@jskit-ai/users-core 0.1.22 → 0.1.23

package/package.descriptor.mjs

@@ -1,7 +1,7 @@
 export default Object.freeze({
   packageVersion: 1,
   packageId: "@jskit-ai/users-core",
-  version: "0.1.22",
+  version: "0.1.23",
   description: "Users/workspace domain runtime plus HTTP routes for workspace, account, and console features.",
   dependsOn: [
     "@jskit-ai/auth-core",
@@ -203,10 +203,10 @@ export default Object.freeze({
   mutations: {
     dependencies: {
       runtime: {
-        "@jskit-ai/auth-core": "0.1.15",
-        "@jskit-ai/database-runtime": "0.1.16",
-        "@jskit-ai/http-runtime": "0.1.15",
-        "@jskit-ai/kernel": "0.1.16",
+        "@jskit-ai/auth-core": "0.1.16",
+        "@jskit-ai/database-runtime": "0.1.17",
+        "@jskit-ai/http-runtime": "0.1.16",
+        "@jskit-ai/kernel": "0.1.17",
         "@fastify/multipart": "^9.4.0",
         "@fastify/type-provider-typebox": "^6.1.0",
         "typebox": "^1.0.81"
@@ -257,7 +257,7 @@ export default Object.freeze({
         from: "templates/migrations/users_core_workspace_settings_single_name_source.cjs",
         toDir: "migrations",
         extension: ".cjs",
-        reason: "Remove workspace_settings.name so workspace names come from workspaces only.",
+        reason: "Remove workspace_settings name/avatar fields so workspace identity data comes from workspaces only.",
         category: "migration",
         id: "users-core-workspace-settings-single-name-source"
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/users-core",
-  "version": "0.1.22",
+  "version": "0.1.23",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -16,6 +16,7 @@
     "./shared/support/usersVisibility": "./src/shared/support/usersVisibility.js",
     "./shared/support/workspacePathModel": "./src/shared/support/workspacePathModel.js",
     "./shared/support/usersApiPaths": "./src/shared/support/usersApiPaths.js",
+    "./shared/resources/workspaceResource": "./src/shared/resources/workspaceResource.js",
     "./shared/resources/workspaceSettingsResource": "./src/shared/resources/workspaceSettingsResource.js",
     "./shared/resources/workspaceSettingsFields": "./src/shared/resources/workspaceSettingsFields.js",
     "./shared/resources/userProfileResource": "./src/shared/resources/userProfileResource.js",
@@ -24,10 +25,10 @@
     "./shared/resources/consoleSettingsFields": "./src/shared/resources/consoleSettingsFields.js"
   },
   "dependencies": {
-    "@jskit-ai/auth-core": "0.1.15",
-    "@jskit-ai/database-runtime": "0.1.16",
-    "@jskit-ai/http-runtime": "0.1.15",
-    "@jskit-ai/kernel": "0.1.16",
+    "@jskit-ai/auth-core": "0.1.16",
+    "@jskit-ai/database-runtime": "0.1.17",
+    "@jskit-ai/http-runtime": "0.1.16",
+    "@jskit-ai/kernel": "0.1.17",
     "@fastify/multipart": "^9.4.0",
     "@fastify/type-provider-typebox": "^6.1.0",
     "typebox": "^1.0.81"

package/src/server/common/formatters/workspaceFormatter.js

@@ -23,7 +23,6 @@ function mapWorkspaceSettingsPublic(workspaceSettings, { workspaceInvitationsEna
   const themePalettes = resolveWorkspaceThemePalettes(source);
 
   return {
-    name: normalizeText(source.name),
     lightPrimaryColor: themePalettes.light.color,
     lightSecondaryColor: themePalettes.light.secondaryColor,
     lightSurfaceColor: themePalettes.light.surfaceColor,
@@ -32,7 +31,6 @@ function mapWorkspaceSettingsPublic(workspaceSettings, { workspaceInvitationsEna
     darkSecondaryColor: themePalettes.dark.secondaryColor,
     darkSurfaceColor: themePalettes.dark.surfaceColor,
     darkSurfaceVariantColor: themePalettes.dark.surfaceVariantColor,
-    avatarUrl: normalizeText(source.avatarUrl),
     invitesEnabled,
     invitesAvailable,
     invitesEffective: invitesAvailable && invitesEnabled

package/src/server/common/repositories/workspacesRepository.js

@@ -45,14 +45,14 @@ function createRepository(knex) {
     throw new TypeError("workspacesRepository requires knex.");
   }
 
-  function workspaceSelectColumns(client, { includeMembership = false } = {}) {
+  function workspaceSelectColumns({ includeMembership = false } = {}) {
     const columns = [
       "w.id",
       "w.slug",
       "w.name",
       "w.owner_user_id",
       "w.is_personal",
-      client.raw("COALESCE(ws.avatar_url, w.avatar_url) as avatar_url"),
+      "w.avatar_url",
       "w.color",
       "w.created_at",
       "w.updated_at",
@@ -67,9 +67,8 @@ function createRepository(knex) {
   async function findById(workspaceId, options = {}) {
     const client = options?.trx || knex;
     const row = await client("workspaces as w")
-      .leftJoin("workspace_settings as ws", "ws.workspace_id", "w.id")
       .where({ "w.id": Number(workspaceId) })
-      .select(workspaceSelectColumns(client))
+      .select(workspaceSelectColumns())
       .first();
     return mapRow(row);
   }
@@ -82,9 +81,8 @@ function createRepository(knex) {
     }
 
