@gitpod/gitpod-protocol 0.1.5-pluggable-workspace-cluster.21 → 0.1.5-port-description-3059-fork.0

package/src/util/gitpod-host-url.ts

@@ -12,8 +12,13 @@ export interface UrlChange {
 }
 export type UrlUpdate = UrlChange | Partial<URL>;
 
+const basewoWkspaceIDRegex = "(([a-f][0-9a-f]{7}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})|([0-9a-z]{2,16}-[0-9a-z]{2,16}-[0-9a-z]{8}))";
+
 // this pattern matches v4 UUIDs as well as the new generated workspace ids (e.g. pink-panda-ns35kd21)
-export const workspaceIDRegex = /(([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})|([0-9a-z]{2,16}-[0-9a-z]{2,16}-[0-9a-z]{8}))/;
+const workspaceIDRegex = RegExp(`^${basewoWkspaceIDRegex}$`);
+
+// this pattern matches URL prefixes of workspaces
+const workspaceUrlPrefixRegex = RegExp(`^([0-9]{4,6}-)?${basewoWkspaceIDRegex}\\.`);
 
 export class GitpodHostUrl {
     readonly url: URL;
@@ -44,7 +49,7 @@ export class GitpodHostUrl {
     }
 
     withoutWorkspacePrefix(): GitpodHostUrl {
-        if (!this.url.host.match(workspaceIDRegex)) {
+        if (!this.url.host.match(workspaceUrlPrefixRegex)) {
             // URL has no workspace prefix
             return this;
         }
@@ -80,23 +85,27 @@ export class GitpodHostUrl {
     }
 
     asDashboard(): GitpodHostUrl {
-        return this.with(url => ({ pathname: '/workspaces/' }));
+        return this.with(url => ({ pathname: '/' }));
     }
 
     asLogin(): GitpodHostUrl {
-        return this.with(url => ({ pathname: '/login/' }));
+        return this.with(url => ({ pathname: '/login' }));
     }
 
     asUpgradeSubscription(): GitpodHostUrl {
-        return this.with(url => ({ pathname: '/upgrade-subscription/' }));
+        return this.with(url => ({ pathname: '/plans' }));
     }
 
     asAccessControl(): GitpodHostUrl {
-        return this.with(url => ({ pathname: '/access-control/' }));
+        return this.with(url => ({ pathname: '/integrations' }));
     }
 
     asSettings(): GitpodHostUrl {
-        return this.with(url => ({ pathname: '/settings/' }));
+        return this.with(url => ({ pathname: '/settings' }));
+    }
+
+    asPreferences(): GitpodHostUrl {
+        return this.with(url => ({ pathname: '/preferences' }));
     }
 
     asGraphQLApi(): GitpodHostUrl {
@@ -128,9 +137,13 @@ export class GitpodHostUrl {
 
     get workspaceId(): string | undefined {
         const hostSegs = this.url.host.split(".");
-        if (hostSegs.length > 1 && hostSegs[0].match(workspaceIDRegex)) {
-            // URL has a workspace prefix
-            return hostSegs[0];
+        if (hostSegs.length > 1) {
+            const matchResults = hostSegs[0].match(workspaceIDRegex);
+            if (matchResults) {
+                // URL has a workspace prefix
+                // port prefixes are excluded
+                return matchResults[0];
+            }
         }
 
         const pathSegs = this.url.pathname.split("/")

package/src/util/grpc.ts

@@ -0,0 +1,15 @@
+/**
+ * Copyright (c) 2021 Gitpod GmbH. All rights reserved.
+ * Licensed under the GNU Affero General Public License (AGPL).
+ * See License-AGPL.txt in the project root for license information.
+ */
+
+ export const defaultGRPCOptions = {
+    "grpc.keepalive_timeout_ms": 10000,
+    "grpc.keepalive_time_ms": 60000,
+    "grpc.http2.min_time_between_pings_ms": 10000,
+    "grpc.keepalive_permit_without_calls": 1,
+    "grpc-node.max_session_memory": 50,
+    "grpc.max_reconnect_backoff_ms": 5000,
+    "grpc.max_receive_message_length": 1024 * 1024 * 16,
+};

