WIP 3

apps/server/src/collaboration/extensions/authentication.extension.ts

@@ -9,6 +9,7 @@ import { TokenService } from '../../core/auth/services/token.service';
 import { UserRepo } from '@docmost/db/repos/user/user.repo';
 import { PageRepo } from '@docmost/db/repos/page/page.repo';
 import { SpaceMemberRepo } from '@docmost/db/repos/space/space-member.repo';
+import { PagePermissionRepo } from '@docmost/db/repos/page/page-permission.repo';
 import { findHighestUserSpaceRole } from '@docmost/db/repos/space/utils';
 import { SpaceRole } from '../../common/helpers/types/permission';
 import { getPageId } from '../collaboration.util';
@@ -23,6 +24,7 @@ export class AuthenticationExtension implements Extension {
     private userRepo: UserRepo,
     private pageRepo: PageRepo,
     private readonly spaceMemberRepo: SpaceMemberRepo,
+    private readonly pagePermissionRepo: PagePermissionRepo,
   ) {}
 
   async onAuthenticate(data: onAuthenticatePayload) {
@@ -73,6 +75,33 @@ export class AuthenticationExtension implements Extension {
       this.logger.debug(`User granted readonly access to page: ${pageId}`);
     }
 
+    // Check page-level permissions (in addition to space permissions)
+    const canAccessPage = await this.pagePermissionRepo.canUserAccessPage(
+      user.id,
+      page.id,
+    );
+
+    if (!canAccessPage) {
+      this.logger.warn(
+        `User ${user.id} denied page-level access to page: ${pageId}`,
+      );
+      throw new UnauthorizedException();
+    }
+
+    // Check if user can edit (has writer role on all restricted ancestors)
+    const canEditPage = await this.pagePermissionRepo.canUserEditPage(
+      user.id,
+      page.id,
+    );
+
+    // If user has space edit permission but lacks page-level write permission, force readonly
+    if (!canEditPage && !data.connection.readOnly) {
+      data.connection.readOnly = true;
+      this.logger.debug(
+        `User ${user.id} granted readonly access to restricted page: ${pageId}`,
+      );
+    }
+
     this.logger.debug(`Authenticated user ${user.id} on page ${pageId}`);
 
     return {