dataroom

Overview ¶

Package dataroom folds hanzoai/dataroom (a Papermark fork: Next.js + Prisma + Postgres, "open-source DocSend/dataroom") FULLY into the unified hanzoai/cloud binary as an in-process subsystem (HIP-0106, task #101 / epic #96). Cloud serves the dataroom surface (/v1/dataroom/*) ITSELF — no standalone dataroom pod, no Postgres, no Next.js.

WRAP, DON'T REWRITE — the read-WRITE variant, on the SHARED binding. The dataroom business logic (documents, data rooms, shareable links with access controls, viewers, per-page view analytics) is a self-contained goja bundle (bundle.js, the ESM-free port of the Papermark API handlers). It runs in-process on the REUSABLE clients/goja host — the SAME RW-Base binding captable (#97) pilots and esign (#100) reuses — which injects __db/__newId/__now and one SQLite file per tenant, one transaction per request. This leaf adds only: the per-tenant Schema, the object-storage seam for document bytes, a bcrypt HostFn for link passwords, and the public link→org index. Zero domain logic lives in Go.

dataroom bundle (bundle.js, go:embed)  +  per-tenant Schema  +  __bcrypt HostFn
                    │
             clients/goja.NewBase(...)   ← __db/__newId/__now, per-tenant Base,
                    │                       one transaction per request
             /v1/dataroom/* zip routes

STORAGE. Document BYTES never touch the bundle or local disk: the leaf stores them through the cloud object-storage seam (deps.VFS — the SeaweedFS/S3 data plane) keyed by an org-scoped opaque key (a Go storage host-fn over the s3/storage subsystem), and the bundle persists only that key via __db. View-analytics events (page-by-page tracking) are Base rows in the tenant DB.

AUTH. Admin routes require a validated cloud principal (principal.Org → org); public viewer routes carry no principal and resolve their org from the link index (a link id → org routing table — the one cross-tenant piece). Tenant isolation is the per-org SQLite file NewBase selects from that org.

ACTIVATION: dataroom is NOT staged — it mounts under the mount-all default (empty CLOUD_ENABLE), so the one binary serves /v1/dataroom/* from first boot. There is no standalone dataroom pod to defer to (the Papermark/Next.js/Postgres app is retired by this fold — no such deployment runs in the fleet), so cloud's fresh per-tenant Base/SQLite is authoritative from the first write, with no data to migrate.

The link index is the ONE cross-tenant piece of dataroom: a public share link is opened anonymously by a visitor who supplies only the link id, so the leaf must map that id back to the owning org BEFORE it can select the tenant's SQLite store. That mapping is pure routing/infra (Go's job), kept out of the per-tenant domain bundle. It lives in a single small SQLite file under the data root and is written when a link is created, read on every viewer request.