Skip to content

Handoff: CreatorTrack workspace sharing (pending invites, per-app permissions, login-gate fix)

Date: 2026-07-06 Branch: feat/workspace-sharing (worktree ~/forge-suite-wt/feat/workspace-sharing, dev slot :3063, DB ct_feat_workspace_sharing) Status: BUILT + verified end-to-end on the dev slot. NOT merged, NOT deployed.

What shipped (4 commits: c385e00, e4317f5, 4491462, 7749517)

  1. Share a workspace with someone not on CreatorTrack. Inviting an unknown email now stores a pending invite (core.workspace_invites) instead of bouncing. Workspace settings shows the person with a "Not on CreatorTrack" pill, an "Invite them to CreatorTrack" button (branded signup-nudge email via Resend, /signup?email= prefilled), and Revoke. At signup (Google or credentials) core.claim_workspace_invites converts pending invites into memberships and drops a workspace_invite bell notification ("Justin Wiebelhaus invited you to ..."; click routes into the workspace). Login (both providers) also claims opportunistically, so a hiccuped signup claim self-heals.
  2. Per-member app permissions. core.memberships.blocked_apps text[] + owner/admin-gated SECURITY DEFINER fns (set_member_role, set_member_blocked_apps, remove_workspace_member, my_blocked_apps; roster fn returns role+blocked). Settings > workspace card > Members: role select (Member/Admin), Remove/Leave, and an "Apps" chip editor per member. Blocked apps vanish from that member's sidebar/mobile sheet/installed seed AND the pretty-URL page refuses with a no-access note. Owner untouchable; admins can't edit their own restrictions.
  3. "Not provisioned" fixed. Root cause: a present-but-stale session cookie passed proxy.ts's optimistic check and the suite layout dead-ended on a "Not provisioned." div. New requireUser() in lib/auth.ts redirects to /login; wired into (suite)/layout.tsx + [ws]/layout.tsx (the gate every suite page renders under).

Verified (dev slot, real flows)

  • Stale cookie -> 307 /login; anonymous -> 307 /login (proxy already covered that path).
  • Playwright signup as invited email -> membership in Gus Outdoor Co + claimed invite + bell notification payload correct.
  • Blocked tasks for test member -> gone from sidebar, deep link shows no-access note.
  • Roster/member/invite APIs exercised via HTTP; tsc clean.

Review notes

  • Migration 20260706T212015_...workspace_invites... must run on prod DB at merge (deploy script handles migrations dir).
  • Test artifacts live only in the dev DB clone (sharetest1/[email protected]), not prod.
  • WORKSPACE_DEV_AUTH was toggled during testing and restored to 1 in the slot's .env.local.
  • Blocked-app enforcement is UI/page-level; the underlying node APIs still honor RLS membership only. If per-app API enforcement is wanted (bots, direct API), add the my_blocked_apps check to the app route handlers as a follow-up.

URL: https://mkdocs.justinsforge.com/memory/handoffs/creatortrack-workspace-sharing-2026-07-06/