Function resolveAccess

packages/core/src/sharing/access.ts:137–168

(
  resourceType: string,
  resourceId: string,
  ctx: AccessContext = currentAccess(),
)

 * null if they have no access. Loads the resource and relevant share rows.
 */
export async function resolveAccess(
  resourceType: string,
  resourceId: string,
  ctx: AccessContext = currentAccess(),
): Promise<ResolvedAccess | null> {
  const reg = requireShareableResource(resourceType);
  const db = reg.getDb() as any;

  const [resource] = await db
    .select()
    .from(reg.resourceTable)
    .where(eq(reg.resourceTable.id, resourceId));
  if (!resource) return null;

  const { userEmail, orgId } = ctx;

  if (userEmail && resource.ownerEmail === userEmail) {
    return { role: "owner", resource };
  }
  if (resource.visibility === "public") {
    // No share row needed; default viewer unless upgraded below.
    const role = await highestShareRole(reg, resourceId, ctx);
    return { role: role ?? "viewer", resource };
  }
  if (resource.visibility === "org" && orgId && resource.orgId === orgId) {
    const role = await highestShareRole(reg, resourceId, ctx);
    return { role: role ?? "viewer", resource };
  }
  const role = await highestShareRole(reg, resourceId, ctx);
  if (role) return { role, resource };
  return null;
}

async function highestShareRole(
  reg: ShareableResourceRegistration,