package/src/util/logging.ts

@@ -30,66 +30,66 @@ export interface LogPayload {
 };
 
 export namespace log {
-    export function error(context: LogContext, message: string, error: Error, payload: LogPayload): void;
-    export function error(context: LogContext, message: string, error: Error): void;
+    export function error(context: LogContext, message: string, error: any, payload: LogPayload): void;
+    export function error(context: LogContext, message: string, error: any): void;
     export function error(context: LogContext, message: string, payload: LogPayload): void;
     export function error(context: LogContext, message: string): void;
-    export function error(context: LogContext, error: Error, payload: LogPayload): void;
-    export function error(context: LogContext, error: Error): void;
-    export function error(message: string, error: Error, payload: LogPayload): void;
-    export function error(message: string, error: Error): void;
+    export function error(context: LogContext, error: any, payload: LogPayload): void;
+    export function error(context: LogContext, error: any): void;
+    export function error(message: string, error: any, payload: LogPayload): void;
+    export function error(message: string, error: any): void;
     export function error(message: string, payload: LogPayload): void;
     export function error(message: string): void;
-    export function error(error: Error, payload: LogPayload): void;
-    export function error(error: Error): void;
+    export function error(error: any, payload: LogPayload): void;
+    export function error(error: any): void;
     export function error(...args: any[]): void {
         errorLog(false, args);
     }
 
-    export function warn(context: LogContext, message: string, error: Error, payload: LogPayload): void;
-    export function warn(context: LogContext, message: string, error: Error): void;
+    export function warn(context: LogContext, message: string, error: any, payload: LogPayload): void;
+    export function warn(context: LogContext, message: string, error: any): void;
     export function warn(context: LogContext, message: string, payload: LogPayload): void;
     export function warn(context: LogContext, message: string): void;
-    export function warn(context: LogContext, error: Error, payload: LogPayload): void;
-    export function warn(context: LogContext, error: Error): void;
-    export function warn(message: string, error: Error, payload: LogPayload): void;
-    export function warn(message: string, error: Error): void;
+    export function warn(context: LogContext, error: any, payload: LogPayload): void;
+    export function warn(context: LogContext, error: any): void;
+    export function warn(message: string, error: any, payload: LogPayload): void;
+    export function warn(message: string, error: any): void;
     export function warn(message: string, payload: LogPayload): void;
     export function warn(message: string): void;
-    export function warn(error: Error, payload: LogPayload): void;
-    export function warn(error: Error): void;
+    export function warn(error: any, payload: LogPayload): void;
+    export function warn(error: any): void;
     export function warn(...args: any[]): void {
         warnLog(false, args);
     }
 
-    export function info(context: LogContext, message: string, error: Error, payload: LogPayload): void;
-    export function info(context: LogContext, message: string, error: Error): void;
+    export function info(context: LogContext, message: string, error: any, payload: LogPayload): void;
+    export function info(context: LogContext, message: string, error: any): void;
     export function info(context: LogContext, message: string, payload: LogPayload): void;
     export function info(context: LogContext, message: string): void;
-    export function info(context: LogContext, error: Error, payload: LogPayload): void;
-    export function info(context: LogContext, error: Error): void;
-    export function info(message: string, error: Error, payload: LogPayload): void;
-    export function info(message: string, error: Error): void;
+    export function info(context: LogContext, error: any, payload: LogPayload): void;
+    export function info(context: LogContext, error: any): void;
+    export function info(message: string, error: any, payload: LogPayload): void;
+    export function info(message: string, error: any): void;
     export function info(message: string, payload: LogPayload): void;
     export function info(message: string): void;
-    export function info(error: Error, payload: LogPayload): void;
-    export function info(error: Error): void;
+    export function info(error: any, payload: LogPayload): void;
+    export function info(error: any): void;
     export function info(...args: any[]): void {
         infoLog(false, args);
     }
 
