fix(workspace): ensure backing project before design share

Author: lefarcen

apps/daemon/src/design-systems/team-project-share.ts

@@ -33,7 +33,19 @@ export interface DesignSystemBackingProjectBinding {
 }
 
 export interface CreateDesignSystemBackingProjectPreparerOptions {
-  resolveProjectId(resourceId: string): Promise<string | null> | string | null;
+  resolveProjectId(
+    resourceId: string,
+    scope: TeamResourceRequestScope,
+  ): Promise<string | null> | string | null;
+  /**
+   * Materialize and bind a missing backing project under the request's exact
+   * Workspace identity. This is mutation-only; collection reads must never
+   * invoke it.
+   */
+  ensureProjectId?(
+    resourceId: string,
+    scope: TeamResourceRequestScope,
+  ): Promise<string | null> | string | null;
   projectExists(projectId: string): boolean;
   getProjectBinding(projectId: string): DesignSystemBackingProjectBinding | undefined;
   publishProject(
@@ -76,7 +88,10 @@ export function createDesignSystemBackingProjectPreparer(
   options: CreateDesignSystemBackingProjectPreparerOptions,
 ): CreateLinkedProjectTeamResourceShareServiceOptions['prepare'] {
   return async (resourceId, scope) => {
-    const projectId = (await options.resolveProjectId(resourceId))?.trim() ?? '';
+    let projectId = (await options.resolveProjectId(resourceId, scope))?.trim() ?? '';
+    if ((!projectId || !options.projectExists(projectId)) && options.ensureProjectId) {
+      projectId = (await options.ensureProjectId(resourceId, scope))?.trim() ?? '';
+    }
     if (!projectId || !options.projectExists(projectId)) {
       throw new Error('design system backing project is unavailable');
     }
@@ -247,19 +262,14 @@ export function createLinkedProjectTeamResourceShareService(
     sharedIds: (scope) => resource.sharedIds(scope),
     async sharedResources(scope, readOptions) {
       const resources = await resource.sharedResources(scope, readOptions);
-      await Promise.all(resources.map(async (candidate) => {
-        if (!candidate.canUnshare) return;
-        try {
-          // Reuse the exact same creator/Workspace preflight as the mutation
-          // path. The generic hub grants owner/admin broadly, but linked
-          // design-system projects are deliberately single-writer.
-          await options.prepare(candidate.id, scope);
-        } catch {
-          // Mutate in place to preserve the non-enumerable hubResourceId used
-          // by teammate materialization.
-          candidate.canUnshare = false;
-        }
-      }));
+      for (const candidate of resources) {
+        // Generic hub capability grants Workspace owner/admin broadly. Linked
+        // design-system projects are single-writer, so the authoritative hub
+        // owner id is the cheap collection-level creator evidence. Full local
+        // project resolution/creation remains mutation-only.
+        candidate.canUnshare = candidate.canUnshare === true
+          && candidate.ownerMemberId === scope.principal.memberId;
+      }
       return resources;
     },
     isShared: (resourceId, scope) => resource.isShared(resourceId, scope),

apps/daemon/src/server.ts

@@ -5782,10 +5782,18 @@ export async function startServer({
   const designSystemsTeamShare = createLinkedProjectTeamResourceShareService({
     resource: designSystemsTeamResourceShare,
     prepare: createDesignSystemBackingProjectPreparer({
-      resolveProjectId: async (resourceId) =>
-        (await listAllDesignSystems())
+      resolveProjectId: async (resourceId, scope) =>
+        (await listAllDesignSystems({
+          workspaceId: scope.principal.teamId,
+          workspaceMemberId: scope.principal.memberId,
+        }))
           .find((candidate) => candidate.id === resourceId)
           ?.projectId ?? null,
+      ensureProjectId: async (resourceId, scope) =>
+        (await ensureUserDesignSystemWorkspaceProject(db, resourceId, {
+          workspaceId: scope.principal.teamId,
+          workspaceMemberId: scope.principal.memberId,
+        }))?.project.id ?? null,
       projectExists: (projectId) => Boolean(getProject(db, projectId)),
       getProjectBinding: (projectId) =>
         getWorkspaceProjectByProjectId(db, projectId),

apps/daemon/tests/design-systems/team-project-share.test.ts

@@ -20,12 +20,14 @@ const scope = (workspaceId = 'ws-a'): TeamResourceRequestScope => ({
   canShare: true,
 });
 
