Advanced file sharing

This is a WIP for advanced file sharing, but I won't pursue this for now since using symlinks in the file system works for me, and this is adding a ton of complexity I don't want or need right now.

routes/api/files/create-directory.tsx

@@ -1,7 +1,7 @@
 import { Handlers } from 'fresh/server.ts';
 
 import { Directory, FreshContextState } from '/lib/types.ts';
-import { createDirectory, getDirectories } from '/lib/data/files.ts';
+import { createDirectory, getDirectories, getDirectoryAccess } from '/lib/data/files.ts';
 
 interface Data {}
 
@@ -30,14 +30,22 @@ export const handler: Handlers<Data, FreshContextState> = {
       return new Response('Bad Request', { status: 400 });
     }
 
-    // TODO: Verify user has write access to path and get the appropriate ownerUserId
-
-    const createdDirectory = await createDirectory(
+    const { hasWriteAccess, ownerUserId, ownerParentPath } = await getDirectoryAccess(
       context.state.user.id,
       requestBody.parentPath,
       requestBody.name.trim(),
     );
 
+    if (!hasWriteAccess) {
+      return new Response('Forbidden', { status: 403 });
+    }
+
+    const createdDirectory = await createDirectory(
+      ownerUserId,
+      ownerParentPath,
+      requestBody.name.trim(),
+    );
+
     const newDirectories = await getDirectories(context.state.user.id, requestBody.parentPath);
 
     const responseBody: ResponseBody = { success: createdDirectory, newDirectories };

routes/api/files/delete-directory.tsx

@@ -1,7 +1,7 @@
 import { Handlers } from 'fresh/server.ts';
 
 import { Directory, FreshContextState } from '/lib/types.ts';
-import { deleteDirectoryOrFile, getDirectories } from '/lib/data/files.ts';
+import { deleteDirectoryOrFile, getDirectories, getDirectoryAccess } from '/lib/data/files.ts';
 
 interface Data {}
 
@@ -30,14 +30,22 @@ export const handler: Handlers<Data, FreshContextState> = {
       return new Response('Bad Request', { status: 400 });
     }
 
-    // TODO: Verify user has write access to path and get the appropriate ownerUserId
-
-    const deletedDirectory = await deleteDirectoryOrFile(
+    const { hasWriteAccess, ownerUserId, ownerParentPath } = await getDirectoryAccess(
       context.state.user.id,
       requestBody.parentPath,
       requestBody.name.trim(),
     );
 
+    if (!hasWriteAccess) {
+      return new Response('Forbidden', { status: 403 });
+    }
+
+    const deletedDirectory = await deleteDirectoryOrFile(
+      ownerUserId,
+      ownerParentPath,
+      requestBody.name.trim(),
+    );
+
     const newDirectories = await getDirectories(context.state.user.id, requestBody.parentPath);
 
     const responseBody: ResponseBody = { success: deletedDirectory, newDirectories };

routes/api/files/delete.tsx

@@ -1,7 +1,7 @@
 import { Handlers } from 'fresh/server.ts';
 
 import { DirectoryFile, FreshContextState } from '/lib/types.ts';
-import { deleteDirectoryOrFile, getFiles } from '/lib/data/files.ts';
+import { deleteDirectoryOrFile, getDirectoryAccess, getFileAccess, getFiles } from '/lib/data/files.ts';
 
 interface Data {}
 
@@ -30,14 +30,30 @@ export const handler: Handlers<Data, FreshContextState> = {
       return new Response('Bad Request', { status: 400 });
     }
 
-    // TODO: Verify user has write access to path/file and get the appropriate ownerUserId
-
-    const deletedFile = await deleteDirectoryOrFile(
+    let { hasWriteAccess, ownerUserId, ownerParentPath } = await getFileAccess(
       context.state.user.id,
       requestBody.parentPath,
       requestBody.name.trim(),
     );
 
