matched_folder_permissions(user_id, folder_id, resource_scope, action_code) AS (
SELECT DISTINCT ip.user_id, granted.id, p.resource_scope, p.action_code
FROM public.dms_file_permissions p
JOIN input_principals ip
ON ip.principal_id = p.principal_id
AND (
(p.principal_type = 'USER' AND ip.principal_kind = 'USER')
OR (p.principal_type = 'ORG' AND p.include_child_orgs = FALSE
AND ip.principal_kind = 'ORG_DIRECT')
OR (p.principal_type = 'ORG' AND p.include_child_orgs = TRUE
AND ip.principal_kind = 'ORG_ANCESTOR')
OR (p.principal_type = 'POSITION' AND ip.principal_kind = 'POSITION')
OR (p.principal_type = 'ROLE' AND ip.principal_kind = 'ROLE')
OR (p.principal_type = 'GROUP' AND ip.principal_kind = 'GROUP')
)
JOIN public.dms_folders granted
ON granted.tenant_id = p.tenant_id
AND granted.id = p.resource_id
AND granted.f_delete_mark IS NULL
WHERE p.tenant_id = #{q.tenantId}
AND p.resource_type = 'FOLDER'
AND p.resource_scope IN ('SELF', 'SUBTREE')
AND p.action_code IN ('READ', 'PRINT')
AND p.revoked_at IS NULL
AND p.valid_from <= CURRENT_TIMESTAMP
AND (p.valid_to IS NULL OR CURRENT_TIMESTAMP < p.valid_to)
AND (p.max_use_count IS NULL OR p.used_count < p.max_use_count)
)
SELECT DISTINCT p.resource_id AS id
FROM public.dms_file_permissions p
WHERE p.tenant_id = #{tenantId}
AND p.principal_type = 'USER' AND p.principal_id = #{userId}
AND p.resource_type = 'FILE_VERSION' AND p.resource_scope = 'SELF'
AND p.action_code = 'PRINT' AND p.source_type = 'WORKFLOW'
AND p.revoked_at IS NULL
AND p.valid_from <= CURRENT_TIMESTAMP
AND (p.valid_to IS NULL OR CURRENT_TIMESTAMP < p.valid_to)
AND (p.max_use_count IS NULL OR p.used_count < p.max_use_count)
ORDER BY id
WITH RECURSIVE input_principals(user_id, principal_kind, principal_id) AS (
SELECT item ->> 'userId', item ->> 'principalKind', item ->> 'principalId'
FROM jsonb_array_elements(CAST(#{q.principalsJson} AS jsonb)) item
),
WITH RECURSIVE input_principals(user_id, principal_kind, principal_id) AS (
SELECT item ->> 'userId', item ->> 'principalKind', item ->> 'principalId'
FROM jsonb_array_elements(CAST(#{q.principalsJson} AS jsonb)) item
),
parent_ancestors(id, parent_id) AS (
SELECT folder.id, folder.parent_id
FROM public.dms_folders folder
WHERE folder.tenant_id = #{q.tenantId}
AND folder.id = #{q.parentId}
AND folder.f_delete_mark IS NULL
SELECT NULL::UUID, NULL::UUID WHERE FALSE
UNION
SELECT parent.id, parent.parent_id
FROM parent_ancestors child
JOIN public.dms_folders parent
ON parent.tenant_id = #{q.tenantId}
AND parent.id = child.parent_id
AND parent.f_delete_mark IS NULL
),
AND folder.parent_id IS NULL
AND folder.parent_id = #{q.parentId}
AND (
folder.id IN (SELECT visible.id FROM navigation_ancestors visible)
OR EXISTS (
SELECT 1
FROM matched_folder_permissions inherited
WHERE inherited.resource_scope = 'SUBTREE'
AND inherited.folder_id IN (SELECT ancestor.id FROM parent_ancestors ancestor)
)
)
AND (folder.sort_code > #{q.cursorSortCode}
OR (folder.sort_code = #{q.cursorSortCode} AND folder.id > #{q.cursorId}))
ORDER BY folder.sort_code, folder.id
LIMIT #{q.limit}
),
effective_page_permissions(user_id, folder_id, action_code) AS (
SELECT DISTINCT permission.user_id, folder.id, permission.action_code
FROM page_folders folder
JOIN matched_folder_permissions permission
ON permission.folder_id = folder.id
OR (
permission.resource_scope = 'SUBTREE'
AND permission.folder_id IN (
SELECT ancestor.id FROM parent_ancestors ancestor
)
)
)
SELECT folder.id,
folder.parent_id,
folder.name,
folder.sort_code,
EXISTS (
SELECT 1
FROM public.dms_folders child
WHERE child.tenant_id = #{q.tenantId}
AND child.parent_id = folder.id
AND child.f_delete_mark IS NULL
AND (
child.id IN (SELECT visible.id FROM navigation_ancestors visible)
OR EXISTS (
SELECT 1
FROM matched_folder_permissions inherited
WHERE inherited.resource_scope = 'SUBTREE'
AND (
inherited.folder_id = folder.id
OR inherited.folder_id IN (
SELECT ancestor.id FROM parent_ancestors ancestor
)
)
)
)
) AS has_children,
permission.user_id,
permission.action_code
FROM page_folders folder
LEFT JOIN effective_page_permissions permission ON permission.folder_id = folder.id
ORDER BY folder.sort_code, folder.id, permission.user_id, permission.action_code