     const row = await client("workspaces as w")
-      .leftJoin("workspace_settings as ws", "ws.workspace_id", "w.id")
       .where({ "w.slug": normalizedSlug })
-      .select(workspaceSelectColumns(client))
+      .select(workspaceSelectColumns())
       .first();
     return mapRow(row);
   }
@@ -92,10 +90,9 @@ function createRepository(knex) {
   async function findPersonalByOwnerUserId(userId, options = {}) {
     const client = options?.trx || knex;
     const row = await client("workspaces as w")
-      .leftJoin("workspace_settings as ws", "ws.workspace_id", "w.id")
       .where({ "w.owner_user_id": Number(userId), "w.is_personal": 1 })
       .orderBy("w.id", "asc")
-      .select(workspaceSelectColumns(client))
+      .select(workspaceSelectColumns())
       .first();
     return mapRow(row);
   }
@@ -161,12 +158,11 @@ function createRepository(knex) {
     const client = options?.trx || knex;
     const rows = await client("workspace_memberships as wm")
       .join("workspaces as w", "w.id", "wm.workspace_id")
-      .leftJoin("workspace_settings as ws", "ws.workspace_id", "w.id")
       .where({ "wm.user_id": Number(userId) })
       .whereNull("w.deleted_at")
       .orderBy("w.is_personal", "desc")
       .orderBy("w.id", "asc")
-      .select(workspaceSelectColumns(client, { includeMembership: true }));
+      .select(workspaceSelectColumns({ includeMembership: true }));
 
     return rows.map(mapMembershipWorkspaceRow).filter(Boolean);
   }

package/src/server/common/services/workspaceContextService.js

@@ -205,6 +205,16 @@ function createService({
     return inserted;
   }
 
+  async function getWorkspaceForAuthenticatedUser(user, workspaceSlug, options = {}) {
+    const workspaceContext = await resolveWorkspaceContextForUserBySlug(user, workspaceSlug, options);
+    return workspaceContext.workspace;
+  }
+
+  async function updateWorkspaceForAuthenticatedUser(user, workspaceSlug, patch = {}, options = {}) {
+    const workspaceContext = await resolveWorkspaceContextForUserBySlug(user, workspaceSlug, options);
+    return workspacesRepository.updateById(workspaceContext.workspace.id, patch, options);
+  }
+
   async function resolveWorkspaceContextForUserBySlug(user, workspaceSlug, options = {}) {
     const normalizedUser = authenticatedUserValidator.normalize(user);
     if (!normalizedUser) {
@@ -261,6 +271,8 @@ function createService({
     ensurePersonalWorkspaceForUser,
     provisionWorkspaceForNewUser,
     createWorkspaceForAuthenticatedUser,
+    getWorkspaceForAuthenticatedUser,
+    updateWorkspaceForAuthenticatedUser,
     listWorkspacesForUser,
     listWorkspacesForAuthenticatedUser,
     resolveWorkspaceContextForUserBySlug

package/src/server/workspaceDirectory/bootWorkspaceDirectoryRoutes.js

@@ -4,6 +4,9 @@ import { workspaceResource } from "../../shared/resources/workspaceResource.js";
 import {
   USERS_WORKSPACE_SELF_CREATE_ENABLED_TOKEN
 } from "../common/diTokens.js";
+import { resolveWorkspaceRoutePath } from "../common/support/workspaceRoutePaths.js";
+import { workspaceSlugParamsValidator } from "../common/validators/routeParamsValidator.js";
+import { resolveDefaultWorkspaceRouteSurfaceIdFromAppConfig } from "../support/workspaceActionSurfaces.js";
 
 function bootWorkspaceDirectoryRoutes(app) {
   if (!app || typeof app.make !== "function" || typeof app.has !== "function") {
@@ -11,6 +14,8 @@ function bootWorkspaceDirectoryRoutes(app) {
   }
 
   const router = app.make(KERNEL_TOKENS.HttpRouter);
+  const appConfig = app.has("appConfig") ? app.make("appConfig") : {};
+  const workspaceRouteSurfaceId = resolveDefaultWorkspaceRouteSurfaceIdFromAppConfig(appConfig);
   const workspaceSelfCreateEnabled = app.has(USERS_WORKSPACE_SELF_CREATE_ENABLED_TOKEN)
     ? app.make(USERS_WORKSPACE_SELF_CREATE_ENABLED_TOKEN) === true
     : false;
@@ -68,6 +73,65 @@ function bootWorkspaceDirectoryRoutes(app) {
       reply.code(200).send(response);
     }
   );
+
+  router.register(
+    "GET",
+    resolveWorkspaceRoutePath("/"),
+    {
+      auth: "required",
+      surface: workspaceRouteSurfaceId,
+      visibility: "workspace",
+      meta: {
+        tags: ["workspace"],
+        summary: "Get workspace profile by workspace slug"
+      },
+      paramsValidator: workspaceSlugParamsValidator,
+      responseValidators: withStandardErrorResponses({
+        200: workspaceResource.operations.view.outputValidator
+      })
+    },
+    async function (request, reply) {
+      const response = await request.executeAction({
+        actionId: "workspace.workspaces.read",
+        input: {
+          workspaceSlug: request.input.params.workspaceSlug
+        }
+      });
+      reply.code(200).send(response);
+    }
+  );
+
+  router.register(
+    "PATCH",
+    resolveWorkspaceRoutePath("/"),
+    {
+      auth: "required",
+      surface: workspaceRouteSurfaceId,
+      visibility: "workspace",
+      meta: {
+        tags: ["workspace"],
+        summary: "Update workspace profile by workspace slug"
+      },
+      paramsValidator: workspaceSlugParamsValidator,
+      bodyValidator: workspaceResource.operations.patch.bodyValidator,
+      responseValidators: withStandardErrorResponses(
+        {
+          200: workspaceResource.operations.patch.outputValidator
+        },
+        { includeValidation400: true }
+      )
+    },
+    async function (request, reply) {
+      const response = await request.executeAction({
+        actionId: "workspace.workspaces.update",
+        input: {
+          workspaceSlug: request.input.params.workspaceSlug,
+          patch: request.input.body
+        }
+      });
+      reply.code(200).send(response);
+    }
+  );
 }
 
