studiograph 1.3.48-next.21 → 1.3.48-next.210

package/dist/server/routes/share-api.js

@@ -0,0 +1,234 @@
+/**
+ * Public read-only share links.
+ *
+ * The app's first anonymous surface. Three routes:
+ *
+ *   POST /api/repos/:repo/entities/:type/:id/share-link   (AUTHED)  — mint/reuse
+ *   GET  /api/share/:token                                (PUBLIC)  — read body
+ *   GET  /api/share/:token/asset/:assetId/:filename       (PUBLIC)  — embedded asset
+ *
+ * Authorization model:
+ *  - Mint is write-gated (mirrors revoke). Personal folders ARE publishable by
+ *    their owner — the publish right is orthogonal to teammate visibility, and
+ *    the single mint caller is already owner-gated. Today read ⟺ write for
+ *    shared folders, so write-gating is a no-op now but keeps publish/unpublish
+ *    coherent and pre-empts a future read-only role from minting a link it
+ *    couldn't revoke.
+ *  - The two PUBLIC routes are bypassed in the global auth hook; the opaque
+ *    token (looked up in share_links, fail-closed on missing/revoked) IS the
+ *    authorization. A revoked token stops resolving for BOTH the body and its
+ *    assets immediately.
+ *  - The public read returns ONLY { title, entityType, content } — frontmatter
+ *    and metadata never cross the boundary (test-enforced). Asset URLs in the
+ *    body are rewritten to token-scoped /api/share/:token/asset/... links.
+ *  - A public asset must be EMBEDDED in the shared entry (and so belong to the
+ *    same repo), so a crafted body can't republish another entry's, another
+ *    repo's, or an un-embedded asset.
+ */
+import * as access from '../../services/access-control.js';
+import { rewriteImmutableAssetUrls, extractImmutableAssetRefs } from '../../core/embeds.js';
+import { serveIndexedAsset } from './asset-api.js';
+/**
+ * Whether a folder may be published at all. Personal folders ARE publishable:
+ * the owner's right to publish their own content externally is orthogonal to
+ * teammate visibility, and the single `mint()` caller is already owner-gated
+ * (a non-owner 404s on a personal folder before reaching here). The gate now
+ * degrades to a repo-existence check, but it stays a named gate — and keeps its
+ * four call sites — because it's where a future non-publishable repo class
+ * (e.g. a `system` / workspace-wide asset store added to RepoConfig) would be
+ * rejected. Read the flag off the repo config directly — `isRestrictedPersonalFolder`
+ * in access-control is unexported and user-scoped (a per-user access check),
+ * whereas this is a publish gate.
+ */
+function isPublishableRepo(workspaceManager, repo) {
+    const config = workspaceManager.getRepoConfig(repo);
+    if (!config)
+        return false;
+    return true;
+}
+function entityTitle(data, fallbackId) {
+    const name = data?.name ?? data?.title;
+    return typeof name === 'string' && name.trim() ? name : fallbackId;
+}
+/** The entry's stable creation timestamp, used to detect a delete+recreate at
+ *  the same coords. Returns null when absent (then identity isn't enforced). */
+function entityTimestamp(entity) {
+    const ts = entity?.data?.created_at;
+    return typeof ts === 'string' && ts ? ts : null;
+}
+/**
+ * Resolve the entry a live share link points at, applying the existence +
+ * entity-identity guards both public routes share: the repo + entry must still
+ * exist, and when both the link and the current entry carry a created_at they
+ * must match (else the original entry was deleted and a new one took its coords
+ * — fail closed so the old token can't serve unrelated content). Returns the
+ * entity, or null when any guard trips. Callers have already validated the
+ * token + publishable gate.
