userName) {
+function handleClientMessage(wsHub, yjsManager, socket, raw, userId, userName, canAccess) {
     // Binary frames → Yjs sync/awareness protocol (NOT JSON)
     if (Buffer.isBuffer(raw) && raw.length >= 3) {
         // Decode binary frame: [2B nameLen][name][1B msgType][payload]
         const nameLen = raw.readUInt16BE(0);
         if (nameLen > 0 && 2 + nameLen + 1 <= raw.length) {
             const docName = raw.subarray(2, 2 + nameLen).toString('utf-8');
+            const repo = parseRepoFromDocName(docName);
+            if (!repo || !canAccess(repo))
+                return; // silently drop
             const msgType = raw[2 + nameLen];
             const payload = raw.subarray(2 + nameLen + 1);
             yjsManager.handleMessage(docName, socket, msgType, payload);
@@ -92,6 +122,11 @@ function handleClientMessage(wsHub, yjsManager, socket, raw, userId, userName) {
             return;
         }
         if (msg?.type === 'presence' && msg.action && msg.repo && msg.entityType && msg.entityId) {
+            // Drop presence writes / snapshot reads for repos the user can't see.
+            // Without this, an attacker could pollute the presence map for any
+            // folder and the snapshot reply discloses who's editing what.
+            if (!canAccess(msg.repo))
+                return;
             wsHub.handlePresence(msg.action, msg.repo, msg.entityType, msg.entityId, { id: userId, name: userName });
             // On enter: immediately send back current presence so the client
             // doesn't have to wait for others' 30s heartbeats.
@@ -113,13 +148,26 @@ function handleClientMessage(wsHub, yjsManager, socket, raw, userId, userName) {
             }
             return;
         }
-        // collab:join — register client for a Yjs doc (server seeds Y.Doc from disk)
+        // collab:join — register client for a Yjs doc. Server replies with a
+        // collab:joined ack JSON message after the doc is loaded (including any
+        // persisted snapshot); the client gates its sync-step-1 + awareness
+        // sends behind the ack so binary frames don't race the async load.
+        // Gate by per-repo access so docName can't be used to read/edit folders
+        // the user doesn't have access to.
         if (msg?.type === 'collab:join' && msg.docName) {
-            yjsManager.addClient(msg.docName, socket);
+            const repo = parseRepoFromDocName(msg.docName);
+            if (!repo || !canAccess(repo))
+                return;
+            yjsManager.addClient(msg.docName, socket).catch(err => {
+                log.error(`[ws] yjsManager.addClient(${msg.docName}) failed:`, err);
+            });
             return;
         }
         // collab:leave — unregister from a Yjs doc
         if (msg?.type === 'collab:leave' && msg.docName) {
+            const repo = parseRepoFromDocName(msg.docName);
+            if (!repo || !canAccess(repo))
+                return;
             yjsManager.removeClient(msg.docName, socket);
             return;
         }