fix: Unable to search drafts without a collection (#12079)

* fix: Unable to search drafts without a collection

* PR feedback
This commit is contained in:
Tom Moor
2026-04-16 17:37:25 -04:00
committed by GitHub
parent 1596e51fa5
commit 26f5bb9784
2 changed files with 52 additions and 0 deletions
@@ -391,6 +391,46 @@ describe("PostgresSearchProvider", () => {
expect(results.length).toBe(1);
});
it("should include drafts with no collection created by user", async () => {
const user = await buildUser();
const draft = await buildDraftDocument({
teamId: user.teamId,
userId: user.id,
createdById: user.id,
collectionId: null,
title: "test",
});
const { results } = await provider.searchForUser(user, {
query: "test",
statusFilter: [StatusFilter.Draft],
});
expect(results.length).toBe(1);
expect(results[0].document?.id).toBe(draft.id);
});
it("should not include drafts created by user in inaccessible collections", async () => {
const team = await buildTeam();
const user = await buildUser({ teamId: team.id });
const otherUser = await buildUser({ teamId: team.id });
const privateCollection = await buildCollection({
teamId: team.id,
userId: otherUser.id,
permission: null,
});
await buildDraftDocument({
teamId: team.id,
userId: user.id,
createdById: user.id,
collectionId: privateCollection.id,
title: "test",
});
const { results } = await provider.searchForUser(user, {
query: "test",
statusFilter: [StatusFilter.Draft],
});
expect(results.length).toBe(0);
});
it("should not include drafts with user read permission", async () => {
const user = await buildUser();
await buildDraftDocument({
@@ -628,6 +628,18 @@ export default class PostgresSearchProvider extends BaseSearchProvider {
{ "$memberships.id$": { [Op.ne]: null } },
{ "$groupMemberships.id$": { [Op.ne]: null } }
);
// Allow users to see their own drafts that have no collection, where no
// membership or collection access applies. Drafts in collections remain
// gated by the collection/membership checks above.
if (options.statusFilter?.includes(StatusFilter.Draft)) {
where[Op.or].push({
createdById: model.id,
collectionId: { [Op.is]: null },
publishedAt: { [Op.eq]: null },
archivedAt: { [Op.eq]: null },
});
}
}
// Ensure we're filtering by the users accessible collections. If