Apply comment visibility and expiry rules across Clips

templates/clips/actions/add-recording-to-space.ts

@@ -5,6 +5,7 @@ import { and, eq } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
+import { assertRecordingNotExpired } from "../server/lib/recording-read-access.js";
 import { parseSpaceIds, stringifySpaceIds } from "../server/lib/recordings.js";
 
 const MAX_CAS_ATTEMPTS = 5;
@@ -21,7 +22,9 @@ export default defineAction({
       .describe("Whether to add or remove the space"),
   }),
   run: async (args) => {
-    await assertAccess("recording", args.recordingId, "editor");
+    assertRecordingNotExpired(
+      await assertAccess("recording", args.recordingId, "editor"),
+    );
 
     const db = getDb();
 

templates/clips/actions/archive-recording.ts

@@ -5,6 +5,7 @@ import { eq } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
+import { assertRecordingNotExpired } from "../server/lib/recording-read-access.js";
 
 export default defineAction({
   description:
@@ -13,7 +14,9 @@ export default defineAction({
     id: z.string().describe("Recording ID"),
   }),
   run: async (args) => {
-    await assertAccess("recording", args.id, "editor");
+    assertRecordingNotExpired(
+      await assertAccess("recording", args.id, "editor"),
+    );
 
     const db = getDb();
 

templates/clips/actions/burn-recording-redactions.test.ts

@@ -4,6 +4,7 @@ const recording = vi.hoisted(() => ({
   id: "rec_1",
   title: "Test recording",
   kind: "video" as string,
+  expiresAt: null as string | null,
   ownerEmail: "owner@example.com",
   storageMode: null as "own" | "hosted" | null,
   videoUrl: "https://cdn.example.com/media/clips/rec_1.webm",
@@ -53,6 +54,8 @@ const state = vi.hoisted(() => ({
   canStart: true,
   filmstripCalls: [] as Array<Record<string, unknown>>,
   duringEncode: null as null | (() => void),
+  duringUpload: null as null | (() => void),
+  accessRole: "editor",
 }));
 
 vi.mock("@agent-native/core/action", () => ({
@@ -102,13 +105,19 @@ vi.mock("../server/lib/upload-recording-media.js", () => ({
   uploadRecordingMedia: vi.fn(async (input: Record<string, unknown>) => {
     state.uploadCalls.push(input);
     if (state.uploadError) throw state.uploadError;
+    state.duringUpload?.();
     return state.uploadUrl ? { url: state.uploadUrl, provider: "s3" } : null;
   }),
 }));
-vi.mock("@agent-native/core/sharing", () => ({
-  assertAccess: vi.fn(async () => undefined),
+vi.mock("@agent-native/core/sharing", async (original) => ({
+  ...(await original<typeof import("@agent-native/core/sharing")>()),
+  assertAccess: vi.fn(async () => ({
+    role: state.accessRole,
+    resource: { expiresAt: recording.expiresAt },
+  })),
 }));
-vi.mock("drizzle-orm", () => ({
+vi.mock("drizzle-orm", async (original) => ({
+  ...(await original<typeof import("drizzle-orm")>()),
   and: (...args: unknown[]) => args,
   eq: (column: unknown, value: unknown) => ({ column, value }),
 }));
@@ -224,11 +233,41 @@ describe("burning redactions into a recording", () => {
     state.uploadError = null;
     state.canStart = true;
     state.duringEncode = null;
+    state.duringUpload = null;
+    state.accessRole = "editor";
+    recording.expiresAt = null;
     recording.videoUrl = "https://cdn.example.com/media/clips/rec_1.webm";
     recording.kind = "video";
     recording.storageMode = null;
   });
 
+  it.each(["encode", "upload"])(
+    "refuses expiry during %s before replacing media",
+    async (phase) => {
+      const expire = () => {
+        recording.expiresAt = "2000-01-01T00:00:00Z";
+      };
+      if (phase === "encode") state.duringEncode = expire;
+      else state.duringUpload = expire;
+      await expect(run()).rejects.toMatchObject({ statusCode: 403 });
+      expect(state.updated).toHaveLength(0);
+      expect(state.deleted).not.toContain(
+        "https://cdn.example.com/media/clips/rec_1.webm",
+      );
+      expect(state.deleted).toEqual(
+        phase === "upload" ? [state.uploadUrl] : [],
+      );
+    },
+  );
+  it("retains owner completion when expiry changes during encoding", async () => {
+    state.accessRole = "owner";
+    state.duringEncode = () => {
+      recording.expiresAt = "2000-01-01T00:00:00Z";
+    };
+    await expect(run()).resolves.toMatchObject({ id: "rec_1" });
+    expect(state.updated).toHaveLength(2);
+  });
+
   it("returns a typed setup error when storage is not connected", async () => {
     state.uploadUrl = null;
 

