apunkt/SurfSense
1
0
Fork 0
mirror of https://github.com/MODSetter/SurfSense.git synced 2026-07-06 22:12:12 +02:00
Code Issues Projects Releases Packages Wiki Activity

fix(zero):scope core workspace queries

Browse source
This commit is contained in:
Anish Sarkar 2026-06-23 13:00:40 +05:30
parent 90c3dc98ca
commit 737d63f3dc
3 changed files with 33 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

8
surfsense_web/zero/queries/automations.ts
View file

@ -1,12 +1,16 @@
import { defineQuery } from "@rocicorp/zero"; import { defineQuery } from "@rocicorp/zero";
import { z } from "zod"; import { z } from "zod";
import { zql } from "../schema/index"; import { zql } from "../schema/index";
import { constrainToAllowedSpaces } from "./authz";
// Mirrors chat byThread: client passes the parent id, the REST route still // Mirrors chat byThread: client passes the parent id, the REST route still
// authorizes via `automation_id -> search_space`. No search_space_id on the // authorizes via `automation_id -> search_space`. No search_space_id on the
// table by design. // table by design.
export const automationRunQueries = { export const automationRunQueries = {
byAutomation: defineQuery(z.object({ automationId: z.number() }), ({ args: { automationId } }) => byAutomation: defineQuery(z.object({ automationId: z.number() }), ({ args: { automationId }, ctx }) =>
zql.automation_runs.where("automationId", automationId).orderBy("createdAt", "desc") zql.automation_runs
.where("automationId", automationId)
.whereExists("automation", (q) => constrainToAllowedSpaces(q, ctx))
.orderBy("createdAt", "desc")
), ),
}; };

22
surfsense_web/zero/queries/chat.ts
View file

@ -1,21 +1,31 @@
import { defineQuery } from "@rocicorp/zero"; import { defineQuery } from "@rocicorp/zero";
import { z } from "zod"; import { z } from "zod";
import { zql } from "../schema/index"; import { zql } from "../schema/index";
import { constrainToAllowedSpaces } from "./authz";
export const messageQueries = { export const messageQueries = {
byThread: defineQuery(z.object({ threadId: z.number() }), ({ args: { threadId } }) => byThread: defineQuery(z.object({ threadId: z.number() }), ({ args: { threadId }, ctx }) =>
zql.new_chat_messages.where("threadId", threadId).orderBy("createdAt", "asc") zql.new_chat_messages
.where("threadId", threadId)
.whereExists("thread", (q) => constrainToAllowedSpaces(q, ctx))
.orderBy("createdAt", "asc")
), ),
}; };
export const commentQueries = { export const commentQueries = {
byThread: defineQuery(z.object({ threadId: z.number() }), ({ args: { threadId } }) => byThread: defineQuery(z.object({ threadId: z.number() }), ({ args: { threadId }, ctx }) =>
zql.chat_comments.where("threadId", threadId).orderBy("createdAt", "asc") zql.chat_comments
.where("threadId", threadId)
.whereExists("thread", (q) => constrainToAllowedSpaces(q, ctx))
.orderBy("createdAt", "asc")
), ),
}; };
export const chatSessionQueries = { export const chatSessionQueries = {
byThread: defineQuery(z.object({ threadId: z.number() }), ({ args: { threadId } }) => byThread: defineQuery(z.object({ threadId: z.number() }), ({ args: { threadId }, ctx }) =>
zql.chat_session_state.where("threadId", threadId).one() zql.chat_session_state
.where("threadId", threadId)
.whereExists("thread", (q) => constrainToAllowedSpaces(q, ctx))
.one()
), ),
}; };

17
surfsense_web/zero/queries/documents.ts
View file

@ -1,15 +1,20 @@
import { defineQuery } from "@rocicorp/zero"; import { defineQuery } from "@rocicorp/zero";
import { z } from "zod"; import { z } from "zod";
import { zql } from "../schema/index"; import { zql } from "../schema/index";
import { canReadSpace, constrainToAllowedSpaces, denySpace } from "./authz";
export const documentQueries = { export const documentQueries = {
bySpace: defineQuery(z.object({ searchSpaceId: z.number() }), ({ args: { searchSpaceId } }) => bySpace: defineQuery(z.object({ searchSpaceId: z.number() }), ({ args: { searchSpaceId }, ctx }) => {
zql.documents.where("searchSpaceId", searchSpaceId).orderBy("createdAt", "desc") const query = zql.documents.where("searchSpaceId", searchSpaceId);
), if (!canReadSpace(ctx, searchSpaceId)) return denySpace(query).orderBy("createdAt", "desc");
return constrainToAllowedSpaces(query, ctx).orderBy("createdAt", "desc");
}),
}; };
export const connectorQueries = { export const connectorQueries = {
bySpace: defineQuery(z.object({ searchSpaceId: z.number() }), ({ args: { searchSpaceId } }) => bySpace: defineQuery(z.object({ searchSpaceId: z.number() }), ({ args: { searchSpaceId }, ctx }) => {
zql.search_source_connectors.where("searchSpaceId", searchSpaceId).orderBy("createdAt", "desc") const query = zql.search_source_connectors.where("searchSpaceId", searchSpaceId);
), if (!canReadSpace(ctx, searchSpaceId)) return denySpace(query).orderBy("createdAt", "desc");
return constrainToAllowedSpaces(query, ctx).orderBy("createdAt", "desc");
}),
}; };