feat(tenancy): implement workspace isolation

web/tests/e2e/fixtures/langbot-api.ts

@@ -67,7 +67,32 @@ interface BotMock {
   updated_at: string;
 }
 
+export interface WorkspaceEntryMock {
+  workspace: {
+    uuid: string;
+    instance_uuid: string;
+    name: string;
+    slug: string;
+    type: 'personal' | 'team';
+    status: 'active';
+    source: 'local' | 'cloud_projection';
+  };
+  membership: {
+    uuid: string;
+    workspace_uuid: string;
+    account_uuid: string;
+    email: string;
+    role: 'owner' | 'admin' | 'developer' | 'operator' | 'viewer';
+    status: 'active';
+    joined_at: string;
+    created_at: string;
+  };
+  permissions: string[];
+  placement_generation: number;
+}
+
 interface LangBotApiMockState {
+  authenticated: boolean;
   bots: BotMock[];
   counters: Record<string, number>;
   knowledgeBases: KnowledgeBaseMock[];
@@ -78,6 +103,7 @@ interface LangBotApiMockState {
   sessionAnalyses: Record<string, unknown>;
   sessionMessages: Record<string, unknown[]>;
   skills: SkillMock[];
+  workspaces: WorkspaceEntryMock[];
 }
 
 function ok(data: unknown) {
@@ -109,6 +135,58 @@ function now() {
   return new Date().toISOString();
 }
 
+export function makeWorkspaceEntry(
+  uuid: string,
+  name: string,
+  source: 'local' | 'cloud_projection' = 'cloud_projection',
+): WorkspaceEntryMock {
+  const createdAt = now();
+  return {
+    workspace: {
+      uuid,
+      instance_uuid: 'instance-playwright',
+      name,
+      slug: uuid,
+      type: 'team',
+      status: 'active',
+      source,
+    },
+    membership: {
+      uuid: `membership-${uuid}`,
+      workspace_uuid: uuid,
+      account_uuid: 'account-playwright',
+      email: 'admin@example.com',
+      role: 'owner',
+      status: 'active',
+      joined_at: createdAt,
+      created_at: createdAt,
+    },
+    permissions: [
+      'api_key.manage',
+      'audit.view',
+      'member.invite',
+      'member.remove',
+      'member.update_role',
+      'member.view',
+      'owner.transfer',
+      'provider_secret.manage',
+      'resource.manage',
+      'resource.view',
+      'runtime.operate',
+      'workspace.view',
+    ],
+    placement_generation: 1,
+  };
+}
+
+function defaultWorkspaceEntry(): WorkspaceEntryMock {
+  return makeWorkspaceEntry(
+    'workspace-playwright',
+    'Playwright Workspace',
+    'local',
+  );
+}
+
 function nextId(state: LangBotApiMockState, prefix: string) {
   state.counters[prefix] = (state.counters[prefix] || 0) + 1;
   return `${prefix}-${state.counters[prefix]}`;
@@ -423,21 +501,33 @@ async function handleBackendApi(route: Route, state: LangBotApiMockState) {
   if (path === '/api/v1/user/account-info') {
     return fulfillJson(route, {
       initialized: true,
-      account_type: 'local',
-      has_password: true,
+      password_login_enabled: true,
+      space_login_enabled: false,
     });
   }
 
   if (path === '/api/v1/user/check-token') {
-    return fulfillJson(route, { token: '' });
+    return fulfillJson(route, {
+      token: state.authenticated ? 'playwright-token' : '',
+    });
   }
 
   if (path === '/api/v1/user/auth') {
+    state.authenticated = true;
     return fulfillJson(route, { token: 'playwright-token' });
   }
 
+  if (path === '/api/v1/user/space/callback') {
+    state.authenticated = true;
+    return fulfillJson(route, {
+      token: 'playwright-space-token',
+      user: 'admin@example.com',
+    });
+  }
+
   if (path === '/api/v1/user/info') {
     return fulfillJson(route, {
+      account_uuid: 'account-playwright',
       user: 'admin@example.com',
       account_type: 'local',
       has_password: true,
@@ -448,6 +538,24 @@ async function handleBackendApi(route: Route, state: LangBotApiMockState) {
     return fulfillJson(route, { credits: null });
   }
 
