Limit client asset library to app-generated folders only.

Agency still sees the full Drive tree and portal uploads; clients only see Pipeline-creatividades / calendarios / brandbook-style paths.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/lib/assets-client-scope.ts

@@ -0,0 +1,60 @@
+/**
+ * What clients may see in Biblioteca de Activos.
+ * Agency sees the full Drive tree + all portal uploads.
+ * Clients only see folders/files produced by Centro de Mando.
+ */
+
+/** Drive folder names created (or reserved) by the app under the client root. */
+const APP_DRIVE_FOLDER_RES =
+  /^(Pipeline-creatividades_|Calendarios?[_\s-]?|Creatividades[_\s-]?|Ads[_\s-]?creatividades|Centro[_\s-]?de[_\s-]?Mando|4Ventures[_\s-]?Portal|Portal[_\s-]?app)/i;
+
+/** Portal asset_files.folder prefixes written by the app (not free-form agency dumps). */
+const APP_PORTAL_FOLDER_PREFIXES = [
+  'brandbook',
+  'creatividades',
+  'calendarios',
+  'calendario',
+  'pipeline',
+  'pipeline-creatividades',
+  'ads',
+  'meta',
+  'centro-de-mando',
+  'kpis',
+] as const;
+
+export function isAppGeneratedDriveFolderName(name: string): boolean {
+  const n = (name || '').trim();
+  if (!n) return false;
+  return APP_DRIVE_FOLDER_RES.test(n);
+}
+
+export function isAppGeneratedPortalFolder(folder: string | null | undefined): boolean {
+  const f = String(folder || '')
+    .trim()
+    .replace(/^\/+|\/+$/g, '')
+    .toLowerCase();
+  if (!f) return false;
+  return APP_PORTAL_FOLDER_PREFIXES.some(
+    (p) => f === p || f.startsWith(`${p}/`)
+  );
+}
+
+export function filterPortalAssetsForClient<T extends { folder?: string | null }>(
+  assets: T[]
+): T[] {
+  return assets.filter((a) => isAppGeneratedPortalFolder(a.folder));
+}
+
+export function filterDriveEntriesForClientRoot<
+  T extends { name: string; isFolder?: boolean; mimeType?: string },
+>(files: T[]): T[] {
+  return files.filter((f) => {
+    const isFolder =
+      f.isFolder || f.mimeType === 'application/vnd.google-apps.folder';
+    if (!isFolder) {
+      // Loose files at client root are agency/manual — hide from client
+      return false;
+    }
+    return isAppGeneratedDriveFolderName(f.name);
+  });
+}