wiki-viewer 1.7.2 → 1.8.1

package/.next/standalone/src/app/api/system/workspaces/route.ts

@@ -0,0 +1,67 @@
+/**
+ * Workspace management API — list and create.
+ *
+ * GET  /api/system/workspaces  — any signed-in user; returns workspaces the
+ *                                caller can access + isAdmin flag.
+ * POST { rootDir, name? }      — admin-only: create a new workspace.
+ *
+ * Bootstrap: first authenticated request triggers ensureBootstrapAdmin.
+ */
+import { stat } from "node:fs/promises";
+import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
+import { isAdmin, requireAdmin, ensureBootstrapAdmin } from "@/lib/auth/admin";
+import {
+	listWorkspaces,
+	createWorkspace,
+	migrateConfigToWorkspaces,
+	userCanAccess,
+} from "@/lib/workspaces";
+
+export const runtime = "nodejs";
+
+export async function GET(request: Request) {
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
+	// Bootstrap: first authenticated user becomes admin if no admin set yet.
+	await ensureBootstrapAdmin(auth.user.id);
+	await migrateConfigToWorkspaces();
+
+	const admin = await isAdmin(auth.user.id, auth.user.email);
+	const all = await listWorkspaces();
+	const workspaces = all.filter((ws) => userCanAccess(ws, auth.user.id, admin));
+
+	return NextResponse.json({ workspaces, isAdmin: admin });
+}
+
+export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	const authResult = await requireAdmin(request);
+	if (!authResult.ok)
+		return NextResponse.json({ error: authResult.code }, { status: authResult.status });
+
+	const body: { rootDir?: string; name?: string } = await request.json();
+	const rootDir = body.rootDir?.trim();
+	if (!rootDir) return NextResponse.json({ error: "Missing rootDir" }, { status: 400 });
+
+	// Validate directory
+	try {
+		const info = await stat(rootDir);
+		if (!info.isDirectory())
+			return NextResponse.json({ error: "Not a directory" }, { status: 400 });
+	} catch {
+		return NextResponse.json({ error: "Directory not found" }, { status: 404 });
+	}
+
+	const workspace = await createWorkspace({
+		rootDir,
+		name: body.name?.trim() || undefined,
+		createdBy: authResult.user.id,
+	});
+
+	return NextResponse.json({ ok: true, workspace });
+}

package/.next/standalone/src/app/api/upload/[...path]/route.ts

@@ -1,7 +1,8 @@
 import { mkdir, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
-import { getRootDir } from "@/lib/root-dir";
+import { resolveWorkspaceForAgent } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 
 const MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
 
@@ -32,13 +33,17 @@ export async function POST(
 	request: Request,
 	{ params }: { params: Promise<{ path: string[] }> },
 ) {
+	const wsx = await resolveWorkspaceForAgent(request);
+	if (!wsx.ok) return NextResponse.json({ error: wsx.code }, { status: wsx.status });
+	const { rootDir } = wsx;
+
 	const { path: segments } = await params;
 	const subPath = (segments ?? []).join("/");
 
-	// Save images in _uploads/ within getRootDir(), mirroring the page path
-	const uploadsDir = path.join(getRootDir(), "_uploads", subPath);
-	const resolved = path.resolve(uploadsDir);
-	if (!resolved.startsWith(getRootDir() + path.sep) && resolved !== getRootDir())
+	// Save images in _uploads/ within rootDir, mirroring the page path
+	const uploadsDir = path.join(rootDir, "_uploads", subPath);
+	const resolved = safeWorkspacePath(rootDir, path.join("_uploads", subPath));
+	if (!resolved)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 
 	let form: FormData;

package/.next/standalone/src/app/api/wiki/app/route.ts

@@ -1,14 +1,14 @@
 import path from "node:path";
 import { NextResponse } from "next/server";
 import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 import { getStatus, startApp, stopApp } from "@/lib/app-runner";
-import { getRootDir, safeRootPath } from "@/lib/root-dir";
 