+ */
+function resolveSharedEntity(workspaceManager, link) {
+    let graph;
+    try {
+        graph = workspaceManager.getGraph(link.repo);
+    }
+    catch {
+        return null;
+    }
+    let entity;
+    try {
+        entity = graph.get(link.entryType, link.entryId);
+    }
+    catch {
+        return null;
+    }
+    if (!entity)
+        return null;
+    const currentTs = entityTimestamp(entity);
+    if (link.entityCreatedAt && currentTs && currentTs !== link.entityCreatedAt)
+        return null;
+    return entity;
+}
+export async function registerShareApiRoutes(fastify, workspaceManager, authService, shareLinkService) {
+    // POST /api/repos/:repo/entities/:type/:id/share-link — mint or reuse the
+    // active public link for an entry. Authed (not bypassed in the auth hook).
+    fastify.post('/api/repos/:repo/entities/:type/:id/share-link', async (req, reply) => {
+        const user = req.user;
+        if (!user)
+            return reply.status(401).send({ error: 'Authentication required' });
+        const { repo, type, id } = req.params;
+        if (!access.hasRepoAccess(user, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        // Write-gate publishing to match revoke (DELETE below). Today read ⟺ write
+        // for shared folders, so this is a no-op, but it keeps the two halves of
+        // the feature coherent and pre-empts a future read-only/viewer role from
+        // being able to mint a permanent public link it couldn't revoke.
+        if (!access.canWriteRepo(user, repo, workspaceManager, authService)) {
+            return reply.status(403).send({ error: 'You do not have write access to this folder' });
+        }
+        if (!isPublishableRepo(workspaceManager, repo)) {
+            return reply.status(403).send({ error: 'This folder cannot be shared publicly.' });
+        }
+        // Confirm the entity exists before minting, and capture its created_at so
+        // a later delete+recreate at the same coords can't inherit this token.
+        let graph;
+        try {
+            graph = workspaceManager.getGraph(repo);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+        let entityCreatedAt = null;
+        try {
+            const entity = graph.get(type, id);
+            if (!entity)
+                return reply.status(404).send({ error: `Entity not found: ${type}/${id}` });
+            entityCreatedAt = entityTimestamp(entity);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message ?? `Entity not found: ${type}/${id}` });
+        }
+        const link = shareLinkService.mint(repo, type, id, user.id, entityCreatedAt);
+        return reply.send({ path: `/share/${link.token}`, token: link.token });
+    });
+    // GET /api/repos/:repo/entities/:type/:id/share-link — share status for an
+    // entry, so the entry view can show "Unshare" only when a live link exists.
+    // Read-gated (authed). Returns the active link, or nulls when not shared.
+    fastify.get('/api/repos/:repo/entities/:type/:id/share-link', async (req, reply) => {
+        const user = req.user;
+        if (!user)
+            return reply.status(401).send({ error: 'Authentication required' });
+        const { repo, type, id } = req.params;
+        if (!access.hasRepoAccess(user, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        // Defense in depth against a future non-publishable repo class: report
+        // not-shared rather than handing out a token that the read path would
+        // refuse to resolve anyway.
+        if (!isPublishableRepo(workspaceManager, repo)) {
+            return reply.send({ path: null, token: null });
+        }
+        const link = shareLinkService.getActiveByEntry(repo, type, id);
+        return reply.send(link ? { path: `/share/${link.token}`, token: link.token } : { path: null, token: null });
+    });
+    // DELETE /api/repos/:repo/entities/:type/:id/share-link — revoke the entry's
+    // active public link (the per-entry "Unshare" action). Write-gated: anyone
+    // who can edit the entry can take it offline (publicness is a property of the
+    // entry, not of whoever first shared it). Idempotent — revoked:false when the
+    // entry wasn't shared.