 export { bootWorkspaceDirectoryRoutes };

package/src/server/workspaceDirectory/workspaceDirectoryActions.js

@@ -3,6 +3,7 @@ import {
   resolveRequest
 } from "@jskit-ai/kernel/shared/actions/actionContributorHelpers";
 import { workspaceResource } from "../../shared/resources/workspaceResource.js";
+import { workspaceSlugParamsValidator } from "../common/validators/routeParamsValidator.js";
 import { resolveActionUser } from "../common/support/resolveActionUser.js";
 
 const workspaceDirectoryActions = Object.freeze([
@@ -59,6 +60,73 @@ const workspaceDirectoryActions = Object.freeze([
         nextCursor: null
       };
     }
+  },
+  {
+    id: "workspace.workspaces.read",
+    version: 1,
+    kind: "query",
+    channels: ["api", "automation", "internal"],
+    surfacesFrom: "workspace",
+    permission: {
+      require: "any",
+      permissions: ["workspace.settings.view", "workspace.settings.update"]
+    },
+    inputValidator: workspaceSlugParamsValidator,
+    outputValidator: workspaceResource.operations.view.outputValidator,
+    idempotency: "none",
+    audit: {
+      actionName: "workspace.workspaces.read"
+    },
+    observability: {},
+    async execute(input, context, deps) {
+      return deps.workspaceService.getWorkspaceForAuthenticatedUser(
+        resolveActionUser(context, input),
+        input.workspaceSlug,
+        {
+          request: resolveRequest(context),
+          context
+        }
+      );
+    }
+  },
+  {
+    id: "workspace.workspaces.update",
+    version: 1,
+    kind: "command",
+    channels: ["api", "assistant_tool", "automation", "internal"],
+    surfacesFrom: "workspace",
+    permission: {
+      require: "all",
+      permissions: ["workspace.settings.update"]
+    },
+    inputValidator: [
+      workspaceSlugParamsValidator,
+      {
+        patch: workspaceResource.operations.patch.bodyValidator
+      }
+    ],
+    outputValidator: workspaceResource.operations.patch.outputValidator,
+    idempotency: "optional",
+    audit: {
+      actionName: "workspace.workspaces.update"
+    },
+    observability: {},
+    extensions: {
+      assistant: {
+        description: "Update workspace profile fields."
+      }
+    },
+    async execute(input, context, deps) {
+      return deps.workspaceService.updateWorkspaceForAuthenticatedUser(
+        resolveActionUser(context, input),
+        input.workspaceSlug,
+        input.patch,
+        {
+          request: resolveRequest(context),
+          context
+        }
+      );
+    }
   }
 ]);
 

package/src/shared/resources/workspaceResource.js

@@ -5,6 +5,21 @@ import {
   createCursorListValidator
 } from "@jskit-ai/kernel/shared/validators";
 
+function normalizeWorkspaceAvatarUrl(value) {
+  const avatarUrl = normalizeText(value);
+  if (!avatarUrl) {
+    return "";
+  }
+  if (!avatarUrl.startsWith("http://") && !avatarUrl.startsWith("https://")) {
+    return null;
+  }
+  try {
+    return new URL(avatarUrl).toString();
+  } catch {
+    return null;
+  }
+}
+
 function normalizeWorkspaceInput(payload = {}) {
   const source = normalizeObjectInput(payload);
   const normalized = {};
@@ -19,7 +34,7 @@ function normalizeWorkspaceInput(payload = {}) {
     normalized.ownerUserId = Number(source.ownerUserId);
   }
   if (Object.hasOwn(source, "avatarUrl")) {
-    normalized.avatarUrl = normalizeText(source.avatarUrl);
+    normalized.avatarUrl = normalizeWorkspaceAvatarUrl(source.avatarUrl);
   }
   if (Object.hasOwn(source, "color")) {
     const color = normalizeText(source.color);
@@ -92,6 +107,33 @@ const createRequestBodySchema = Type.Object(
   { additionalProperties: false }
 );
 
