share folders and files
This commit is contained in:
m
@@ -0,0 +1,432 @@
|
||||
package repository
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"errors"
|
||||
"time"
|
||||
)
|
||||
|
||||
// Access ranking — docs/api-v1.md §6.2.
|
||||
const (
|
||||
AccessNone = 0
|
||||
AccessViewer = 1
|
||||
AccessCommenter = 2
|
||||
AccessEditor = 3
|
||||
AccessOwner = 4
|
||||
)
|
||||
|
||||
// AccessFromString maps contract access levels to numeric ranks.
|
||||
func AccessFromString(s string) int {
|
||||
switch s {
|
||||
case "viewer":
|
||||
return AccessViewer
|
||||
case "commenter":
|
||||
return AccessCommenter
|
||||
case "editor":
|
||||
return AccessEditor
|
||||
case "owner":
|
||||
return AccessOwner
|
||||
default:
|
||||
return AccessNone
|
||||
}
|
||||
}
|
||||
|
||||
// AccessToString maps numeric ranks back to the contract string.
|
||||
func AccessToString(rank int) string {
|
||||
switch rank {
|
||||
case AccessViewer:
|
||||
return "viewer"
|
||||
case AccessCommenter:
|
||||
return "commenter"
|
||||
case AccessEditor:
|
||||
return "editor"
|
||||
case AccessOwner:
|
||||
return "owner"
|
||||
default:
|
||||
return ""
|
||||
}
|
||||
}
|
||||
|
||||
// EffectivePermission mirrors the full ResourcePermission DTO from
|
||||
// docs/api-v1.md §6.2 — one row per resource the user can access.
|
||||
type EffectivePermission struct {
|
||||
ResourceID string
|
||||
ResourceType string
|
||||
EffectiveRank int
|
||||
OwnerID string
|
||||
SharedByID *string
|
||||
ExpiresAt *time.Time
|
||||
Inherit bool
|
||||
UpdatedAt time.Time
|
||||
Name string
|
||||
ParentID *string
|
||||
}
|
||||
|
||||
// ResourceAccess is the result of EffectiveAccess — a lightweight check
|
||||
// for whether the user can act on a given resource.
|
||||
type ResourceAccess struct {
|
||||
Accessible bool
|
||||
IsOwner bool
|
||||
EffectiveRank int
|
||||
Inherit bool
|
||||
}
|
||||
|
||||
// Shares implements share persistence for user-to-user grants.
|
||||
type Shares struct {
|
||||
DB *sql.DB
|
||||
}
|
||||
|
||||
// Upsert inserts or updates an active share. On conflict (active row for
|
||||
// same resource + grantee) the access, inherit, and expires_at are updated.
|
||||
func (s *Shares) Upsert(resourceID, granteeUserID, access string, inherit bool, expiresAt *time.Time, createdBy string) error {
|
||||
var expires any
|
||||
if expiresAt != nil {
|
||||
expires = *expiresAt
|
||||
}
|
||||
_, err := s.DB.Exec(
|
||||
`INSERT INTO shares (id, resource_id, grantee_user_id, access, inherit, created_by, expires_at)
|
||||
VALUES ($1, $2, $3, $4, $5, $6, $7)
|
||||
ON CONFLICT (resource_id, grantee_user_id) WHERE revoked_at IS NULL
|
||||
DO UPDATE SET access = EXCLUDED.access,
|
||||
inherit = EXCLUDED.inherit,
|
||||
expires_at = EXCLUDED.expires_at,
|
||||
updated_at = NOW()`,
|
||||
NewID(), resourceID, granteeUserID, access, inherit, createdBy, expires,
|
||||
)
|
||||
return err
|
||||
}
|
||||
|
||||
// Revoke soft-revokes the active share between a resource and a grantee.
|
||||
func (s *Shares) Revoke(resourceID, granteeUserID string) error {
|
||||
result, err := s.DB.Exec(
|
||||
`UPDATE shares SET revoked_at = NOW(), updated_at = NOW()
|
||||
WHERE resource_id = $1 AND grantee_user_id = $2 AND revoked_at IS NULL`,
|
||||
resourceID, granteeUserID,
|
||||
)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
affected, err := result.RowsAffected()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if affected == 0 {
|
||||
return ErrNotFound
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// ListEffectivePermissions computes the full permissions snapshot for the
|
||||
// calling user (docs/api-v1.md §6.2).
