fix(collab): keep workspace projects usable during outages and first open (#7027) (#7069)

* fix(daemon): decouple local data plane from workspace authority

* test(e2e): align workspace authority contracts

* fix(daemon): preserve read-only team mirrors offline

* test(daemon): preserve retryable result literal

* fix(web): keep projects usable during workspace outages

* test(web): keep collaboration mounted during outages

* test(daemon): keep viewer comments local during outages

* fix(collab): open team projects during materialization

* fix(collab): keep project placeholders fail-closed

(cherry picked from commit 67576cb)

Co-authored-by: lefarcen <935902669@qq.com>

Author: open-design-release-bot[bot]

apps/daemon/src/automations/workspace-scope.ts

@@ -1,10 +1,3 @@
-import type {
-  WorkspaceCollabContext,
-  WorkspaceDirectoryItem,
-} from '@open-design/contracts';
-import type { WorkspaceDirectoryFetchResult } from '../collab/vela-workspace-context.js';
-import { workspaceContextFromDirectoryItem } from '../collab/vela-workspace-context.js';
-
 export interface PersistedAutomationWorkspaceScope {
   workspaceId: string;
   workspaceMemberId: string;
@@ -13,9 +6,7 @@ export interface PersistedAutomationWorkspaceScope {
 export class AutomationWorkspaceScopeError extends Error {
   constructor(
     readonly code:
-      | 'WORKSPACE_AUTHORITY_UNAVAILABLE'
-      | 'WORKSPACE_ACCESS_DENIED'
-      | 'WORKSPACE_PROJECT_PERMISSION_DENIED',
+      | 'WORKSPACE_ACCESS_DENIED',
     message: string,
     readonly retryable: boolean,
   ) {
@@ -78,87 +69,3 @@ export function bindProjectToPersistedAutomationWorkspace(
     updatedAt: now,
   });
 }
-
-async function fetchDirectoryOrThrow(
-  fetchWorkspaceDirectory: (() => Promise<WorkspaceDirectoryFetchResult>) | undefined,
-): Promise<WorkspaceDirectoryItem[]> {
-  if (!fetchWorkspaceDirectory) {
-    throw new AutomationWorkspaceScopeError(
-      'WORKSPACE_AUTHORITY_UNAVAILABLE',
-      'workspace membership authority is not configured',
-      true,
-    );
-  }
-  let directory: WorkspaceDirectoryFetchResult;
-  try {
-    directory = await fetchWorkspaceDirectory();
-  } catch {
-    directory = { ok: false, items: [] };
-  }
-  if (!directory.ok) {
-    throw new AutomationWorkspaceScopeError(
-      'WORKSPACE_AUTHORITY_UNAVAILABLE',
-      'workspace membership authority is temporarily unavailable',
-      true,
-    );
-  }
-  return directory.items;
-}
-
-function activeWritableContext(
-  context: WorkspaceCollabContext | null,
-): WorkspaceCollabContext | null {
-  return context
-    && context.memberStatus === 'active'
-    && context.lifecycleState === 'active'
-    && context.permissions.canWriteSyncedFiles
-    ? context
-    : null;
-}
-
-/**
- * Re-authorize a Workspace/member pair captured when an unattended automation
- * was configured. No daemon-global current/active Workspace participates.
- */
-export async function authorizePersistedAutomationWorkspaceScope(
-  scope: PersistedAutomationWorkspaceScope,
-  fetchWorkspaceDirectory: (() => Promise<WorkspaceDirectoryFetchResult>) | undefined,
-): Promise<WorkspaceCollabContext> {
-  const items = await fetchDirectoryOrThrow(fetchWorkspaceDirectory);
-  const item = items.find(
-    (candidate) =>
-      candidate.workspaceId === scope.workspaceId
-      && candidate.workspaceMemberId === scope.workspaceMemberId,
-  );
-  const context = activeWritableContext(item ? workspaceContextFromDirectoryItem(item) : null);
-  if (!context) {
-    throw new AutomationWorkspaceScopeError(
-      'WORKSPACE_ACCESS_DENIED',
-      'the automation Workspace is no longer writable by this member',
-      false,
-    );
-  }
-  return context;
-}
-
-/**
- * Resolve a reused project's persisted binding. The project row chooses the
- * Workspace; the signed-in directory supplies the current member and authority.
- */
-export async function authorizePersistedProjectWorkspace(
-  workspaceIdInput: string,
-  fetchWorkspaceDirectory: (() => Promise<WorkspaceDirectoryFetchResult>) | undefined,
-): Promise<WorkspaceCollabContext> {
-  const workspaceId = workspaceIdInput.trim();
-  const items = await fetchDirectoryOrThrow(fetchWorkspaceDirectory);
-  const item = items.find((candidate) => candidate.workspaceId === workspaceId);
-  const context = activeWritableContext(item ? workspaceContextFromDirectoryItem(item) : null);
-  if (!context) {
-    throw new AutomationWorkspaceScopeError(
-      'WORKSPACE_PROJECT_PERMISSION_DENIED',
-      'the reused project Workspace is no longer writable by this member',
-      false,
-    );
-  }
-  return context;
-}

