9ede795c5b
Enforce workspace isolation at every layer: - Router: move RequireWorkspaceMember middleware to group level so ALL workspace-scoped routes (issues, agents, skills, runtimes, inbox, comments) require workspace context - SQL: add GetXxxInWorkspace queries that filter by workspace_id, eliminating cross-workspace data access at the query level - Handlers: loadXForUser functions use workspace-scoped queries, no fallback to unscoped queries - Migration 025: add workspace_id column to comment table with backfill - ListComments: add workspace_id filter for defense-in-depth Fix daemon workspace mapping: - Server returns workspace_id in task claim response (from issue) - Daemon uses task.WorkspaceID directly instead of unreliable workspaceIDForRuntime() local map lookup - Remove workspaceIDForRuntime function Fix agent/human parity: - Comment update/delete: use resolveActor for isAuthor check so agents can edit/delete their own comments - Event attribution: replace hardcoded "member" with resolveActor in agent, skill, and subscriber publish calls Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
55 lines
1.8 KiB
SQL
55 lines
1.8 KiB
SQL
-- name: ListInboxItems :many
|
|
SELECT i.*,
|
|
iss.status as issue_status
|
|
FROM inbox_item i
|
|
LEFT JOIN issue iss ON iss.id = i.issue_id
|
|
WHERE i.workspace_id = $1 AND i.recipient_type = $2 AND i.recipient_id = $3 AND i.archived = false
|
|
ORDER BY i.created_at DESC
|
|
LIMIT $4 OFFSET $5;
|
|
|
|
-- name: GetInboxItem :one
|
|
SELECT * FROM inbox_item
|
|
WHERE id = $1;
|
|
|
|
-- name: GetInboxItemInWorkspace :one
|
|
SELECT * FROM inbox_item
|
|
WHERE id = $1 AND workspace_id = $2;
|
|
|
|
-- name: CreateInboxItem :one
|
|
INSERT INTO inbox_item (
|
|
workspace_id, recipient_type, recipient_id,
|
|
type, severity, issue_id, title, body,
|
|
actor_type, actor_id, details
|
|
) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
|
|
RETURNING *;
|
|
|
|
-- name: MarkInboxRead :one
|
|
UPDATE inbox_item SET read = true
|
|
WHERE id = $1
|
|
RETURNING *;
|
|
|
|
-- name: ArchiveInboxItem :one
|
|
UPDATE inbox_item SET archived = true
|
|
WHERE id = $1
|
|
RETURNING *;
|
|
|
|
-- name: CountUnreadInbox :one
|
|
SELECT count(*) FROM inbox_item
|
|
WHERE workspace_id = $1 AND recipient_type = $2 AND recipient_id = $3 AND read = false AND archived = false;
|
|
|
|
-- name: MarkAllInboxRead :execrows
|
|
UPDATE inbox_item SET read = true
|
|
WHERE workspace_id = $1 AND recipient_type = 'member' AND recipient_id = $2 AND archived = false AND read = false;
|
|
|
|
-- name: ArchiveAllInbox :execrows
|
|
UPDATE inbox_item SET archived = true
|
|
WHERE workspace_id = $1 AND recipient_type = 'member' AND recipient_id = $2 AND archived = false;
|
|
|
|
-- name: ArchiveAllReadInbox :execrows
|
|
UPDATE inbox_item SET archived = true
|
|
WHERE workspace_id = $1 AND recipient_type = 'member' AND recipient_id = $2 AND read = true AND archived = false;
|
|
|
|
-- name: ArchiveCompletedInbox :execrows
|
|
UPDATE inbox_item i SET archived = true
|
|
WHERE i.workspace_id = $1 AND i.recipient_type = 'member' AND i.recipient_id = $2 AND i.archived = false
|
|
AND i.issue_id IN (SELECT id FROM issue WHERE status IN ('done', 'cancelled'));
|