@plandesk/api 1.0.0-beta.8 → 1.0.0

package/dist/services/projects.js

@@ -1,7 +1,10 @@
-import { withTransaction, clearDocumentParentRefsByProject, clearFolderParentRefsByProject, createDocument, createEdge, createProject as dbCreateProject, createTask, deleteAgentRun, deleteAgentRunEventsByRunId, deleteCommentsByProjectId, deleteDocumentsByProjectId, deleteFoldersByProjectId, deleteNotesByProjectId, deleteEdgesByProjectId, deleteGoalsByProjectId, deleteShareSubmissionsByProjectId, deleteSharesByProjectId, deleteTagsByProjectId, deleteSyncRemoteByProjectId, deleteSyncStateByProjectId, deleteProject as dbDeleteProject, deleteTasksByProjectId, getOrCreateDefaultGoal, getProject as dbGetProject, InvalidTaskStatusError, isTaskStatus, listAgentRuns, listProjects as dbListProjects, listTasks, updateProject as dbUpdateProject, } from '@plandesk/db';
+import { withTransaction, clearDocumentParentRefsByProject, clearFolderParentRefsByProject, createDocument, createEdge, createProject as dbCreateProject, createTask, deleteAgentRun, deleteAgentRunEventsByRunId, deleteCommentsByProjectId, deleteDocumentsByProjectId, deleteFoldersByProjectId, deleteNotesByProjectId, deleteEdgesByProjectId, deleteGoalsByProjectId, deleteShareSubmissionsByProjectId, deleteSharesByProjectId, deleteTagsByProjectId, deleteSyncRemoteByProjectId, deleteSyncStateByProjectId, deleteProject as dbDeleteProject, deleteTasksByProjectId, getOrCreateDefaultGoal, getProject as dbGetProject, getProjectInOrg, InvalidTaskStatusError, isTaskStatus, listAgentRuns, listProjects as dbListProjects, listTasks, updateProject as dbUpdateProject, } from '@plandesk/db';
+import { ensureDefaultTeamForOrg, getTeamInOrg } from '../identity.js';
 import { emptyTaskStatusSummary, serializeDocument, serializeEdge, serializeProject, serializeProjectDetail, serializeTask, } from '../serialize.js';
+import { tryGetAuthContext } from '../auth-context.js';
 import { assertPermission, resolveOrgId } from './org-scope.js';
-import { assertProjectInOrg, ProjectNotInOrgError } from './scope.js';
+import { PermissionDeniedError } from '../permissions.js';
+import { assertProjectInOrg, ProjectNotInOrgError, WorkspaceNotFoundError, } from './scope.js';
 export class InvalidScaffoldError extends Error {
     constructor(message) {
         super(message);
@@ -42,6 +45,52 @@ function validateScaffoldInput(input) {
         }
     }
 }
+/**
+ * Resolve the workspace a new project lands in. A workspace/project-scoped
+ * agent key is forced into its own workspace (no explicit target, or a target
+ * that must equal its scope); an org-wide caller may pass a workspace
+ * (validated in-org) or fall back to the org default. Shared by create() and
+ * scaffoldFromPlan() so the two new-project paths cannot drift again.
+ */
+async function resolveWorkspaceForNewProject(deps, client, requestedWorkspaceId) {
+    const orgId = resolveOrgId(deps);
+    const ctx = tryGetAuthContext();
+    let callerWorkspaceId;
+    if (ctx?.kind === 'apikey') {
+        if (ctx.workspaceId !== undefined) {
+            callerWorkspaceId = ctx.workspaceId;
+        }
+        else if (ctx.projectId !== undefined) {
+            callerWorkspaceId = (await getProjectInOrg(client, ctx.projectId, orgId))?.workspaceId;
+        }
+    }
+    let workspaceId;
+    if (requestedWorkspaceId !== undefined && requestedWorkspaceId.length > 0) {
+        if (deps.auth === undefined) {
+            throw new WorkspaceNotFoundError(requestedWorkspaceId);
+        }
+        const team = await getTeamInOrg(deps.auth, requestedWorkspaceId, orgId);
+        if (team === undefined) {
+            throw new WorkspaceNotFoundError(requestedWorkspaceId);
+        }
+        workspaceId = team.id;
+    }
+    else if (callerWorkspaceId !== undefined) {
+        // Scoped key without an explicit target: force its own workspace so it
+        // can never land a project in the org-default (or any other) workspace.
