Mention-grants: Collaborator-based cross-space access for @-mentions

[MichaelUray]

Mention-grants: Collaborator-based cross-space access for @-mentions

When a user @-mentions someone on a doc whose class is opted into mentions-grant-access, that mentioned account should gain read access to the doc — even if they are not a member of the doc's containing space. This is the cross-space access path that today's Collaborator infrastructure already supports for explicit addCollaborator calls; this PR wires it up to the @-mention authoring flow with an opt-in disclosure dialog.

Companion docs: hcengineering/huly-docs#72 (draft; text complete, screenshots will be added in a follow-up commit on the same branch).

Scope: tracker.class.Issue is the only class that opts in today via mentionsGrantAccess: true. The architecture is generic (any ClassCollaborators provider can opt in), but rolling it out to other classes is an explicit follow-up decision per class.

What this builds

V1 — Cross-space Space-visibility for Guests. Guests who hold a Collaborator edge to a doc inside a space they are not a member of need that space to surface in their navigator so the doc is reachable without deep-link gymnastics. Three layers cooperate:

1. foundations/server/packages/middleware/src/spaceSecurity.ts — skip the middleware-level space pre-filter for Guest / ReadOnlyGuest reads of Space-derived classes (spaceCollabBypass). The Postgres adapter then does the filtering at SQL level.
2. foundations/server/packages/postgres/src/storage.ts — addSecurity appends an OR EXISTS (collaborator WHERE space = domain._id AND collaborator = caller) branch for Guest reads on DOMAIN_SPACE. A Space hosting any Collaborator record naming the caller becomes readable. Self-Collaborator visibility for non-Admin non-System callers is added in the same change.
3. plugins/workbench-resources/src/components/Navigator.svelte — client-side: union of member-spaces + collab-spaces. The collab-spaces set comes from findAll(Collaborator, { collaborator: self }) with projection: { space: 1 }, then a batched findAll(Space, { _id: { $in: ... } }). Tracker's per-project tree marks collab-only projects with a dim icon + tooltip ("Shared with you") and hides non-Issues sub-views (Components / Milestones / Templates) because they would render empty for a collab-only Guest.

V3 — Send-time disclosure for @-mentions. When the author types @person, the picker passes the user-intent into a Markup attribute on the reference node (grantsAccess, values: 'true' | 'false' | undefined). On send, if the message contains any reference with grantsAccess !== 'false' and the mentioned employee is not already a member of the doc's space, a disclosure dialog asks the author to confirm per grantee. (The server trigger additionally dedups against existing Collaborator records, so the dialog may surface for a user who already has the grant; the trigger then emits no new Tx.) Cancelling the dialog preserves the unsent comment.

V3c (server filter) — mentionsGrantAccess trigger ignores any reference whose grantsAccess is explicitly 'false'. V3d (edit path) — re-grants on a message edit are strictly add-only: a removed mention does not retract anyone's read access (a previously-granted user remains a Collaborator until an explicit removeDoc on the Collaborator).

Architecture sketch

Author types @person          Reference node carries grantsAccess attr
        │                              │
        ▼                              ▼
Comment composer (V3a)        Server trigger applyMentionGrants (V3c/d)
        │                              │
        ▼                              ▼
 Disclosure dialog (V3b)       TxCreateDoc Collaborator (add-only)
        │                              │
        ▼                              ▼
   Send / Cancel              Guest: postgres OR-branch + Navigator (V1)
                                      │
                                      ▼
                              Doc + space visible cross-space

What is opt-in

• Per class via ClassCollaborators.mentionsGrantAccess: true (default false).
• Today only tracker.class.Issue opts in.

Tests

Suite	Result
foundations/core/packages/core	982 / 982
foundations/core/packages/text-core	19 / 19 (new reference.test.ts)
plugins/chunter-resources	5 / 5 (new mentionGrants.test.ts)
server-plugins/chunter-resources	6 / 6 (new mentionGrantsTrigger.test.ts)
foundations/server/packages/middleware	30 / 30

rush install / rush build / rush validate: all exit 0. svelte-check across tracker-resources / chunter-resources / workbench-resources: 0 errors.

Live deployment evidence

Deployed and verified on a self-hosted Huly v0.7.423 instance with the CockroachDB backend. Specifically exercised:

• Guest user with Collaborator records on Issues across two projects (one project where they are also a member, one where they are collab-only) — nav surfaces both, with the collab-only one dimmed and sub-nodes hidden; mention picker correctly lists their collab-targets.
• Postgres OR-branch verified at SQL level (EXISTS query against collaborator table returns the expected projects).
• V3b dialog opens on send when the message contains an unprivileged-mention; Cancel returns to the composer with the message intact.

Sign-off

Single author, signed-off-by on every commit, DCO-compliant. 28 commits, intentionally not squashed for traceability. Squash-merge fine if preferred.

[huly-github-staging]

Connected to Huly®: UBERF-16493