+    fastify.delete('/api/repos/:repo/entities/:type/:id/share-link', async (req, reply) => {
+        const user = req.user;
+        if (!user)
+            return reply.status(401).send({ error: 'Authentication required' });
+        const { repo, type, id } = req.params;
+        if (!access.hasRepoAccess(user, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        if (!access.canWriteRepo(user, repo, workspaceManager, authService)) {
+            return reply.status(403).send({ error: 'You do not have write access to this folder' });
+        }
+        return reply.send({ revoked: shareLinkService.revokeByEntry(repo, type, id) });
+    });
+    // GET /api/share/:token — PUBLIC read. Returns title + body only.
+    fastify.get('/api/share/:token', async (req, reply) => {
+        const link = shareLinkService.resolve(req.params.token);
+        // Missing OR revoked → 404 (fail-closed, no existence oracle).
+        if (!link)
+            return reply.status(404).send({ error: 'Share link not found' });
+        // Defense in depth: even a valid token never serves a now-unpublishable
+        // folder (a future non-publishable repo class).
+        if (!isPublishableRepo(workspaceManager, link.repo)) {
+            return reply.status(404).send({ error: 'Share link not found' });
+        }
+        // Existence + entity-identity guard (a delete+recreate at the same coords
+        // fails closed). Shared with the asset route below.
+        const entity = resolveSharedEntity(workspaceManager, link);
+        if (!entity)
+            return reply.status(404).send({ error: 'Share link not found' });
+        const rawContent = entity.document?.content ?? '';
+        // Mutable + security-sensitive: never let a proxy/CDN cache it, so edits
+        // and a revoke take effect immediately (D4).
+        reply.header('Cache-Control', 'no-store');
+        // SECURITY BOUNDARY: title + body + type ONLY. Frontmatter / metadata must
+        // never cross to a guest (test-enforced in share-api.test.ts).
+        return reply.send({
+            title: entityTitle(entity.data, link.entryId),
+            entityType: entity.entityType ?? link.entryType,
+            content: rewriteImmutableAssetUrls(rawContent, (assetId, filename) => `/api/share/${link.token}/asset/${assetId}/${filename}`),
+        });
+    });
+    // GET / HEAD /api/share/:token/asset/:assetId/:filename — PUBLIC asset.
+    fastify.route({
+        method: ['GET', 'HEAD'],
+        url: '/api/share/:token/asset/:assetId/:filename',
+        handler: async (req, reply) => {
+            const { token, assetId, filename } = req.params;
+            const isHead = req.method === 'HEAD';
+            const link = shareLinkService.resolve(token);
+            if (!link)
+                return reply.status(404).send({ error: 'Asset not found' });
+            if (!isPublishableRepo(workspaceManager, link.repo)) {
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            const row = workspaceManager.getAssetIndex().get(assetId);
+            // Unknown id, filename mismatch, or an asset owned by a DIFFERENT repo
+            // than the shared entry all fail-closed.
+            if (!row || row.filename !== filename || row.repo !== link.repo) {
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            // The asset must be EMBEDDED in the shared entry — not merely a same-repo
+            // sibling. Re-resolve the entry through the same existence + identity
+            // guard the body read uses (so an asset 404s after a delete+recreate),
+            // then confirm the body references this immutable asset URL. Uses the
+            // same grammar `rewriteImmutableAssetUrls` rewrote it from on the read.
