Add Cloudflare email and collaboration workflows

apps/server/internal/app/app.go

@@ -73,6 +73,16 @@ func New(ctx context.Context, cfg config.Config, logger *slog.Logger) (*App, err
 	var emailQueue *email.Queue
 	emailRenderer := email.CollaborationRenderer{InstanceName: cfg.Email.InstanceName}
 	switch cfg.Email.ResolvedProvider() {
+	case "cloudflare":
+		cf := email.NewCloudflareSender(
+			cfg.Email.CloudflareAccountID,
+			cfg.Email.CloudflareAPIToken,
+			cfg.Email.From,
+			cfg.Email.CloudflareAPIURL,
+			logger,
+		)
+		emailSender = cf
+		authService.SetEmailSender(cf)
 	case "postmark":
 		pm := email.NewPostmarkSender(cfg.Email.PostmarkToken, cfg.Email.From, cfg.Email.PostmarkAPIURL, logger)
 		emailSender = pm
@@ -95,7 +105,22 @@ func New(ctx context.Context, cfg config.Config, logger *slog.Logger) (*App, err
 		EmailQueue:    emailQueue,
 		EmailRenderer: emailRenderer,
 		UserLookup:    authRepo,
-		PublicOrigin:  cfg.Auth.PublicOrigin,
+		CanReadDocument: func(ctx context.Context, userID, documentID string) (bool, error) {
+			document, err := repo.GetDocumentByID(ctx, documentID)
+			if err != nil {
+				return false, err
+			}
+			principal, err := authService.PrincipalForUser(ctx, userID)
+			if err != nil {
+				return false, err
+			}
+			permission, err := authService.EffectiveResourcePermission(ctx, principal, auth.ResourceDocument, document.Path, document.Tags)
+			if err != nil {
+				return false, err
+			}
+			return auth.PermissionAllows(permission, auth.PermissionRead), nil
+		},
+		PublicOrigin: cfg.Auth.PublicOrigin,
 	})
 
 	service.OnChange(func(change docs.DocumentChange) {