1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

// Core permission data model
enum PermissionLevel {
    VIEWER = 'viewer',
    COMMENTER = 'commenter',
    EDITOR = 'editor',
    OWNER = 'owner',
}
 
interface Permission {
    id: string;
    resourceId: string;        // File or folder ID
    resourceType: 'file' | 'folder';
    
    // Who has the permission
    granteeType: 'user' | 'group' | 'link' | 'anyone';
    granteeId?: string;        // User/group ID (null for 'anyone')
    
    // What permission they have
    level: PermissionLevel;
    
    // Optional restrictions
    expiresAt?: Date;          // Auto-revoke after date
    downloadsRemaining?: number; // For limited download links
    
    // Metadata
    createdAt: Date;
    createdBy: string;
    inherited: boolean;        // From parent folder?
    inheritedFrom?: string;    // Which ancestor?
}
 
// Capabilities computed from permission level
const CAPABILITIES = {
    [PermissionLevel.VIEWER]: ['view', 'download', 'metadata'],
    [PermissionLevel.COMMENTER]: ['view', 'download', 'metadata', 'comment', 'suggest'],
    [PermissionLevel.EDITOR]: ['view', 'download', 'metadata', 'comment', 'suggest', 'edit', 'share'],
    [PermissionLevel.OWNER]: ['view', 'download', 'metadata', 'comment', 'suggest', 'edit', 'share', 'delete', 'manage_permissions', 'transfer_ownership'],
};
 
// Check if user can perform action
function hasCapability(permission: Permission, capability: string): boolean {
    return CAPABILITIES[permission.level].includes(capability);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

// Resolve effective permissions for a resource
class PermissionResolver {
    // Get all effective permissions for a file/folder
    async getEffectivePermissions(resourceId: string): Promise<EffectivePermission[]> {
        const resource = await this.getResource(resourceId);
        
        // Get ancestry path: [root, ..., parent, self]
        const ancestry = await this.getAncestry(resource.path);
        
        // Collect permissions from all ancestors
        const permissionMap = new Map<string, EffectivePermission>();
        
        for (const ancestor of ancestry) {
            const permissions = await this.getDirectPermissions(ancestor.id);
            
            for (const perm of permissions) {
                const key = `${perm.granteeType}:${perm.granteeId}`;
                const existing = permissionMap.get(key);
                
                if (!existing || this.isHigherLevel(perm.level, existing.level)) {
                    permissionMap.set(key, {
                        ...perm,
                        inherited: ancestor.id !== resourceId,
                        inheritedFrom: ancestor.id !== resourceId ? ancestor.path : undefined,
                    });
                }
            }
        }
        
        return Array.from(permissionMap.values());
    }
    
    // Check if user can perform action on resource
    async checkAccess(
        userId: string, 
        resourceId: string, 
        capability: string
    ): Promise<boolean> {
        // Get user's groups
        const groupIds = await this.getUserGroups(userId);
        
        // Get all effective permissions
        const permissions = await this.getEffectivePermissions(resourceId);
        
        // Find best matching permission
        for (const perm of permissions) {
            const matches = 
                (perm.granteeType === 'anyone') ||
                (perm.granteeType === 'user' && perm.granteeId === userId) ||
                (perm.granteeType === 'group' && groupIds.includes(perm.granteeId!));
            
            if (matches && hasCapability(perm, capability)) {
                // Check expiration
                if (perm.expiresAt && perm.expiresAt < new Date()) {
                    continue; // Expired, try next
                }
                return true;
            }
        }
        
        return false;
    }
    
    private isHigherLevel(a: PermissionLevel, b: PermissionLevel): boolean {
        const order = ['viewer', 'commenter', 'editor', 'owner'];
        return order.indexOf(a) > order.indexOf(b);
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

// Shareable link implementation
interface ShareLink {
    id: string;
    token: string;              // The secret part of the URL
    resourceId: string;
    resourceType: 'file' | 'folder';
    
    // Access control
    accessLevel: 'view' | 'comment' | 'edit';
    requiresAuth: 'none' | 'any_account' | 'org_account' | 'specific_users';
    allowedUsers?: string[];    // If specific_users
    password?: string;          // Bcrypt hash if password protected
    
    // Restrictions
    expiresAt?: Date;
    maxDownloads?: number;
    currentDownloads: number;
    allowDownload: boolean;
    