+const patchRequestBodySchema = Type.Object(
+  {
+    name: Type.Optional(Type.String({ minLength: 1, maxLength: 160 })),
+    avatarUrl: Type.Optional(
+      Type.String({
+        pattern: "^(https?://.+)?$",
+        messages: {
+          pattern: "Workspace avatar URL must be a valid absolute URL (http:// or https://).",
+          default: "Workspace avatar URL must be a valid absolute URL (http:// or https://)."
+        }
+      })
+    ),
+    color: Type.Optional(
+      Type.String({
+        minLength: 7,
+        maxLength: 7,
+        pattern: "^#[0-9A-Fa-f]{6}$",
+        messages: {
+          pattern: "Workspace color must be a hex color like #1867C0.",
+          default: "Workspace color must be a hex color like #1867C0."
+        }
+      })
+    )
+  },
+  { additionalProperties: false }
+);
+
 const responseRecordValidator = Object.freeze({
   schema: responseRecordSchema,
   normalize: normalizeWorkspaceOutput
@@ -138,7 +180,7 @@ const resource = {
     patch: {
       method: "PATCH",
       bodyValidator: {
-        schema: Type.Partial(createRequestBodySchema, { additionalProperties: false }),
+        schema: patchRequestBodySchema,
         normalize: normalizeWorkspaceInput
       },
       outputValidator: responseRecordValidator

package/templates/migrations/users_core_initial.cjs

@@ -44,6 +44,7 @@ exports.up = async function up(knex) {
 
   await knex.schema.createTable("workspace_settings", (table) => {
     table.integer("workspace_id").unsigned().primary().references("id").inTable("workspaces").onDelete("CASCADE");
+    table.string("name", 160).notNullable().defaultTo("Workspace");
     table.string("avatar_url", 512).notNullable().defaultTo("");
     table.string("light_primary_color", 7).notNullable().defaultTo("#1867C0");
     table.string("light_secondary_color", 7).notNullable().defaultTo("#48A9A6");

package/templates/migrations/users_core_workspace_settings_single_name_source.cjs

@@ -1,6 +1,7 @@
 const WORKSPACE_SETTINGS_TABLE = "workspace_settings";
 const WORKSPACES_TABLE = "workspaces";
 const LEGACY_NAME_COLUMN = "name";
+const LEGACY_AVATAR_COLUMN = "avatar_url";
 
 async function hasTable(knex, tableName) {
   return knex.schema.hasTable(tableName);
@@ -17,12 +18,18 @@ exports.up = async function up(knex) {
   }
 
   const hasLegacyName = await hasColumn(knex, WORKSPACE_SETTINGS_TABLE, LEGACY_NAME_COLUMN);
-  if (!hasLegacyName) {
+  const hasLegacyAvatarUrl = await hasColumn(knex, WORKSPACE_SETTINGS_TABLE, LEGACY_AVATAR_COLUMN);
+  if (!hasLegacyName && !hasLegacyAvatarUrl) {
     return;
   }
 
   await knex.schema.alterTable(WORKSPACE_SETTINGS_TABLE, (table) => {
-    table.dropColumn(LEGACY_NAME_COLUMN);
+    if (hasLegacyName) {
+      table.dropColumn(LEGACY_NAME_COLUMN);
+    }
+    if (hasLegacyAvatarUrl) {
+      table.dropColumn(LEGACY_AVATAR_COLUMN);
+    }
   });
 };
 
@@ -33,9 +40,15 @@ exports.down = async function down(knex) {
   }
 
   const hasLegacyName = await hasColumn(knex, WORKSPACE_SETTINGS_TABLE, LEGACY_NAME_COLUMN);
-  if (!hasLegacyName) {
+  const hasLegacyAvatarUrl = await hasColumn(knex, WORKSPACE_SETTINGS_TABLE, LEGACY_AVATAR_COLUMN);
+  if (!hasLegacyName || !hasLegacyAvatarUrl) {
     await knex.schema.alterTable(WORKSPACE_SETTINGS_TABLE, (table) => {
-      table.string(LEGACY_NAME_COLUMN, 160).notNullable().defaultTo("Workspace");
+      if (!hasLegacyName) {
+        table.string(LEGACY_NAME_COLUMN, 160).notNullable().defaultTo("Workspace");
+      }
+      if (!hasLegacyAvatarUrl) {
+        table.string(LEGACY_AVATAR_COLUMN, 512).notNullable().defaultTo("");
+      }
     });
   }
 
@@ -44,11 +57,15 @@ exports.down = async function down(knex) {
     return;
   }
 
-  const workspaceRows = await knex(WORKSPACES_TABLE).select("id", "name");
+  const workspaceRows = await knex(WORKSPACES_TABLE).select("id", "name", "avatar_url");
   for (const workspaceRow of workspaceRows) {
     const normalizedName = String(workspaceRow?.name || "").trim() || "Workspace";
+    const normalizedAvatarUrl = String(workspaceRow?.avatar_url || "").trim();
     await knex(WORKSPACE_SETTINGS_TABLE)
       .where({ workspace_id: Number(workspaceRow.id) })
-      .update({ name: normalizedName });
+      .update({
+        name: normalizedName,
+        avatar_url: normalizedAvatarUrl
+      });
   }
 };

package/templates/packages/main/src/shared/resources/workspaceSettingsFields.js

@@ -13,21 +13,6 @@ import {
   resetWorkspaceSettingsFields
 } from "@jskit-ai/users-core/shared/resources/workspaceSettingsFields";
 
-function normalizeAvatarUrl(value) {
-  const avatarUrl = normalizeText(value);
-  if (!avatarUrl) {
-    return "";
-  }
-  if (!avatarUrl.startsWith("http://") && !avatarUrl.startsWith("https://")) {
-    return null;
-  }
-  try {
-    return new URL(avatarUrl).toString();
-  } catch {
-    return null;
-  }
-}
-
 function normalizeHexColor(value) {
   const color = normalizeText(value);
   return /^#[0-9A-Fa-f]{6}$/.test(color) ? color.toUpperCase() : null;
@@ -35,23 +20,6 @@ function normalizeHexColor(value) {
 
 resetWorkspaceSettingsFields();
 