 // GET /api/wiki/app?path=relative/path
 export async function GET(request: Request) {
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
 
 	const { searchParams } = new URL(request.url);
 	const rel = searchParams.get("path") ?? "";
@@ -19,15 +19,16 @@ export async function GET(request: Request) {
 export async function POST(request: Request) {
 	const csrf = checkOrigin(request);
 	if (csrf) return csrf;
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const body: { path?: string } = await request.json();
 	const rel = body.path;
 	if (!rel || typeof rel !== "string")
 		return NextResponse.json({ error: "Missing path" }, { status: 400 });
 
-	const abs = safeRootPath(rel);
+	const abs = safeWorkspacePath(rootDir, rel);
 	if (!abs)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 
@@ -43,8 +44,8 @@ export async function POST(request: Request) {
 export async function DELETE(request: Request) {
 	const csrf = checkOrigin(request);
 	if (csrf) return csrf;
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
 
 	const body: { path?: string } = await request.json();
 	const rel = body.path;

package/.next/standalone/src/app/api/wiki/content/route.ts

@@ -3,12 +3,12 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
 import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 import { emitEvents, trimEvents } from "@/lib/proof/event-bus";
 import { withFileMutex } from "@/lib/proof/mutex";
 import { emptySidecar, readSidecar, writeSidecar } from "@/lib/proof/sidecar";
 import { SIDECAR_EVENT_TRIM_SIZE } from "@/lib/proof-config";
-import { getRootDir, safeRootPath } from "@/lib/root-dir";
 
 const TEXT_EXTS = new Set([
 	"txt", "md", "markdown", "json", "yaml", "yml", "toml", "csv", "tsv",
@@ -35,12 +35,13 @@ function sha256content(content: string): string {
 }
 
 export async function GET(request: Request) {
-	const sessionAuth = await requireUser(request);
-	if (!sessionAuth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const { searchParams } = new URL(request.url);
 	const rel = searchParams.get("path") ?? "";
-	const filePath = safeRootPath(rel);
+	const filePath = safeWorkspacePath(rootDir, rel);
 	if (!filePath)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 	if (!isTextFile(path.basename(filePath)))
@@ -55,7 +56,6 @@ export async function GET(request: Request) {
 		const content = buffer.toString("utf-8");
 		const headers: Record<string, string> = {};
 		if (isMarkdownFile(path.basename(filePath))) {
-			const rootDir = getRootDir();
 			const sc = await readSidecar(rootDir, rel);
 			if (sc) {
 				headers["X-Wiki-Revision"] = String(sc.revision);
@@ -71,10 +71,9 @@ export async function GET(request: Request) {
 export async function PUT(request: Request) {
 	const csrf = checkOrigin(request);
 	if (csrf) return csrf;
-	const user = await requireUser(request);
-	if (!user.ok) {
-		return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
-	}
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const body: { path?: string; content?: string; baseRevision?: number } =
 		await request.json();
@@ -84,7 +83,7 @@ export async function PUT(request: Request) {
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 	if (typeof content !== "string")
 		return NextResponse.json({ error: "Missing content" }, { status: 400 });
-	const filePath = safeRootPath(rel);
+	const filePath = safeWorkspacePath(rootDir, rel);
 	if (!filePath)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 	if (!isTextFile(path.basename(filePath)))
@@ -102,8 +101,9 @@ export async function PUT(request: Request) {
 	}
 
 	// Markdown files: mutex + sidecar revision check + fingerprint update + event.
-	return withFileMutex(filePath, async () => {
-		const rootDir = getRootDir();
+	// Use the same key format as the agent routes (`${rootDir}\0${rel}`) so a doc
+	// edited via both the editor and the agent fs API shares one lock.
+	return withFileMutex(`${rootDir}\u0000${rel}`, async () => {
 		const sc = (await readSidecar(rootDir, rel)) ?? emptySidecar(rel);
 