-    export function debug(context: LogContext, message: string, error: Error, payload: LogPayload): void;
-    export function debug(context: LogContext, message: string, error: Error): void;
+    export function debug(context: LogContext, message: string, error: any, payload: LogPayload): void;
+    export function debug(context: LogContext, message: string, error: any): void;
     export function debug(context: LogContext, message: string, payload: LogPayload): void;
     export function debug(context: LogContext, message: string): void;
-    export function debug(context: LogContext, error: Error, payload: LogPayload): void;
-    export function debug(context: LogContext, error: Error): void;
-    export function debug(message: string, error: Error, payload: LogPayload): void;
-    export function debug(message: string, error: Error): void;
+    export function debug(context: LogContext, error: any, payload: LogPayload): void;
+    export function debug(context: LogContext, error: any): void;
+    export function debug(message: string, error: any, payload: LogPayload): void;
+    export function debug(message: string, error: any): void;
     export function debug(message: string, payload: LogPayload): void;
     export function debug(message: string): void;
-    export function debug(error: Error, payload: LogPayload): void;
-    export function debug(error: Error): void;
+    export function debug(error: any, payload: LogPayload): void;
+    export function debug(error: any): void;
     export function debug(...args: any[]): void {
         debugLog(false, args);
     }
@@ -97,10 +97,14 @@ export namespace log {
     /**
      * Do not use in frontend.
      */
-    export function enableJSONLogging(componentArg: string, versionArg: string | undefined): void {
+    export function enableJSONLogging(componentArg: string, versionArg: string | undefined, logLevel?: LogrusLogLevel): void {
         component = componentArg;
         version = versionArg;
 
+        setLogLevel(logLevel);
+    }
+
+    export function setLogLevel(logLevel: LogrusLogLevel | undefined) {
         jsonLogging = true;
 
         console.error = function (...args: any[]): void {
@@ -115,8 +119,20 @@ export namespace log {
         console.debug = function (...args: any[]): void {
             debugLog(true, args);
         }
+
         console.log = console.info;
         // FIXME wrap also other console methods (e.g. trace())
+
+        // set/unset log functions based on loglevel so we only have to evaluate once, not every call
+        const noop = () => {};
+        const setLog = (logFunc: DoLogFunction, funcLevel: LogrusLogLevel): DoLogFunction => {
+            return LogrusLogLevel.isGreatherOrEqual(funcLevel, logLevel) ? logFunc : noop;
+        };
+
+        errorLog = setLog(doErrorLog, "error");
+        warnLog = setLog(doWarnLog, "warning");
+        infoLog = setLog(doInfoLog, "info");
+        debugLog = setLog(doDebugLog, "debug");
     }
 
     export function resetToDefaultLogging(): void {
@@ -128,24 +144,73 @@ export namespace log {
         console.info = infoConsoleLog;
         console.debug = debugConsoleLog;
     }
+
+    export function setVersion(versionArg: string) {
+        version = versionArg;
+    }
 }
 
-function errorLog(calledViaConsole: boolean, args: any[]): void {
+type DoLogFunction = (calledViaConsole: boolean, args: any[]) => void;
+
+let errorLog = doErrorLog;
+function doErrorLog(calledViaConsole: boolean, args: any[]): void {
     doLog(calledViaConsole, errorConsoleLog, 'ERROR', args);
 }
 
-function warnLog(calledViaConsole: boolean, args: any[]): void {
+let warnLog = doWarnLog;
+function doWarnLog(calledViaConsole: boolean, args: any[]): void {
     doLog(calledViaConsole, warnConsoleLog, 'WARNING', args);
 }
 
-function infoLog(calledViaConsole: boolean, args: any[]): void {
+let infoLog = doInfoLog;
+function doInfoLog(calledViaConsole: boolean, args: any[]): void {
     doLog(calledViaConsole, infoConsoleLog, 'INFO', args);
 }
 
-function debugLog(calledViaConsole: boolean, args: any[]): void {
+let debugLog = doDebugLog;
+function doDebugLog(calledViaConsole: boolean, args: any[]): void {
     doLog(calledViaConsole, debugConsoleLog, 'DEBUG', args);
 }
 