-defineField({
-  key: "avatarUrl",
-  dbColumn: "avatar_url",
-  required: false,
-  inputSchema: Type.String({
-    pattern: "^(https?://.+)?$",
-    messages: {
-      pattern: "Workspace avatar URL must be a valid absolute URL (http:// or https://).",
-      default: "Workspace avatar URL must be a valid absolute URL (http:// or https://)."
-    }
-  }),
-  outputSchema: Type.String(),
-  normalizeInput: normalizeAvatarUrl,
-  normalizeOutput: (value) => normalizeText(value),
-  resolveDefault: ({ workspace = {} } = {}) => normalizeText(workspace.avatarUrl)
-});
-
 defineField({
   key: "lightPrimaryColor",
   dbColumn: "light_primary_color",

package/test/registerWorkspaceDirectory.test.js

@@ -22,5 +22,10 @@ test("registerWorkspaceDirectory registers workspace directory actions without r
   const app = createAppDouble();
 
   registerWorkspaceDirectory(app);
-  assert.deepEqual(listActionIds(app), ["workspace.workspaces.create", "workspace.workspaces.list"]);
+  assert.deepEqual(listActionIds(app), [
+    "workspace.workspaces.create",
+    "workspace.workspaces.list",
+    "workspace.workspaces.read",
+    "workspace.workspaces.update"
+  ]);
 });

package/test/usersRouteRequestInputValidator.test.js

@@ -126,6 +126,10 @@ test("workspace and settings routes attach only the shared transport normalizers
     method: "GET",
     path: "/api/w/:workspaceSlug/workspace/settings"
   });
+  const workspacePatch = findRoute(routes, {
+    method: "PATCH",
+    path: "/api/w/:workspaceSlug/workspace"
+  });
   const workspaceSettingsPatch = findRoute(routes, {
     method: "PATCH",
     path: "/api/w/:workspaceSlug/workspace/settings"
@@ -156,6 +160,7 @@ test("workspace and settings routes attach only the shared transport normalizers
   });
 
   assert.equal(typeof workspaceSettings?.paramsValidator?.normalize, "function");
+  assert.equal(typeof workspacePatch?.bodyValidator?.normalize, "function");
   assert.equal(typeof workspaceSettingsPatch?.bodyValidator?.normalize, "function");
   assert.equal(typeof workspaceMemberRole?.paramsValidator?.normalize, "function");
   assert.equal(typeof workspaceMemberRole?.bodyValidator?.normalize, "function");
@@ -167,8 +172,16 @@ test("workspace and settings routes attach only the shared transport normalizers
   assert.equal(typeof consoleSettingsPatch?.bodyValidator?.normalize, "function");
 });
 
-test("workspace settings routes mount one canonical workspace endpoint", async () => {
+test("workspace core/settings routes mount one canonical workspace endpoint", async () => {
   const routes = await registerRoutes();
+  const workspace = findRoute(routes, {
+    method: "GET",
+    path: "/api/w/:workspaceSlug/workspace"
+  });
+  const workspacePatch = findRoute(routes, {
+    method: "PATCH",
+    path: "/api/w/:workspaceSlug/workspace"
+  });
   const workspaceSettings = findRoute(routes, {
     method: "GET",
     path: "/api/w/:workspaceSlug/workspace/settings"
@@ -186,6 +199,11 @@ test("workspace settings routes mount one canonical workspace endpoint", async (
     path: "/api/console/w/:workspaceSlug/workspace/settings"
   });
 
+  assert.ok(workspace);
+  assert.equal(workspace?.visibility, "workspace");
+  assert.equal(workspacePatch?.visibility, "workspace");
+  assert.equal(workspace?.surface, "");
+  assert.equal(workspacePatch?.surface, "");
   assert.ok(workspaceSettings);
   assert.equal(workspaceSettings?.visibility, "workspace");
   assert.equal(workspaceSettingsPatch?.visibility, "workspace");
@@ -205,6 +223,8 @@ test("users-core boot skips workspace routes when workspace policy is disabled",
 
   assert.equal(findRoute(routes, { method: "GET", path: "/api/workspaces" }), null);
   assert.equal(findRoute(routes, { method: "POST", path: "/api/workspaces" }), null);
+  assert.equal(findRoute(routes, { method: "GET", path: "/api/w/:workspaceSlug/workspace" }), null);
+  assert.equal(findRoute(routes, { method: "PATCH", path: "/api/w/:workspaceSlug/workspace" }), null);
   assert.equal(findRoute(routes, { method: "GET", path: "/api/w/:workspaceSlug/workspace/settings" }), null);
   assert.equal(findRoute(routes, { method: "GET", path: "/api/settings" })?.path, "/api/settings");
 });
@@ -242,11 +262,21 @@ test("users-core route registration follows tenancy mode matrix", async () => {
 
   assert.equal(findRoute(noneRoutes, { method: "GET", path: "/api/workspaces" }), null);
   assert.equal(findRoute(noneRoutes, { method: "POST", path: "/api/workspaces" }), null);
+  assert.equal(findRoute(noneRoutes, { method: "GET", path: "/api/w/:workspaceSlug/workspace" }), null);
+  assert.equal(findRoute(noneRoutes, { method: "PATCH", path: "/api/w/:workspaceSlug/workspace" }), null);
   assert.equal(findRoute(noneRoutes, { method: "GET", path: "/api/w/:workspaceSlug/workspace/settings" }), null);
   assert.equal(findRoute(noneRoutes, { method: "GET", path: "/api/workspace/invitations/pending" }), null);
 