 		// baseRevision is required for markdown to prevent lost writes.
@@ -146,7 +146,7 @@ export async function PUT(request: Request) {
 			{
 				type: "file.edited",
 				at: new Date().toISOString(),
-				by: `user:${user.user.id}`,
+				by: `user:${ctx.userId}`,
 				revision: newRevision,
 			},
 		]);

package/.next/standalone/src/app/api/wiki/download/route.ts

@@ -4,8 +4,8 @@ import path from "node:path";
 import { Readable } from "node:stream";
 import JSZip from "jszip";
 import { NextResponse } from "next/server";
-import { requireUser } from "@/lib/auth/server";
-import { safeRootPath } from "@/lib/root-dir";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 
 // Skip noise that should never end up in a downloaded archive.
 const SKIP_DIRS = new Set([".git", "node_modules", ".next", ".proof"]);
@@ -37,13 +37,14 @@ async function addDirToZip(
 }
 
 export async function GET(request: Request) {
-	const auth = await requireUser(request);
-	if (!auth.ok)
-		return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok)
+		return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const { searchParams } = new URL(request.url);
 	const rel = searchParams.get("path") ?? "";
-	const target = safeRootPath(rel);
+	const target = safeWorkspacePath(rootDir, rel);
 	if (!target)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 

package/.next/standalone/src/app/api/wiki/file/route.ts

@@ -1,7 +1,8 @@
 import { readFile, stat } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
-import { safeRootPath } from "@/lib/root-dir";
+import { resolveWorkspaceForAgent } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 
 const MIME_MAP: Record<string, string> = {
 	jpg: "image/jpeg",
@@ -28,9 +29,13 @@ const MIME_MAP: Record<string, string> = {
 };
 
 export async function GET(request: Request) {
+	const wsx = await resolveWorkspaceForAgent(request);
+	if (!wsx.ok) return NextResponse.json({ error: wsx.code }, { status: wsx.status });
+	const { rootDir } = wsx;
+
 	const { searchParams } = new URL(request.url);
 	const rel = searchParams.get("path") ?? "";
-	const filePath = safeRootPath(rel);
+	const filePath = safeWorkspacePath(rootDir, rel);
 	if (!filePath)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 	try {

package/.next/standalone/src/app/api/wiki/folder/route.ts

@@ -1,14 +1,15 @@
 import { mkdir } from "node:fs/promises";
 import { NextResponse } from "next/server";
 import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
-import { safeRootPath } from "@/lib/root-dir";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 
 export async function POST(request: Request) {
 	const csrf = checkOrigin(request);
 	if (csrf) return csrf;
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const body: { path?: string } = await request.json();
 	const rel = body.path;
@@ -17,7 +18,7 @@ export async function POST(request: Request) {
 		return NextResponse.json({ error: "Invalid folder path" }, { status: 400 });
 	}
 
-	const folderPath = safeRootPath(rel);
+	const folderPath = safeWorkspacePath(rootDir, rel);
 	if (!folderPath)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 

package/.next/standalone/src/app/api/wiki/move/route.ts

@@ -2,15 +2,16 @@ import { rename, stat } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
 import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
-import { safeRootPath, getRootDir } from "@/lib/root-dir";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 import { moveSidecar } from "@/lib/proof/sidecar";
 
 export async function POST(request: Request) {
 	const csrf = checkOrigin(request);
 	if (csrf) return csrf;
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const body: { from?: string; to?: string } = await request.json();
 	if (
@@ -25,8 +26,8 @@ export async function POST(request: Request) {
 		);
 	}
 
-	const fromPath = safeRootPath(body.from);
-	const toPath = safeRootPath(body.to);
+	const fromPath = safeWorkspacePath(rootDir, body.from);
+	const toPath = safeWorkspacePath(rootDir, body.to);
 
 	if (!fromPath || !toPath)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
@@ -50,7 +51,6 @@ export async function POST(request: Request) {
 		// Fix latent bug: sidecar was orphaned on .md renames (R3)
 		const fromExt = path.extname(body.from).toLowerCase();
 		if (fromExt === ".md" || fromExt === ".markdown") {
-			const rootDir = getRootDir();
 			await moveSidecar(rootDir, body.from, body.to);
 		}
 

package/.next/standalone/src/app/api/wiki/new-file/route.ts

@@ -2,15 +2,16 @@ import { mkdir, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
 import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
-import { safeRootPath } from "@/lib/root-dir";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 
 export async function POST(request: Request) {
 	const csrf = checkOrigin(request);
 	if (csrf) return csrf;
-	const auth = await requireUser(request);
-	if (!auth.ok)
-		return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok)
+		return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const body: { path?: string } = await request.json();
 	const rel = body.path;
@@ -22,7 +23,7 @@ export async function POST(request: Request) {
 		return NextResponse.json({ error: "Invalid file path" }, { status: 400 });
 	}
 