+// Ref: https://github.com/sirupsen/logrus#level-logging
+export type LogrusLogLevel = keyof (typeof LogrusLogLevels);
+export const LogrusLogLevels = {
+    trace: true,
+    debug: true,
+    info: true,
+    warning: true,
+    error: true,
+    fatal: true,
+    panic: true,
+}
+export namespace LogrusLogLevel {
+    export function isGreatherOrEqual(lvl: LogrusLogLevel | undefined, ref: LogrusLogLevel | undefined): boolean {
+        if (lvl === undefined) {
+            return false;
+        }
+        if (ref === undefined) {
+            return true;
+        }
+        return getLevelArity(lvl) >= getLevelArity(ref);
+    }
+    function getLevelArity(lvl: LogrusLogLevel): number {
+        return Object.keys(LogrusLogLevels)
+            .findIndex((l) => l === lvl);
+    }
+    export function getFromEnv(): LogrusLogLevel | undefined {
+        const lvlStr = process.env.LOG_LEVEL;
+        if (!lvlStr) {
+            return undefined;
+        }
+        const lvl = lvlStr as LogrusLogLevel;
+        const exists = LogrusLogLevels[lvl]
+        if (!exists) {
+            return undefined;
+        }
+        return lvl;
+    }
+}
+
 // Source: https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#LogSeverity
 type GoogleLogSeverity = 'EMERGENCY' | 'ALERT' | 'CRITICAL' | 'ERROR' | 'WARNING' | 'INFO' | 'DEBUG';
 namespace GoogleLogSeverity {
@@ -243,7 +308,6 @@ function makeLogItem(severity: GoogleLogSeverity, context: LogContext | undefine
         severity,
         time: new Date().toISOString(),
         environment: process.env.KUBE_STAGE,
-        region: process.env.GITPOD_REGION,
         context,
         message,
         error,

package/src/util/parse-workspace-id.spec.ts

@@ -6,7 +6,7 @@
 
 import * as chai from 'chai';
 import { suite, test } from 'mocha-typescript';
-import { parseWorkspaceIdFromHostname } from './parse-workspace-id';
+import { matchesInstanceIdOrLegacyWorkspaceIdExactly, matchesNewWorkspaceIdExactly, parseWorkspaceIdFromHostname } from './parse-workspace-id';
 const expect = chai.expect;
 
 @suite
@@ -52,5 +52,25 @@ export class ParseWorkspaceIdTest {
         const actual = parseWorkspaceIdFromHostname("webview-3000-ca81a50f-09d7-465c-acd9-264a747d5351.ws-eu01.some.subdomain.somehost.com");
         expect(actual).to.equal("ca81a50f-09d7-465c-acd9-264a747d5351");
     }
+
+    // match - instance ID
+    @test public matchesInstanceIdOrLegacyWorkspaceIdExactly_positive() {
+        const actual = matchesInstanceIdOrLegacyWorkspaceIdExactly("b7e0eaf8-ec73-44ec-81ea-04859263b656");
+        expect(actual).to.be.true;
+    }
+    @test public matchesInstanceIdOrLegacyWorkspaceIdExactly_negative() {
+        const actual = matchesInstanceIdOrLegacyWorkspaceIdExactly("b7e0eaf8-ec73-44ec-81a-04859263b656");
+        expect(actual).to.be.false;
+    }
+
+    // match - new workspace ID
+    @test public matchesWorkspaceIdExactly_new_positive() {
+        const actual = matchesNewWorkspaceIdExactly("moccasin-ferret-155799b3");
+        expect(actual).to.be.true;
+    }
+    @test public matchesWorkspaceIdExactly_new_negative() {
+        const actual = matchesNewWorkspaceIdExactly("moccasin-ferret-15599b3");
+        expect(actual).to.be.false;
+    }
 }
 module.exports = new ParseWorkspaceIdTest()

package/src/util/parse-workspace-id.ts

@@ -4,6 +4,14 @@
  * See License-AGPL.txt in the project root for license information.
  */
 
