policy-effective.controller.ts

policy-effective.controller.tsapps/api/src/modules/org/policy-effective.controller.tsraw ← org2,550 B← Back to the app
1/**
2 * TASK-0133 — the MEMBER-facing effective-policy endpoint (spec: "a
3 * lightweight `GET /api/v1/workspaces/:id/policy/effective` for members —
4 * used by the [file] picker, never authoritative").
5 *
6 * It returns the org policy + the EFFECTIVE caps (org policy ∩ plan limits —
7 * the same computation the upload path enforces, `effectiveMaxFileBytes`).
8 * The file picker reads this to warn BEFORE the user picks a file; the
9 * presign endpoint remains the authoritative enforcement (413 — a client
10 * that ignores the warning still cannot exceed the cap). Requires VIEW on
11 * the workspace (any member) — it reveals policy VALUES (not secrets), which
12 * is fine for members of the org.
13 */
14import { Controller, Get, Inject, Param, Req } from "@nestjs/common";
15import type { Request } from "express";
16import { PrismaService } from "../../common/prisma.service.js";
17import { requireUser } from "../../common/types.js";
18import { assertCan } from "../../lib/authorize.js";
19import {
20  effectiveMaxFileBytes,
21  planMaxFileBytes,
22  workspaceOrgPolicy
23} from "./org-policy.service.js";
24 
25@Controller("workspaces/:workspaceId/policy")
26export class PolicyEffectiveController {
27  // Explicit @Inject (see OrgAdminController — bare params break under
28  // vitest/esbuild's missing design:paramtypes).
29  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
30 
31  @Get("effective")
32  async effective(@Param("workspaceId") workspaceId: string, @Req() req: Request) {
33    const userId = requireUser(req);
34    await assertCan(this.prisma, { workspaceId, userId }, "VIEW");
35    const ws = await this.prisma.workspace.findUnique({
36      where: { id: workspaceId },
37      select: { organizationId: true, billingPlan: true }
38    });
39    if (!ws) throw new (await import("../../common/errors.js")).ApiError("NOT_FOUND", 404, "Workspace not found.");
40    const { orgId, policy } = await workspaceOrgPolicy(this.prisma, workspaceId);
41    const maxBytes = effectiveMaxFileBytes(policy, ws.billingPlan);
42    return {
43      orgId,
44      policy,
45      effective: {
46        // The org's effective upload cap (org ∩ plan) — the picker warns at
47        // this size; the presign endpoint enforces it authoritatively (413).
48        maxFileSizeBytes: maxBytes,
49        maxFileSizeMB: Math.floor(maxBytes / 1024 / 1024),
50        planMaxFileSizeBytes: planMaxFileBytes(ws.billingPlan),
51        sessionLifetimeHours: policy?.sessionLifetimeHours ?? null,
52        allowExternalEmbeds: policy?.allowExternalEmbeds ?? true
53      }
54    };
55  }
56}
57