Function resolveChunkAccess

apps/sim/app/api/knowledge/utils.ts:299–360

* Resolve chunk access within a document/knowledge base, gated by read or write * permission on the KB. The document must exist and be fully processed * (`processingStatus === 'completed'`) before its chunks are accessible.

(
  knowledgeBaseId: string,
  documentId: string,
  chunkId: string,
  userId: string,
  requireWrite: boolean
)

 * (`processingStatus === 'completed'`) before its chunks are accessible.
 */
async function resolveChunkAccess(
  knowledgeBaseId: string,
  documentId: string,
  chunkId: string,
  userId: string,
  requireWrite: boolean
): Promise<ChunkAccessCheck> {
  const kbAccess = await resolveKnowledgeBaseAccess(knowledgeBaseId, userId, requireWrite)

  if (!kbAccess.hasAccess) {
    return {
      hasAccess: false,
      notFound: kbAccess.notFound,
      reason: kbAccess.notFound ? 'Knowledge base not found' : 'Unauthorized knowledge base access',
    }
  }

  const doc = await db
    .select()
    .from(document)
    .where(
      and(
        eq(document.id, documentId),
        eq(document.knowledgeBaseId, knowledgeBaseId),
        eq(document.userExcluded, false),
        isNull(document.archivedAt),
        isNull(document.deletedAt)
      )
    )
    .limit(1)

  if (doc.length === 0) {
    return { hasAccess: false, notFound: true, reason: 'Document not found' }
  }

  const docData = doc[0] as DocumentData

  // Chunks are only accessible once the document has finished processing.
  if (docData.processingStatus !== 'completed') {
    return {
      hasAccess: false,
      reason: `Document is not ready for access (status: ${docData.processingStatus})`,
    }
  }

  const chunk = await db
    .select()
    .from(embedding)
    .where(and(eq(embedding.id, chunkId), eq(embedding.documentId, documentId)))
    .limit(1)

  if (chunk.length === 0) {
    return { hasAccess: false, notFound: true, reason: 'Chunk not found' }
  }

  return {
    hasAccess: true,
    chunk: chunk[0] as EmbeddingData,