apps/daemon/src/collab/created-project-workspace.ts

@@ -1,14 +1,10 @@
 import type { ApiErrorResponse } from '@open-design/contracts';
 import type { Response } from 'express';
 import {
-  isWorkspaceResourceLocked,
   workspaceResourceContextFromRequest,
   type WorkspaceResourceContext,
 } from './workspace-resource-mutation.js';
-import {
-  workspaceContextFromDirectoryItem,
-  type WorkspaceDirectoryFetchResult,
-} from './vela-workspace-context.js';
+import type { WorkspaceDirectoryFetchResult } from './vela-workspace-context.js';
 import { sendApiError } from '../http/api-errors.js';
 
 export type CreatedProjectWorkspaceResolution =
@@ -43,43 +39,6 @@ export function sendCreatedProjectWorkspaceError(
   );
 }
 
-/**
- * Resolve the workspace authority for a route that creates a project.
- *
- * A completely headerless request is a legal legacy/anonymous caller and
- * intentionally leaves the new project unbound. Once either workspace
- * identity header is present, however, the request is a workspace-aware
- * caller: partial, removed, locked, or non-writing identities must fail
- * closed instead of silently creating an unbound orphan.
- */
-export function resolveCreatedProjectWorkspace(
-  req: unknown,
-): CreatedProjectWorkspaceResolution {
-  const context = workspaceResourceContextFromRequest(req);
-  if (context === null) return { ok: true, context: null };
-  if (context === 'missing') {
-    return {
-      ok: false,
-      status: 400,
-      code: 'WORKSPACE_CONTEXT_INCOMPLETE',
-      message: 'workspace project creation requires both workspace and member identity',
-    };
-  }
-  if (
-    context.memberStatus !== 'active'
-    || !context.canWriteSyncedFiles
-    || isWorkspaceResourceLocked(context)
-  ) {
-    return {
-      ok: false,
-      status: 403,
-      code: 'WORKSPACE_PROJECT_PERMISSION_DENIED',
-      message: 'workspace project creation is not allowed',
-    };
-  }
-  return { ok: true, context };
-}
-
 /**
  * Capture optional local attribution for an ordinary local project create.
  *
@@ -98,90 +57,13 @@ export function localProjectWorkspaceAttribution(
   return context === null || context === 'missing' ? null : context;
 }
 