|
||||
//
|
||||
// Key invariants enforced by the CTE:
|
||||
// 1. TTL (24h) is NOT applied server-side — it is a client-side cache
|
||||
// concern. The server returns ALL effective permissions; the client
|
||||
// downgrades to viewer when cachedAt > 24h.
|
||||
// 2. Ownership (rank 4) always wins.
|
||||
// 3. Expired grants (expires_at in the past) are excluded AND do not
|
||||
// propagate to descendants.
|
||||
// 4. Revoked shares (revoked_at IS NOT NULL) are excluded AND do not
|
||||
// propagate.
|
||||
// 5. Ancestors propagate ONLY when inherit = true on the ancestor grant.
|
||||
// 6. The exact-node permission is authoritative (§6.2 rule 2): a resource
|
||||
// with its own owned row or direct grant keeps that rank, which is NOT
|
||||
// overridden by an ancestor grant. inherit=false on that node only stops
|
||||
// propagation to descendants.
|
||||
// 7. Rules 5+6 combine: a node WITHOUT its own seed keeps the highest rank
|
||||
// among the inherit=true grants up its chain (§6.2 rule 5). inherit=false
|
||||
// on an intermediate node does NOT block a grant further up from passing
|
||||
// through it.
|
||||
func (s *Shares) ListEffectivePermissions(userID string, afterMs int64) ([]EffectivePermission, error) {
|
||||
rows, err := s.DB.Query(`
|
||||
WITH RECURSIVE
|
||||
-- Seeds: owned (rank=4) rows + active grants to this user (rank from the access column).
|
||||
-- is_seed marks these: their own rank is authoritative on the node.
|
||||
seeded(id, type, updated_at, parent_id, grant_rank, created_by, expires_at, grant_inherit, name, is_seed) AS (
|
||||
SELECT r.resource_id, r.type, r.updated_at, r.parent_id,
|
||||
4::int, NULL::text, NULL::timestamptz, FALSE, r.name, TRUE
|
||||
FROM resources r
|
||||
WHERE r.user_id = $1 AND r.deleted_at IS NULL
|
||||
UNION ALL
|
||||
SELECT r.resource_id, r.type, r.updated_at, r.parent_id,
|
||||
CASE sh.access WHEN 'viewer' THEN 1 WHEN 'commenter' THEN 2 WHEN 'editor' THEN 3 ELSE 0 END,
|
||||
sh.created_by, sh.expires_at, sh.inherit, r.name, TRUE
|
||||
FROM shares sh
|
||||
JOIN resources r ON r.resource_id = sh.resource_id
|
||||
WHERE sh.grantee_user_id = $1 AND sh.revoked_at IS NULL
|
||||
AND (sh.expires_at IS NULL OR sh.expires_at > NOW())
|
||||
AND r.deleted_at IS NULL
|
||||
),
|
||||
-- Recursive descendants: walk DOWN from each seeded row, following children.
|
||||
-- A child inherits the rank of an inherit=true grant up the chain; propagated
|
||||
-- rows are NOT seeds (is_seed = FALSE). inherit=false on an intermediate node
|
||||
-- does not block a grant further up from passing through it.
|
||||
descendants(id, type, updated_at, parent_id, grant_rank, created_by, expires_at, grant_inherit, name, is_seed, depth) AS (
|
||||
SELECT *, 0 FROM seeded
|
||||
UNION ALL
|
||||
SELECT r.resource_id, r.type, r.updated_at, r.parent_id,
|
||||
d.grant_rank, d.created_by, d.expires_at, TRUE, r.name, FALSE, d.depth + 1
|
||||
FROM resources r
|
||||
JOIN descendants d ON r.parent_id = d.id
|
||||
WHERE d.grant_inherit AND d.grant_rank BETWEEN 1 AND 3
|
||||
AND r.deleted_at IS NULL
|
||||
AND d.depth < 100
|
||||
)
|
||||
SELECT d.id, d.type,
|
||||
(EXTRACT(EPOCH FROM d.updated_at) * 1000)::bigint AS updated_at_ms,
|
||||
COALESCE(r.user_id, d.effective_created_by) AS owner_id,
|
||||
d.effective_rank, d.effective_created_by,
|
||||
d.effective_expires_at, d.effective_inherit,
|
||||
d.name, r.parent_id
|
||||
FROM (
|
||||
SELECT id, type, updated_at, parent_id, name,
|
||||
-- The node's own seed rank wins when it IS a seed (owned/direct
|
||||
-- grant, §6.2 rule 2); otherwise the highest inherited rank wins
|
||||
-- (rule 5). The winning row also supplies created_by / expires_at /
|
||||
-- inherit.