-function fixture() {
+function fixture(options: { projectInitiallyExists?: boolean } = {}) {
   const calls: string[] = [];
   const shared = new Set<string>();
-  const projectVisibility = new Map<string, 'personal' | 'team'>([
-    ['project-brand', 'personal'],
-  ]);
+  const projectVisibility = new Map<string, 'personal' | 'team'>(
+    options.projectInitiallyExists === false
+      ? []
+      : [['project-brand', 'personal']],
+  );
   let failResourceShare = false;
   let failResourceUnshare = false;
   let resourceUnshareFailuresRemaining = 0;
@@ -35,7 +37,16 @@ function fixture() {
   let authoritativeShared: Set<string> | null = null;
   let authoritativeReadError: Error | null = null;
   let authoritativeCanUnshare = true;
-  let projectCreatorMemberId: string | null = 'member-owner';
+  let hubOwnerMemberId: string | undefined = 'member-owner';
+  let projectBinding: {
+    workspaceId: string;
+    createdByWorkspaceMemberId: string;
+  } | undefined = options.projectInitiallyExists === false
+    ? undefined
+    : {
+        workspaceId: 'ws-a',
+        createdByWorkspaceMemberId: 'member-owner',
+      };
 
   const resource: TeamResourceShareService = {
     configured: true,
@@ -61,24 +72,47 @@ function fixture() {
       if (readOptions?.authoritative) {
         if (authoritativeReadError) throw authoritativeReadError;
         return [...(authoritativeShared ?? shared)]
-          .map((id) => ({ id, canUnshare: authoritativeCanUnshare }));
+          .map((id) => ({
+            id,
+            ...(hubOwnerMemberId ? { ownerMemberId: hubOwnerMemberId } : {}),
+            canUnshare: authoritativeCanUnshare,
+          }));
       }
-      return [...shared].map((id) => ({ id, canUnshare: true }));
+      return [...shared].map((id) => ({
+        id,
+        ...(hubOwnerMemberId ? { ownerMemberId: hubOwnerMemberId } : {}),
+        canUnshare: true,
+      }));
     },
     isShared(resourceId) {
       return shared.has(resourceId);
     },
   };
+  const ensureProjectId = vi.fn(async (
+    resourceId: string,
+    requestScope: TeamResourceRequestScope,
+  ) => {
+    expect(resourceId).toBe('user:brand');
+    expect(requestScope.principal).toMatchObject({
+      teamId: 'ws-a',
+      memberId: 'member-owner',
+    });
+    calls.push('project:ensure:project-brand');
+    projectVisibility.set('project-brand', 'personal');
+    projectBinding = {
+      workspaceId: requestScope.principal.teamId,
+      createdByWorkspaceMemberId: requestScope.principal.memberId,
+    };
+    return 'project-brand';
+  });
   const prepare = vi.fn(createDesignSystemBackingProjectPreparer({
     resolveProjectId: (resourceId) => {
       expect(resourceId).toBe('user:brand');
-      return 'project-brand';
+      return projectVisibility.has('project-brand') ? 'project-brand' : null;
     },
+    ensureProjectId,
     projectExists: (projectId) => projectVisibility.has(projectId),
-    getProjectBinding: () => ({
-      workspaceId: 'ws-a',
-      createdByWorkspaceMemberId: projectCreatorMemberId,
-    }),
+    getProjectBinding: () => projectBinding,
     async publishProject(projectId) {
       calls.push(`project:team:${projectId}`);
       if (failNextProjectShare) {
@@ -109,6 +143,7 @@ function fixture() {
     shared,
     projectVisibility,
     prepare,
+    ensureProjectId,
     service,
     failResourceShare: () => { failResourceShare = true; },
     failResourceUnshare: () => { failResourceUnshare = true; },
@@ -125,8 +160,8 @@ function fixture() {
     denyAuthoritativeUnshare: () => {
       authoritativeCanUnshare = false;
     },
-    clearProjectCreator: () => {
-      projectCreatorMemberId = null;
+    clearHubOwner: () => {
+      hubOwnerMemberId = undefined;
     },
   };
 }
@@ -149,6 +184,55 @@ describe('design-system team share linked backing project', () => {
     ]);
   });
 
