Repository navigation
feat(artifacts): list only your own artifacts, and share a personal one with the org - #32
Merged
Merged
Conversation
…ne with the org Org-tier artifacts stay openable, editable and deletable by every member through their link, but the artifact list (the gallery and the MCP list tool) now shows only the caller's own: their personal artifacts, org artifacts they created, and org artifacts with no recorded creator. A new nullable `created_by` column records the creating subject on save. Overwrites, renames and preview updates leave it alone. POST /artifacts/:artifactId/share moves one of the caller's personal artifacts to the org tier and records them as its creator. Another member's artifact, an unknown id and an already shared artifact all return 404. The detail page shows Share for a personal artifact and Copy link for a shared one. Includes the cloud migration for the new column and a D1 upgrade test.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since #31, new artifacts are created at the org tier, so every member's artifact list shows every other member's artifacts. This keeps #31's access model and scopes the list.
List. The gallery and the MCP
artifacts.listtool now return only the caller's own artifacts:user-tier) artifacts;created_bycolumn, set on create, never rewritten);An executor with no subject still lists every org artifact. Opening, editing and deleting by id are unchanged: any member can open an org artifact from its link.
Share. Artifacts saved before #31 are personal, and another member opening their link gets a 404.
POST /artifacts/:artifactId/sharemoves one of the caller's personal artifacts to the org tier in place and records the caller as its creator. Another member's artifact, an unknown id and an already shared artifact all return 404. The detail page shows Share (with a confirmation) on a personal artifact and Copy link on a shared one.Migration. Adds nullable
artifact.created_by: cloud migration0023, and the D1 runtime schema upgrade is covered by a newd1.test.tscase.Tests
packages/core/sdk/src/artifacts.test.ts: own list vs another member's list, legacy rows with no creator, share by owner, share by another member, share of an already shared artifact, and an overwrite by another member keeping the creator. Mutation-checked: removing the list filter, not recording the creator, or dropping theowner = 'user'guard on share each fail tests.packages/core/api/src/artifacts/artifacts-share.test.ts: 200 withowner: "org", and 404 for an unknown id.apps/host-cloudflare/src/db/d1.test.ts: the column is added to a database that predates it.The UI change was typechecked and linted but not exercised in a browser.
Known gap, not addressed here. The settled-render image preview (
setPreview) holds whatever data its capturer saw. On an org artifact any member can write it, and since #31 it's shown to every member. The UI doesn't call it today.