+const REGEX_WORKSPACE_ID = /[0-9a-z]{2,16}-[0-9a-z]{2,16}-[0-9a-z]{8}/;
+const REGEX_WORKSPACE_ID_EXACT = new RegExp(`^${REGEX_WORKSPACE_ID.source}$`);
+// We need to parse the workspace id precisely here to get the case '<some-str>-<port>-<wsid>.ws.' right
+const REGEX_WORKSPACE_ID_FROM_HOSTNAME = new RegExp(`(${REGEX_WORKSPACE_ID.source})\.ws`);
+
+const REGEX_WORKSPACE_ID_LEGACY = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/;
+const REGEX_WORKSPACE_ID_LEGACY_EXACT = new RegExp(`^${REGEX_WORKSPACE_ID_LEGACY.source}$`);
+const REGEX_WORKSPACE_ID_LEGACY_FROM_HOSTNAME = new RegExp(`(${REGEX_WORKSPACE_ID_LEGACY.source})\.ws`);
 
 /**
  * Hostname may be of the form:
@@ -13,17 +21,35 @@
  * @param hostname The hostname the request is headed to
  */
 export const parseWorkspaceIdFromHostname = function(hostname: string) {
-    // We need to parse the workspace id precisely here to get the case '<some-str>-<port>-<wsid>.ws.' right
-    const wsIdExpression = /([0-9a-z]{2,16}-[0-9a-z]{2,16}-[0-9a-z]{8})\.ws/g;
-    const match = wsIdExpression.exec(hostname);
+    const match = REGEX_WORKSPACE_ID_FROM_HOSTNAME.exec(hostname);
     if (match && match.length >= 2) {
         return match[1];
     } else {
-        const legacyUrlFormat = /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.ws/g;
-        const legacyMatch = legacyUrlFormat.exec(hostname);
+        const legacyMatch = REGEX_WORKSPACE_ID_LEGACY_FROM_HOSTNAME.exec(hostname);
         if (legacyMatch && legacyMatch.length >= 2) {
             return legacyMatch[1];
         }
         return undefined;
     }
-}
+};
+
+/** Equalls UUIDv4 (and REGEX_WORKSPACE_ID_LEGACY!) */
+const REGEX_INSTANCE_ID = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/;
+const REGEX_INSTANCE_ID_EXACT = new RegExp(`^${REGEX_INSTANCE_ID.source}$`);
+
+/**
+ * @param maybeId
+ * @returns
+ */
+export const matchesInstanceIdOrLegacyWorkspaceIdExactly = function(maybeId: string): boolean {
+    return REGEX_INSTANCE_ID_EXACT.test(maybeId)
+        || REGEX_WORKSPACE_ID_LEGACY_EXACT.test(maybeId);
+};
+
+/**
+ * @param maybeWorkspaceId
+ * @returns
+ */
+export const matchesNewWorkspaceIdExactly = function(maybeWorkspaceId: string): boolean {
+    return REGEX_WORKSPACE_ID_EXACT.test(maybeWorkspaceId);
+};

package/src/util/semaphore.ts

@@ -9,7 +9,7 @@ export class Semaphore {
     protected queue: (() => void)[] = [];
     protected used: number;
 
-    constructor(protected readonly capacity: number) { 
+    constructor(protected readonly capacity: number) {
         if(capacity < 1) {
             throw new Error("Capacity cannot be less than 1");
         }
@@ -17,7 +17,7 @@ export class Semaphore {
 
     public release() {
         if(this.used == 0) return;
-        
+
         const queued = this.queue.shift();
         if (queued) {
             queued();

package/src/util/skip-if.ts

@@ -27,7 +27,7 @@ export function skipIf(doSkip: (suite: TestSuiteContext) => boolean): MochaTypeS
             }
         })
     };
-    
+
     // Mark as "trait": mimics the behavior of https://github.com/testdeck/testdeck/blob/9d2dd6a458c2c86c945f6f2999b8278b7528a7a7/index.ts#L433
     (trait as any)["__mts_isTrait"] = true;
     return trait;