+  it('ensures and binds a missing backing project in the exact Workspace before direct share', async () => {
+    const f = fixture({ projectInitiallyExists: false });
+
+    await expect(f.service.share('user:brand', scope())).resolves.toEqual({ version: 1 });
+
+    expect(f.ensureProjectId).toHaveBeenCalledOnce();
+    expect(f.projectVisibility.get('project-brand')).toBe('team');
+    expect([...f.shared]).toEqual(['user:brand']);
+    expect(f.calls).toEqual([
+      'project:ensure:project-brand',
+      'resource:share:user:brand',
+      'project:team:project-brand',
+    ]);
+  });
+
+  it('compensates a failed direct share without leaving the ensured project in Team', async () => {
+    const f = fixture({ projectInitiallyExists: false });
+    f.failNextProjectShare();
+
+    await expect(f.service.share('user:brand', scope()))
+      .rejects.toThrow('project publish failed');
+
+    expect(f.ensureProjectId).toHaveBeenCalledOnce();
+    expect(f.projectVisibility.get('project-brand')).toBe('personal');
+    expect(f.shared.size).toBe(0);
+    expect(f.calls).toEqual([
+      'project:ensure:project-brand',
+      'resource:share:user:brand',
+      'project:team:project-brand',
+      'resource:unshare:user:brand',
+    ]);
+  });
+
+  it('keeps an ensured backing project Personal when design-system publication fails', async () => {
+    const f = fixture({ projectInitiallyExists: false });
+    f.failResourceShare();
+
+    await expect(f.service.share('user:brand', scope()))
+      .rejects.toThrow('design-system publish failed');
+
+    expect(f.ensureProjectId).toHaveBeenCalledOnce();
+    expect(f.projectVisibility.get('project-brand')).toBe('personal');
+    expect(f.shared.size).toBe(0);
+    expect(f.calls).toEqual([
+      'project:ensure:project-brand',
+      'resource:share:user:brand',
+    ]);
+  });
+
   it('leaves the project Personal when the design-system publish fails', async () => {
     const f = fixture();
     f.failResourceShare();
@@ -349,20 +433,36 @@ describe('design-system team share linked backing project', () => {
     };
 
     await expect(f.service.sharedResources(adminScope)).resolves.toEqual([
-      { id: 'user:brand', canUnshare: false },
+      { id: 'user:brand', ownerMemberId: 'member-owner', canUnshare: false },
     ]);
   });
 
-  it('fails closed when no exact linked-project creator can be proven', async () => {
+  it('fails closed when the hub omits exact linked-project creator evidence', async () => {
     const f = fixture();
     await f.service.share('user:brand', scope());
-    f.clearProjectCreator();
+    f.clearHubOwner();
 
     await expect(f.service.sharedResources(scope())).resolves.toEqual([
       { id: 'user:brand', canUnshare: false },
     ]);
   });
 
+  it('derives list capability without running full project preparation per resource', async () => {
+    const f = fixture();
+    f.shared.add('user:brand');
+    f.shared.add('user:brand-two');
+    f.shared.add('user:brand-three');
+    f.prepare.mockClear();
+
+    await expect(f.service.sharedResources(scope())).resolves.toEqual([
+      { id: 'user:brand', ownerMemberId: 'member-owner', canUnshare: true },
+      { id: 'user:brand-two', ownerMemberId: 'member-owner', canUnshare: true },
+      { id: 'user:brand-three', ownerMemberId: 'member-owner', canUnshare: true },
+    ]);
+
+    expect(f.prepare).not.toHaveBeenCalled();
+  });
+
   it('fails closed across Workspace A→B before either hub mutation runs', async () => {
     const f = fixture();