+            const entity = resolveSharedEntity(workspaceManager, link);
+            if (!entity)
+                return reply.status(404).send({ error: 'Asset not found' });
+            const embedded = extractImmutableAssetRefs(entity.document?.content ?? '');
+            if (!embedded.some((ref) => ref.assetId === assetId && ref.filename === filename)) {
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            return serveIndexedAsset(workspaceManager, reply, { assetId, filename, repo: row.repo, isHead });
+        },
+    });
+}
+//# sourceMappingURL=share-api.js.map

package/dist/server/routes/share-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-api.js","sourceRoot":"","sources":["../../../src/server/routes/share-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,MAAM,MAAM,kCAAkC,CAAC;AAG3D,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CAAC,gBAAkC,EAAE,IAAY;IACzE,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAyC,EAAE,UAAkB;IAChF,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,KAAK,CAAC;IACvC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AACrE,CAAC;AAED;gFACgF;AAChF,SAAS,eAAe,CAAC,MAAW;IAClC,MAAM,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC;IACpC,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,gBAAkC,EAAE,IAA0F;IACzJ,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QAAC,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACrD,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACtB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAuB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACvE,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACtB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,eAAe,IAAI,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACzF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAwB,EACxB,gBAAkC,EAClC,WAAwB,EACxB,gBAAkC;IAGlC,0EAA0E;IAC1E,2EAA2E;IAC3E,OAAO,CAAC,IAAI,CACV,gDAAgD,EAChD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC/E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAEtC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,2EAA2E;QAC3E,yEAAyE;QACzE,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YAAC,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAChD,OAAO,GAAQ,EAAE,CAAC;YAAC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;QAC3E,IAAI,eAAe,GAAkB,IAAI,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAkB,EAAE,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACzF,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,qBAAqB,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QAC7E,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC,CACF,CAAC;IAEF,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,OAAO,CAAC,GAAG,CACT,gDAAgD,EAChD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC/E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,4BAA4B;QAC5B,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9G,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,uBAAuB;IACvB,OAAO,CAAC,MAAM,CACZ,gDAAgD,EAChD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC/E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC,CACF,CAAC;IAEF,kEAAkE;IAClE,OAAO,CAAC,GAAG,CACT,mBAAmB,EACnB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxD,+DAA+D;QAC/D,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC5E,wEAAwE;QACxE,gDAAgD;QAChD,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,0EAA0E;QAC1E,oDAAoD;QACpD,MAAM,MAAM,GAAG,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAE9E,MAAM,UAAU,GAAW,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC;QAC1D,yEAAyE;QACzE,6CAA6C;QAC7C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC1C,2EAA2E;QAC3E,+DAA+D;QAC/D,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,IAA2C,EAAE,IAAI,CAAC,OAAO,CAAC;YACpF,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS;YAC/C,OAAO,EAAE,yBAAyB,CAChC,UAAU,EACV,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,cAAc,IAAI,CAAC,KAAK,UAAU,OAAO,IAAI,QAAQ,EAAE,CAC/E;SACF,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,wEAAwE;IACxE,OAAO,CAAC,KAAK,CAAmE;QAC9E,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,GAAG,EAAE,4CAA4C;QACjD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAmB,EAAE,EAAE;YAC1C,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;YAChD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;YAErC,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAEvE,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1D,uEAAuE;YACvE,yCAAyC;YACzC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBAChE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YAED,0EAA0E;YAC1E,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,wEAAwE;YACxE,MAAM,MAAM,GAAG,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAClF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YAED,OAAO,iBAAiB,CAAC,gBAAgB,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACnG,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/views-api.js

@@ -79,5 +79,56 @@ export async function registerViewsApiRoutes(fastify, authService, workspaceMana
         authService.deleteUserView(viewId, userId);
         return reply.send({ ok: true });
     });
+    // ── Workspace views (folder-views redesign) ──
+    // Workspace-shared, scope-keyed view sets. Scope is `folder:<id>` |
+    // `type:<entityType>` | `recent`. Not per-user — everyone sees the same set.
+    const VIEW_TYPES = new Set(['list', 'gallery', 'kanban', 'timeline', 'calendar', 'graph']);
+    // GET /api/workspace-views?scope=… — ordered views for a scope (seeds defaults
+    // on first access: a List, plus Calendar+Graph for `recent`).
+    fastify.get('/api/workspace-views', async (req, reply) => {
+        const scope = req.query?.scope;
+        if (!scope)
+            return reply.status(400).send({ error: 'scope is required' });
+        return reply.send(authService.ensureViewsForScope(scope));
+    });
+    // POST /api/workspace-views — add a view to a scope. One-of-each is enforced
+    // by the DB.
