Knowledge bases, and a file input that lines up

**Bases.** Documents now live in named collections rather than one flat pile,
and a chat can be pointed at particular ones — "answer from the contracts
folder" is a different question from "answer from everything I have ever
uploaded". A chat with none attached still searches everything its owner can
see, because empty means unscoped, not empty.

The harness names the attached bases. Without that the model cannot tell "there
is nothing about this" from "I am only allowed to see one folder", and it
phrases a miss as the former.

**Sharing moves to the base.** A document is visible to whoever can see the base
it lives in, so `Document` is gone from the shareable types and
`documents.visible()` filters through `base_id`. "This folder is the team's" is
the granularity people think in; per-document grants meant answering "who can
see this?" by checking every file. Moving a document between bases changes who
can see it, so the destination has to be one you own.

`Document.base_id` is nullable only because the column had to be added to a
table that already had rows. `sweep_unfiled()` runs at startup beside the
orphaned-upload sweep and files anything predating bases into its owner's
default, which is what makes "always set" true everywhere else.

**The file input.** `.input` gave it a fixed height and horizontal padding, so
the browser's own button sat hard against the left edge while the filename
floated off the centre line. A file input is two controls in one box and
neither inherits anything useful, so it gets its own rule: no horizontal
padding, the button sized to `--control-h` with the divider that separates it,
and the text centred with line-height rather than flexbox, which file inputs do
not lay out reliably.

437 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_sharing.py

@@ -12,7 +12,6 @@ from sqlalchemy import select
 from lembas.db.models import (
     PRINCIPAL_GROUP,
     PRINCIPAL_USER,
-    Document,
     Group,
     Note,
     Share,
@@ -147,25 +146,25 @@ def test_forgetting_a_principal_drops_their_shares(db, people):
 
 def test_two_kinds_of_resource_do_not_collide(db, people):
     """One shares table across three resource types, so the type must be part
-    of the match -- otherwise a note and a document sharing an id would share
-    each other's access."""
+    of the match -- otherwise a note and a base sharing an id would share each
+    other's access."""
     note = _note(db, people["frodo"])
-    document = documents_service.store_upload(
-        db, owner=people["frodo"], payload=b"hello", filename="a.txt"
-    )
+    base = documents_service.create_base(db, owner=people["frodo"], name="Papers")
     sharing.set_grants(db, note, user_ids=[people["gollum"].id], group_ids=[])
 
     assert sharing.can_read(db, note, people["gollum"])
-    assert not sharing.can_read(db, document, people["gollum"])
+    assert not sharing.can_read(db, base, people["gollum"])
 
 
-def test_resource_type_refuses_something_unshareable(db, people):
-    """Memory is deliberately not shareable: a record about a person is not
-    content to hand round."""
-    from lembas.db.models import Memory
+@pytest.mark.parametrize("unshareable", ["Memory", "Document"])
+def test_resource_type_refuses_something_unshareable(db, people, unshareable):
+    """Memory is not shareable at all -- a record about a person is not content
+    to hand round. A Document is shared through the base it lives in, so asking
+    to share one directly is a mistake worth catching loudly."""
+    import lembas.db.models as models
 
     with pytest.raises(ValueError):
-        sharing.resource_type(Memory)
+        sharing.resource_type(getattr(models, unshareable))
 
 
 # --- Through the search path -------------------------------------------------
@@ -180,20 +179,53 @@ def test_search_does_not_leak_across_owners(db, people):
     assert notes_service.search(db, people["gandalf"], "golden") == []
 
 
-def test_a_shared_document_is_findable_by_the_person_it_was_shared_with(db, people):
+def test_sharing_a_base_shares_what_is_in_it(db, people):
+    """Documents are shared through their base. "This folder is the team's" is
+    the granularity people think in, and per-document grants would mean
+    answering "who can see this?" by checking every file."""
+    base = documents_service.create_base(db, owner=people["frodo"], name="Trees")
     document = documents_service.store_upload(
         db,
         owner=people["frodo"],
         payload=b"The mallorn is a golden tree.",
         filename="tree.txt",
+        base=base,
     )
     assert documents_service.search(db, people["gollum"], "mallorn") == []
 
-    sharing.set_grants(db, document, user_ids=[people["gollum"].id], group_ids=[])
+    sharing.set_grants(db, base, user_ids=[people["gollum"].id], group_ids=[])
     found = documents_service.search(db, people["gollum"], "mallorn")
     assert [d.id for d in found] == [document.id]
 
 
+def test_a_document_in_an_unshared_base_stays_private(db, people):
+    """Two bases, one shared: the other must not come with it."""
+    shared = documents_service.create_base(db, owner=people["frodo"], name="Public")
+    private = documents_service.create_base(db, owner=people["frodo"], name="Private")
+    documents_service.store_upload(
+        db, owner=people["frodo"], payload=b"A mallorn tree.", filename="a.txt", base=shared
+    )
+    documents_service.store_upload(
+        db, owner=people["frodo"], payload=b"A mallorn secret.", filename="b.txt", base=private
+    )
+    sharing.set_grants(db, shared, user_ids=[people["gollum"].id], group_ids=[])
+
+    found = documents_service.search(db, people["gollum"], "mallorn")
+    assert [d.base_id for d in found] == [shared.id]
+
+
+def test_scoping_to_a_base_cannot_be_used_to_reach_one(db, people):
+    """Naming a base you cannot see returns nothing rather than granting it."""
+    private = documents_service.create_base(db, owner=people["frodo"], name="Private")
+    documents_service.store_upload(
+        db, owner=people["frodo"], payload=b"A mallorn tree.", filename="a.txt", base=private
+    )
+    found = documents_service.search(
+        db, people["gollum"], "mallorn", base_ids=[private.id]
+    )
+    assert found == []
+
+
 def test_the_shares_table_records_what_was_asked_for(db, people):
     group = Group(name="Fellowship")
     db.add(group)
@@ -222,10 +254,33 @@ def test_visibility_is_a_query_filter_not_a_python_loop(db, people):
     assert [n.title for n in rows] == ["Note 0", "Note 1"]
 
 
-def test_documents_and_notes_use_the_same_rule(db, people):
+def test_a_document_follows_its_base(db, people):
     document = documents_service.store_upload(
         db, owner=people["frodo"], payload=b"x", filename="a.txt"
     )
     assert document in db.scalars(documents_service.visible(db, people["frodo"]))
     assert document not in db.scalars(documents_service.visible(db, people["gollum"]))
-    assert list(db.scalars(select(Document).where(sharing.visible_to(Document, None)))) == []
+    assert list(db.scalars(documents_service.visible(db, None))) == []
+
+
+def test_an_uploaded_document_always_lands_in_a_base(db, people):
+    """base_id is nullable only so the column could be added to a table that
+    already had rows; the service never leaves it unset."""
+    document = documents_service.store_upload(
+        db, owner=people["frodo"], payload=b"x", filename="a.txt"
+    )
+    assert document.base_id is not None
+
+
+def test_documents_predating_bases_are_filed_at_startup(db, people):
+    document = documents_service.store_upload(
+        db, owner=people["frodo"], payload=b"x", filename="a.txt"
+    )
+    document.base_id = None
+    db.commit()
+    assert document not in db.scalars(documents_service.visible(db, people["frodo"]))
+
+    assert documents_service.sweep_unfiled(db) == 1
+    db.refresh(document)
+    assert document.base_id is not None
+    assert document in db.scalars(documents_service.visible(db, people["frodo"]))