feat(workspace): add in-product collaboration and direct Cloud launch

tests/integration/api/test_user_space_oauth.py

@@ -46,10 +46,17 @@ async def space_oauth_api():
             local_account if (state, purpose) == ('opaque-bind-state', 'bind') else None
         )
     )
+    application.user_service.consume_space_oauth_state_details = AsyncMock(
+        return_value=SimpleNamespace(launch_workspace_uuid=None)
+    )
     application.user_service.bind_space_account = AsyncMock(return_value=bound_account)
     application.user_service.generate_jwt_token = AsyncMock(return_value='rotated-account-token')
+    application.user_service.get_user_by_uuid = AsyncMock(return_value=bound_account)
     application.user_service.authenticate_space_user = AsyncMock(return_value=('space-login-token', bound_account))
     application.user_service.verify_jwt_token = AsyncMock()
+    application.space_launch_service.consume_assertion = AsyncMock(
+        return_value={'account_uuid': 'account-a', 'workspace_uuid': WORKSPACE_UUID}
+    )
     application.workspace_collaboration_service.resolve_account_workspace = AsyncMock(return_value=access)
     application.space_service.get_oauth_authorize_url = Mock(
         side_effect=lambda redirect_uri, state: f'https://space.example/authorize?state={state}'
@@ -87,6 +94,29 @@ async def test_public_login_state_is_server_issued(space_oauth_api):
     application.user_service.issue_space_oauth_state.assert_awaited_once_with('login')
 
 
+@pytest.mark.asyncio
+async def test_cloud_launch_state_is_server_issued_and_workspace_bound(space_oauth_api):
+    application, client = space_oauth_api
+    application.deployment.multi_workspace_enabled = True
+
+    response = await client.get(
+        '/api/v1/user/space/authorize-url',
+        query_string={
+            'redirect_uri': 'http://localhost/auth/space/callback',
+            'launch_workspace_uuid': WORKSPACE_UUID,
+        },
+        headers={'Origin': 'http://localhost'},
+    )
+
+    assert response.status_code == 200
+    authorize_url = (await response.get_json())['data']['authorize_url']
+    assert parse_qs(urlsplit(authorize_url).query)['state'] == ['opaque-login-state']
+    application.user_service.issue_space_oauth_state.assert_awaited_once_with(
+        'login',
+        launch_workspace_uuid=WORKSPACE_UUID,
+    )
+
+
 @pytest.mark.asyncio
 async def test_public_login_rejects_caller_supplied_state(space_oauth_api):
     application, client = space_oauth_api
@@ -203,10 +233,33 @@ async def test_login_callback_requires_and_consumes_server_state(space_oauth_api
     assert (await missing.get_json())['code'] == 1
     assert response.status_code == 200
     assert (await response.get_json())['data']['token'] == 'space-login-token'
-    application.user_service.consume_space_oauth_state.assert_awaited_once_with('opaque-login-state', 'login')
+    application.user_service.consume_space_oauth_state_details.assert_awaited_once_with('opaque-login-state', 'login')
     application.space_service.exchange_oauth_code.assert_awaited_once_with('oauth-code')
 
 
+@pytest.mark.asyncio
+async def test_login_callback_launch_state_selects_asserted_workspace(space_oauth_api):
+    application, client = space_oauth_api
+    application.user_service.consume_space_oauth_state_details.reset_mock()
+    application.user_service.consume_space_oauth_state_details.return_value = SimpleNamespace(
+        launch_workspace_uuid=WORKSPACE_UUID
+    )
+
+    response = await client.post(
+        '/api/v1/user/space/callback',
+        json={'code': 'oauth-code', 'state': 'opaque-login-state'},
+    )
+
+    assert response.status_code == 200
+    data = (await response.get_json())['data']
+    assert data['token'] == 'space-login-token'
+    assert data['workspace_uuid'] == WORKSPACE_UUID
+    application.workspace_collaboration_service.resolve_account_workspace.assert_awaited_with(
+        'account-a',
+        WORKSPACE_UUID,
+    )
+
+
 @pytest.mark.asyncio
 async def test_bind_callback_uses_opaque_state_and_never_treats_it_as_jwt(space_oauth_api):
     application, client = space_oauth_api
@@ -234,3 +287,30 @@ async def test_bind_callback_uses_opaque_state_and_never_treats_it_as_jwt(space_
     assert (await response.get_json())['data']['token'] == 'rotated-account-token'
     application.user_service.verify_jwt_token.assert_not_awaited()
     application.user_service.bind_space_account.assert_awaited_once_with('owner@example.com', 'oauth-code')
+
+
+@pytest.mark.asyncio
+async def test_direct_launch_assertion_does_not_consume_normal_oauth_state(space_oauth_api):
+    application, client = space_oauth_api
+    application.user_service.consume_space_oauth_state.reset_mock()
+    application.space_service.exchange_oauth_code.reset_mock()
+
+    response = await client.post(
+        '/api/v1/user/space/callback',
+        json={
+            'state': 'space-generated-state-is-not-oauth-state',
+            'workspace_uuid': WORKSPACE_UUID,
+            'launch_assertion': 'signed-launch-token',
+        },
+    )
+
+    assert response.status_code == 200
+    data = (await response.get_json())['data']
+    assert data['token'] == 'rotated-account-token'
+    assert data['workspace_uuid'] == WORKSPACE_UUID
+    application.space_launch_service.consume_assertion.assert_awaited_once_with(
+        'signed-launch-token',
+        expected_workspace_uuid=WORKSPACE_UUID,
+    )
+    application.user_service.consume_space_oauth_state.assert_not_awaited()
+    application.space_service.exchange_oauth_code.assert_not_awaited()