+  if (path === '/api/v1/workspaces/bootstrap') {
+    return fulfillJson(route, { workspaces: state.workspaces });
+  }
+
+  if (path === '/api/v1/workspaces/current') {
+    const selectedWorkspaceUuid = request.headers()['x-workspace-id'];
+    const entry = state.workspaces.find(
+      (item) => item.workspace.uuid === selectedWorkspaceUuid,
+    );
+    return fulfillJson(route, entry || state.workspaces[0]);
+  }
+
+  if (path === '/api/v1/workspaces') {
+    return fulfillJson(route, {
+      workspaces: state.workspaces.map((entry) => entry.workspace),
+    });
+  }
+
   if (path === '/api/v1/platform/adapters') {
     return fulfillJson(route, { adapters: mockAdapters() });
   }
@@ -951,6 +1059,7 @@ export async function installLangBotApiMocks(
     sessionAnalyses?: Record<string, unknown>;
     sessionMessages?: Record<string, unknown[]>;
     storage?: JsonRecord;
+    workspaces?: WorkspaceEntryMock[];
   } = {},
 ) {
   const {
@@ -960,8 +1069,10 @@ export async function installLangBotApiMocks(
     sessionAnalyses,
     sessionMessages,
     storage = {},
+    workspaces = [defaultWorkspaceEntry()],
   } = options;
   const state: LangBotApiMockState = {
+    authenticated,
     bots: [],
     counters: {},
     knowledgeBases: [],
@@ -972,6 +1083,7 @@ export async function installLangBotApiMocks(
     sessionAnalyses: sessionAnalyses || {},
     sessionMessages: sessionMessages || {},
     skills: [],
+    workspaces,
   };
 
   await page.addInitScript(

web/tests/e2e/invitations.spec.ts

@@ -0,0 +1,55 @@
+import { expect, test } from '@playwright/test';
+
+import { installLangBotApiMocks } from './fixtures/langbot-api';
+
+test('terminal invitation errors refresh on a new fragment and allow account switching', async ({
+  page,
+}) => {
+  await installLangBotApiMocks(page, {
+    storage: {
+      token: 'playwright-token',
+      userEmail: 'another-account@example.com',
+    },
+  });
+  await page.route('**/api/v1/invitations/inspect', async (route) => {
+    const body = JSON.parse(route.request().postData() || '{}') as {
+      token?: string;
+    };
+    const code =
+      body.token === 'revoked-invitation'
+        ? 'invitation_revoked'
+        : 'invitation_used';
+    await route.fulfill({
+      status: 410,
+      contentType: 'application/json',
+      body: JSON.stringify({ code, msg: code }),
+    });
+  });
+
+  await page.goto('/invitations/accept#token=used-invitation');
+  await expect(
+    page.getByText('This invitation was already used.'),
+  ).toBeVisible();
+  await expect
+    .poll(() =>
+      page.evaluate(() =>
+        sessionStorage.getItem('langbot_pending_invitation_token'),
+      ),
+    )
+    .toBeNull();
+
+  await page.evaluate(() => {
+    window.location.hash = 'token=revoked-invitation';
+  });
+  await expect(page.getByText('This invitation was revoked.')).toBeVisible();
+
+  await page.getByRole('button', { name: 'Back to sign in' }).click();
+  await expect(page).toHaveURL(/\/login$/);
+  await expect(page.getByText('Welcome')).toBeVisible();
+  expect(
+    await page.evaluate(() => ({
+      token: localStorage.getItem('token'),
+      userEmail: localStorage.getItem('userEmail'),
+    })),
+  ).toEqual({ token: null, userEmail: null });
+});

web/tests/e2e/login.spec.ts

@@ -1,6 +1,9 @@
 import { expect, test } from '@playwright/test';
 
-import { installLangBotApiMocks } from './fixtures/langbot-api';
+import {
+  installLangBotApiMocks,
+  makeWorkspaceEntry,
+} from './fixtures/langbot-api';
 
 test('local account login reaches the authenticated home shell', async ({
   page,
@@ -14,9 +17,129 @@ test('local account login reaches the authenticated home shell', async ({
   await page.getByPlaceholder('Enter password').fill('password');
   await page.getByRole('button', { name: 'Login with password' }).click();
 
