fix: fix issues with apps in /share endpoint

doc/devmeta/track-comments.md

@@ -46,3 +46,8 @@ Comments beginning with `// track:`. See
   then the null check should result in a early return of null;
   this code with the track comment may have additional logic
   for the null/undefined case.
+- `track: manual safe object`
+  This code manually creates a new "client-safe" version of
+  some object that's in scope. This could be either to pass
+  onto the browser or to pass to something like the
+  notification service.

packages/backend/src/routers/share.js

@@ -235,6 +235,7 @@ const v0_2 = async (req, res) => {
 
     recipients_work.clear_invalid();
     
+    // Check: users specified by username exist
     for ( const item of recipients_work.list() ) {
         if ( item.type !== 'username' ) continue;
 
@@ -270,6 +271,8 @@ const v0_2 = async (req, res) => {
     }
     shares_work.lockin();
     
+    // Check: all share items are a type-tagged-object
+    //        with one of these types: fs-share, app-share.
     for ( const item of shares_work.list() ) {
         const { i } = item;
         let { value } = item;
@@ -286,13 +289,25 @@ const v0_2 = async (req, res) => {
         
         const allowed_things = ['fs-share', 'app-share'];
         if ( ! allowed_things.includes(thing.$) ) {
+            item.invalid = true;
+            result.shares[i] =
                 APIError.create('disallowed_thing', null, {
                     thing: thing.$,
                     accepted: allowed_things,
-            })
+                });
+            continue;
         }
         
-        if ( thing.$ === 'fs-share' ) {
+        item.thing = thing;
+    }
+
+    shares_work.clear_invalid();
+    
+    // Process: create $share-intent:file for file items
+    for ( const item of shares_work.list() ) {
+        const { thing } = item;
+        if ( thing.$ !== 'fs-share' ) continue;
+
         item.type = 'fs';
         const errors = [];
         if ( ! thing.path ) {
@@ -316,13 +331,22 @@ const v0_2 = async (req, res) => {
         }
         
         item.path = thing.path;
-            item.permission = PermissionUtil.join('fs', thing.path, access);
+        item.share_intent = {
+            $: 'share-intent:file',
+            permissions: [PermissionUtil.join('fs', thing.path, access)],
+        };
     }
 
-        if ( thing.$ === 'app-share' ) {
+    shares_work.clear_invalid();
+
+    // Process: create $share-intent:app for app items
+    for ( const item of shares_work.list() ) {
+        const { thing } = item;
+        if ( thing.$ !== 'app-share' ) continue;
+
         item.type = 'app';
         const errors = [];
-            if ( ! thing.uid && thing.name ) {
+        if ( ! thing.uid && ! thing.name ) {
             errors.push('`uid` or `name` is required');
         }
 
@@ -336,9 +360,21 @@ const v0_2 = async (req, res) => {
             continue;
         }
         
-            item.permission = PermissionUtil.join('app', thing.path, 'access');
+        const app_selector = thing.uid
+            ? `uid#${thing.uid}` : thing.name;
+        
+        item.share_intent = {
+            $: 'share-intent:app',
+            permissions: [
+                PermissionUtil.join('app', app_selector, 'access')
+            ]
+        }
         continue;
     }
+    
+    // Process: conditionally add permission for subdomain
+    for ( const item of shares_work.list() ) {
+        // NEXT
     }
     
     shares_work.clear_invalid();
@@ -374,6 +410,13 @@ const v0_2 = async (req, res) => {
     
     shares_work.clear_invalid();
     
+    for ( const item of shares_work.list() ) {
+        if ( item.type !== 'app' ) continue;
+        const app = await get_app({});
+    }
+    
+    shares_work.clear_invalid();
+
     // Mark files as successful; further errors will be
     // reported on recipients instead.
     for ( const item of shares_work.list() ) {
@@ -408,12 +451,15 @@ const v0_2 = async (req, res) => {
         const username = recipient_item.user.username;
 
         for ( const share_item of shares_work.list() ) {
+            const permissions = share_item.share_intent.permissions;
+            for ( const perm of permissions ) {
                 await svc_permission.grant_user_user_permission(
                     actor,
                     username,
-                share_item.permission,
+                    perm,
                 );
             }
+        }
         
         // TODO: Need to re-work this for multiple files
         /*
@@ -433,13 +479,28 @@ const v0_2 = async (req, res) => {
         */
        
         const files = []; {
-            for ( const path_item of shares_work.list() ) {
+            for ( const item of shares_work.list() ) {
+                if ( item.type !== 'file' ) continue;
                 files.push(
-                    await path_item.node.getSafeEntry(),
+                    await item.node.getSafeEntry(),
                 );
             }
         }
 
+        const apps = []; {
+            for ( const item of shares_work.list() ) {
+                if ( item.type !== 'app' ) continue;
+                // TODO: is there a general way to create a
+                //       client-safe app right now without
+                //       going through entity storage?
+                // track: manual safe object
+                apps.push(item.name
+                    ? item.name : await get_app({
+                        uid: item.uid,
+                    }));
+            }
+        }
+        
         svc_notification.notify(UsernameNotifSelector(username), {
             source: 'sharing',
             icon: 'shared.svg',