feat(content/list-documents): include accessRole/canEdit/canManage on each row

`list-documents` previously returned only document metadata,
leaving the UI to compute 'can I edit this doc?' separately or
optimistically — which led to subtle bugs where viewers saw edit
affordances they couldn't actually use.

The action now joins access-resolution into the listing:
- Owner detection: `ownerEmail === userEmail` AND owner-scope
  matches the active orgId (mirrors the `accessFilter` change
  in aa93f2f).
- Per-share lookup: a single bulk query against `documentShares`
  fetches user + org grants for all returned documents in one
  round-trip; `strongerRole()` picks the highest grant per
  resource id.
- Visibility floor: org-scoped documents the viewer accesses via
  visibility alone get a `viewer` role.
- Final shape adds `accessRole`, `canEdit`, `canManage` so the
  sidebar / list UI can render the right affordances directly off
  the listing response.

Author: steve8708

templates/content/actions/list-documents.ts

@@ -1,8 +1,16 @@
 import { defineAction } from "@agent-native/core";
-import { asc } from "drizzle-orm";
+import { and, asc, eq, inArray, or } from "drizzle-orm";
 import { getDb, schema } from "../server/db/index.js";
 import { parseDocumentFavorite } from "../server/lib/documents.js";
-import { accessFilter } from "@agent-native/core/sharing";
+import {
+  accessFilter,
+  ROLE_RANK,
+  type ShareRole,
+} from "@agent-native/core/sharing";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server/request-context";
 import { z } from "zod";
 
 function contentPreview(content: string, maxLength = 180) {
@@ -11,32 +19,120 @@ function contentPreview(content: string, maxLength = 180) {
   return `${compact.slice(0, maxLength).trimEnd()}...`;
 }
 
+type EffectiveRole = "owner" | ShareRole;
+
+function canEditRole(role: EffectiveRole) {
+  return role === "owner" || role === "admin" || role === "editor";
+}
+
+function canManageRole(role: EffectiveRole) {
+  return role === "owner" || role === "admin";
+}
+
+function strongerRole(
+  current: ShareRole | null,
+  next: ShareRole,
+): ShareRole {
+  if (!current || ROLE_RANK[next] > ROLE_RANK[current]) return next;
+  return current;
+}
+
 export default defineAction({
   description:
     "List document metadata ordered by position. Does not return full document bodies; use get-document for one document's content.",
   schema: z.object({}),
   http: { method: "GET" },
   run: async () => {
     const db = getDb();
+    const userEmail = getRequestUserEmail();
+    const orgId = getRequestOrgId();
     const documents = await db
       .select()
       .from(schema.documents)
       .where(accessFilter(schema.documents, schema.documentShares))
       .orderBy(asc(schema.documents.position));
 
-    const mapped = documents.map((d) => ({
-      id: d.id,
-      parentId: d.parentId,
-      title: d.title,
-      contentPreview: contentPreview(d.content),
-      contentLength: d.content.length,
-      icon: d.icon,
-      position: d.position,
-      isFavorite: parseDocumentFavorite(d.isFavorite),
-      visibility: d.visibility,
-      createdAt: d.createdAt,
-      updatedAt: d.updatedAt,
-    }));
+    const shareRoleByDocumentId = new Map<string, ShareRole>();
+    if (documents.length > 0) {
+      const principalClauses: NonNullable<ReturnType<typeof and>>[] = [];
+      if (userEmail) {
+        principalClauses.push(
+          and(
+            eq(schema.documentShares.principalType, "user"),
+            eq(schema.documentShares.principalId, userEmail),
+          ),
+        );
+      }
+      if (orgId) {
+        principalClauses.push(
+          and(
+            eq(schema.documentShares.principalType, "org"),
+            eq(schema.documentShares.principalId, orgId),
+          ),
+        );
+      }
+
+      if (principalClauses.length > 0) {
+        const shareRows = await db
+          .select({
+            resourceId: schema.documentShares.resourceId,
+            role: schema.documentShares.role,
+          })
+          .from(schema.documentShares)
+          .where(
+            and(
+              inArray(
+                schema.documentShares.resourceId,
+                documents.map((d) => d.id),
+              ),
+              or(...principalClauses),
+            ),
+          );
+
+        for (const row of shareRows) {
+          shareRoleByDocumentId.set(
+            row.resourceId,
+            strongerRole(
+              shareRoleByDocumentId.get(row.resourceId) ?? null,
+              row.role,
+            ),
+          );
+        }
+      }
+    }
+
+    const mapped = documents.map((d) => {
+      let accessRole: EffectiveRole = "viewer";
+      const shareRole = shareRoleByDocumentId.get(d.id) ?? null;
+
+      if (shareRole && ROLE_RANK[shareRole] > ROLE_RANK[accessRole]) {
+        accessRole = shareRole;
+      }
+      if (
+        userEmail &&
+        d.ownerEmail === userEmail &&
+        (orgId ? d.orgId === orgId : !d.orgId)
+      ) {
+        accessRole = "owner";
+      }
+
+      return {
+        id: d.id,
+        parentId: d.parentId,
+        title: d.title,
+        contentPreview: contentPreview(d.content),
+        contentLength: d.content.length,
+        icon: d.icon,
+        position: d.position,
+        isFavorite: parseDocumentFavorite(d.isFavorite),
+        visibility: d.visibility,
+        accessRole,
+        canEdit: canEditRole(accessRole),
+        canManage: canManageRole(accessRole),
+        createdAt: d.createdAt,
+        updatedAt: d.updatedAt,
+      };
+    });
 
     return { documents: mapped };
   },