-  await expect(page).toHaveURL(/\/home$/);
+  await expect(page).toHaveURL(/\/home(?:\/monitoring)?$/);
   await expect(page.getByText('Home').first()).toBeVisible();
   await expect(page.getByRole('button', { name: 'Dashboard' })).toBeVisible();
   await expect(page.getByText('Total Messages').first()).toBeVisible();
   await expect(page.getByText('Unable to connect to server')).toHaveCount(0);
 });
+
+test('an existing Account token bootstraps the singleton without a selector loop', async ({
+  page,
+}) => {
+  const bootstrapWorkspaceHeaders: Array<string | undefined> = [];
+  page.on('request', (request) => {
+    if (new URL(request.url()).pathname === '/api/v1/workspaces/bootstrap') {
+      bootstrapWorkspaceHeaders.push(request.headers()['x-workspace-id']);
+    }
+  });
+
+  await installLangBotApiMocks(page, { authenticated: true });
+  await page.goto('/login');
+
+  await expect(page).toHaveURL(/\/home(?:\/monitoring)?$/);
+  await expect(page.getByRole('button', { name: 'Dashboard' })).toBeVisible();
+  expect(bootstrapWorkspaceHeaders.length).toBeGreaterThan(0);
+  expect(bootstrapWorkspaceHeaders.every((header) => !header)).toBe(true);
+});
+
+test('multi-Workspace login waits for an explicit selection', async ({
+  page,
+}) => {
+  const accountScopedRequests: { path: string; workspace?: string }[] = [];
+  const selectedWorkspaceHeaders: string[] = [];
+  page.on('request', (request) => {
+    const path = new URL(request.url()).pathname;
+    const workspace = request.headers()['x-workspace-id'];
+    if (
+      path === '/api/v1/user/auth' ||
+      path === '/api/v1/user/check-token' ||
+      path === '/api/v1/workspaces/bootstrap'
+    ) {
+      accountScopedRequests.push({ path, workspace });
+    }
+    if (path === '/api/v1/workspaces/current' && workspace) {
+      selectedWorkspaceHeaders.push(workspace);
+    }
+  });
+
+  await installLangBotApiMocks(page, {
+    storage: {
+      langbot_active_workspace_uuid: 'workspace-from-another-account',
+    },
+    workspaces: [
+      makeWorkspaceEntry('workspace-alpha', 'Alpha Workspace'),
+      makeWorkspaceEntry('workspace-beta', 'Beta Workspace'),
+    ],
+  });
+
+  await page.goto('/login');
+  await page.getByPlaceholder('Enter email address').fill('admin@example.com');
+  await page.getByPlaceholder('Enter password').fill('password');
+  await page.getByRole('button', { name: 'Login with password' }).click();
+
+  await expect(page).toHaveURL(/\/workspaces\/select/);
+  await expect(
+    page.getByRole('heading', { name: 'Choose a Workspace' }),
+  ).toBeVisible();
+  await expect(page.getByText('Alpha Workspace')).toBeVisible();
+  await expect(page.getByText('Beta Workspace')).toBeVisible();
+
+  await page.getByRole('button', { name: /Beta Workspace/ }).click();
+
+  await expect(page).toHaveURL(/\/home(?:\/monitoring)?$/);
+  await expect(
+    page.getByRole('combobox', { name: 'Switch Workspace' }),
+  ).toBeVisible();
+  expect(selectedWorkspaceHeaders).toContain('workspace-beta');
+  expect(accountScopedRequests.length).toBeGreaterThan(0);
+  expect(accountScopedRequests.every((request) => !request.workspace)).toBe(
+    true,
+  );
+});
+
+test('Space OAuth bootstraps a singleton before entering home', async ({
+  page,
+}) => {
+  const selectedWorkspaceHeaders: string[] = [];
+  page.on('request', (request) => {
+    const path = new URL(request.url()).pathname;
+    const workspace = request.headers()['x-workspace-id'];
+    if (path === '/api/v1/workspaces/current' && workspace) {
+      selectedWorkspaceHeaders.push(workspace);
+    }
+  });
+
+  await installLangBotApiMocks(page);
+  await page.goto('/auth/space/callback?code=oauth-code&state=oauth-state');
+
+  await expect(page).toHaveURL(/\/home(?:\/monitoring)?$/, {
+    timeout: 5_000,
+  });
+  expect(selectedWorkspaceHeaders).toContain('workspace-playwright');
+});
+
+test('Space OAuth sends a multi-Workspace Account to the chooser', async ({
+  page,
+}) => {
+  const bootstrapWorkspaceHeaders: Array<string | undefined> = [];
+  page.on('request', (request) => {
+    if (new URL(request.url()).pathname === '/api/v1/workspaces/bootstrap') {
+      bootstrapWorkspaceHeaders.push(request.headers()['x-workspace-id']);
+    }
+  });
+
+  await installLangBotApiMocks(page, {
+    workspaces: [
+      makeWorkspaceEntry('workspace-alpha', 'Alpha Workspace'),
+      makeWorkspaceEntry('workspace-beta', 'Beta Workspace'),
+    ],
+  });
+  await page.goto('/auth/space/callback?code=oauth-code&state=oauth-state');
+
+  await expect(page).toHaveURL(/\/workspaces\/select/, { timeout: 5_000 });
+  await expect(page.getByText('Alpha Workspace')).toBeVisible();
+  await expect(page.getByText('Beta Workspace')).toBeVisible();
+  expect(bootstrapWorkspaceHeaders.length).toBeGreaterThan(0);
+  expect(bootstrapWorkspaceHeaders.every((header) => !header)).toBe(true);
+});