-	const filePath = safeRootPath(rel);
+	const filePath = safeWorkspacePath(rootDir, rel);
 	if (!filePath)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 

package/.next/standalone/src/app/api/wiki/page/route.ts

@@ -2,8 +2,8 @@ import { mkdir, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
 import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
-import { safeRootPath } from "@/lib/root-dir";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 
 const VALID_DIRS = new Set(["entities", "concepts", "comparisons"]);
 const SLUG_RE = /^[a-z0-9-]+$/;
@@ -37,8 +37,9 @@ function singularType(
 export async function POST(request: Request) {
 	const csrf = checkOrigin(request);
 	if (csrf) return csrf;
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const body: PageBody = await request.json();
 	const { dir, slug } = body;
@@ -51,7 +52,7 @@ export async function POST(request: Request) {
 	}
 
 	const relPath = `${dir}/${slug}.md`;
-	const filePath = safeRootPath(relPath);
+	const filePath = safeWorkspacePath(rootDir, relPath);
 	if (!filePath)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 

package/.next/standalone/src/app/api/wiki/presence/route.ts

@@ -12,17 +12,18 @@
 export const runtime = "nodejs";
 
 import { NextResponse } from "next/server";
-import { requireUser } from "@/lib/auth/server";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 import { setLease, clearLease } from "@/lib/proof/lease";
-import { safeRootPath } from "@/lib/root-dir";
 
 function errJson(code: string, message: string, status: number): NextResponse {
 	return NextResponse.json({ error: code, message }, { status });
 }
 
 export async function POST(req: Request): Promise<NextResponse> {
-	const auth = await requireUser(req);
-	if (!auth.ok) return errJson("UNAUTHORIZED", "Not authenticated", 401);
+	const ctx = await resolveWorkspaceForUser(req);
+	if (!ctx.ok) return errJson(ctx.code, "Not authenticated", ctx.status);
+	const { rootDir } = ctx;
 
 	let body: { path?: unknown; action?: unknown };
 	try {
@@ -40,15 +41,15 @@ export async function POST(req: Request): Promise<NextResponse> {
 	}
 
 	// Basic traversal guard
-	if (!safeRootPath(relPath)) {
+	if (!safeWorkspacePath(rootDir, relPath)) {
 		return errJson("INVALID_PATH", "Path traversal rejected", 400);
 	}
 
 	if (action === "open" || action === "heartbeat") {
-		setLease(relPath, auth.user.id);
+		setLease(rootDir, relPath, ctx.userId);
 	} else {
 		// close
-		clearLease(relPath, auth.user.id);
+		clearLease(rootDir, relPath, ctx.userId);
 	}
 
 	return NextResponse.json({ ok: true });

package/.next/standalone/src/app/api/wiki/route.ts

@@ -2,18 +2,19 @@ import { readdir, rmdir, stat, unlink } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
 import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
-import { getRootDir, safeRootPath } from "@/lib/root-dir";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 import { isAppFolder, isNodeApp } from "@/lib/wiki-helpers";
 
 export async function GET(request: Request) {
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const { searchParams } = new URL(request.url);
 	const dir = searchParams.get("dir") ?? "";
 
-	const targetDir = safeRootPath(dir);
+	const targetDir = safeWorkspacePath(rootDir, dir);
 	if (!targetDir)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 
@@ -31,7 +32,7 @@ export async function GET(request: Request) {
 				const info = await stat(filePath);
 				if (info.isDirectory()) {
 					const relPath = dir ? `${dir}/${name}` : name;
-					const nodeApp = await isNodeApp(getRootDir(), relPath);
+					const nodeApp = await isNodeApp(rootDir, relPath);
 					if (nodeApp) {
 						return {
 							name,
@@ -39,7 +40,7 @@ export async function GET(request: Request) {
 							modifiedAt: info.mtime.toISOString(),
 						};
 					}
-					const isApp = await isAppFolder(getRootDir(), relPath);
+					const isApp = await isAppFolder(rootDir, relPath);
 					return {
 						name,
 						type: (isApp ? "app" : "dir") as "app" | "dir",
@@ -74,16 +75,17 @@ export async function GET(request: Request) {
 export async function DELETE(request: Request) {
 	const csrf = checkOrigin(request);
 	if (csrf) return csrf;
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const body: { path?: string } = await request.json();
 	const rel = body.path;
 	if (!rel || typeof rel !== "string")
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 
-	const filePath = safeRootPath(rel);
-	if (!filePath || filePath === getRootDir())
+	const filePath = safeWorkspacePath(rootDir, rel);
+	if (!filePath || filePath === rootDir)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 
 	try {