templates/clips/actions/burn-recording-redactions.ts

@@ -24,6 +24,7 @@ import { getDb, schema } from "../server/db/index.js";
 import { ensureRecordingThumbnail } from "../server/lib/ensure-recording-thumbnail.js";
 import { loadRecordingMediaBytes } from "../server/lib/public-agent-context.js";
 import { deleteStoredMediaUrl } from "../server/lib/recording-media-cleanup.js";
+import { assertRecordingNotExpired } from "../server/lib/recording-read-access.js";
 import { getCurrentOwnerEmail } from "../server/lib/recordings.js";
 import {
   failBurn,
@@ -86,7 +87,9 @@ export async function burnRedactionsFor(args: {
   recordingId: string;
   ownerEmail: string;
 }) {
-  await assertAccess("recording", args.recordingId, "editor");
+  assertRecordingNotExpired(
+    await assertAccess("recording", args.recordingId, "editor"),
+  );
 
   const db = getDb();
   const { ownerEmail } = args;
@@ -225,6 +228,9 @@ export async function burnRedactionsFor(args: {
 
   timer.mark("verify");
   setBurnProgress(args.recordingId, 88);
+  assertRecordingNotExpired(
+    await assertAccess("recording", args.recordingId, "editor"),
+  );
   const upload = await uploadRecordingMedia({
     recordingId: args.recordingId,
     data: burned,
@@ -238,6 +244,21 @@ export async function burnRedactionsFor(args: {
     failStorageSetupRequired();
   }
 
+  const discardUpload = async () => {
+    if (upload.url !== previousVideoUrl) {
+      try {
+        await deleteStoredMediaUrl(upload.url, {
+          storageMode: existing.storageMode,
+          recordingId: existing.id,
+        });
+      } catch (err) {
+        console.warn("[burn] could not delete the orphaned upload", {
+          url: upload.url,
+          err: err instanceof Error ? err.message : String(err),
+        });
+      }
+    }
+  };
   timer.mark("upload");
   const burnedAt = new Date().toISOString();
 
@@ -286,6 +307,15 @@ export async function burnRedactionsFor(args: {
     ],
   };
 
+  try {
+    assertRecordingNotExpired(
+      await assertAccess("recording", args.recordingId, "editor"),
+    );
+  } catch (error) {
+    await discardUpload();
+    throw error;
+  }
+
   const updated = await db
     .update(schema.recordings)
     .set({
@@ -318,19 +348,7 @@ export async function burnRedactionsFor(args: {
     .returning({ id: schema.recordings.id });
 
   if (!updated.length) {
-    if (upload.url !== previousVideoUrl) {
-      try {
-        await deleteStoredMediaUrl(upload.url, {
-          storageMode: existing.storageMode,
-          recordingId: existing.id,
-        });
-      } catch (err) {
-        console.warn("[burn] could not delete the orphaned upload", {
-          url: upload.url,
-          err: err instanceof Error ? err.message : String(err),
-        });
-      }
-    }
+    await discardUpload();
     throw new Error(
       "The recording changed while the redaction was rendering. Nothing was deleted — try again.",
     );
@@ -451,7 +469,9 @@ export default defineAction({
     recordingId: z.string().describe("Recording ID"),
   }),
   run: async (args) => {
-    await assertAccess("recording", args.recordingId, "editor");
+    assertRecordingNotExpired(
+      await assertAccess("recording", args.recordingId, "editor"),
+    );
     const ownerEmail = getCurrentOwnerEmail();
 
     const db = getDb();

templates/clips/actions/clear-edits.test.ts

@@ -45,7 +45,10 @@ vi.mock("@agent-native/core/application-state", () => ({
   writeAppState: vi.fn(),
 }));
 vi.mock("@agent-native/core/sharing", () => ({
-  assertAccess: vi.fn(),
+  assertAccess: vi.fn(async () => ({
+    role: "editor",
+    resource: { expiresAt: null },
+  })),
 }));
 vi.mock("drizzle-orm", () => ({
   eq: (column: string, value: unknown) => ({ column, value }),

templates/clips/actions/clear-edits.ts

@@ -10,6 +10,7 @@ import {
   serializeEdits,
 } from "../app/lib/timestamp-mapping.js";
 import { getDb, schema } from "../server/db/index.js";
+import { assertRecordingNotExpired } from "../server/lib/recording-read-access.js";
 import { assertNativeRecordingMedia } from "./lib/native-media.js";
 
 const MAX_CAS_ATTEMPTS = 5;
@@ -21,7 +22,9 @@ export default defineAction({
     recordingId: z.string().describe("Recording ID"),
   }),
   run: async (args) => {
-    await assertAccess("recording", args.recordingId, "editor");
+    assertRecordingNotExpired(
+      await assertAccess("recording", args.recordingId, "editor"),
+    );
 
     const db = getDb();
 

templates/clips/actions/complete-workflow.test.ts

@@ -1,7 +1,10 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
-  assertAccess: vi.fn(async () => undefined),
+  assertAccess: vi.fn(async () => ({
+    role: "viewer",
+    resource: { expiresAt: null as string | null },
+  })),
   compareAndSetAppState: vi.fn(async () => true),
   readAppState: vi.fn(),
 }));
@@ -17,7 +20,8 @@ vi.mock("@agent-native/core/application-state", () => ({
     mocks.compareAndSetAppState(...args),
   readAppState: (...args: unknown[]) => mocks.readAppState(...args),
 }));
-vi.mock("@agent-native/core/sharing", () => ({
+vi.mock("@agent-native/core/sharing", async (original) => ({
+  ...(await original<typeof import("@agent-native/core/sharing")>()),
   assertAccess: (...args: unknown[]) => mocks.assertAccess(...args),
 }));
 