|
||||
(ARRAY_AGG(grant_rank ORDER BY is_seed DESC, grant_rank DESC))[1] AS effective_rank,
|
||||
(ARRAY_AGG(created_by ORDER BY is_seed DESC, grant_rank DESC))[1] AS effective_created_by,
|
||||
(ARRAY_AGG(expires_at ORDER BY is_seed DESC, grant_rank DESC))[1] AS effective_expires_at,
|
||||
(ARRAY_AGG(grant_inherit ORDER BY is_seed DESC, grant_rank DESC))[1] AS effective_inherit
|
||||
FROM descendants
|
||||
WHERE grant_rank > 0
|
||||
GROUP BY id, type, updated_at, parent_id, name
|
||||
) d
|
||||
LEFT JOIN resources r ON r.resource_id = d.id
|
||||
WHERE (EXTRACT(EPOCH FROM r.updated_at) * 1000)::bigint > $2
|
||||
OR r.updated_at IS NULL
|
||||
ORDER BY d.updated_at DESC
|
||||
LIMIT 10000`,
|
||||
userID, afterMs,
|
||||
)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var perms []EffectivePermission
|
||||
for rows.Next() {
|
||||
var (
|
||||
p EffectivePermission
|
||||
updatedAtMs int64
|
||||
ownerID sql.NullString
|
||||
createdBy sql.NullString
|
||||
expiresAt sql.NullTime
|
||||
parentID sql.NullString
|
||||
)
|
||||
if err := rows.Scan(
|
||||
&p.ResourceID, &p.ResourceType, &updatedAtMs,
|
||||
&ownerID, &p.EffectiveRank, &createdBy,
|
||||
&expiresAt, &p.Inherit,
|
||||
&p.Name, &parentID,
|
||||
); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
p.UpdatedAt = time.UnixMilli(updatedAtMs)
|
||||
if ownerID.Valid {
|
||||
p.OwnerID = ownerID.String
|
||||
} else {
|
||||
p.OwnerID = userID
|
||||
}
|
||||
if createdBy.Valid {
|
||||
p.SharedByID = &createdBy.String
|
||||
}
|
||||
if expiresAt.Valid {
|
||||
p.ExpiresAt = &expiresAt.Time
|
||||
}
|
||||
if parentID.Valid {
|
||||
p.ParentID = &parentID.String
|
||||
}
|
||||
perms = append(perms, p)
|
||||
}
|
||||
return perms, rows.Err()
|
||||
}
|
||||
|
||||
// EffectiveAccess computes the effective access rank of a user on a specific
|
||||
// resource, walking ancestors for inherited grants. This is the server-side
|
||||
// enforcement for individual resource access (e.g. GET /files/:id).
|
||||
//
|
||||
// It mirrors the snapshot semantics (§6.2): ownership → owner (rule 4); else
|
||||
// the exact-node permission is authoritative (rule 2); else the highest rank
|
||||
// among the inherit=true grants up the ancestor chain wins (rules 3 + 5).
|
||||
func (s *Shares) EffectiveAccess(userID, resourceID string) (ResourceAccess, error) {
|
||||
var ra ResourceAccess
|
||||
err := s.DB.QueryRow(`
|
||||
WITH RECURSIVE
|
||||
-- 1. Ownership beats everything.
|
||||
owned AS (
|
||||
SELECT 4::int AS rank
|
||||
FROM resources WHERE resource_id = $2 AND user_id = $1 AND deleted_at IS NULL
|
||||
),
|
||||
-- 2. Direct grants on this exact node (apply regardless of inherit, rule 2).