+    fastify.post('/api/workspace-views', async (req, reply) => {
+        const user = req.user;
+        const { scope, viewType, config } = req.body ?? {};
+        if (!scope)
+            return reply.status(400).send({ error: 'scope is required' });
+        if (!viewType || !VIEW_TYPES.has(viewType)) {
+            return reply.status(400).send({ error: 'valid viewType is required' });
+        }
+        const view = authService.createWorkspaceView(scope, viewType, config ?? {}, user?.displayName ?? user?.email);
+        return reply.send(view);
+    });
+    // PUT /api/workspace-views/:id — update config / position / name.
+    fastify.put('/api/workspace-views/:id', async (req, reply) => {
+        const viewId = Number(req.params.id);
+        const existing = authService.getWorkspaceView(viewId);
+        if (!existing)
+            return reply.status(404).send({ error: 'View not found' });
+        authService.updateWorkspaceView(viewId, {
+            config: req.body?.config,
+            position: req.body?.position,
+            name: req.body?.name,
+        });
+        return reply.send({ ok: true });
+    });
+    // DELETE /api/workspace-views/:id — remove a view. List is un-removable
+    // (every scope keeps ≥1 view); every other view is removable from any scope.
+    fastify.delete('/api/workspace-views/:id', async (req, reply) => {
+        const viewId = Number(req.params.id);
+        const existing = authService.getWorkspaceView(viewId);
+        if (!existing)
+            return reply.status(404).send({ error: 'View not found' });
+        if (existing.viewType === 'list') {
+            return reply.status(400).send({ error: 'The List view cannot be removed' });
+        }
+        authService.deleteWorkspaceView(viewId);
+        return reply.send({ ok: true });
+    });
 }
 //# sourceMappingURL=views-api.js.map

package/dist/server/routes/views-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"views-api.js","sourceRoot":"","sources":["../../../src/server/routes/views-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAwB,EACxB,WAAwB,EACxB,gBAAkC;IAGlC,SAAS,SAAS,CAAC,GAAQ;QACzB,OAAS,GAAW,CAAC,IAA6B,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,SAAS,mBAAmB;QAC1B,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,WAAqB,CAAC;oBAC3C,IAAI,IAAI;wBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6EAA6E;IAC7E,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,WAAW,CAAC,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,YAAY,EACZ,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,IAAI,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1H,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,qDAAqD;IACrD,OAAO,CAAC,IAAI,CACV,sBAAsB,EACtB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,SAAS,CAAC;QACrD,WAAW,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9C,CAAC,CACF,CAAC;IAEF,qCAAqC;IACrC,OAAO,CAAC,GAAG,CACT,gBAAgB,EAChB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE;YACzC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI;YACpB,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM;YACxB,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS;SAC/B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,wCAAwC;IACxC,OAAO,CAAC,MAAM,CACZ,gBAAgB,EAChB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"views-api.js","sourceRoot":"","sources":["../../../src/server/routes/views-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAwB,EACxB,WAAwB,EACxB,gBAAkC;IAGlC,SAAS,SAAS,CAAC,GAAQ;QACzB,OAAS,GAAW,CAAC,IAA6B,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,SAAS,mBAAmB;QAC1B,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,WAAqB,CAAC;oBAC3C,IAAI,IAAI;wBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6EAA6E;IAC7E,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,WAAW,CAAC,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,YAAY,EACZ,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,IAAI,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1H,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,qDAAqD;IACrD,OAAO,CAAC,IAAI,CACV,sBAAsB,EACtB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,SAAS,CAAC;QACrD,WAAW,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9C,CAAC,CACF,CAAC;IAEF,qCAAqC;IACrC,OAAO,CAAC,GAAG,CACT,gBAAgB,EAChB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE;YACzC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI;YACpB,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM;YACxB,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS;SAC/B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,wCAAwC;IACxC,OAAO,CAAC,MAAM,CACZ,gBAAgB,EAChB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,gDAAgD;IAChD,oEAAoE;IACpE,6EAA6E;IAE7E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3F,+EAA+E;IAC/E,8DAA8D;IAC9D,OAAO,CAAC,GAAG,CACT,sBAAsB,EACtB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC;QAC/B,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5D,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,aAAa;IACb,OAAO,CAAC,IAAI,CACV,sBAAsB,EACtB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9G,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,kEAAkE;IAClE,OAAO,CAAC,GAAG,CACT,0BAA0B,EAC1B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC1E,WAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE;YACtC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM;YACxB,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,wEAAwE;IACxE,6EAA6E;IAC7E,OAAO,CAAC,MAAM,CACZ,0BAA0B,EAC1B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC1E,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/server/routes/workspace-api.d.ts

@@ -6,4 +6,5 @@
 import type { FastifyInstance } from 'fastify';
 import { WorkspaceManager } from '../../core/workspace-manager.js';
 import { GitUser } from '../../services/git.js';
-export declare function registerWorkspaceApiRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, gitUser: GitUser): Promise<void>;
+import { type AuthService } from '../../services/auth-service.js';
+export declare function registerWorkspaceApiRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, gitUser: GitUser, authService: AuthService): Promise<void>;

package/dist/server/routes/workspace-api.js

@@ -3,14 +3,32 @@
  *
  * Git operations: status, commit, push, pull across all repos.
  */
-/** Repo names eligible for local git ops (status, commit, revert) — includes private. */
+import { existsSync, statSync } from 'fs';
+import { join } from 'path';
+import archiver from 'archiver';
+import * as access from '../../services/access-control.js';
+import { log } from '../../utils/log.js';
+/** Repo names eligible for local git ops (status, commit, revert) — includes personal. */
 function getLocalRepoNames(wm) {
     return wm.getAllRepoConfigs().map(r => r.name);
 }
-export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitUser) {
+function getReadableLocalRepoNames(user, wm, authService) {
+    return getLocalRepoNames(wm).filter(name => access.hasRepoAccess(user, name, wm, authService));
+}
+function getWritableLocalRepoNames(user, wm, authService) {
+    return getLocalRepoNames(wm).filter(name => access.canWriteRepo(user, name, wm, authService));
+}
+function getWritableSyncRepoNames(user, wm, authService) {
+    return wm
+        .getAllRepoConfigs()
+        .filter(repo => !repo.personal && access.canWriteRepo(user, repo.name, wm, authService))
+        .map(repo => repo.name);
+}
+export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitUser, authService) {
     // GET /api/status — git status across all repos
-    fastify.get('/api/status', async (_req, reply) => {
-        const repoNames = getLocalRepoNames(workspaceManager);
+    fastify.get('/api/status', async (req, reply) => {
+        const user = req.user;
+        const repoNames = getReadableLocalRepoNames(user, workspaceManager, authService);
         const results = [];
         for (const name of repoNames) {
             try {
@@ -72,7 +90,8 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
         const { message } = req.body ?? {};
         const commitMessage = message || 'Update from web UI';
         try {
-            const repoNames = getLocalRepoNames(workspaceManager);
+            const user = req.user;
+            const repoNames = getWritableLocalRepoNames(user, workspaceManager, authService);
             const committed = [];
             for (const name of repoNames) {
                 try {
@@ -96,19 +115,20 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
             return reply.status(500).send({ error: err.message });
         }
     });
-    // POST /api/push — push all repos (skip private)
-    fastify.post('/api/push', async (_req, reply) => {
+    // POST /api/push — push writable repos (skip personal)
+    fastify.post('/api/push', async (req, reply) => {
         try {
-            const repos = workspaceManager.getAllRepoConfigs().filter(r => !r.private);
+            const user = req.user;
