fix(workspace): gate linked unshare on live authority

Author: lefarcen

apps/daemon/src/collab/team-resource-share.ts

@@ -27,6 +27,23 @@ export class TeamResourceShareForbiddenError extends Error {
   }
 }
 
+/**
+ * Thrown when an operation requires a live Team hub read but the authority
+ * cannot be reached. Callers must distinguish this from an authoritative
+ * empty list: retrying is safe, while proceeding from a cached fallback is
+ * not.
+ */
+export class TeamResourceAuthorityUnavailableError extends Error {
+  readonly status = 503;
+  readonly code = 'WORKSPACE_RESOURCE_AUTHORITY_UNAVAILABLE';
+  readonly retryable = true;
+
+  constructor(cause?: unknown) {
+    super('team resource authority is temporarily unavailable', { cause });
+    this.name = 'TeamResourceAuthorityUnavailableError';
+  }
+}
+
 export interface TeamResourceShareRecord {
   id: string;
   hubResourceId?: string;
@@ -281,10 +298,15 @@ export async function unshareIfCurrentlyShared(
   resourceId: string,
   scope: TeamResourceRequestScope,
 ): Promise<boolean> {
-  const resources = await service.sharedResources(scope);
+  let resources: TeamResourceShareRecord[];
+  try {
+    resources = await service.sharedResources(scope, { authoritative: true });
+  } catch (error) {
+    if (error instanceof TeamResourceAuthorityUnavailableError) throw error;
+    throw new TeamResourceAuthorityUnavailableError(error);
+  }
   if (!resources.some((resource) => resource.id === resourceId)) return false;
-  await service.unshare(resourceId, scope);
-  return true;
+  return service.unshare(resourceId, scope);
 }
 
 interface SharedResourceListPayload {

apps/daemon/src/design-systems/team-project-share.ts

@@ -1,4 +1,5 @@
 import {
+  TeamResourceAuthorityUnavailableError,
   TeamResourceShareForbiddenError,
   type TeamResourceRequestScope,
   type TeamResourceShareService,
@@ -85,10 +86,7 @@ export function createDesignSystemBackingProjectPreparer(
     if (binding?.workspaceId && binding.workspaceId !== workspaceId) {
       throw new Error('design system backing project belongs to another workspace');
     }
-    if (
-      binding?.createdByWorkspaceMemberId
-      && binding.createdByWorkspaceMemberId !== memberId
-    ) {
+    if (binding?.createdByWorkspaceMemberId !== memberId) {
       throw new TeamResourceShareForbiddenError();
     }
     options.onPrepared?.({ resourceId, projectId, scope });
@@ -207,12 +205,18 @@ export function createLinkedProjectTeamResourceShareService(
       return result;
     },
     async unshare(resourceId, scope) {
-      // The linked project must not move before the resource's authoritative
-      // owner/admin gate has approved this exact caller. `resource.unshare`
-      // repeats the same check immediately before its write.
-      const sharedResource = (await service.sharedResources(scope))
-        .find((candidate) => candidate.id === resourceId);
-      if (sharedResource && !sharedResource.canUnshare) {
+      // This live read is the idempotency boundary. A cached/session fallback
+      // may still remember an already-removed design system, so it must never
+      // authorize moving the independently shareable backing project.
+      let sharedResource;
+      try {
+        sharedResource = (await resource.sharedResources(scope, { authoritative: true }))
+          .find((candidate) => candidate.id === resourceId);
+      } catch (error) {
+        throw new TeamResourceAuthorityUnavailableError(error);
+      }
+      if (!sharedResource) return false;
+      if (!sharedResource.canUnshare) {
         throw new TeamResourceShareForbiddenError();
       }
       const linkedProject = await options.prepare(resourceId, scope);
@@ -241,8 +245,23 @@ export function createLinkedProjectTeamResourceShareService(
       }
     },
     sharedIds: (scope) => resource.sharedIds(scope),
-    sharedResources: (scope, readOptions) =>
-      resource.sharedResources(scope, readOptions),
+    async sharedResources(scope, readOptions) {
+      const resources = await resource.sharedResources(scope, readOptions);
+      await Promise.all(resources.map(async (candidate) => {
+        if (!candidate.canUnshare) return;
+        try {
+          // Reuse the exact same creator/Workspace preflight as the mutation
+          // path. The generic hub grants owner/admin broadly, but linked
+          // design-system projects are deliberately single-writer.
+          await options.prepare(candidate.id, scope);
+        } catch {
+          // Mutate in place to preserve the non-enumerable hubResourceId used
+          // by teammate materialization.
+          candidate.canUnshare = false;
+        }
+      }));
+      return resources;
+    },
     isShared: (resourceId, scope) => resource.isShared(resourceId, scope),
   };
   return service;

