fix: relationships.list drafts (#13170)

server/models/Document.test.ts

@@ -1,5 +1,5 @@
 import { EmptyResultError, Op } from "sequelize";
-import { CollectionPermission } from "@shared/types";
+import { CollectionPermission, DocumentPermission } from "@shared/types";
 import slugify from "@shared/utils/slugify";
 import { parser } from "@server/editor";
 import Document from "@server/models/Document";
@@ -413,6 +413,56 @@ describe("findByIds", () => {
     );
     expect(documents.length).toBe(1);
   });
+
+  it("should not return another user's unfiled draft", async () => {
+    const team = await buildTeam();
+    const author = await buildUser({ teamId: team.id });
+    const user = await buildUser({ teamId: team.id });
+    const draft = await buildDraftDocument({
+      teamId: team.id,
+      userId: author.id,
+      collectionId: null,
+    });
+    const documents = await Document.findByIds([draft.id], {
+      userId: user.id,
+    });
+    expect(documents.length).toBe(0);
+  });
+
+  it("should return the user's own unfiled draft", async () => {
+    const team = await buildTeam();
+    const user = await buildUser({ teamId: team.id });
+    const draft = await buildDraftDocument({
+      teamId: team.id,
+      userId: user.id,
+      collectionId: null,
+    });
+    const documents = await Document.findByIds([draft.id], {
+      userId: user.id,
+    });
+    expect(documents.length).toBe(1);
+  });
+
+  it("should return an unfiled draft shared with the user", async () => {
+    const team = await buildTeam();
+    const author = await buildUser({ teamId: team.id });
+    const user = await buildUser({ teamId: team.id });
+    const draft = await buildDraftDocument({
+      teamId: team.id,
+      userId: author.id,
+      collectionId: null,
+    });
+    await UserMembership.create({
+      createdById: author.id,
+      documentId: draft.id,
+      userId: user.id,
+      permission: DocumentPermission.Read,
+    });
+    const documents = await Document.findByIds([draft.id], {
+      userId: user.id,
+    });
+    expect(documents.length).toBe(1);
+  });
 });
 
 describe("tasks", () => {

server/models/Document.ts

@@ -899,14 +899,23 @@ class Document extends ArchivableModel<
       return documents;
     }
 
-    return documents.filter(
-      (doc) =>
-        (!doc.collection?.isPrivate && !user?.isGuest) ||
-        (doc.collection?.memberships.length || 0) > 0 ||
-        (doc.collection?.groupMemberships.length || 0) > 0 ||
-        doc.memberships.length > 0 ||
-        doc.groupMemberships.length > 0
-    );
+    return documents.filter((doc) => {
+      if (doc.memberships.length > 0 || doc.groupMemberships.length > 0) {
+        return true;
+      }
+
+      // A document without a collection is either an unfiled draft or lives in
+      // a collection the user cannot see – access is limited to the creator.
+      if (!doc.collection) {
+        return doc.createdById === userId;
+      }
+
+      return (
+        (!doc.collection.isPrivate && !user?.isGuest) ||
+        doc.collection.memberships.length > 0 ||
+        doc.collection.groupMemberships.length > 0
+      );
+    });
   }
 
   // instance methods

server/models/Relationship.ts

@@ -70,7 +70,7 @@ class Relationship extends IdModel<
     const documents = await Document.findByIds(
       relationships.map((relationship) => relationship.reverseDocumentId),
       {
-        attributes: ["id"],
+        attributes: ["id", "createdById"],
         userId: user.id,
         includeState: false,
         includeViews: false,