+        workspaceId = callerWorkspaceId;
+    }
+    else {
+        workspaceId = deps.auth ? await ensureDefaultTeamForOrg(deps.auth, orgId) : undefined;
+    }
+    if (workspaceId === undefined) {
+        throw new Error('cannot resolve workspace for project');
+    }
+    if (callerWorkspaceId !== undefined && workspaceId !== callerWorkspaceId) {
+        throw new WorkspaceNotFoundError(workspaceId);
+    }
+    return workspaceId;
+}
 function summarizeTasks(tasks) {
     const summary = emptyTaskStatusSummary();
     for (const task of tasks) {
@@ -55,12 +104,29 @@ export function createProjectService(deps) {
         async create(input) {
             assertPermission(deps, 'project', 'create');
             const orgId = resolveOrgId(deps);
-            const project = await dbCreateProject(db, { ...input, orgId });
+            const workspaceId = await resolveWorkspaceForNewProject(deps, db, input.workspaceId);
+            const project = await dbCreateProject(db, { ...input, orgId, workspaceId });
             return serializeProject(project);
         },
         async list(pagination = {}) {
             const orgId = resolveOrgId(deps);
-            return (await dbListProjects(db, orgId, pagination)).map(serializeProject);
+            const ctx = tryGetAuthContext();
+            // RFC§12: a session member sees only projects in their workspaces.
+            // Owner/admin and other contexts keep their existing scoping below.
+            if (ctx?.kind === 'session' && ctx.role === 'member') {
+                return (await dbListProjects(db, orgId, { ...pagination, workspaceIds: ctx.memberWorkspaceIds })).map(serializeProject);
+            }
+            // A project-scoped agent key sees only its own project (a key with
+            // ctx.projectId and no workspaceId would otherwise enumerate every org
+            // project). getProjectInOrg also enforces org membership.
+            if (ctx?.kind === 'apikey' && ctx.projectId !== undefined) {
+                const project = await getProjectInOrg(db, ctx.projectId, orgId);
+                return project === undefined ? [] : [serializeProject(project)];
+            }
+            const workspaceId = (ctx?.kind === 'apikey' || ctx?.kind === 'loopback') && ctx.workspaceId !== undefined
+                ? ctx.workspaceId
+                : undefined;
+            return (await dbListProjects(db, orgId, { ...pagination, workspaceId })).map(serializeProject);
         },
         async get(id) {
             const orgId = resolveOrgId(deps);
@@ -94,6 +160,47 @@ export function createProjectService(deps) {
             }
             return serializeProject(project);
         },
+        /**
+         * Move a project to another workspace (team) in the caller's org.
+         *
+         * Owner-gated: a workspace/project-scoped agent key must not move projects
+         * (it would drag a project out of its scope), so scoped callers are rejected
+         * before any existence check. Requires project:create authority (owner/admin).
+         * The target team must exist in the caller's org; otherwise 404.
+         */
+        async moveProjectToWorkspace(id, workspaceId) {
+            const ctx = tryGetAuthContext();
+            const scoped = ctx !== undefined &&
+                ((ctx.kind === 'apikey' &&
+                    (ctx.workspaceId !== undefined || ctx.projectId !== undefined)) ||
+                    (ctx.kind === 'loopback' && ctx.workspaceId !== undefined));
+            if (scoped) {
+                throw new PermissionDeniedError('project', 'create');
+            }
+            assertPermission(deps, 'project', 'create');
+            const orgId = resolveOrgId(deps);
+            try {
+                await assertProjectInOrg(db, id, orgId);
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
+            if (deps.auth === undefined) {
+                throw new WorkspaceNotFoundError(workspaceId);
+            }
+            const team = await getTeamInOrg(deps.auth, workspaceId, orgId);
+            if (team === undefined) {
+                throw new WorkspaceNotFoundError(workspaceId);
+            }
+            const project = await dbUpdateProject(db, id, { workspaceId: team.id });
+            if (!project) {
+                return undefined;
+            }
+            return serializeProject(project);
+        },
         async delete(id) {
             assertPermission(deps, 'project', 'delete');
             const orgId = resolveOrgId(deps);
@@ -166,10 +273,12 @@ export function createProjectService(deps) {
                     if (input.name === undefined || input.name.trim() === '') {
                         throw new InvalidScaffoldError('name is required to create a new project (or pass projectId to add to an existing one)');
                     }
+                    const workspaceId = await resolveWorkspaceForNewProject(deps, tx, input.workspaceId);
                     const project = await dbCreateProject(tx, {
                         name: input.name,
                         description: input.description,
                         orgId,
+                        workspaceId,
                     });
                     projectId = project.id;
                 }

package/dist/services/scope.d.ts

@@ -3,6 +3,10 @@ import { type DbClient, type Project } from '@plandesk/db';
 export declare class ProjectNotInOrgError extends Error {
     constructor(projectId: string);
 }
+/** Thrown when a target workspace (team) is missing or outside the caller's org. Maps to HTTP 404. */
+export declare class WorkspaceNotFoundError extends Error {
+    constructor(workspaceId: string);
+}
 /**
  * Fail-closed tenant boundary: project must exist and belong to orgId.