apps/daemon/src/routes/team-resource-share.ts

@@ -1,5 +1,6 @@
 import type { Express, Request, Response } from 'express';
 import {
+  TeamResourceAuthorityUnavailableError,
   TeamResourceShareForbiddenError,
   type TeamResourceRequestScope,
   type TeamResourceShareRecord,
@@ -179,6 +180,13 @@ export function registerTeamResourceShareRoutes(
       if (error instanceof TeamResourceShareForbiddenError) {
         return res.status(403).json({ error: 'WORKSPACE_RESOURCE_UNSHARE_DENIED' });
       }
+      if (error instanceof TeamResourceAuthorityUnavailableError) {
+        return res.status(503).json({
+          error: error.code,
+          message: error.message,
+          retryable: true,
+        });
+      }
       res.status(500).json({ error: error instanceof Error ? error.message : 'unshare failed' });
     }
   });

apps/daemon/tests/design-systems/team-project-share.test.ts

@@ -4,6 +4,7 @@ import {
   createLinkedProjectTeamResourceShareService,
 } from '../../src/design-systems/team-project-share.js';
 import {
+  TeamResourceAuthorityUnavailableError,
   TeamResourceShareForbiddenError,
   type TeamResourceRequestScope,
   type TeamResourceShareService,
@@ -31,6 +32,10 @@ function fixture() {
   let failNextProjectShare = false;
   let projectUnshareFailuresRemaining = 0;
   let failNextProjectPersist = false;
+  let authoritativeShared: Set<string> | null = null;
+  let authoritativeReadError: Error | null = null;
+  let authoritativeCanUnshare = true;
+  let projectCreatorMemberId: string | null = 'member-owner';
 
   const resource: TeamResourceShareService = {
     configured: true,
@@ -52,7 +57,12 @@ function fixture() {
     async sharedIds() {
       return [...shared];
     },
-    async sharedResources() {
+    async sharedResources(_scope, readOptions) {
+      if (readOptions?.authoritative) {
+        if (authoritativeReadError) throw authoritativeReadError;
+        return [...(authoritativeShared ?? shared)]
+          .map((id) => ({ id, canUnshare: authoritativeCanUnshare }));
+      }
       return [...shared].map((id) => ({ id, canUnshare: true }));
     },
     isShared(resourceId) {
@@ -67,7 +77,7 @@ function fixture() {
     projectExists: (projectId) => projectVisibility.has(projectId),
     getProjectBinding: () => ({
       workspaceId: 'ws-a',
-      createdByWorkspaceMemberId: 'member-owner',
+      createdByWorkspaceMemberId: projectCreatorMemberId,
     }),
     async publishProject(projectId) {
       calls.push(`project:team:${projectId}`);
@@ -106,6 +116,18 @@ function fixture() {
     failNextProjectShare: () => { failNextProjectShare = true; },
     failNextProjectUnshare: () => { projectUnshareFailuresRemaining = 1; },
     failNextProjectPersist: () => { failNextProjectPersist = true; },
+    setAuthoritativeShared: (ids: string[]) => {
+      authoritativeShared = new Set(ids);
+    },
+    failAuthoritativeRead: () => {
+      authoritativeReadError = new Error('authoritative hub unavailable');
+    },
+    denyAuthoritativeUnshare: () => {
+      authoritativeCanUnshare = false;
+    },
+    clearProjectCreator: () => {
+      projectCreatorMemberId = null;
+    },
   };
 }
 
@@ -264,7 +286,7 @@ describe('design-system team share linked backing project', () => {
     const f = fixture();
     await f.service.share('user:brand', scope());
     f.calls.length = 0;
-    f.service.sharedResources = async () => [{ id: 'user:brand', canUnshare: false }];
+    f.denyAuthoritativeUnshare();
 
     await expect(f.service.unshare('user:brand', scope()))
       .rejects.toBeInstanceOf(TeamResourceShareForbiddenError);
@@ -273,6 +295,74 @@ describe('design-system team share linked backing project', () => {
     expect(f.calls).toEqual([]);
   });
 
