Function resolveDocumentAccess

apps/sim/app/api/knowledge/utils.ts:230–269

* Resolve document access within a knowledge base, gated by read or write * permission on the KB (see resolveKnowledgeBaseAccess).

(
  knowledgeBaseId: string,
  documentId: string,
  userId: string,
  requireWrite: boolean
)

 * permission on the KB (see {@link resolveKnowledgeBaseAccess}).
 */
async function resolveDocumentAccess(
  knowledgeBaseId: string,
  documentId: string,
  userId: string,
  requireWrite: boolean
): Promise<DocumentAccessCheck> {
  const kbAccess = await resolveKnowledgeBaseAccess(knowledgeBaseId, userId, requireWrite)

  if (!kbAccess.hasAccess) {
    return {
      hasAccess: false,
      notFound: kbAccess.notFound,
      reason: kbAccess.notFound ? 'Knowledge base not found' : 'Unauthorized knowledge base access',
    }
  }

  const doc = await db
    .select()
    .from(document)
    .where(
      and(
        eq(document.id, documentId),
        eq(document.knowledgeBaseId, knowledgeBaseId),
        eq(document.userExcluded, false),
        isNull(document.archivedAt),
        isNull(document.deletedAt)
      )
    )
    .limit(1)

  if (doc.length === 0) {
    return { hasAccess: false, notFound: true, reason: 'Document not found' }
  }

  return {
    hasAccess: true,
    document: doc[0] as DocumentData,
    knowledgeBase: kbAccess.knowledgeBase!,
  }
}

/**
 * Check if a user has read access to a document within a knowledge base.