+            const repoNames = getWritableSyncRepoNames(user, workspaceManager, authService);
             const pushed = [];
-            for (const repoConfig of repos) {
+            for (const name of repoNames) {
                 try {
-                    const graph = workspaceManager.getGraph(repoConfig.name);
+                    const graph = workspaceManager.getGraph(name);
                     const git = graph.gitService;
                     if (!git)
                         continue;
                     await git.push();
-                    pushed.push(repoConfig.name);
+                    pushed.push(name);
                 }
                 catch {
                     // Skip individual repo failures
@@ -120,19 +140,23 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
             return reply.status(500).send({ error: err.message });
         }
     });
-    // POST /api/pull — pull all repos (skip private)
-    fastify.post('/api/pull', async (_req, reply) => {
+    // POST /api/pull — pull writable repos (skip personal)
+    fastify.post('/api/pull', async (req, reply) => {
         try {
-            const repos = workspaceManager.getAllRepoConfigs().filter(r => !r.private);
+            const user = req.user;
+            const repoNames = getWritableSyncRepoNames(user, workspaceManager, authService);
             const pulled = [];
-            for (const repoConfig of repos) {
+            for (const name of repoNames) {
                 try {
-                    const graph = workspaceManager.getGraph(repoConfig.name);
-                    const git = graph.gitService;
-                    if (!git)
+                    const graph = workspaceManager.getGraph(name);
+                    if (!graph)
                         continue;
-                    await git.pull();
-                    pulled.push(repoConfig.name);
+                    // pullAndReconcile runs the pull AND smart-merges the new disk
+                    // content into any live editor Y.Doc the pull changed — without it,
+                    // a user editing a pulled-updated entry overwrites the pulled
+                    // changes on their next autosave (silent loss).
+                    await graph.pullAndReconcile();
+                    pulled.push(name);
                 }
                 catch {
                     // Skip individual repo failures
@@ -145,9 +169,10 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
         }
     });
     // POST /api/revert — revert all uncommitted changes across all repos
-    fastify.post('/api/revert', async (_req, reply) => {
+    fastify.post('/api/revert', async (req, reply) => {
         try {
-            const repoNames = getLocalRepoNames(workspaceManager);
+            const user = req.user;
+            const repoNames = getWritableLocalRepoNames(user, workspaceManager, authService);
             const reverted = [];
             for (const name of repoNames) {
                 try {
@@ -173,6 +198,10 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
     });
     // GET /api/repos/:repo/status — git status for a single repo
     fastify.get('/api/repos/:repo/status', async (req, reply) => {
+        const user = req.user;
+        if (!access.hasRepoAccess(user, req.params.repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: 'Repo not found' });
+        }
         try {
             const graph = workspaceManager.getGraph(req.params.repo);
             const git = graph.gitService;
@@ -200,6 +229,11 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
     });
     // POST /api/repos/:repo/publish — commit + push a single repo
     fastify.post('/api/repos/:repo/publish', async (req, reply) => {
+        const user = req.user;
+        // Publish writes to the shared remote — require write access.
+        if (!access.canWriteRepo(user, req.params.repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: 'Repo not found' });
+        }
         try {
             const graph = workspaceManager.getGraph(req.params.repo);
             const git = graph.gitService;
@@ -222,6 +256,12 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
     });
     // POST /api/repos/:repo/revert — revert uncommitted changes in a single repo
     fastify.post('/api/repos/:repo/revert', async (req, reply) => {
+        const user = req.user;
+        // Revert is destructive — require write access. A non-member must
+        // not be able to discard another user's uncommitted work.