  * Returns 404-shaped error (not 403) so existence is not leaked across orgs.

package/dist/services/scope.js

@@ -7,6 +7,13 @@ export class ProjectNotInOrgError extends Error {
         this.name = 'ProjectNotInOrgError';
     }
 }
+/** Thrown when a target workspace (team) is missing or outside the caller's org. Maps to HTTP 404. */
+export class WorkspaceNotFoundError extends Error {
+    constructor(workspaceId) {
+        super(`Workspace not found: ${workspaceId}`);
+        this.name = 'WorkspaceNotFoundError';
+    }
+}
 /**
  * Fail-closed tenant boundary: project must exist and belong to orgId.
  * Returns 404-shaped error (not 403) so existence is not leaked across orgs.
@@ -24,6 +31,21 @@ export async function assertProjectInOrg(db, projectId, orgId) {
         ctx.projectId !== projectId) {
         throw new ProjectNotInOrgError(projectId);
     }
+    if (ctx !== undefined &&
+        (ctx.kind === 'apikey' || ctx.kind === 'loopback') &&
+        ctx.workspaceId !== undefined &&
+        project.workspaceId !== ctx.workspaceId) {
+        throw new ProjectNotInOrgError(projectId);
+    }
+    // RFC§12: a session member may reach only projects in workspaces they belong
+    // to (a teamMember row in the active org). Owner/admin manage the org and
+    // bypass this gate. Same 404 no-leak shape as the cross-workspace guard.
+    if (ctx !== undefined &&
+        ctx.kind === 'session' &&
+        ctx.role === 'member' &&
+        !ctx.memberWorkspaceIds.includes(project.workspaceId)) {
+        throw new ProjectNotInOrgError(projectId);
+    }
     return project;
 }
 //# sourceMappingURL=scope.js.map

package/dist/services/share.d.ts

@@ -1,15 +1,19 @@
 import { type Db, type Share, type ShareMode, type SharePermissions } from '@plandesk/db';
-import { type ClientView, type SharePolicy } from '../projection.js';
+import type { BetterAuthInstance } from '../better-auth.js';
+import { type ClientView, type SharePolicy, type WorkspaceClientView } from '../projection.js';
 import { type OrgScopedDeps } from './org-scope.js';
 export declare class InvalidShareError extends Error {
     constructor(message: string);
 }
 export type ShareServiceDeps = OrgScopedDeps & {
     db: Db;
+    /** better-auth instance for workspace (team) validation on workspace shares. */
+    auth?: BetterAuthInstance;
 };
 export type SerializedShare = {
     id: string;
-    project_id: string;
+    project_id: string | null;
+    workspace_id: string | null;
     audience_name: string;
     mode: ShareMode;
     permissions: SharePermissions;
@@ -27,6 +31,19 @@ export type CreateShareInput = {
     invitedEmails?: string[];
     expiresAt?: Date;
 };
+export type CreateWorkspaceShareInput = {
+    audienceName: string;
+    mode: ShareMode;
+    permissions?: SharePermissions;
+    policy?: SharePolicy;
+    invitedEmails?: string[];
+    expiresAt?: Date;
+};
+export type WorkspaceShareResult = {
+    share: SerializedShare;
+    token: string;
+    url: string;
+};
 export type ShareResourceRef = {
     kind: 'task';
     id: string;
@@ -93,6 +110,8 @@ export type SubmitIssueInput = {
     body?: string;
     severity?: string;
     task_ref?: string;
+    /** Target project for a workspace share (ignored for project shares). */
+    project_id?: string;
 };
 export type SubmitIssueResult = {
     status: 'ok';
@@ -103,6 +122,8 @@ export type SubmitIssueResult = {
     status: 'submit_not_permitted';
 } | {
     status: 'title_required';
+} | {
+    status: 'project_required';
 } | {
     status: 'rate_limited';
 };