@@ -36,6 +40,10 @@ const generating = {
 
 beforeEach(() => {
   vi.clearAllMocks();
+  mocks.assertAccess.mockResolvedValue({
+    role: "viewer",
+    resource: { expiresAt: null },
+  });
   mocks.compareAndSetAppState.mockResolvedValue(true);
 });
 
@@ -132,3 +140,36 @@ describe("complete-workflow", () => {
     ).resolves.toEqual({ saved: true, recordingId: "rec_1", requestedAt });
   });
 });
+
+it.each(["2000-01-01T00:00:00Z", "not-a-date"])(
+  "refuses workflow completion after recording availability ends (%s)",
+  async (expiresAt) => {
+    mocks.assertAccess.mockResolvedValue({
+      role: "viewer",
+      resource: { expiresAt },
+    });
+    mocks.readAppState
+      .mockResolvedValueOnce(generating)
+      .mockResolvedValueOnce({ ...generating, status: "ready", content });
+    await expect(
+      action.run({ recordingId: "rec_1", requestedAt, requestId, content }),
+    ).rejects.toMatchObject({ statusCode: 403 });
+    expect(mocks.compareAndSetAppState).not.toHaveBeenCalled();
+  },
+);
+it.each(["2000-01-01T00:00:00Z", "not-a-date"])(
+  "allows the owner to complete an unavailable recording workflow (%s)",
+  async (expiresAt) => {
+    mocks.assertAccess.mockResolvedValue({
+      role: "owner",
+      resource: { expiresAt },
+    });
+    mocks.readAppState
+      .mockResolvedValueOnce(generating)
+      .mockResolvedValueOnce({ ...generating, status: "ready", content });
+    await expect(
+      action.run({ recordingId: "rec_1", requestedAt, requestId, content }),
+    ).resolves.toMatchObject({ saved: true });
+    expect(mocks.compareAndSetAppState).toHaveBeenCalledOnce();
+  },
+);

templates/clips/actions/complete-workflow.ts

@@ -6,6 +6,7 @@ import {
 import { assertAccess } from "@agent-native/core/sharing";
 import { z } from "zod";
 
+import { assertRecordingNotExpired } from "../server/lib/recording-read-access.js";
 import {
   matchesWorkflowRequest,
   WorkflowKindSchema,
@@ -45,7 +46,9 @@ export default defineAction({
       .describe("Final workflow document in markdown"),
   }),
   run: async ({ recordingId, requestedAt, requestId, content }) => {
-    await assertAccess("recording", recordingId, "viewer");
+    assertRecordingNotExpired(
+      await assertAccess("recording", recordingId, "viewer"),
+    );
 
     const stateKey = `clips-workflow-${recordingId}`;
     const current = await readAppState(stateKey);

templates/clips/actions/create-cta.test.ts

@@ -51,7 +51,10 @@ function selectBuilder(result: unknown[]) {
 
 beforeEach(() => {
   vi.clearAllMocks();
-  mockAssertAccess.mockResolvedValue(undefined);
+  mockAssertAccess.mockResolvedValue({
+    role: "editor",
+    resource: { expiresAt: null },
+  });
   mockWriteAppState.mockResolvedValue(undefined);
   mockNanoid.mockReturnValue("cta_1");
   mockDb.select.mockReturnValue(

templates/clips/actions/create-cta.ts

@@ -5,6 +5,7 @@ import { eq } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
+import { assertRecordingNotExpired } from "../server/lib/recording-read-access.js";
 import { nanoid } from "../server/lib/recordings.js";
 import { ctaUrlSchema } from "./lib/cta-url.js";
 
@@ -22,7 +23,9 @@ export default defineAction({
   }),
   run: async (args) => {
     const db = getDb();
-    await assertAccess("recording", args.recordingId, "editor");
+    assertRecordingNotExpired(
+      await assertAccess("recording", args.recordingId, "editor"),
+    );
 
     const [recording] = await db
       .select({

templates/clips/actions/delete-agent-recording-if-unpromoted.ts

@@ -4,14 +4,15 @@ import { eq } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
+import { assertRecordingNotExpired } from "../server/lib/recording-read-access.js";
 import deleteRecordingPermanent from "./delete-recording-permanent.js";
 
 export default defineAction({
   description:
     "Delete an expired agent-created Clip only if it is still private and has not been renamed, shared, commented on, reacted to, tagged, archived, or trashed.",
   schema: z.object({ id: z.string() }),
   run: async ({ id }) => {
-    await assertAccess("recording", id, "editor");
+    assertRecordingNotExpired(await assertAccess("recording", id, "editor"));
     const db = getDb();
     const [recording] = await db
       .select()