+  it('treats an authoritative empty list as an idempotent unshare without touching the project', async () => {
+    const f = fixture();
+    await f.service.share('user:brand', scope());
+    f.calls.length = 0;
+    f.setAuthoritativeShared([]);
+
+    await expect(f.service.unshare('user:brand', scope())).resolves.toBe(false);
+
+    expect(f.projectVisibility.get('project-brand')).toBe('team');
+    expect(f.calls).toEqual([]);
+  });
+
+  it('does not undo an independent project share on a repeated design-system DELETE', async () => {
+    const f = fixture();
+    await f.service.share('user:brand', scope());
+    await expect(f.service.unshare('user:brand', scope())).resolves.toBe(true);
+
+    // The design system is already absent from the authoritative Team index,
+    // while the backing project has since been shared independently.
+    f.projectVisibility.set('project-brand', 'team');
+    f.calls.length = 0;
+
+    await expect(f.service.unshare('user:brand', scope())).resolves.toBe(false);
+
+    expect(f.projectVisibility.get('project-brand')).toBe('team');
+    expect(f.calls).toEqual([]);
+  });
+
+  it('fails before touching the project when the authoritative Team index is unavailable', async () => {
+    const f = fixture();
+    await f.service.share('user:brand', scope());
+    f.calls.length = 0;
+    f.failAuthoritativeRead();
+
+    await expect(f.service.unshare('user:brand', scope()))
+      .rejects.toBeInstanceOf(TeamResourceAuthorityUnavailableError);
+
+    expect(f.projectVisibility.get('project-brand')).toBe('team');
+    expect(f.calls).toEqual([]);
+  });
+
+  it('downgrades hub owner/admin permission when the linked project creator gate denies mutation', async () => {
+    const f = fixture();
+    await f.service.share('user:brand', scope());
+    const adminScope: TeamResourceRequestScope = {
+      principal: {
+        ...scope().principal,
+        memberId: 'member-admin',
+        role: 'admin',
+      },
+      canShare: true,
+    };
+
+    await expect(f.service.sharedResources(adminScope)).resolves.toEqual([
+      { id: 'user:brand', canUnshare: false },
+    ]);
+  });
+
+  it('fails closed when no exact linked-project creator can be proven', async () => {
+    const f = fixture();
+    await f.service.share('user:brand', scope());
+    f.clearProjectCreator();
+
+    await expect(f.service.sharedResources(scope())).resolves.toEqual([
+      { id: 'user:brand', canUnshare: false },
+    ]);
+  });
+
   it('fails closed across Workspace A→B before either hub mutation runs', async () => {
     const f = fixture();
 

apps/daemon/tests/routes/design-system-delete-unshares-team-share.test.ts

@@ -32,6 +32,7 @@ import type { DesignSystemSummary } from '../../src/design-systems/index.js';
 import { closeDatabase, openDatabase } from '../../src/db.js';
 import {
   createTeamResourceShareService,
+  TeamResourceAuthorityUnavailableError,
   unshareIfCurrentlyShared,
   type TeamResourceRequestScope,
 } from '../../src/collab/team-resource-share.js';
@@ -301,4 +302,29 @@ describe('DELETE /api/design-systems/:id unshares from the team hub first', () =
     // chain, not just the local delete.
     expect(hub.resources.has('ds-t-1-user-my-brand')).toBe(true);
   });
+
+  it('returns retryable 503 and preserves the local system when Team authority is unavailable', async () => {
+    const hub = fakeHub();
+    const app = express();
+    app.use(express.json());
+    const { deleteUserDesignSystem } = registerRoutes(app, {
+      hub,
+      unshareTeamDesignSystemIfShared: async () => {
+        throw new TeamResourceAuthorityUnavailableError(new Error('hub offline'));
+      },
+    });
+    const baseUrl = await listen(app);
+
+    const res = await fetch(`${baseUrl}/api/design-systems/user:my-brand`, {
+      method: 'DELETE',
+    });
+
+    expect(res.status).toBe(503);
+    await expect(res.json()).resolves.toEqual({
+      error: 'WORKSPACE_RESOURCE_AUTHORITY_UNAVAILABLE',
+      message: 'team resource authority is temporarily unavailable',
+      retryable: true,
+    });
+    expect(deleteUserDesignSystem).not.toHaveBeenCalled();
+  });
 });

apps/daemon/tests/team-resource-share-list-cache.test.ts

@@ -9,6 +9,7 @@ import type {
   TeamResourceShareRecord,
   TeamResourceShareService,
 } from '../src/collab/team-resource-share.js';
+import { TeamResourceAuthorityUnavailableError } from '../src/collab/team-resource-share.js';
 
 let server: http.Server | null = null;
 const SCOPE: TeamResourceRequestScope = {
@@ -102,6 +103,27 @@ const record = (id: string): TeamResourceShareRecord =>
   ({ id, localId: id, version: 1 }) as unknown as TeamResourceShareRecord;
 
 describe('team resource share /team listing', () => {
+  it('returns retryable 503 when unshare cannot read the authoritative Team index', async () => {
+    const service = {
+      async unshare() {
+        throw new TeamResourceAuthorityUnavailableError(new Error('hub offline'));
+      },
+    } as unknown as TeamResourceShareService;
+    const req = await startServer({
+      basePath: 'design-systems',
+      share: service,
+    });
+
+    const response = await req.del('/api/workspace/design-systems/user%3Abrand/share');
+
+    expect(response.status).toBe(503);
+    expect(response.body).toEqual({
+      error: 'WORKSPACE_RESOURCE_AUTHORITY_UNAVAILABLE',
+      message: 'team resource authority is temporarily unavailable',
+      retryable: true,
+    });
+  });
+
   it('rejects a share when the resource-owner gate denies it', async () => {
     let shareCalls = 0;
     const service = {