package/.next/standalone/src/app/api/wiki/search/route.ts

@@ -0,0 +1,44 @@
+export const runtime = "nodejs";
+
+import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { ensureIndexer, ftsSearch } from "@/lib/search/indexer";
+
+const HARD_LIMIT = 200;
+
+export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+
+	let body: { query?: unknown; limit?: unknown };
+	try {
+		body = (await request.json()) as typeof body;
+	} catch {
+		return NextResponse.json({ error: "INVALID_PAYLOAD" }, { status: 400 });
+	}
+
+	const query = typeof body.query === "string" ? body.query : "";
+	const limit = Math.min(
+		typeof body.limit === "number" ? body.limit : 30,
+		HARD_LIMIT,
+	);
+
+	// Lazy init: fire-and-forget. Returns results from whatever is already indexed;
+	// index warms up in background on first call per workspace.
+	ensureIndexer(ctx.ws.id, ctx.rootDir).catch((e) =>
+		console.error("[search] ensureIndexer failed", e),
+	);
+
+	const result = ftsSearch(ctx.ws.id, query, limit);
+
+	return NextResponse.json({
+		kind: "fts",
+		query,
+		matches: result.matches,
+		truncated: result.truncated,
+	});
+}

package/.next/standalone/src/app/api/wiki/slugs/route.ts

@@ -1,8 +1,7 @@
 import { readdir } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
-import { requireUser } from "@/lib/auth/server";
-import { getRootDir } from "@/lib/root-dir";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
 
 type SlugBuckets = {
 	entities: string[];
@@ -28,17 +27,18 @@ async function readMarkdownSlugsFromDir(dirPath: string): Promise<string[]> {
 }
 
 export async function GET(request: Request) {
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	try {
 		// Scan root + known dirs (entities, concepts, comparisons for wiki compat)
 		// plus any other immediate subdirectories
 		const [entities, concepts, comparisons, root] = await Promise.all([
-			readMarkdownSlugsFromDir(path.join(getRootDir(), "entities")),
-			readMarkdownSlugsFromDir(path.join(getRootDir(), "concepts")),
-			readMarkdownSlugsFromDir(path.join(getRootDir(), "comparisons")),
-			readMarkdownSlugsFromDir(getRootDir()),
+			readMarkdownSlugsFromDir(path.join(rootDir, "entities")),
+			readMarkdownSlugsFromDir(path.join(rootDir, "concepts")),
+			readMarkdownSlugsFromDir(path.join(rootDir, "comparisons")),
+			readMarkdownSlugsFromDir(rootDir),
 		]);
 
 		const body: SlugBuckets = { entities, concepts, comparisons, root };

package/.next/standalone/src/app/api/wiki/upload/route.ts

@@ -2,8 +2,8 @@ import { mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
 import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
-import { safeRootPath } from "@/lib/root-dir";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 
 const ALLOWED_MIME_TYPES = new Set([
 	"application/pdf",
@@ -39,8 +39,9 @@ function sanitizeFilename(name: string): string {
 export async function POST(request: Request) {
 	const csrf = checkOrigin(request);
 	if (csrf) return csrf;
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	let formData: FormData;
 	try {
@@ -54,7 +55,7 @@ export async function POST(request: Request) {
 		return NextResponse.json({ error: "No file provided" }, { status: 400 });
 
 	const dir = (formData.get("dir") as string) ?? "";
-	const targetDir = safeRootPath(dir);
+	const targetDir = safeWorkspacePath(rootDir, dir);
 	if (!targetDir)
 		return NextResponse.json({ error: "Invalid directory" }, { status: 400 });