From 1dae0d0a2d4553eb1990314a10e9c9883f77d976 Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Wed, 17 Jun 2026 14:46:57 +0000
Subject: [PATCH] address routine annotation review feedback

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 server/src/services/document-annotations.ts   | 23 +++++++++++++++----
 .../routine-sections/editable-sections.tsx    |  2 +-
 ui/src/context/LiveUpdatesProvider.tsx        |  5 ++++
 3 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/server/src/services/document-annotations.ts b/server/src/services/document-annotations.ts
index f98ce426860..207b7f2f527 100644
--- a/server/src/services/document-annotations.ts
+++ b/server/src/services/document-annotations.ts
@@ -146,7 +146,11 @@ export function documentAnnotationService(db: Db) {
       })
       .from(routineDocuments)
       .innerJoin(documents, eq(routineDocuments.documentId, documents.id))
-      .where(and(eq(routineDocuments.routineId, routineId), eq(routineDocuments.key, key)))
+      .where(and(
+        eq(routineDocuments.routineId, routineId),
+        eq(routineDocuments.key, key),
+        eq(routineDocuments.companyId, documents.companyId),
+      ))
       .then((rows: RoutineDocumentRow[]) => rows[0] ?? null);
   }
 
@@ -171,6 +175,8 @@ export function documentAnnotationService(db: Db) {
     routineId: string,
     documentKey: string,
     threadId: string,
+    companyId: string,
+    documentId: string,
     dbOrTx: any = db,
   ): Promise<DocumentAnnotationThread | null> {
     return dbOrTx
@@ -178,7 +184,9 @@ export function documentAnnotationService(db: Db) {
       .from(documentAnnotationThreads)
       .where(and(
         eq(documentAnnotationThreads.id, threadId),
+        eq(documentAnnotationThreads.companyId, companyId),
         eq(documentAnnotationThreads.routineId, routineId),
+        eq(documentAnnotationThreads.documentId, documentId),
         eq(documentAnnotationThreads.documentKey, documentKey),
       ))
       .then((rows: DocumentAnnotationThread[]) => rows[0] ?? null);
@@ -256,6 +264,7 @@ export function documentAnnotationService(db: Db) {
       const doc = await getRoutineDocument(routineId, key);
       if (!doc) throw notFound("Document not found");
       const conditions = [
+        eq(documentAnnotationThreads.companyId, doc.companyId),
         eq(documentAnnotationThreads.routineId, routineId),
         eq(documentAnnotationThreads.documentId, doc.documentId),
       ];
@@ -289,7 +298,9 @@ export function documentAnnotationService(db: Db) {
     },
 
     getThreadForRoutineDocument: async (routineId: string, key: string, threadId: string) => {
-      const thread = await getThreadForRoutine(routineId, key, threadId);
+      const doc = await getRoutineDocument(routineId, key);
+      if (!doc) return null;
+      const thread = await getThreadForRoutine(routineId, key, threadId, doc.companyId, doc.documentId);
       if (!thread) return null;
       const comments = await commentsForThreads([thread.id]);
       return { ...thread, comments };
@@ -512,7 +523,9 @@ export function documentAnnotationService(db: Db) {
       input: CreateDocumentAnnotationComment,
       actor: ActorInput,
     ) => db.transaction(async (tx) => {
-      const thread = await getThreadForRoutine(routineId, key, threadId, tx);
+      const doc = await getRoutineDocument(routineId, key, tx);
+      if (!doc) throw notFound("Document not found");
+      const thread = await getThreadForRoutine(routineId, key, threadId, doc.companyId, doc.documentId, tx);
       if (!thread) throw notFound("Annotation thread not found");
       const now = new Date();
       const [comment] = await tx
@@ -646,7 +659,9 @@ export function documentAnnotationService(db: Db) {
       input: UpdateDocumentAnnotationThread,
       actor: ActorInput,
     ) => db.transaction(async (tx) => {
-      const thread = await getThreadForRoutine(routineId, key, threadId, tx);
+      const doc = await getRoutineDocument(routineId, key, tx);
+      if (!doc) throw notFound("Document not found");
+      const thread = await getThreadForRoutine(routineId, key, threadId, doc.companyId, doc.documentId, tx);
       if (!thread) throw notFound("Annotation thread not found");
       if (!input.status || input.status === thread.status) return thread;
 
diff --git a/ui/src/components/routine-sections/editable-sections.tsx b/ui/src/components/routine-sections/editable-sections.tsx
index 8e3c76f668f..cb7cc190173 100644
--- a/ui/src/components/routine-sections/editable-sections.tsx
+++ b/ui/src/components/routine-sections/editable-sections.tsx
@@ -223,7 +223,7 @@ export function OverviewSection() {
         <div className="flex items-center justify-end">
           {routine.descriptionDocument ? (
             <DocumentAnnotationsCountChip
-              issueId={routine.id}
+              issueId=""
               docKey="description"
               target={{ kind: "routine", routineId: routine.id, documentKey: "description" }}
               panelOpen={descriptionAnnotationsOpen}
diff --git a/ui/src/context/LiveUpdatesProvider.tsx b/ui/src/context/LiveUpdatesProvider.tsx
index 1e1b908360b..086a8d47908 100644
--- a/ui/src/context/LiveUpdatesProvider.tsx
+++ b/ui/src/context/LiveUpdatesProvider.tsx
@@ -667,6 +667,9 @@ function invalidateActivityQueries(
   const actorType = readString(payload.actorType);
   const actorId = readString(payload.actorId);
   const details = readRecord(payload.details);
+  const ownActorActivity =
+    (actorType === "user" && !!currentActor.userId && actorId === currentActor.userId) ||
+    (actorType === "agent" && !!currentActor.agentId && actorId === currentActor.agentId);
 
   if (action?.startsWith("resource_membership.")) {
     const targetUserId = readString(details?.userId);
@@ -789,8 +792,10 @@ function invalidateActivityQueries(
     queryClient.invalidateQueries({ queryKey: ["routines"] });
     if (entityType === "routine" && action && ROUTINE_DOCUMENT_ANNOTATION_ACTIVITY_ACTIONS.has(action) && entityId) {
       const documentKey = readString(details?.key) ?? readString(details?.documentKey) ?? "description";
+      const routineInvalidationOptions = ownActorActivity ? { refetchType: "inactive" as const } : undefined;
       queryClient.invalidateQueries({
         queryKey: ["routines", "document-annotations", entityId, documentKey],
+        ...routineInvalidationOptions,
       });
     }
     return;