+        if (!access.canWriteRepo(user, req.params.repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: 'Repo not found' });
+        }
         try {
             const graph = workspaceManager.getGraph(req.params.repo);
             const git = graph.gitService;
@@ -242,7 +282,7 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
         for (const repoConfig of repos) {
             try {
                 const graph = workspaceManager.getGraph(repoConfig.name);
-                const entities = graph.search({}).filter((e) => !e.id.toLowerCase().startsWith('readme'));
+                const entities = graph.search({});
                 totalEntities += entities.length;
                 for (const e of entities) {
                     totalLinks += (e.document?.wikilinks?.length ?? 0);
@@ -257,5 +297,84 @@ export async function registerWorkspaceApiRoutes(fastify, workspaceManager, gitU
             links: totalLinks,
         });
     });
+    // GET /api/workspace/export — stream a zip of the caller's accessible
+    // workspace (all shared folders they're a member of + their personal
+    // folder, plus a filtered .studiograph). Honours the same access scope
+    // as `studiograph clone` — owners do NOT see other users' personal
+    // folders, since those are local-only by design.
+    //
+    // The zip preserves each repo's .git directory so users can keep working
+    // from the export (commit history intact). Excluded from .studiograph:
+    // auth.db, server-auth.json, populate-cache/, memory/, *.log — same
+    // exclusion list the CLI clone .gitignore enforces. Secrets and per-user
+    // server state shouldn't leave the server in a portable archive.
+    fastify.get('/api/workspace/export', async (req, reply) => {
+        const user = req.user;
+        const repos = user
+            ? access.getAccessibleRepos(user, workspaceManager, authService)
+            : workspaceManager.getAllRepoConfigs();
+        const workspacePath = workspaceManager.getWorkspacePath();
+        const dateStamp = new Date().toISOString().slice(0, 10);
+        const slug = workspaceManager.config?.team_name
+            ? String(workspaceManager.config.team_name).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '')
+            : 'studiograph';
+        const filename = `${slug || 'studiograph'}-${dateStamp}.zip`;
+        reply.header('Content-Type', 'application/zip');
+        reply.header('Content-Disposition', `attachment; filename="${filename}"`);
+        const archive = archiver('zip', { zlib: { level: 6 } });
+        archive.on('warning', (err) => {
+            // ENOENT on missing optional files is fine; bail on anything else.
+            if (err?.code !== 'ENOENT')
+                log.error('[export] archive warning:', err);
+        });
+        archive.on('error', (err) => {
+            log.error('[export] archive error:', err);
+            reply.raw.destroy(err);
+        });
+        // Pipe directly to the underlying socket — Fastify's reply.send() would
+        // try to serialize the stream and add headers we've already set.
+        archive.pipe(reply.raw);
+        // Each accessible repo, with its .git history. Repos live at
+        // `${workspacePath}/${repo.path}` per WorkspaceManager's layout.
+        for (const repo of repos) {
+            const repoPath = join(workspacePath, repo.path);
+            if (!existsSync(repoPath))
+                continue;
+            try {
+                if (!statSync(repoPath).isDirectory())
+                    continue;
+            }
+            catch {
+                continue;
+            }
+            archive.directory(repoPath, repo.path);
+        }
+        // .studiograph — workspace.json, sources, connectors, ABOUT.md, schema.
+        // Mirrors the CLI clone .gitignore exclusion list so secrets, per-user
+        // server state, caches, and logs stay on the server.
+        const studiographPath = join(workspacePath, '.studiograph');
+        if (existsSync(studiographPath)) {
+            archive.glob('**/*', {
+                cwd: studiographPath,
+                ignore: [
+                    'auth.db',
+                    'auth.db-journal',
+                    'auth-seed.json',
+                    'server-auth.json',
+                    // Public share-link bearer tokens — exporting these would hand every
+                    // active anonymous link (and its entry mapping) to the recipient.
+                    'share-links.db',
+                    'share-links.db-wal',
+                    'share-links.db-shm',
+                    'populate-cache/**',
+                    'memory/**',
+                    'sessions/**',
+                    '*.log',
+                ],
+                dot: true,
+            }, { prefix: '.studiograph' });
+        }
+        await archive.finalize();
+    });
 }
 //# sourceMappingURL=workspace-api.js.map