@@ -117,6 +138,7 @@ export declare function createShareService(deps: ShareServiceDeps): {
         share: SerializedShare;
         token: string;
     } | undefined>;
+    createWorkspaceShare(workspaceId: string, input: CreateWorkspaceShareInput, origin: string): Promise<WorkspaceShareResult | undefined>;
     listShares(projectId: string): Promise<SerializedShare[] | undefined>;
     revokeShare(id: string): Promise<boolean>;
     buildClientView(projectId: string, shareId: string): Promise<ClientView | undefined>;
@@ -124,7 +146,7 @@ export declare function createShareService(deps: ShareServiceDeps): {
     getResourceMarkdown(token: string, origin: string): Promise<ResourceMarkdownResult>;
     getShareMeta(token: string): Promise<ShareMetaResult>;
     joinShare(token: string, input: JoinShareInput): Promise<JoinShareResult>;
-    getClientView(token: string): Promise<ClientView | undefined>;
+    getClientView(token: string): Promise<ClientView | WorkspaceClientView | undefined>;
     submitIssue(token: string, input: SubmitIssueInput): Promise<SubmitIssueResult>;
     listMySubmissions(token: string): Promise<ListMySubmissionsResult>;
 };

package/dist/services/share.js

@@ -1,6 +1,7 @@
-import { countRecentSubmissionsByParticipant, createGuestSession, createGuestSubmission, createShare as dbCreateShare, getDocument, getGuestSessionById, getProject, getShare as dbGetShare, getShareByTokenHashRaw, getTask, hashShareToken, listDocuments, listShares as dbListShares, listSubmissionsByShareAndParticipant, parseSharePermissions, parseSharePolicy, revokeShare as dbRevokeShare, } from '@plandesk/db';
-import { getAuthContext } from '../auth-context.js';
-import { buildClientView } from '../projection.js';
+import { countRecentSubmissionsByParticipant, createGuestSession, createGuestSubmission, createShare as dbCreateShare, getDocument, getGuestSessionById, getProject, getProjectInOrg, getShare as dbGetShare, getShareByTokenHashRaw, getTask, hashShareToken, listDocuments, listShares as dbListShares, listSubmissionsByShareAndParticipant, parseSharePermissions, parseSharePolicy, revokeShare as dbRevokeShare, } from '@plandesk/db';
+import { getAuthContext, tryGetAuthContext } from '../auth-context.js';
+import { getTeamInOrg } from '../identity.js';
+import { buildClientView, buildWorkspaceClientView, } from '../projection.js';
 import { assertPermission, resolveOrgId } from './org-scope.js';
 import { assertProjectInOrg, ProjectNotInOrgError } from './scope.js';
 const GUEST_SUBMIT_RATE_LIMIT = 10;
@@ -17,6 +18,7 @@ export function serializeShare(share) {
     return {
         id: share.id,
         project_id: share.projectId,
+        workspace_id: share.workspaceId,
         audience_name: share.audienceName,
         mode: share.mode,
         permissions: parseSharePermissions(share),
@@ -55,6 +57,18 @@ function isShareLive(share, now = new Date()) {
     }
     return true;
 }
+// Does this share belong to this guest's scope? Share id must match, and the
+// scoping column (projectId for a project share, workspaceId for a workspace
+// share) must match the guest context. Fail-closed on any mismatch.
+function shareMatchesGuest(share, auth) {
+    if (share.id !== auth.shareId) {
+        return false;
+    }
+    if (share.workspaceId !== null) {
+        return auth.workspaceId === share.workspaceId;
+    }
+    return share.projectId === auth.projectId;
+}
 // The rich-text editor stores document/comment bodies as HTML; this is a
 // deliberately small converter for that constrained, known markup (not
 // arbitrary HTML) rather than pulling in a DOM/HTML-parsing dependency.