package/src/util/timeutil.ts

@@ -6,12 +6,12 @@
 
 /**
  * Returns the <code>day</code>th of the next month from <code>formDate</code>.
- * If the next month does not have a <code>day</code>th, the last day of that 
+ * If the next month does not have a <code>day</code>th, the last day of that
  * month is taken.
  * The time is copied from <code>fromDate</code>.
- * 
- * @param fromDate 
- * @param day 
+ *
+ * @param fromDate
+ * @param day
  */
 export function oneMonthLater(fromDate: string, day?: number): string {
     const later = new Date(fromDate);

package/src/util/tracing.ts

@@ -9,19 +9,29 @@ import * as opentracing from 'opentracing';
 import { TracingConfig, initTracerFromEnv, Sampler, SamplingDecision } from 'jaeger-client';
 import { initGlobalTracer } from 'opentracing';
 import { injectable } from 'inversify';
+import { ResponseError } from 'vscode-jsonrpc';
 
 export interface TraceContext {
     span?: opentracing.Span
 }
+export type TraceContextWithSpan = TraceContext & {
+    span: opentracing.Span
+}
+
 
 export namespace TraceContext {
-    export function startSpan(operation: string, ctx: TraceContext): opentracing.Span {
+    export function startSpan(operation: string, parentCtx: TraceContext): opentracing.Span {
         const options: opentracing.SpanOptions = {
-            childOf: ctx.span
+            childOf: parentCtx.span
         }
         return opentracing.globalTracer().startSpan(operation, options);
     }
 
+    export function childContextWithSpan(operation: string, parentCtx: TraceContext): TraceContextWithSpan {
+        const span = startSpan(operation, parentCtx);
+        return { span };
+    }
+
     export function startAsyncSpan(operation: string, ctx: TraceContext): opentracing.Span {
         const options: opentracing.SpanOptions = {};
         if (!!ctx.span) {
@@ -39,7 +49,42 @@ export namespace TraceContext {
             "error": err.message,
             "stacktrace": err.stack
         })
-        ctx.span.setTag("error", true)
+        ctx.span.setTag("error", true);
+    }
+
+    export function logJsonRPCError(ctx: TraceContext, method: string, err: ResponseError<any>) {
+        if (!ctx.span) {
+            return;
+        }
+        logError(ctx, err);
+
+        // https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/trace/semantic_conventions/rpc.md#json-rpc
+        ctx.span.addTags({
+            rpc: {
+                system: "jsonrpc",
+                method,
+                jsonrpc: {
+                    error_code: err.code,
+                    error_message: err.message,
+                },
+            },
+        });
+    }
+
+    export function addJsonRPCParameters(ctx: TraceContext, method: string, args: any[]) {
+        if (!ctx.span) {
+            return;
+        }
+
+        ctx.span.addTags({
+            rpc: {
+                system: "jsonrpc",
+                method,
+                jsonrpc: {
+                    parameters: args.slice(),
+                },
+            },
+        });
     }
 }
 
@@ -132,3 +177,20 @@ export class PerOperationSampler implements Sampler {
         }
     }
 }
+
+// Augment interfaces with an leading parameter "TraceContext" on every method
+type IsValidArg<T> = T extends object ? keyof T extends never ? false : true : true;
+type AddTraceContext<T> =
+    T extends (a: infer A, b: infer B, c: infer C, d: infer D, e: infer E, f: infer F) => infer R ? (
+        IsValidArg<F> extends true ? (ctx: TraceContextWithSpan, a: A, b: B, c: C, d: D, e: E, f: F) => R :
+        IsValidArg<E> extends true ? (ctx: TraceContextWithSpan, a: A, b: B, c: C, d: D, e: E) => R :
+        IsValidArg<D> extends true ? (ctx: TraceContextWithSpan, a: A, b: B, c: C, d: D) => R :
+        IsValidArg<C> extends true ? (ctx: TraceContextWithSpan, a: A, b: B, c: C) => R :
+        IsValidArg<B> extends true ? (ctx: TraceContextWithSpan, a: A, b: B) => R :
+        IsValidArg<A> extends true ? (ctx: TraceContextWithSpan, a: A) => R :
+        (ctx: TraceContextWithSpan) => Promise<R>
+    ) : never;
+
+export type InterfaceWithTraceContext<T> = {
+    [P in keyof T]: AddTraceContext<T[P]>
+};