   assert.equal(findRoute(personalRoutes, { method: "GET", path: "/api/workspaces" })?.path, "/api/workspaces");
   assert.equal(findRoute(personalRoutes, { method: "POST", path: "/api/workspaces" }), null);
+  assert.equal(
+    findRoute(personalRoutes, { method: "GET", path: "/api/w/:workspaceSlug/workspace" })?.path,
+    "/api/w/:workspaceSlug/workspace"
+  );
+  assert.equal(
+    findRoute(personalRoutes, { method: "PATCH", path: "/api/w/:workspaceSlug/workspace" })?.path,
+    "/api/w/:workspaceSlug/workspace"
+  );
   assert.equal(
     findRoute(personalRoutes, { method: "GET", path: "/api/w/:workspaceSlug/workspace/settings" })?.path,
     "/api/w/:workspaceSlug/workspace/settings"
@@ -258,6 +288,14 @@ test("users-core route registration follows tenancy mode matrix", async () => {
 
   assert.equal(findRoute(workspaceRoutes, { method: "GET", path: "/api/workspaces" })?.path, "/api/workspaces");
   assert.equal(findRoute(workspaceRoutes, { method: "POST", path: "/api/workspaces" }), null);
+  assert.equal(
+    findRoute(workspaceRoutes, { method: "GET", path: "/api/w/:workspaceSlug/workspace" })?.path,
+    "/api/w/:workspaceSlug/workspace"
+  );
+  assert.equal(
+    findRoute(workspaceRoutes, { method: "PATCH", path: "/api/w/:workspaceSlug/workspace" })?.path,
+    "/api/w/:workspaceSlug/workspace"
+  );
   assert.equal(
     findRoute(workspaceRoutes, { method: "GET", path: "/api/w/:workspaceSlug/workspace/settings" })?.path,
     "/api/w/:workspaceSlug/workspace/settings"
@@ -404,7 +442,7 @@ test("workspace settings route handlers build action input from request.input",
     createActionRequest({
       input: {
         params: { workspaceSlug: "acme" },
-        body: { avatarUrl: "https://example.com/acme.png" }
+        body: { lightPrimaryColor: "#0F6B54" }
       },
       executeAction
     }),
@@ -413,7 +451,39 @@ test("workspace settings route handlers build action input from request.input",
 
   assert.deepEqual(calls[0], {
     actionId: "workspace.settings.update",
-    input: { workspaceSlug: "acme", patch: { avatarUrl: "https://example.com/acme.png" } }
+    input: { workspaceSlug: "acme", patch: { lightPrimaryColor: "#0F6B54" } }
+  });
+});
+
+test("workspace route handlers build action input from request.input", async () => {
+  const routes = await registerRoutes();
+  const workspacePatch = findRoute(routes, {
+    method: "PATCH",
+    path: "/api/w/:workspaceSlug/workspace"
+  });
+  const calls = [];
+  const executeAction = async (payload) => {
+    calls.push(payload);
+    return {};
+  };
+
+  await workspacePatch.handler(
+    createActionRequest({
+      input: {
+        params: { workspaceSlug: "acme" },
+        body: { name: "Acme", avatarUrl: "https://example.com/acme.png", color: "#0F6B54" }
+      },
+      executeAction
+    }),
+    createReplyDouble()
+  );
+
+  assert.deepEqual(calls[0], {
+    actionId: "workspace.workspaces.update",
+    input: {
+      workspaceSlug: "acme",
+      patch: { name: "Acme", avatarUrl: "https://example.com/acme.png", color: "#0F6B54" }
+    }
   });
 });
 

package/test/workspaceService.test.js

@@ -39,6 +39,7 @@ function createWorkspaceServiceFixture({
     findPersonalByOwnerUserId: 0,
     listForUserId: 0,
     insert: 0,
+    updateById: 0,
     ensureOwnerMembership: 0
   };
   let nextWorkspaceId = 10;
@@ -125,6 +126,32 @@ function createWorkspaceServiceFixture({
         };
         workspaceBySlug.set(String(inserted.slug).trim().toLowerCase(), inserted);
         return inserted;
+      },
+      async updateById(workspaceId, patch) {
+        calls.updateById += 1;
+        const targetId = Number(workspaceId);
+        for (const [slug, workspace] of workspaceBySlug.entries()) {
+          if (Number(workspace.id) !== targetId) {
+            continue;
+          }
+          const updated = {
+            ...workspace
+          };
+          if (Object.hasOwn(patch, "name")) {
+            updated.name = String(patch.name || "");
+          }
+          if (Object.hasOwn(patch, "avatarUrl")) {
+            updated.avatarUrl = String(patch.avatarUrl || "");
+          }
+          if (Object.hasOwn(patch, "color")) {
+            updated.color = String(patch.color || "#0F6B54");
+          }
+          workspaceBySlug.set(slug, updated);
+          return {
+            ...updated
+          };
+        }
+        return null;
       }
     },
     workspaceMembershipsRepository: {
@@ -478,3 +505,54 @@ test("workspaceService.resolveWorkspaceContextForUserBySlug resolves permissions
 
