Function assertUserCanAccessFileInternal

packages/dotcom-shared/src/mutators.ts:162–187

* Check if a user has the required permissions for a file. * @param tx - The transaction * @param userId - The user ID to check permissions for * @param file - The file to check permissions on * @param allowGuestAccess - If true, shared files are accessible even if user isn't owner/member

(
	tx: Transaction<TlaSchema>,
	userId: string,
	file: TlaFile,
	allowGuestAccess: boolean
)

 * @param allowGuestAccess - If true, shared files are accessible even if user isn't owner/member
 */
async function assertUserCanAccessFileInternal(
	tx: Transaction<TlaSchema>,
	userId: string,
	file: TlaFile,
	allowGuestAccess: boolean
) {
	assert(file, ZErrorCode.bad_request)
	assert(!file.isDeleted, ZErrorCode.bad_request)

	// If shared and we allow shared access, grant access immediately
	if (allowGuestAccess && file.shared) {
		return
	}

	if (file.ownerId) {
		// Legacy model: user must own the file
		assert(file.ownerId === userId, ZErrorCode.forbidden)
	} else if (file.owningGroupId) {
		// New model: user must be a member of the owning workspace
		const role = await getRole(tx, userId, file.owningGroupId)
		assert(can(role, 'accessFiles'), ZErrorCode.forbidden)
	} else {
		// File has neither ownerId nor owningGroupId - invalid state
		assert(false, ZErrorCode.bad_request)
	}
}

/**
 * Check if a user can access (read) a file.