Repository navigation
feat(api): manage workspace members through the v2 API - #9852
Merged
Merged
Conversation
Add PATCH and DELETE /api/v2/workspaces/{workspaceId}/members/{userId},
backed by the existing permission-update and member-removal use cases.
Both operations now admit personal API keys and OAuth tokens with
api:write; workspace API keys stay refused.
PATCH returns the member exactly as the roster lists them, read before
the write so a committed change is never left unaudited. DELETE reports
whether leaving removed the organization membership.
A directory-managed member's refusal keeps its SCIM_MANAGED_MEMBERSHIP
code through the store's HTTP wrapper. The v2 member policy answers the
billing-account removal refusal as 409 and exhausted transaction
contention as 503 instead of 500.
The CLI gains `workspaces members update` and `workspaces members
remove`; the listing becomes `workspaces members list` and shows user ids.
Add a real-HTTP E2E script for the new member update and removal endpoints, reporting to WORKSPACE_MEMBERS_E2E_REPORT_PATH: workspace-key and api:read-only OAuth refusals, role and tenant denials, non-member targets, self-demotion, protected owner/billing/org-admin roles, no-op writes without audit, last-admin leave, the 409 owner removal, self-leave with a personal key, input validation, and the key owner as audit actor. The use-case test now refuses a workspace key, which the operations still reject, rather than a personal key, which they now admit, and pins that a coded directory refusal survives the store's HTTP wrapper.
…reSQL Replace the running-app E2E script with an integration suite that drives the real v2 member route handlers with hashed personal keys, a workspace key, and OAuth tokens against PostgreSQL, including a SCIM-managed member. Simplify the store-failure mapping with findCause and a status table, and keep the store's HTTP error as the cause of a coded refusal so the internal permissions route renders it exactly as before. Spread params and body in the PATCH route like the organization member route, trim comments, and list the renamed member commands in the Teammates settings section.
- Answer a role change for a non-member with 404 "Member not found", as the organization member route does, and drop the post-write re-read. - Answer role-change contention with 503 and Retry-After, like removal; the internal route keeps its 409. - Keep `sim workspaces members` listing members as the default subcommand of the new group. - Correct the member route prose and the workspaceId parameter wording. - Give each integration test its own fixture and cover contention.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
 [High impact] The changes appear safe to merge; no new actionable issues were found. SummaryAdds v2 routes to change workspace member roles and remove members through the existing authorized use cases.
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
… and append the CLI user column
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
…e member update - Pin the CLI reference heading for `sim workspaces members list` to the `#sim-workspaces-members` anchor it shipped under, through a reference-page counterpart of the existing legacy anchor map, and restore that heading in the docs compatibility baseline. - Classify `updateWorkspaceMember` as non-destructive alongside `updateOrganizationMember`. - Cover an inherited organization admin with no grant row: PATCH answers the documented 400 for every requested role and writes nothing.
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PATCH /api/v2/workspaces/{workspaceId}/members/{userId}(change a member's role) andDELETE(remove a member, or leave), mirroring the v2 organization member routesapi:write; workspace keys stay denied since they can never hold adminRetry-After, removing an owner with no billing-account heir is 409, and SCIM refusals keep theSCIM_MANAGED_MEMBERSHIPcode (internal UI routes respond exactly as before)workspaces members list|update|remove; the shippedsim workspaces membersspelling still listsType of Change
Testing
apps/sim/lib/workspaces/__integration__/members.integration.ts(17 passing) drives the real v2 handlers in-process against PostgreSQL with hashed personal/workspace keys and OAuth tokens; reverting the principal widening, scope, 404, 503, 409, and SCIM-code changes each turns its test redmanage-permissions.test.ts,remove-member.test.ts,public-queries.test.ts, CLIgroup-default.test.tsandreferenceteststscon apps/sim;check:openapi,cli-api,cli-docs,mcp-operations,v2-route-table,route-verbs,principal-kind-parity,api-validation:strict,test-patterns,boundaries,source-conventions; biomeChecklist
test-auditauthoring gate)