   assert.deepEqual(context.permissions, ["workspace.settings.update"]);
 });
+
+test("workspaceService.getWorkspaceForAuthenticatedUser resolves workspace from slug context", async () => {
+  const { service } = createWorkspaceServiceFixture({
+    additionalWorkspaces: [
+      {
+        id: 42,
+        slug: "team-alpha",
+        name: "Team Alpha",
+        ownerUserId: 99,
+        isPersonal: false,
+        avatarUrl: "",
+        color: "#0F6B54"
+      }
+    ]
+  });
+
+  const workspace = await service.getWorkspaceForAuthenticatedUser(
+    {
+      id: 7,
+      email: "chiaramobily@gmail.com",
+      displayName: "Chiara"
+    },
+    "team-alpha"
+  );
+
+  assert.equal(workspace.slug, "team-alpha");
+  assert.equal(workspace.name, "Team Alpha");
+});
+
+test("workspaceService.updateWorkspaceForAuthenticatedUser updates workspace profile fields", async () => {
+  const { service, calls } = createWorkspaceServiceFixture();
+
+  const workspace = await service.updateWorkspaceForAuthenticatedUser(
+    {
+      id: 7,
+      email: "chiaramobily@gmail.com",
+      displayName: "Chiara"
+    },
+    "tonymobily3",
+    {
+      name: "Updated Workspace",
+      avatarUrl: "https://example.com/acme.png",
+      color: "#123ABC"
+    }
+  );
+
+  assert.equal(calls.updateById, 1);
+  assert.equal(workspace.name, "Updated Workspace");
+  assert.equal(workspace.avatarUrl, "https://example.com/acme.png");
+  assert.equal(workspace.color, "#123ABC");
+});

package/test/workspaceSettingsActions.test.js

@@ -40,3 +40,13 @@ test("workspace directory actions use the canonical workspace list resource outp
   assert.ok(listAction);
   assert.equal(listAction.outputValidator, workspaceResource.operations.list.outputValidator);
 });
+
+test("workspace directory read/update actions use canonical workspace resource validators", () => {
+  const readAction = workspaceDirectoryActions.find((action) => action.id === "workspace.workspaces.read");
+  const updateAction = workspaceDirectoryActions.find((action) => action.id === "workspace.workspaces.update");
+
+  assert.ok(readAction);
+  assert.ok(updateAction);
+  assert.equal(readAction.outputValidator, workspaceResource.operations.view.outputValidator);
+  assert.equal(updateAction.outputValidator, workspaceResource.operations.patch.outputValidator);
+});

package/test/workspaceSettingsRepository.test.js

@@ -16,7 +16,6 @@ function createKnexStub(rowOverrides = {}) {
     updatePayload: null,
     row: {
       workspace_id: 1,
-      avatar_url: "",
       light_primary_color: DEFAULT_WORKSPACE_THEME.light.color,
       light_secondary_color: DEFAULT_WORKSPACE_THEME.light.secondaryColor,
       light_surface_color: DEFAULT_WORKSPACE_THEME.light.surfaceColor,
@@ -40,7 +39,6 @@ function createKnexStub(rowOverrides = {}) {
         state.insertedRow = { ...payload };
         state.row = {
           workspace_id: payload.workspace_id,
-          avatar_url: payload.avatar_url,
           light_primary_color: payload.light_primary_color,
           light_secondary_color: payload.light_secondary_color,
           light_surface_color: payload.light_surface_color,
@@ -67,9 +65,6 @@ function createKnexStub(rowOverrides = {}) {
             if (Object.hasOwn(payload, "invites_enabled")) {
               state.row.invites_enabled = payload.invites_enabled;
             }
-            if (Object.hasOwn(payload, "avatar_url")) {
-              state.row.avatar_url = payload.avatar_url;
-            }
             if (Object.hasOwn(payload, "light_primary_color")) {
               state.row.light_primary_color = payload.light_primary_color;
             }
@@ -117,7 +112,6 @@ test("workspaceSettingsRepository.findByWorkspaceId maps the stored row", async
 
   assert.deepEqual(record, {
     workspaceId: 1,
-    avatarUrl: "",
     lightPrimaryColor: DEFAULT_WORKSPACE_THEME.light.color,
     lightSecondaryColor: DEFAULT_WORKSPACE_THEME.light.secondaryColor,
     lightSurfaceColor: DEFAULT_WORKSPACE_THEME.light.surfaceColor,
@@ -156,7 +150,6 @@ test("workspaceSettingsRepository.ensureForWorkspaceId inserts the injected defa
   const record = await repository.ensureForWorkspaceId(5);
 
   assert.equal(state.insertedRow.workspace_id, 5);
-  assert.equal(state.insertedRow.avatar_url, "");
   assert.equal(state.insertedRow.light_primary_color, DEFAULT_WORKSPACE_THEME.light.color);
   assert.equal(state.insertedRow.light_secondary_color, DEFAULT_WORKSPACE_THEME.light.secondaryColor);
   assert.equal(state.insertedRow.light_surface_color, DEFAULT_WORKSPACE_THEME.light.surfaceColor);
@@ -172,7 +165,6 @@ test("workspaceSettingsRepository.ensureForWorkspaceId inserts the injected defa
     DEFAULT_WORKSPACE_THEME.dark.surfaceVariantColor
   );
   assert.equal(state.insertedRow.invites_enabled, false);
-  assert.equal(record.avatarUrl, "");
   assert.equal(record.lightPrimaryColor, DEFAULT_WORKSPACE_THEME.light.color);
   assert.equal(record.lightSecondaryColor, DEFAULT_WORKSPACE_THEME.light.secondaryColor);
   assert.equal(record.lightSurfaceColor, DEFAULT_WORKSPACE_THEME.light.surfaceColor);
@@ -184,20 +176,17 @@ test("workspaceSettingsRepository.ensureForWorkspaceId inserts the injected defa
   assert.equal(record.invitesEnabled, false);
 });
 