|
||||
direct AS (
|
||||
SELECT CASE sh.access WHEN 'viewer' THEN 1 WHEN 'commenter' THEN 2 WHEN 'editor' THEN 3 ELSE 0 END AS rank
|
||||
FROM shares sh
|
||||
JOIN resources r ON r.resource_id = sh.resource_id
|
||||
WHERE sh.resource_id = $2 AND sh.grantee_user_id = $1
|
||||
AND sh.revoked_at IS NULL
|
||||
AND (sh.expires_at IS NULL OR sh.expires_at > NOW())
|
||||
AND r.deleted_at IS NULL
|
||||
),
|
||||
-- 3. Walk UP the ancestors starting at the node's parent. Any ancestor with an
|
||||
-- active grant AND inherit = true contributes its rank (rule 3); the whole
|
||||
-- chain is considered and the highest wins (rule 5). inherit=false on an
|
||||
-- intermediate node does not block a grant further up.
|
||||
inherited(id, grant_rank, depth) AS (
|
||||
SELECT r.parent_id,
|
||||
COALESCE((SELECT CASE sh.access WHEN 'viewer' THEN 1 WHEN 'commenter' THEN 2 WHEN 'editor' THEN 3 ELSE 0 END
|
||||
FROM shares sh
|
||||
WHERE sh.resource_id = r.parent_id AND sh.grantee_user_id = $1
|
||||
AND sh.revoked_at IS NULL AND sh.inherit
|
||||
AND (sh.expires_at IS NULL OR sh.expires_at > NOW())), 0),
|
||||
0
|
||||
FROM resources r
|
||||
WHERE r.resource_id = $2 AND r.deleted_at IS NULL AND r.parent_id IS NOT NULL
|
||||
UNION ALL
|
||||
SELECT r.parent_id,
|
||||
COALESCE((SELECT CASE sh.access WHEN 'viewer' THEN 1 WHEN 'commenter' THEN 2 WHEN 'editor' THEN 3 ELSE 0 END
|
||||
FROM shares sh
|
||||
WHERE sh.resource_id = ag.id AND sh.grantee_user_id = $1
|
||||
AND sh.revoked_at IS NULL AND sh.inherit
|
||||
AND (sh.expires_at IS NULL OR sh.expires_at > NOW())), 0),
|
||||
ag.depth + 1
|
||||
FROM inherited ag
|
||||
JOIN resources r ON r.resource_id = ag.id
|
||||
WHERE r.deleted_at IS NULL AND ag.depth < 100
|
||||
)
|
||||
SELECT EXISTS(SELECT 1 FROM owned)
|
||||
OR EXISTS(SELECT 1 FROM direct WHERE rank > 0)
|
||||
OR EXISTS(SELECT 1 FROM inherited WHERE grant_rank > 0),
|
||||
CASE
|
||||
WHEN EXISTS(SELECT 1 FROM owned) THEN 4
|
||||
WHEN (SELECT COALESCE(MAX(rank), 0) FROM direct) > 0 THEN (SELECT MAX(rank) FROM direct)
|
||||
ELSE COALESCE((SELECT MAX(grant_rank) FROM inherited), 0)
|
||||
END,
|
||||
EXISTS(SELECT 1 FROM owned)`,
|
||||
userID, resourceID,
|
||||
).Scan(&ra.Accessible, &ra.EffectiveRank, &ra.IsOwner)
|
||||
if err != nil {
|
||||
return ra, err
|
||||
}
|
||||
return ra, nil
|
||||
}
|
||||
|
||||
// ResourceExists confirms a non-deleted resource exists in the system
|
||||
// (ownership not checked — used for share operations where the caller
|
||||
// must own the resource, verified separately).
|
||||
func (s *Shares) ResourceExists(resourceID string) (bool, error) {
|
||||
var exists int
|
||||
err := s.DB.QueryRow(
|
||||
`SELECT 1 FROM resources WHERE resource_id = $1 AND deleted_at IS NULL`,
|
||||
resourceID,
|
||||
).Scan(&exists)
|
||||
if err == sql.ErrNoRows {
|
||||
return false, nil
|
||||
}
|
||||
return err == nil, err
|
||||
}
|
||||
|
||||
// CreateLink stores a share link (token = id, client-generated 32-hex).