    // Tracking
    createdAt: Date;
    createdBy: string;
    lastAccessedAt?: Date;
    accessCount: number;
}
 
class ShareLinkService {
    // Generate new share link
    async createLink(
        resourceId: string,
        options: CreateLinkOptions
    ): Promise<ShareLink> {
        // Generate cryptographically secure token
        const token = crypto.randomBytes(32).toString('base64url');
        
        const link: ShareLink = {
            id: generateId(),
            token,
            resourceId,
            resourceType: options.type,
            accessLevel: options.accessLevel || 'view',
            requiresAuth: options.requiresAuth || 'none',
            allowedUsers: options.allowedUsers,
            password: options.password 
                ? await bcrypt.hash(options.password, 12) 
                : undefined,
            expiresAt: options.expiresAt,
            maxDownloads: options.maxDownloads,
            currentDownloads: 0,
            allowDownload: options.allowDownload !== false,
            createdAt: new Date(),
            createdBy: this.currentUser.id,
            accessCount: 0,
        };
        
        await this.db.shareLinks.create(link);
        
        return link;
    }
    
    // Validate access via link
    async validateLinkAccess(
        token: string,
        password?: string,
        user?: User
    ): Promise<LinkValidation> {
        const link = await this.db.shareLinks.findByToken(token);
        
        if (!link) {
            return { valid: false, reason: 'Link not found' };
        }
        
        // Check expiration
        if (link.expiresAt && link.expiresAt < new Date()) {
            return { valid: false, reason: 'Link expired' };
        }
        
        // Check download limit
        if (link.maxDownloads && link.currentDownloads >= link.maxDownloads) {
            return { valid: false, reason: 'Download limit reached' };
        }
        
        // Check password
        if (link.password) {
            if (!password) {
                return { valid: false, reason: 'Password required', needsPassword: true };
            }
            const passwordValid = await bcrypt.compare(password, link.password);
            if (!passwordValid) {
                return { valid: false, reason: 'Invalid password' };
            }
        }
        
        // Check authentication requirement
        if (link.requiresAuth === 'any_account' && !user) {
            return { valid: false, reason: 'Sign-in required', needsAuth: true };
        }
        if (link.requiresAuth === 'org_account') {
            const resource = await this.getResource(link.resourceId);
            if (!user || user.orgId !== resource.orgId) {
                return { valid: false, reason: 'Organization sign-in required', needsAuth: true };
            }
        }
        if (link.requiresAuth === 'specific_users') {
            if (!user || !link.allowedUsers!.includes(user.id)) {
                return { valid: false, reason: 'You do not have access' };
            }
        }
        
        // Track access
        await this.trackAccess(link, user);
        
        return { valid: true, link, accessLevel: link.accessLevel };
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

// Group management and resolution
interface Group {
    id: string;
    name: string;
    description?: string;
    type: 'user_created' | 'org_managed' | 'dynamic';
    
    // Membership
    members: string[];         // Direct member user IDs
    memberGroups: string[];    // Nested group IDs
    
    // Dynamic group rules
    dynamicRules?: {
        field: string;         // e.g., 'department'
        operator: 'equals' | 'contains' | 'startsWith';
        value: string;         // e.g., 'Engineering'
    }[];
    
    // Metadata
    orgId: string;
    createdBy: string;
    createdAt: Date;
    lastSyncedAt?: Date;       // For directory-synced groups
}
 
class GroupResolver {
    // Get all groups a user belongs to (including nested)
    async getUserGroups(userId: string): Promise<string[]> {
        const directGroups = await this.db.groups.findMemberOf(userId);
        const allGroups = new Set<string>();
        
        // BFS to resolve nested groups
        const queue = [...directGroups.map(g => g.id)];
        
        while (queue.length > 0) {
            const groupId = queue.shift()!;
            if (allGroups.has(groupId)) continue;
            
            allGroups.add(groupId);
            
            // Find groups that contain this group as a member
            const parentGroups = await this.db.groups.findContaining(groupId);
            queue.push(...parentGroups.map(g => g.id));
        }
        
        return Array.from(allGroups);
    }
    
    // Get all effective members of a group (including nested)
    async getGroupMembers(groupId: string): Promise<string[]> {
        const group = await this.db.groups.findById(groupId);
        const allMembers = new Set<string>();
        
        // Direct members
        group.members.forEach(m => allMembers.add(m));
        
        // Nested group members
        for (const nestedId of group.memberGroups) {
            const nestedMembers = await this.getGroupMembers(nestedId);
            nestedMembers.forEach(m => allMembers.add(m));
        }
        
        // Dynamic members
        if (group.dynamicRules) {
            const dynamicMembers = await this.resolveDynamicMembers(group.dynamicRules);
            dynamicMembers.forEach(m => allMembers.add(m));
        }
        
        return Array.from(allMembers);
    }
    
    // Cache group membership for performance
    private membershipCache = new LRUCache<string, string[]>({
        max: 10000,
        ttl: 60 * 1000,  // 1 minute cache
    });
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98

// High-performance permission caching
interface CachedPermission {
    userId: string;
    resourceId: string;
    effectiveLevel: PermissionLevel | null; // null = no access
    source: 'owner' | 'direct' | 'group' | 'inherited' | 'link';
    expiresAt: Date;
    computedAt: Date;
}
 
class PermissionCache {
    private redis: RedisClient;
    private localCache: LRUCache<string, CachedPermission>;
    
    // Fast path: check cache first
    async checkAccess(
        userId: string, 
        resourceId: string, 
        capability: string
    ): Promise<boolean> {
        const key = `perm:${userId}:${resourceId}`;
        
