Revert "Hide meeting minutes from guests (#10737)"

dev/tool/src/index.ts

@@ -331,28 +331,10 @@ export function devTool (
   //   })
   // })
 
-  function parseAccountRole (raw: unknown): AccountRole {
-    const rawRole = typeof raw === 'string' ? raw.trim() : String(raw ?? 'User').trim()
-    const normalized = rawRole.trim().toLowerCase()
-
-    const match = Object.values(AccountRole).find((v) => v.toLowerCase() === normalized)
-    if (match !== undefined) return match
-
-    switch (normalized) {
-      case 'readonly':
-        return AccountRole.ReadOnlyGuest
-      case 'docguest':
-        return AccountRole.DocGuest
-      default:
-        throw new Error(`Unknown role: ${rawRole}`)
-    }
-  }
-
   program
     .command('assign-workspace <email> <workspace>')
     .description('assign workspace')
-    .option('--role <role>', 'Workspace role (User, Guest, ReadOnlyGuest, DocGuest, Maintainer, Owner, Admin)', 'User')
-    .action(async (email: string, workspace: string, cmd: { role: string }) => {
+    .action(async (email: string, workspace: string, cmd) => {
       await withAccountDatabase(async (db) => {
         console.log(`assigning user ${email} to ${workspace}...`)
         try {
@@ -361,12 +343,10 @@ export function devTool (
             throw new Error(`Workspace ${workspace} not found`)
           }
 
-          const role = cmd.role != null ? parseAccountRole(cmd.role) : AccountRole.User
-
           await assignWorkspace(toolCtx, db, null, getToolToken(), {
             email,
             workspaceUuid: ws.uuid,
-            role
+            role: AccountRole.User
           })
         } catch (err: any) {
           console.error(err)

foundations/server/packages/middleware/src/spaceSecurity.ts

@@ -613,54 +613,6 @@ export class SpaceSecurityMiddleware extends BaseMiddleware implements Middlewar
     return domain === 'tx' ? 'objectSpace' : domain === 'space' ? '_id' : 'space'
   }
 
-  private mergeDocIdRestriction<T extends Doc>(query: DocumentQuery<T>, allowed: Ref<T>[]): DocumentQuery<T> {
-    const allowedIds: DocumentQuery<T>['_id'] = { $in: allowed.length === 0 ? [] : allowed }
-    const prevId = query._id
-    if (prevId === undefined) {
-      return { ...query, _id: allowedIds }
-    }
-    type WithAnd = DocumentQuery<T> & { $and?: DocumentQuery<T>[] }
-    const { _id: _drop, $and, ...rest } = query as WithAnd
-    const andParts: DocumentQuery<T>[] = [...($and ?? []), { _id: prevId }, { _id: allowedIds }]
-    const merged: DocumentQuery<T> = { ...rest, $and: andParts }
-    return merged
-  }
-
-  private async applyGuestCollaboratorReadRestriction<T extends Doc>(
-    ctx: MeasureContext<SessionData>,
-    _class: Ref<Class<T>>,
-    domain: Domain,
-    query: DocumentQuery<T>
-  ): Promise<DocumentQuery<T>> {
-    const account = ctx.contextData.account
-    if (
-      ![AccountRole.Guest, AccountRole.ReadOnlyGuest].includes(account.role) ||
-      isSystem(account, ctx) ||
-      domain === DOMAIN_MODEL
-    ) {
-      return query
-    }
-
-    const collabSec = getClassCollaborators(this.context.modelDb, this.context.hierarchy, _class)
-    if (collabSec?.provideSecurity !== true) {
-      return query
-    }
-
-    const rootClass = collabSec.attachedTo
-    const docClasses = [...this.context.hierarchy.getDescendants(rootClass), rootClass]
-    const collabs = (await this.provideFindAll(
-      ctx,
-      core.class.Collaborator,
-      {
-        collaborator: account.uuid,
-        attachedToClass: { $in: docClasses }
-      },
-      { projection: { attachedTo: 1 }, limit: 10_000 }
-    )) as Collaborator[]
-    const allowed = collabs.map((c) => c.attachedTo) as Ref<T>[]
-    return this.mergeDocIdRestriction(query, allowed)
-  }
-
   override async findAll<T extends Doc>(
     ctx: MeasureContext<SessionData>,
     _class: Ref<Class<T>>,
@@ -727,10 +679,7 @@ export class SpaceSecurityMiddleware extends BaseMiddleware implements Middlewar
       }
     }
 
-    let queryToUse = !this.skipFindCheck ? newQuery : query
-    queryToUse = await this.applyGuestCollaboratorReadRestriction(ctx, _class, domain, queryToUse)
-
-    let findResult = await this.provideFindAll(ctx, _class, queryToUse, options)
+    let findResult = await this.provideFindAll(ctx, _class, !this.skipFindCheck ? newQuery : query, options)
     if (clientFilterSpaces !== undefined) {
       const cfs = clientFilterSpaces
       findResult = toFindResult(