+    if (!hasWriteAccess) {
+      const directoryAccessResult = await getDirectoryAccess(context.state.user.id, requestBody.parentPath);
+
+      hasWriteAccess = directoryAccessResult.hasWriteAccess;
+      ownerUserId = directoryAccessResult.ownerUserId;
+      ownerParentPath = directoryAccessResult.ownerParentPath;
+
+      if (!hasWriteAccess) {
+        return new Response('Forbidden', { status: 403 });
+      }
+    }
+
+    const deletedFile = await deleteDirectoryOrFile(
+      ownerUserId,
+      ownerParentPath,
+      requestBody.name.trim(),
+    );
+
     const newFiles = await getFiles(context.state.user.id, requestBody.parentPath);
 
     const responseBody: ResponseBody = { success: deletedFile, newFiles };

routes/api/files/move-directory.tsx

@@ -1,7 +1,7 @@
 import { Handlers } from 'fresh/server.ts';
 
 import { Directory, FreshContextState } from '/lib/types.ts';
-import { getDirectories, renameDirectoryOrFile } from '/lib/data/files.ts';
+import { getDirectories, getDirectoryAccess, renameDirectoryOrFile } from '/lib/data/files.ts';
 
 interface Data {}
 
@@ -33,12 +33,26 @@ export const handler: Handlers<Data, FreshContextState> = {
       return new Response('Bad Request', { status: 400 });
     }
 
-    // TODO: Verify user has write access to old and new paths and get the appropriate ownerUserIds
+    const { hasWriteAccess: hasOldWriteAccess, ownerUserId, ownerParentPath: oldOwnerParentPath } =
+      await getDirectoryAccess(context.state.user.id, requestBody.oldParentPath, requestBody.name.trim());
+
+    if (!hasOldWriteAccess) {
+      return new Response('Forbidden', { status: 403 });
+    }
+
+    const { hasWriteAccess: hasNewWriteAccess, ownerParentPath: newOwnerParentPath } = await getDirectoryAccess(
+      context.state.user.id,
+      requestBody.newParentPath,
+    );
+
+    if (!hasNewWriteAccess) {
+      return new Response('Forbidden', { status: 403 });
+    }
 
     const movedDirectory = await renameDirectoryOrFile(
-      context.state.user.id,
-      requestBody.oldParentPath,
-      requestBody.newParentPath,
+      ownerUserId,
+      oldOwnerParentPath,
+      newOwnerParentPath,
       requestBody.name.trim(),
       requestBody.name.trim(),
     );

routes/api/files/move.tsx

@@ -1,7 +1,7 @@
 import { Handlers } from 'fresh/server.ts';
 
 import { DirectoryFile, FreshContextState } from '/lib/types.ts';
-import { getFiles, renameDirectoryOrFile } from '/lib/data/files.ts';
+import { getDirectoryAccess, getFileAccess, getFiles, renameDirectoryOrFile } from '/lib/data/files.ts';
 
 interface Data {}
 
@@ -33,12 +33,35 @@ export const handler: Handlers<Data, FreshContextState> = {
       return new Response('Bad Request', { status: 400 });
     }
 
-    // TODO: Verify user has write access to old and new paths/files and get the appropriate ownerUserIds
-
-    const movedFile = await renameDirectoryOrFile(
+    let { hasWriteAccess: hasOldWriteAccess, ownerUserId, ownerParentPath: oldOwnerParentPath } = await getFileAccess(
       context.state.user.id,
       requestBody.oldParentPath,
+      requestBody.name.trim(),
+    );
+
+    if (!hasOldWriteAccess) {
+      const directoryAccessResult = await getDirectoryAccess(context.state.user.id, requestBody.oldParentPath);
+
+      hasOldWriteAccess = directoryAccessResult.hasWriteAccess;
+      ownerUserId = directoryAccessResult.ownerUserId;
+      oldOwnerParentPath = directoryAccessResult.ownerParentPath;
+
+      return new Response('Forbidden', { status: 403 });
+    }
+
+    const { hasWriteAccess: hasNewWriteAccess, ownerParentPath: newOwnerParentPath } = await getDirectoryAccess(
+      context.state.user.id,
       requestBody.newParentPath,
+    );
+
+    if (!hasNewWriteAccess) {
+      return new Response('Forbidden', { status: 403 });
+    }
+
+    const movedFile = await renameDirectoryOrFile(
+      ownerUserId,
+      oldOwnerParentPath,
+      newOwnerParentPath,
       requestBody.name.trim(),
       requestBody.name.trim(),
     );

routes/api/files/rename-directory.tsx

@@ -1,7 +1,7 @@
 import { Handlers } from 'fresh/server.ts';
 
 import { Directory, FreshContextState } from '/lib/types.ts';
-import { getDirectories, renameDirectoryOrFile } from '/lib/data/files.ts';
+import { getDirectories, getDirectoryAccess, renameDirectoryOrFile } from '/lib/data/files.ts';
 
 interface Data {}
 
@@ -32,12 +32,20 @@ export const handler: Handlers<Data, FreshContextState> = {
       return new Response('Bad Request', { status: 400 });
     }
 