-/**
- * Authorize an explicitly-scoped project create against the signed-in
- * membership directory. The caller-selected workspace/member pair is the
- * lookup key; the daemon's ambient active workspace is deliberately absent
- * from this contract.
- *
- * A missing fetcher is the local/dev compatibility path. Production Vela
- * mode injects one and therefore fails closed when AMR is unavailable.
- */
+/** Capture local attribution for project creation without a network gate. */
 export async function authorizeCreatedProjectWorkspace(
   req: unknown,
-  fetchWorkspaceDirectory?: () => Promise<WorkspaceDirectoryFetchResult>,
-  configuredEnv?: Record<string, string>,
+  _fetchWorkspaceDirectory?: () => Promise<WorkspaceDirectoryFetchResult>,
+  _configuredEnv?: Record<string, string>,
 ): Promise<CreatedProjectWorkspaceResolution> {
-  const claimed = resolveCreatedProjectWorkspace(req);
-  if (!claimed.ok || claimed.context === null || !fetchWorkspaceDirectory) {
-    return claimed;
-  }
-  const claimedContext = claimed.context;
-
-  let directory: WorkspaceDirectoryFetchResult;
-  try {
-    directory = await fetchWorkspaceDirectory();
-  } catch {
-    directory = { ok: false, items: [] };
-  }
-  if (!directory.ok) {
-    if (directory.reason === 'unauthorized') {
-      return {
-        ok: false,
-        status: 401,
-        code: 'AMR_AUTH_REQUIRED',
-        message: 'AMR authorization expired. Sign in again to continue.',
-      };
-    }
-    return {
-      ok: false,
-      status: 503,
-      code: 'WORKSPACE_AUTHORITY_UNAVAILABLE',
-      message: 'workspace membership authority is temporarily unavailable',
-      retryable: true,
-    };
-  }
-
-  const item = directory.items.find(
-    (candidate) =>
-      candidate.workspaceId === claimedContext.workspaceId
-      && candidate.workspaceMemberId === claimedContext.workspaceMemberId,
-  );
-  if (!item) {
-    return {
-      ok: false,
-      status: 403,
-      code: 'WORKSPACE_PROJECT_PERMISSION_DENIED',
-      message: 'workspace project creation is not allowed',
-    };
-  }
-
-  const authoritative = workspaceContextFromDirectoryItem(item, configuredEnv);
-  const context: WorkspaceResourceContext = {
-    workspaceId: authoritative.workspaceId,
-    workspaceType: authoritative.workspaceType,
-    workspaceTypeAsserted: authoritative.workspaceType,
-    appUserId: claimedContext.appUserId,
-    workspaceMemberId: authoritative.workspaceMemberId,
-    role: authoritative.role,
-    memberStatus: authoritative.memberStatus,
-    lifecycleState: authoritative.lifecycleState,
-    canShareProjects: authoritative.permissions.canShareProjects,
-    canWriteSyncedFiles: authoritative.permissions.canWriteSyncedFiles,
-  };
-  if (
-    context.memberStatus !== 'active'
-    || !context.canWriteSyncedFiles
-    || isWorkspaceResourceLocked(context)
-  ) {
-    return {
-      ok: false,
-      status: 403,
-      code: 'WORKSPACE_PROJECT_PERMISSION_DENIED',
-      message: 'workspace project creation is not allowed',
-    };
-  }
-  return { ok: true, context };
+  return { ok: true, context: localProjectWorkspaceAttribution(req) };
 }
 
 /**
@@ -203,12 +85,7 @@ export class CreatedProjectWorkspaceResolutionError extends Error {
   }
 }
 
-/**
- * Resolve an exact creation scope. Headerless legacy requests remain unbound.
- * Once either identity field is asserted, any incomplete, removed, denied, or
- * unavailable authority fails closed; it never degrades to ambient/current or
- * silently creates an unbound project.
- */
+/** Resolve the optional local creation scope. */
 export async function createdProjectWorkspaceHome(
   req: unknown,
   fetchWorkspaceDirectory?: () => Promise<WorkspaceDirectoryFetchResult>,
@@ -255,8 +132,9 @@ export function createCreatedProjectWorkspaceResolver(deps: {
  * the signed-in account wallet, but any later request that asserts a Workspace
  * still needs an exact persisted binding before workspace mutation gates allow it.
  *
- * `context` is the caller's exact verified Workspace when the request named
- * one. A headerless legacy request supplies null and remains unbound.
+ * `context` is the caller's complete local Workspace attribution when the
+ * request named one. A headerless legacy request supplies null and remains
+ * unbound; remote authority is checked only at a later cloud boundary.
  */
 export function bindCreatedProjectToWorkspace(
   ensureWorkspaceProject: (input: {