-test("workspaceSettingsRepository.updateSettingsByWorkspaceId updates avatar/color columns", async () => {
+test("workspaceSettingsRepository.updateSettingsByWorkspaceId updates workspace settings columns", async () => {
   const { knexStub, state } = createKnexStub();
   const repository = createRepository(knexStub, {
     defaultInvitesEnabled: true
   });
 
   const updated = await repository.updateSettingsByWorkspaceId(1, {
-    avatarUrl: "https://example.com/avatar.png",
     lightPrimaryColor: "#123abc"
   });
 
-  assert.equal(state.updatePayload.avatar_url, "https://example.com/avatar.png");
   assert.equal(state.updatePayload.light_primary_color, "#123ABC");
-  assert.equal(updated.avatarUrl, "https://example.com/avatar.png");
   assert.equal(updated.lightPrimaryColor, "#123ABC");
 });
 

package/test/workspaceSettingsResource.test.js

@@ -46,7 +46,6 @@ function parseBody(operation, payload = {}) {
 
 test("workspace settings patch body normalizes valid payload before validation", () => {
   const parsed = parseBody(workspaceSettingsResource.operations.patch, {
-    avatarUrl: "https://example.com/avatar.png",
     lightPrimaryColor: "#0f6b54",
     lightSecondaryColor: "#0b4d3c",
     lightSurfaceColor: "#eef5f3",
@@ -61,7 +60,6 @@ test("workspace settings patch body normalizes valid payload before validation",
   assert.equal(parsed.ok, true);
   assert.deepEqual(parsed.fieldErrors, {});
   assert.deepEqual(parsed.value, {
-    avatarUrl: "https://example.com/avatar.png",
     lightPrimaryColor: "#0F6B54",
     lightSecondaryColor: "#0B4D3C",
     lightSurfaceColor: "#EEF5F3",
@@ -74,16 +72,14 @@ test("workspace settings patch body normalizes valid payload before validation",
   });
 });
 
-test("workspace settings patch body validates avatar URL protocol", () => {
+test("workspace settings patch body ignores unknown fields after normalization", () => {
   const parsed = parseBody(workspaceSettingsResource.operations.patch, {
-    avatarUrl: "ftp://example.com/avatar.png"
+    avatarUrl: "https://example.com/avatar.png"
   });
 
-  assert.equal(parsed.ok, false);
-  assert.equal(
-    parsed.fieldErrors.avatarUrl,
-    "Workspace avatar URL must be a valid absolute URL (http:// or https://)."
-  );
+  assert.equal(parsed.ok, true);
+  assert.deepEqual(parsed.fieldErrors, {});
+  assert.deepEqual(parsed.value, {});
 });
 
 test("workspace settings create body requires full-write fields", () => {
@@ -112,7 +108,6 @@ test("workspace settings output normalizes raw service payloads", () => {
       ownerUserId: "9"
     },
     settings: {
-      avatarUrl: "  https://example.com/avatar.png  ",
       lightPrimaryColor: "#0f6b54",
       invitesEnabled: false
     },
@@ -126,7 +121,6 @@ test("workspace settings output normalizes raw service payloads", () => {
       ownerUserId: 9
     },
     settings: {
-      avatarUrl: "https://example.com/avatar.png",
       lightPrimaryColor: "#0F6B54",
       lightSecondaryColor: expectedTheme.light.secondaryColor,
       lightSurfaceColor: expectedTheme.light.surfaceColor,

package/test/workspaceSettingsService.test.js

@@ -26,11 +26,9 @@ function createFixture({ workspaceInvitationsEnabled = true } = {}) {
       slug: "tonymobily3",
       name: "TonyMobily3",
       ownerUserId: 9,
-      avatarUrl: "",
       color: defaultTheme.light.color
     },
     settings: {
-      avatarUrl: "",
       lightPrimaryColor: defaultTheme.light.color,
       lightSecondaryColor: defaultTheme.light.secondaryColor,
       lightSurfaceColor: defaultTheme.light.surfaceColor,
@@ -74,7 +72,6 @@ test("workspaceSettingsService.getWorkspaceSettings returns the stored invitesEn
   );
 
   assert.deepEqual(response.settings, {
-    avatarUrl: "",
     lightPrimaryColor: "#0F6B54",
     lightSecondaryColor: "#48A9A6",
     lightSurfaceColor: "#FFFFFF",
@@ -104,7 +101,6 @@ test("workspaceSettingsService.updateWorkspaceSettings writes editable fields th
     invitesEnabled: false
   });
   assert.deepEqual(response.settings, {
-    avatarUrl: "",
     lightPrimaryColor: "#0F6B54",
     lightSecondaryColor: "#48A9A6",
     lightSurfaceColor: "#FFFFFF",
@@ -130,7 +126,6 @@ test("workspaceSettingsService disables invite settings in output when app polic
   );
 
   assert.deepEqual(response.settings, {
-    avatarUrl: "",
     lightPrimaryColor: "#0F6B54",
     lightSecondaryColor: "#48A9A6",
     lightSurfaceColor: "#FFFFFF",