|
||||
func (s *Shares) CreateLink(token, resourceID, access string, expiresAt *time.Time, createdBy string) error {
|
||||
var expires any
|
||||
if expiresAt != nil {
|
||||
expires = *expiresAt
|
||||
}
|
||||
_, err := s.DB.Exec(
|
||||
`INSERT INTO share_links (id, resource_id, access, created_by, expires_at)
|
||||
VALUES ($1, $2, $3, $4, $5)`,
|
||||
token, resourceID, access, createdBy, expires,
|
||||
)
|
||||
return err
|
||||
}
|
||||
|
||||
// RevokeLink soft-revokes a link by token. Returns ErrNotFound if the link
|
||||
// does not exist or is already revoked.
|
||||
func (s *Shares) RevokeLink(token string) error {
|
||||
result, err := s.DB.Exec(
|
||||
`UPDATE share_links SET revoked_at = NOW()
|
||||
WHERE id = $1 AND revoked_at IS NULL`,
|
||||
token,
|
||||
)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
affected, err := result.RowsAffected()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if affected == 0 {
|
||||
return ErrNotFound
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// LinkInfo is the public-facing shape for GET /shares/links/:token.
|
||||
type LinkInfo struct {
|
||||
Token string `json:"token"`
|
||||
ResourceID string `json:"resource_id"`
|
||||
ResourceType string `json:"resourceType"`
|
||||
Name string `json:"name"`
|
||||
Access string `json:"access"`
|
||||
ExpiresAt *time.Time `json:"expiresAt"`
|
||||
}
|
||||
|
||||
// GetPublicLink resolves a link token to resource metadata. Returns
|
||||
// ErrNotFound if the link is revoked, expired, or unknown.
|
||||
func (s *Shares) GetPublicLink(token string) (LinkInfo, error) {
|
||||
var info LinkInfo
|
||||
var expiresAt sql.NullTime
|
||||
err := s.DB.QueryRow(
|
||||
`SELECT sl.id, sl.resource_id, r.type, r.name, sl.access, sl.expires_at
|
||||
FROM share_links sl
|
||||
JOIN resources r ON r.resource_id = sl.resource_id
|
||||
WHERE sl.id = $1 AND sl.revoked_at IS NULL
|
||||
AND (sl.expires_at IS NULL OR sl.expires_at > NOW())
|
||||
AND r.deleted_at IS NULL`,
|
||||
token,
|
||||
).Scan(&info.Token, &info.ResourceID, &info.ResourceType, &info.Name, &info.Access, &expiresAt)
|
||||
if err == sql.ErrNoRows {
|
||||
return LinkInfo{}, ErrNotFound
|
||||
}
|
||||
if err != nil {
|
||||
return LinkInfo{}, err
|
||||
}
|
||||
if expiresAt.Valid {
|
||||
info.ExpiresAt = &expiresAt.Time
|
||||
}
|
||||
return info, nil
|
||||
}
|
||||
|
||||
// ListActiveLinksForResource returns all non-revoked links for a given resource.
|
||||
func (s *Shares) ListActiveLinksForResource(resourceID string) ([]LinkInfo, error) {
|
||||
rows, err := s.DB.Query(
|
||||
`SELECT sl.id, sl.resource_id, r.type, r.name, sl.access, sl.expires_at
|
||||
FROM share_links sl
|
||||
JOIN resources r ON r.resource_id = sl.resource_id
|
||||
WHERE sl.resource_id = $1 AND sl.revoked_at IS NULL
|
||||
ORDER BY sl.created_at DESC`,
|
||||
resourceID,
|
||||
)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
var links []LinkInfo
|
||||
for rows.Next() {
|
||||
var (
|
||||
info LinkInfo
|
||||
expiresAt sql.NullTime
|
||||
)
|
||||
if err := rows.Scan(&info.Token, &info.ResourceID, &info.ResourceType, &info.Name, &info.Access, &expiresAt); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if expiresAt.Valid {
|
||||
info.ExpiresAt = &expiresAt.Time
|
||||
}
|
||||
links = append(links, info)
|
||||
}
|
||||
return links, rows.Err()
|
||||
}
|
||||
|
||||
// Errors specific to shares.
|
||||
var ErrGranteeNotFound = errors.New("grantee user not found")
|
||||
Reference in New Issue
Block a user