package/src/workspace-cluster.ts

@@ -7,11 +7,11 @@
 import * as fs from 'fs';
 import { filePathTelepresenceAware } from './env';
 import { DeepPartial } from "./util/deep-partial";
-import { Without } from './util/without';
+import { PermissionName } from './permission';
 
 export interface WorkspaceCluster {
     // Name of the workspace cluster.
-    // This is the string set in each 
+    // This is the string set in each
     // Must be identical to the installationShortname of the cluster it represents!
     name: string;
 
@@ -32,7 +32,14 @@ export interface WorkspaceCluster {
 
     // True if this bridge should control this cluster
     govern: boolean;
+
+    // An optional set of constraints that limit who can start workspaces on the cluster
+    admissionConstraints?: AdmissionConstraint[];
+
+    // An optional set of admission preferences that guide cluster selection
+    admissionPreferences?: AdmissionPreference[];
 }
+
 export type WorkspaceClusterState = "available" | "cordoned" | "draining";
 export interface TLSConfig {
     // the CA shared between client and server (base64 encoded)
@@ -45,35 +52,44 @@ export interface TLSConfig {
 export namespace TLSConfig {
     export const loadFromBase64File = (path: string): string => fs.readFileSync(filePathTelepresenceAware(path)).toString("base64");
 }
-export type WorkspaceClusterWoTls = Without<WorkspaceCluster, "tls">;
+export type WorkspaceClusterWoTLS = Omit<WorkspaceCluster, "tls">;
 export type WorkspaceManagerConnectionInfo = Pick<WorkspaceCluster, "name" | "url" | "tls">;
 
+export type AdmissionConstraint = AdmissionConstraintFeaturePreview | AdmissionConstraintHasRole | AdmissionConstraintHasUserLevel;
+export type AdmissionConstraintFeaturePreview = { type: "has-feature-preview" };
+export type AdmissionConstraintHasRole = { type: "has-permission", permission: PermissionName };
+export type AdmissionConstraintHasUserLevel = { type: "has-user-level", level: string };
+
+export type AdmissionPreference = AdmissionPreferenceUserLevel;
+export type AdmissionPreferenceUserLevel = { type: 'user-level', level: string };
+
+
 export const WorkspaceClusterDB = Symbol("WorkspaceClusterDB");
 export interface WorkspaceClusterDB {
     /**
      * Stores the given WorkspaceCluster to the cluster-local DB in a consistent manner.
      * If there already is an entry with the same name it's merged and updated with the given state.
-     * @param cluster 
+     * @param cluster
      */
     save(cluster: WorkspaceCluster): Promise<void>;
 
     /**
      * Deletes the cluster identified by this name, if any.
-     * @param name 
+     * @param name
      */
     deleteByName(name: string): Promise<void>;
 
     /**
      * Finds a WorkspaceCluster with the given name. If there is none, `undefined` is returned.
-     * @param name 
+     * @param name
      */
     findByName(name: string): Promise<WorkspaceCluster | undefined>;
 
     /**
      * Lists all WorkspaceClusterWoTls for which the given predicate is true (does not return TLS for size/speed concerns)
-     * @param predicate 
+     * @param predicate
      */
-    findFiltered(predicate: DeepPartial<WorkspaceClusterFilter>): Promise<WorkspaceClusterWoTls[]>;
+    findFiltered(predicate: DeepPartial<WorkspaceClusterFilter>): Promise<WorkspaceClusterWoTLS[]>;
 }
 export interface WorkspaceClusterFilter extends Pick<WorkspaceCluster, "state" | "govern" | "url"> {
     minScore: number;