@@ -189,6 +203,57 @@ export function createShareService(deps) {
             });
             return { share: serializeShare(share), token };
         },
+        // Share an entire workspace: the portal then shows every project in it.
+        // Validates the workspace (team) belongs to the caller's org via getTeamInOrg;
+        // fail-closed (undefined → 404) when the workspace is unknown or cross-org,
+        // or when better-auth is not configured (workspace shares need team lookup).
+        async createWorkspaceShare(workspaceId, input, origin) {
+            assertPermission(deps, 'document', 'create');
+            if (deps.auth === undefined) {
+                return undefined;
+            }
+            // A workspace-scoped key may only share its own workspace; a different
+            // workspace id is a 404 even when it lives in the same org.
+            const ctx = tryGetAuthContext();
+            // A project-scoped key cannot publish an entire workspace — its scope is
+            // a single project, so deny before any existence check (uniform 404).
+            if (ctx?.kind === 'apikey' && ctx.projectId !== undefined) {
+                return undefined;
+            }
+            const scopedWorkspaceId = ctx?.kind === 'apikey' || ctx?.kind === 'loopback' ? ctx.workspaceId : undefined;
+            if (scopedWorkspaceId !== undefined && scopedWorkspaceId !== workspaceId) {
+                return undefined;
+            }
+            // A session member may only publish a workspace they belong to (a
+            // teamMember row in this org); a workspace outside that set is a 404
+            // even within the same org. Owner/admin bypass by role.
+            if (ctx?.kind === 'session' &&
+                ctx.role === 'member' &&
+                !ctx.memberWorkspaceIds.includes(workspaceId)) {
+                return undefined;
+            }
+            const team = await getTeamInOrg(deps.auth, workspaceId, resolveOrgId(deps));
+            if (team === undefined) {
+                return undefined;
+            }
+            if (input.audienceName.trim() === '') {
+                throw new InvalidShareError('Share audience name must not be empty');
+            }
+            const { share, token } = await dbCreateShare(db, {
+                workspaceId: team.id,
+                audienceName: input.audienceName,
+                mode: input.mode,
+                permissions: input.permissions ?? DEFAULT_PERMISSIONS,
+                policy: input.policy ?? DEFAULT_POLICY,
+                invitedEmails: input.invitedEmails,
+                expiresAt: input.expiresAt,
+            });
+            return {
+                share: serializeShare(share),
+                token,
+                url: `${origin}/p/${token}`,
+            };
+        },
         async listShares(projectId) {
             try {
                 await assertProjectInOrg(db, projectId, resolveOrgId(deps));
@@ -203,6 +268,31 @@ export function createShareService(deps) {
         },
         async revokeShare(id) {
             assertPermission(deps, 'document', 'delete');
+            const existing = await dbGetShare(db, id);
+            if (!existing) {
+                return false;
+            }
+            // Workspace share: validate the workspace is in the caller's org (or
+            // fail-closed when better-auth is unavailable to confirm it).
+            if (existing.workspaceId !== null) {
+                if (deps.auth === undefined) {
+                    return false;
+                }
+                const team = await getTeamInOrg(deps.auth, existing.workspaceId, resolveOrgId(deps));
+                if (team === undefined) {
+                    return false;
+                }
+                return (await dbRevokeShare(db, id)) !== undefined;
+            }
+            try {
+                await assertProjectInOrg(db, existing.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return false;
+                }
+                throw error;
+            }
             return (await dbRevokeShare(db, id)) !== undefined;
         },
         async buildClientView(projectId, shareId) {
@@ -242,6 +332,17 @@ export function createShareService(deps) {
                 policy = { tasks: [], documentIds: [document.id], fields: {} };
                 audienceName = `Agent link: ${document.title}`;
             }
+            // Cross-org chokepoint: the resolved resource's project must be in the
+            // caller's org (an org-B key sharing an org-A resource → 404, no leak).
