grantedScopes() and holds(): Listing Utilities

import { alfiz } from "./alfiz.js";

async function listAccessibleDocs(userId: string) {
  const { granted, revoked } = await alfiz.grantedScopes(
    { userId },
    "docs.files.read",
  );

  if (granted.size === 0) return [];

  // Closure table: doc_ancestors(scope_id, ancestor_id)
  // Row is accessible when ANY of its ancestors is in `granted`
  // AND NONE of its ancestor chain is in `revoked`.
  return db.query(
    `
    SELECT DISTINCT d.*
    FROM docs d
    JOIN doc_ancestors da ON da.scope_id = 'docs.doc:' || d.id
    WHERE da.ancestor_id = ANY($1::text[])
      AND NOT EXISTS (
        SELECT 1 FROM doc_ancestors da2
        WHERE da2.scope_id = 'docs.doc:' || d.id
          AND da2.ancestor_id = ANY($2::text[])
      )
    `,
    [[...granted], [...revoked]],
  );
}

import { planListing, matPathCondition } from "@alfiz/core";

async function listAccessibleDocs(userId: string) {
  const { granted, revoked } = await alfiz.grantedScopes(
    { userId },
    "docs.files.read",
  );

  const plan = planListing({ granted, revoked });
  if (plan.mode === "none") return [];          // provably nothing, so never query

  const opts = { pathColumn: "path", placeholder: "$" as const };
  const clauses: string[] = [];
  const params: unknown[] = [];

  if (plan.mode === "scoped") {
    const inc = matPathCondition(plan.include, { ...opts, startParam: 1 });
    clauses.push(inc.sql);
    params.push(...inc.params);
  }
  if (plan.mode === "scoped" || plan.mode === "all_except") {
    const exc = matPathCondition(plan.exclude, {
      ...opts,
      startParam: params.length + 1,
    });
    clauses.push(`NOT ${exc.sql}`);             // FALSE when exclude is empty
    params.push(...exc.params);
  }

  const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
  return db.query(`SELECT * FROM docs ${where}`, params);
}

async function listAccessibleDocs(userId: string) {
  const { granted, revoked } = await alfiz.grantedScopes(
    { userId },
    "docs.files.read",
  );

  // planListing folds every case, including a global REVOKE, which means
  // provably nothing however broad the grants are.
  const plan = planListing({ granted, revoked });
  if (plan.mode === "none") return [];

  // A global grant and no revokes: no filter needed at all.
  if (plan.mode === "all") return db.docs.findMany();

  // A global grant minus revoked subtrees.
  if (plan.mode === "all_except") {
    return db.docs.findManyExcluding(await db.scopePaths(plan.exclude));
  }

  // Scoped: include the granted subtrees, minus the revoked ones.
  return listByScopedGrants(plan.include, plan.exclude);
}