shadowdaoandClaude Opus 4.7
d5823ca78c
Adds project-level sharing via the new project_shares table plus the
infrastructure that makes multi-user editing safe and visible.
Authorization (lib/access.ts):
- getAccessibleProjects / getProjectAccess centralise the predicate
used by every read and write path.
- readableProjectIds / writableProjectIds drive listing-style queries.
- Web UI Server Actions and pages source group memberships from the
user_groups table so authorization works without depending on
Agent A's session callback shape.
Optimistic locking:
- memories + snippets gain version + last_edited_by columns. Every
UPDATE bumps version and stamps the editor; UPDATE WHERE clauses
require the caller's pre-fetched version, surfacing a clear
"refresh and try again" error on lost-write races rather than
silently clobbering.
- MemoryUpdateInput / SnippetPutInput accept an optional version
token.
MCP tools:
- memory.write / .update / .delete / .get / .list / .search,
snippet.put / .get / .list / .delete now respect shared-project
access (read = owner | any share, write = owner | rw share).
- project, defaults to ctx.defaultProjectKey from the X-Project-Key
header (populated by the MCP route — Agent A's wiring).
- project.identify returns shared projects you have access to and
prefers an owned project on key collision, audit-logging the
collision so an operator can debug it.
- Tool descriptions for memory.update, memory.write, snippet.put,
and project.identify updated with the co-edit / shared-project
notes.
Web UI:
- Project detail page: ownership badge, shared-with-N-groups badge,
owner-only "Manage sharing" section (add/flip/remove shares via
lib/share-actions.ts). Add-share is constrained to groups the
granter is already in.
- "Shared" chips on memory cards in /memories and /dashboard.
- "Last edited by ..." on memory + snippet detail pages, shown only
when the last editor isn't the row's original author so the chip
stays informative.
- Read-only viewers (ro shares) lose Edit/Delete affordances on
memories and snippets.
Migration 0004_project_shares.sql adds project_shares + the two new
columns on memories and snippets; it depends on Agent A's
0003_groups.sql for the groups, user_groups, and memory_access enum.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
65 lines
3.0 KiB
SQL
65 lines
3.0 KiB
SQL
-- Phase 4c+d+e: project sharing + optimistic-locking version columns.
|
|
--
|
|
-- Depends on Agent A's `0003_groups.sql`, which introduces:
|
|
-- - `groups` table (id, oidc_iss, name, …)
|
|
-- - `user_groups` membership table
|
|
-- - `memory_access` enum ('ro', 'rw')
|
|
--
|
|
-- This migration is the sharing layer on top of those foundations plus
|
|
-- the co-edit primitives that make multi-user editing safe.
|
|
|
|
-- =============================================================================
|
|
-- project_shares: grants a group access to a project
|
|
-- =============================================================================
|
|
--
|
|
-- One row per (project, group) pair. Access level controls whether
|
|
-- members of the group can mutate rows under that project (rw) or only
|
|
-- observe them (ro). Owners (projects.user_id = users.id) always retain
|
|
-- full control regardless of any project_shares rows.
|
|
--
|
|
-- granted_by is informational — `SET NULL` on user delete so the share
|
|
-- itself outlives the granter's account.
|
|
|
|
CREATE TABLE "project_shares" (
|
|
"project_id" uuid NOT NULL REFERENCES "projects"("id") ON DELETE CASCADE,
|
|
"group_id" uuid NOT NULL REFERENCES "groups"("id") ON DELETE CASCADE,
|
|
"access" memory_access NOT NULL,
|
|
"granted_at" timestamptz NOT NULL DEFAULT now(),
|
|
"granted_by" uuid REFERENCES "users"("id") ON DELETE SET NULL,
|
|
PRIMARY KEY ("project_id", "group_id")
|
|
);
|
|
|
|
-- Lookups go in both directions: "what's shared with group G" (used when
|
|
-- resolving a user's accessible projects via their group memberships) and
|
|
-- "who has access to project P" (used on the project detail page).
|
|
-- The primary key already covers the second; this index covers the first.
|
|
CREATE INDEX "project_shares_group_idx" ON "project_shares" ("group_id");
|
|
|
|
-- =============================================================================
|
|
-- memories.version + memories.last_edited_by
|
|
-- =============================================================================
|
|
--
|
|
-- `version` starts at 1 on insert and is bumped by every UPDATE. Edit
|
|
-- forms and MCP `memory.update` pass the version they observed; the
|
|
-- UPDATE's WHERE clause includes `AND version = $version`, so a stale
|
|
-- caller gets 0 rows updated and we surface a "refresh and try again"
|
|
-- error rather than clobber a concurrent edit.
|
|
--
|
|
-- `last_edited_by` records who performed the most recent UPDATE.
|
|
|
|
ALTER TABLE "memories"
|
|
ADD COLUMN "version" integer NOT NULL DEFAULT 1,
|
|
ADD COLUMN "last_edited_by" uuid REFERENCES "users"("id") ON DELETE SET NULL;
|
|
|
|
-- =============================================================================
|
|
-- snippets.version + snippets.last_edited_by
|
|
-- =============================================================================
|
|
--
|
|
-- Same shape and rationale as memories. Co-editable snippets live in
|
|
-- shared projects; user-scope snippets remain single-author in practice
|
|
-- but the columns are uniform across both scopes for simplicity.
|
|
|
|
ALTER TABLE "snippets"
|
|
ADD COLUMN "version" integer NOT NULL DEFAULT 1,
|
|
ADD COLUMN "last_edited_by" uuid REFERENCES "users"("id") ON DELETE SET NULL;
|