tests/integration/api/test_workspaces.py

@@ -53,7 +53,7 @@ async def workspace_api(tmp_path):
                 'jwt': {'secret': 'workspace-api-secret', 'expire': 3600},
                 'allow_modify_login_info': True,
             },
-            'api': {'global_api_key': ''},
+            'api': {'global_api_key': '', 'webui_url': 'https://langbot.example'},
         }
     )
     application.logger = logging.getLogger('workspace-api-test')
@@ -198,6 +198,8 @@ async def test_owner_invites_second_account_and_secret_is_not_persisted(workspac
     invite_data = (await invite_response.get_json())['data']
     invitation_token = invite_data['token']
     assert invitation_token.startswith('lbi_')
+    assert invite_data['link'] == f'https://langbot.example/invitations/accept#token={invitation_token}'
+    assert invite_data['delivery'] == {'status': 'link_only', 'provider': None}
     assert 'token_hash' not in invite_data['invitation']
 
     async with engine.connect() as connection:
@@ -376,7 +378,7 @@ async def test_api_key_secret_is_one_time_and_viewer_cannot_manage_keys(workspac
     assert (await forbidden.get_json())['code'] == 'permission_denied'
 
 
-async def test_cloud_projection_is_selected_explicitly_and_directory_writes_use_control_plane(
+async def test_cloud_projection_is_selected_explicitly_and_collaboration_runs_in_core(
     workspace_api,
 ):
     application, client, engine, owner_token = workspace_api
@@ -514,8 +516,42 @@ async def test_cloud_projection_is_selected_explicitly_and_directory_writes_use_
         headers=_auth(owner_token, cloud_workspace_uuid),
         json={'email': 'member@example.com', 'role': 'viewer'},
     )
-    assert create_invitation.status_code == 409
-    assert (await create_invitation.get_json())['code'] == 'control_plane_required'
+    assert create_invitation.status_code == 200
+    created_invitation = (await create_invitation.get_json())['data']
+    assert created_invitation['invitation']['workspace_uuid'] == cloud_workspace_uuid
+    assert created_invitation['link'].startswith('https://langbot.example/invitations/accept#token=lbi_')
+    assert created_invitation['delivery'] == {'status': 'link_only', 'provider': None}
+
+    accept_response = await client.post(
+        '/api/v1/invitations/accept',
+        json={
+            'token': created_invitation['token'],
+            'registration': {'email': 'member@example.com', 'password': 'member-password'},
+        },
+    )
+    assert accept_response.status_code == 200
+    member_token = (await accept_response.get_json())['data']['token']
+
+    member_current = await client.get(
+        '/api/v1/workspaces/current',
+        headers=_auth(member_token, cloud_workspace_uuid),
+    )
+    assert member_current.status_code == 200
+    member_account_uuid = (await member_current.get_json())['data']['membership']['account_uuid']
+
+    update_member = await client.patch(
+        f'/api/v1/workspaces/{cloud_workspace_uuid}/members/{member_account_uuid}',
+        headers=_auth(owner_token, cloud_workspace_uuid),
+        json={'role': 'developer'},
+    )
+    assert update_member.status_code == 200
+    assert (await update_member.get_json())['data']['member']['role'] == 'developer'
+
+    remove_member = await client.delete(
+        f'/api/v1/workspaces/{cloud_workspace_uuid}/members/{member_account_uuid}',
+        headers=_auth(owner_token, cloud_workspace_uuid),
+    )
+    assert remove_member.status_code == 200
 
 
 async def test_account_bootstrap_does_not_disclose_non_member_workspaces(workspace_api):

tests/integration/persistence/test_migrations_postgres.py

@@ -973,7 +973,7 @@ class TestPostgreSQLTenantRuntime:
                     .values(write_fenced=True)
                 )
                 assert workspace_update.rowcount == 0
-                assert membership_update.rowcount == 0
+                assert membership_update.rowcount == 1
                 assert execution_update.rowcount == 0
 
             async with cloud_manager.tenant_uow(workspace_local) as tenant: