同步 MNote 授权目录到 OpenHub

rust/crates/mnote-web/src/routes/local_folder_source.rs

@@ -5,6 +5,7 @@ use crate::page_aggregate::{
     PageAggregate, PageAggregateSource, PageBody, PageHead, PageIdentity, PageLayout, PageOptions,
     PagePermissions, PageStats, PageTree,
 };
+use crate::provider_identity_sync::sync_openhub_directory_permissions_for_user_id;
 use crate::routes::local_markdown_parser::{
     file_stem_title, parse_markdown_attachment_refs, parse_markdown_page, split_frontmatter,
 };
@@ -2124,6 +2125,7 @@ fn delete_sqlite_local_access_grant_for_context(
             "默认空间的系统授权不能撤销",
         ));
     }
+    let revoked_user_id = grants.first().map(|grant| grant.user_id.clone());
     state
         .control_plane()
         .revoke_directory_grant(grant_id, None)
@@ -2154,6 +2156,7 @@ fn delete_sqlite_local_access_grant_for_context(
         "controlPlane": "sqlite",
         "policyPath": local_access_policy_path().display().to_string(),
         "deletedGrantId": grant_id,
+        "revokedUserId": revoked_user_id,
         "policy": {
             "grants": state
                 .control_plane()
@@ -2371,6 +2374,14 @@ pub async fn create_local_access_grant(
 ) -> Result<(StatusCode, Json<Value>), WebError> {
     let payload = add_sqlite_local_access_grant_for_context(&state, &context, request)
         .map_err(|error| error.with_context(&context))?;
+    if let Some(user_id) = payload
+        .pointer("/grant/userId")
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+    {
+        sync_openhub_directory_permissions_for_user_id(state.control_plane(), user_id).await;
+    }
     Ok((StatusCode::OK, Json(payload)))
 }
 
@@ -2381,6 +2392,14 @@ pub async fn create_user_access_grant(
 ) -> Result<(StatusCode, Json<Value>), WebError> {
     let payload = add_sqlite_user_access_grant_for_context(&state, &context, request)
         .map_err(|error| error.with_context(&context))?;
+    if let Some(user_id) = payload
+        .pointer("/grant/userId")
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+    {
+        sync_openhub_directory_permissions_for_user_id(state.control_plane(), user_id).await;
+    }
     Ok((StatusCode::OK, Json(payload)))
 }
 
@@ -2391,6 +2410,14 @@ pub async fn delete_local_access_grant(
 ) -> Result<(StatusCode, Json<Value>), WebError> {
     let payload = delete_sqlite_local_access_grant_for_context(&state, &context, &grant_id)
         .map_err(|error| error.with_context(&context))?;
+    if let Some(user_id) = payload
+        .get("revokedUserId")
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+    {
+        sync_openhub_directory_permissions_for_user_id(state.control_plane(), user_id).await;
+    }
     Ok((StatusCode::OK, Json(payload)))
 }
 
@@ -2401,6 +2428,14 @@ pub async fn delete_user_access_grant(
 ) -> Result<(StatusCode, Json<Value>), WebError> {
     let payload = delete_sqlite_user_access_grant_for_context(&state, &context, &grant_id)
         .map_err(|error| error.with_context(&context))?;
+    if let Some(user_id) = payload
+        .get("revokedUserId")
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+    {
+        sync_openhub_directory_permissions_for_user_id(state.control_plane(), user_id).await;
+    }
     Ok((StatusCode::OK, Json(payload)))
 }
 
@@ -11244,6 +11279,7 @@ fn main() {}
         .await
         .expect("owner can revoke self-created grant");
         assert_eq!(deleted["deletedGrantId"], grant_id);
+        assert_eq!(deleted["revokedUserId"], "user_target");
         let revoked_error = ensure_local_workspace_write_access_with_state(
             &state,
             &request_context("user_target", "user"),