        // Level 1: Local in-memory cache (fastest, ~0.1ms)
        const local = this.localCache.get(key);
        if (local && local.expiresAt > new Date()) {
            return hasCapability(local, capability);
        }
        
        // Level 2: Distributed cache (fast, ~1ms)
        const cached = await this.redis.get(key);
        if (cached) {
            const parsed = JSON.parse(cached);
            this.localCache.set(key, parsed); // Populate local
            return hasCapability(parsed, capability);
        }
        
        // Level 3: Compute and cache (~10-50ms)
        const computed = await this.computePermission(userId, resourceId);
        await this.cachePermission(key, computed);
        return hasCapability(computed, capability);
    }
    
    // Invalidate cache when permissions change
    async onPermissionChange(resourceId: string): Promise<void> {
        // Get all users with permissions on this resource
        const affectedUsers = await this.getAffectedUsers(resourceId);
        
        // Invalidate their cached permissions
        const keys = affectedUsers.map(u => `perm:${u}:${resourceId}`);
        await this.redis.del(...keys);
        
        // Also invalidate for all descendants (if folder)
        const resource = await this.getResource(resourceId);
        if (resource.type === 'folder') {
            await this.invalidateDescendants(resourceId);
        }
    }
    
    async onGroupMembershipChange(groupId: string, userId: string): Promise<void> {
        // Get all resources shared with this group
        const resources = await this.getGroupSharedResources(groupId);
        
        // Invalidate user's cached permissions for those resources
        const keys = resources.map(r => `perm:${userId}:${r.id}`);
        await this.redis.del(...keys);
    }
    
    // Batch permission check for file listing
    async checkAccessBatch(
        userId: string, 
        resourceIds: string[]
    ): Promise<Map<string, boolean>> {
        // Multi-get from Redis
        const keys = resourceIds.map(r => `perm:${userId}:${r}`);
        const cached = await this.redis.mget(...keys);
        
        const results = new Map<string, boolean>();
        const missing: string[] = [];
        
        cached.forEach((value, index) => {
            if (value) {
                results.set(resourceIds[index], hasCapability(JSON.parse(value), 'view'));
            } else {
                missing.push(resourceIds[index]);
            }
        });
        
        // Batch compute missing
        if (missing.length > 0) {
            const computed = await this.computePermissionBatch(userId, missing);
            for (const [resourceId, perm] of computed) {
                results.set(resourceId, hasCapability(perm, 'view'));
            }
        }
        
        return results;
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102

// Comprehensive audit logging
interface AuditEvent {
    id: string;
    timestamp: Date;
    
    // Actor
    actorId: string;
    actorType: 'user' | 'admin' | 'system' | 'api_key';
    actorEmail: string;
    
    // Action
    action: AuditAction;
    resourceId: string;
    resourcePath: string;
    resourceType: 'file' | 'folder' | 'link' | 'permission';
    
    // Context
    ipAddress: string;
    userAgent: string;
    deviceId?: string;
    sessionId: string;
    
    // Specifics
    details: Record<string, any>;
    
    // Outcome
    success: boolean;
    failureReason?: string;
}
 
type AuditAction = 
    | 'file.view'
    | 'file.download'
    | 'file.upload'
    | 'file.edit'
    | 'file.delete'
    | 'file.restore'
    | 'file.move'
    | 'file.copy'
    | 'permission.grant'
    | 'permission.revoke'
    | 'permission.modify'
    | 'link.create'
    | 'link.access'
    | 'link.revoke'
    | 'share.external'
    | 'admin.export'
    | 'admin.audit_view';
 
// Audit log queries for compliance
class AuditService {
    // Who accessed this file?
    async getFileAccessHistory(
        fileId: string, 
        since: Date
    ): Promise<AuditEvent[]> {
        return this.db.auditEvents
            .where({ resourceId: fileId, action: { $in: ['file.view', 'file.download'] } })
            .where({ timestamp: { $gte: since } })
            .orderBy('timestamp', 'desc')
            .limit(1000);
    }
    
    // What has this user accessed?
    async getUserActivityReport(
        userId: string, 
        since: Date
    ): Promise<AuditEvent[]> {
        return this.db.auditEvents
            .where({ actorId: userId })
            .where({ timestamp: { $gte: since } })
            .orderBy('timestamp', 'desc')
            .limit(10000);
    }
    
    // Permission change history
    async getPermissionChanges(
        resourceId: string
    ): Promise<AuditEvent[]> {
        return this.db.auditEvents
            .where({ resourceId })
            .where({ action: { $regex: /^permission\./ } })
            .orderBy('timestamp', 'desc');
    }
    
    // External access report (for compliance)
    async getExternalAccessReport(
        orgId: string, 
        since: Date
    ): Promise<ExternalAccessSummary[]> {
        const events = await this.db.auditEvents
            .where({ 
                action: 'link.access',
                actorType: 'user',
                timestamp: { $gte: since }
            })
            .join('users', 'actorId', 'id')
            .where('users.orgId', '!=', orgId);  // Not from our org
        
        return this.summarizeByUser(events);
    }
}