fix(articles): list tenant articles for scoped editors

Author: bigjohnn1

server/api/articles/search.ts

@@ -2,63 +2,47 @@ import type { H3Event } from 'h3'
 
 export default defineEventHandler(async (event: H3Event) => {
   const { translate: t } = await useServerI18n(event)
-  const user = (await getServerSession(event))?.user
-  if (!user?.id) throw createError({ statusCode: 401, message: t('common.errors.unauthorized')! })
+  const { user, membership } = await requireTenantScope(event, 'ARTICLE_WRITE')
 
   const { skip, take } = await getPagination(event)
   const query = getQuery(event).query as string | undefined
 
   const db = await getEnhancedPrisma(user)
 
-  const clientSite = await db.clientSite.findFirst({
-    where: { users: { some: { id: user.id } } },
-    select: { id: true },
-  })
-
-  if (!clientSite?.id) {
-    return { data: [], total: 0 }
-  }
+  const clientSiteId = membership.clientSiteId
 
   const aiUserIds = await db.user
     .findMany({
-      where: { clientSiteId: clientSite.id, role: 'ai' },
+      where: { clientSiteId, role: 'ai' },
       select: { id: true },
     })
     .then((users) => users.map((u) => u.id))
 
+  const canEditOthers = hasTenantScope(membership, 'ARTICLE_WRITE_OTHERS')
+  const authorFilter = canEditOthers ? {} : { userId: { in: [user.id, ...aiUserIds] } }
+  const where = {
+    clientSiteId,
+    ...authorFilter,
+    ...(query && {
+      OR: [
+        { title: { contains: query, mode: 'insensitive' as const } },
+        { excerpt: { contains: query, mode: 'insensitive' as const } },
+        { content: { contains: query, mode: 'insensitive' as const } },
+      ],
+    }),
+  }
+
   const [articles, total] = await Promise.all([
     db.article.findMany({
-      where: {
-        clientSiteId: clientSite.id,
-        userId: { in: [user.id, ...aiUserIds] },
-        ...(query && {
-          OR: [
-            { title: { contains: query, mode: 'insensitive' } },
-            { excerpt: { contains: query, mode: 'insensitive' } },
-            { content: { contains: query, mode: 'insensitive' } },
-          ],
-        }),
-      },
+      where,
       orderBy: { createdAt: 'desc' },
       skip,
       take,
       // Feeds the admin table's language column. Drafts are visible here on purpose — this is
       // the owning admin's own list, and "awaiting review" is the whole point of the column.
       include: { translations: { select: { language: true, status: true, slug: true } } },
     }),
-    db.article.count({
-      where: {
-        clientSiteId: clientSite.id,
-        userId: { in: [user.id, ...aiUserIds] },
-        ...(query && {
-          OR: [
-            { title: { contains: query, mode: 'insensitive' } },
-            { excerpt: { contains: query, mode: 'insensitive' } },
-            { content: { contains: query, mode: 'insensitive' } },
-          ],
-        }),
-      },
-    }),
+    db.article.count({ where }),
   ])
 
   return { data: articles, total }

tests/server/tenantMembership.test.ts

@@ -114,6 +114,13 @@ describe('tenant boundary wiring', () => {
     ]
     for (const [file, guard] of expectations) expect(source(file)).toContain(guard)
   })
+
+  it('uses ARTICLE_WRITE_OTHERS when building the admin article list', () => {
+    const endpoint = source('server/api/articles/search.ts')
+    expect(endpoint).toContain("requireTenantScope(event, 'ARTICLE_WRITE')")
+    expect(endpoint).toContain("hasTenantScope(membership, 'ARTICLE_WRITE_OTHERS')")
+    expect(endpoint).toContain('canEditOthers ? {}')
+  })
 })
 
 describe('invitation onboarding wiring', () => {