Claude Fable 5
0c6494f209
All checks were successful
CD / Build and push images (push) Successful in 2m54s
CI / Lint, typecheck, test (push) Successful in 2m25s
CI / Auth e2e pack (push) Successful in 2m58s
CI / Build container images (push) Has been skipped
CD / Deploy to Test (push) Successful in 9s
CD / Smoke tests against Test (push) Successful in 1m12s
CD / Promote to Int (push) Successful in 12s
Every route now declares its access rule explicitly and is enforced through the shared resolution algorithm (permissions.md): - PermissionGuard + decorators (@RequiresPondRole, @RequiresPagePermission, @RequiresAttachmentPermission, @AuthenticatedOnly) applied to every route; a route-enumeration test proves full coverage alongside @Public()/Site-Admin-guarded routes. - 404/403 policy (documented in README conventions): denied reads answer 404 (existence hiding), denied writes on readable things answer 403; trash views need write capability (ADR 0013). - PermissionService resolves page/pond questions via the shared resolver, with an in-process pond-context cache (grants + label parents) that is invalidated on every grant/label-tree change and TTL-bounded as a multi-process safety net. Grant changes also fire pond_access_changed for collab revalidation (#39/#53). - shared: pond-scope resolution (hasPondRole, canSeePond) next to the page resolver; grant wire schemas + GrantView. - Owner Pond-Admin grants: migration backfill for all existing ponds, created transactionally with every new pond (shared + personal + seed). - Grant CRUD under /ponds/:id/grants (pond_admin-gated) with structural and referential validation, last-admin protection, audit logs. - InterimAccessService deleted; page lists, search, backlinks, phantom links, and trash listings are filtered per page through the resolver; collab tokens are now truly ro for readers. - Fixture-matrix e2e (reader/editor/pond admin/foreign, label-deny, authenticated-subject, revoke-then-immediate-deny cache test). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PGdhRiwU1WRL4XxJfZYipY
33 lines
1.4 KiB
TypeScript
33 lines
1.4 KiB
TypeScript
import { PermissionService } from '../permissions/permission.service';
|
|
import { PondPermissionCache } from '../permissions/pond-permission-cache';
|
|
import { PrismaService } from '../prisma/prisma.service';
|
|
import { PostgresSearchProvider } from './postgres-search.provider';
|
|
|
|
/**
|
|
* `search:reindex` CLI (ADR 0010, issue #49): rebuilds the whole search index
|
|
* from `page_content_cache`, idempotently — safe to run after a schema change,
|
|
* a reseed, or a provider swap. It instantiates the PostgreSQL provider
|
|
* directly (no Nest DI): the CLI is run with `tsx`, whose esbuild transform does
|
|
* not emit the decorator metadata Nest injection relies on. The provider itself
|
|
* is still the one bound in the app (proven by the DI test) — only the CLI's
|
|
* wiring is manual.
|
|
*/
|
|
async function main(): Promise<void> {
|
|
const prisma = new PrismaService();
|
|
// Reindexing never asks permission questions, but the provider's search
|
|
// path needs the service — wire it manually like everything here.
|
|
const permissions = new PermissionService(prisma, new PondPermissionCache());
|
|
const provider = new PostgresSearchProvider(prisma, permissions);
|
|
try {
|
|
const count = await provider.reindexAll();
|
|
console.log(`search:reindex — indexed ${count} page(s)`);
|
|
} finally {
|
|
await prisma.$disconnect();
|
|
}
|
|
}
|
|
|
|
void main().catch((error) => {
|
|
console.error('search:reindex failed:', error);
|
|
process.exitCode = 1;
|
|
});
|