-    // TODO: Verify user has write access to path and get the appropriate ownerUserId
-
-    const movedDirectory = await renameDirectoryOrFile(
+    const { hasWriteAccess, ownerUserId, ownerParentPath } = await getDirectoryAccess(
       context.state.user.id,
       requestBody.parentPath,
-      requestBody.parentPath,
+      requestBody.oldName.trim(),
+    );
+
+    if (!hasWriteAccess) {
+      return new Response('Forbidden', { status: 403 });
+    }
+
+    const movedDirectory = await renameDirectoryOrFile(
+      ownerUserId,
+      ownerParentPath,
+      ownerParentPath,
       requestBody.oldName.trim(),
       requestBody.newName.trim(),
     );

routes/api/files/rename.tsx

@@ -1,7 +1,7 @@
 import { Handlers } from 'fresh/server.ts';
 
 import { DirectoryFile, FreshContextState } from '/lib/types.ts';
-import { getFiles, renameDirectoryOrFile } from '/lib/data/files.ts';
+import { getDirectoryAccess, getFileAccess, getFiles, renameDirectoryOrFile } from '/lib/data/files.ts';
 
 interface Data {}
 
@@ -32,12 +32,28 @@ export const handler: Handlers<Data, FreshContextState> = {
       return new Response('Bad Request', { status: 400 });
     }
 
-    // TODO: Verify user has write access to path/file and get the appropriate ownerUserId
-
-    const movedFile = await renameDirectoryOrFile(
+    let { hasWriteAccess, ownerUserId, ownerParentPath } = await getFileAccess(
       context.state.user.id,
       requestBody.parentPath,
-      requestBody.parentPath,
+      requestBody.oldName.trim(),
+    );
+
+    if (!hasWriteAccess) {
+      const directoryAccessResult = await getDirectoryAccess(context.state.user.id, requestBody.parentPath);
+
+      hasWriteAccess = directoryAccessResult.hasWriteAccess;
+      ownerUserId = directoryAccessResult.ownerUserId;
+      ownerParentPath = directoryAccessResult.ownerParentPath;
+
+      if (!hasWriteAccess) {
+        return new Response('Forbidden', { status: 403 });
+      }
+    }
+
+    const movedFile = await renameDirectoryOrFile(
+      ownerUserId,
+      ownerParentPath,
+      ownerParentPath,
       requestBody.oldName.trim(),
       requestBody.newName.trim(),
     );

routes/api/files/upload.tsx

@@ -1,7 +1,7 @@
 import { Handlers } from 'fresh/server.ts';
 
 import { DirectoryFile, FreshContextState } from '/lib/types.ts';
-import { createFile, getFiles } from '/lib/data/files.ts';
+import { createFile, getDirectoryAccess, getFileAccess, getFiles } from '/lib/data/files.ts';
 
 interface Data {}
 
@@ -29,9 +29,25 @@ export const handler: Handlers<Data, FreshContextState> = {
       return new Response('Bad Request', { status: 400 });
     }
 
-    // TODO: Verify user has write access to path and get the appropriate ownerUserId
+    let { hasWriteAccess, ownerUserId, ownerParentPath } = await getFileAccess(
+      context.state.user.id,
+      parentPath,
+      name.trim(),
+    );
 
-    const createdFile = await createFile(context.state.user.id, parentPath, name.trim(), await contents.arrayBuffer());
+    if (!hasWriteAccess) {
+      const directoryAccessResult = await getDirectoryAccess(context.state.user.id, parentPath);
+
+      hasWriteAccess = directoryAccessResult.hasWriteAccess;
+      ownerUserId = directoryAccessResult.ownerUserId;
+      ownerParentPath = directoryAccessResult.ownerParentPath;
+
+      if (!hasWriteAccess) {
+        return new Response('Forbidden', { status: 403 });
+      }
+    }
+
+    const createdFile = await createFile(ownerUserId, ownerParentPath, name.trim(), await contents.arrayBuffer());
 
     const newFiles = await getFiles(context.state.user.id, parentPath);