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             const expiresAt = input.expiresAt === null
                 ? null
                 : (input.expiresAt ?? new Date(Date.now() + RESOURCE_SHARE_DEFAULT_TTL_MS));
@@ -269,6 +370,17 @@ export function createShareService(deps) {
             if (share.revokedAt !== null || (share.expiresAt !== null && share.expiresAt <= now)) {
                 return { status: 'gone' };
             }
+            // The unauthenticated markdown route is an agent-context feed: only
+            // public shares are served here. invite-only shares require a joined
+            // guest session (the /view route); serving them unauthenticated would
+            // bypass the join gate, so collapse to the same not_found shape.
+            if (share.mode !== 'public') {
+                return { status: 'not_found' };
+            }
+            // Workspace shares have no single-project agent markdown link.
+            if (share.projectId === null) {
+                return { status: 'not_found' };
+            }
             const view = await buildClientView(db, share.projectId, share);
             if (!view) {
                 return { status: 'not_found' };
@@ -299,7 +411,11 @@ export function createShareService(deps) {
             }
             const { guest, token: sessionToken } = await createGuestSession(db, {
                 shareId: share.id,
-                projectId: share.projectId,
+                // Bind the guest to the share's scope: a workspace share binds by
+                // workspaceId (projectId null); a project share binds by projectId.
+                ...(share.workspaceId !== null
+                    ? { workspaceId: share.workspaceId }
+                    : { projectId: share.projectId }),
                 name,
                 email: input.email?.trim() || undefined,
             });
@@ -316,7 +432,8 @@ export function createShareService(deps) {
         // Guest-gated portal view: middleware has already verified the guest session
         // matches this share token. The view is COMPUTED live (not a snapshot). Every
         // failure shape collapses to undefined → uniform 404. Guest context has no
-        // orgId; buildClientView reads only this one project.
+        // orgId; the projection reads only the share's scope (one project OR one
+        // workspace's project set).
         async getClientView(token) {
             const auth = getAuthContext();
             if (auth.kind !== 'guest') {
@@ -326,7 +443,16 @@ export function createShareService(deps) {
             if (!share || !isShareLive(share)) {
                 return undefined;
             }
-            if (share.id !== auth.shareId || share.projectId !== auth.projectId) {
+            if (share.id !== auth.shareId) {
+                return undefined;
+            }
+            if (share.workspaceId !== null) {
+                if (auth.workspaceId !== share.workspaceId) {
+                    return undefined;
+                }
+                return buildWorkspaceClientView(db, share.workspaceId, share);
+            }
+            if (share.projectId !== auth.projectId) {
                 return undefined;
             }
             return buildClientView(db, share.projectId, share);
@@ -342,9 +468,34 @@ export function createShareService(deps) {
             if (!share || !isShareLive(share)) {
                 return { status: 'unauthorized' };
             }
-            if (share.id !== auth.shareId || share.projectId !== auth.projectId) {
+            if (share.id !== auth.shareId) {
                 return { status: 'unauthorized' };
             }
+            // Resolve the target project this submission lands against, and enforce
+            // the guest's scope. A project share is bound to share.projectId; a
+            // workspace share requires an explicit project_id AND that the project
+            // belongs to the shared workspace (fail-closed otherwise).
+            let targetProjectId;
+            if (share.workspaceId !== null) {
+                if (auth.workspaceId !== share.workspaceId) {
+                    return { status: 'unauthorized' };
+                }
+                const requestedProjectId = input.project_id?.trim();
+                if (requestedProjectId === undefined || requestedProjectId === '') {
+                    return { status: 'project_required' };
+                }
+                const project = await getProject(db, requestedProjectId);
+                if (project === undefined || project.workspaceId !== share.workspaceId) {
+                    return { status: 'unauthorized' };
+                }
+                targetProjectId = project.id;
+            }
+            else {
+                if (share.projectId !== auth.projectId) {
+                    return { status: 'unauthorized' };
+                }
+                targetProjectId = share.projectId;
+            }
             const permissions = parseSharePermissions(share);
             if (permissions.submit !== true) {
                 return { status: 'submit_not_permitted' };
@@ -369,7 +520,7 @@ export function createShareService(deps) {
             const severity = input.severity?.trim() === '' ? null : (input.severity?.trim() ?? null);
             const taskRef = input.task_ref?.trim() === '' ? null : (input.task_ref?.trim() ?? null);
             const row = await createGuestSubmission(db, {
-                projectId: share.projectId,
+                projectId: targetProjectId,
                 hostedShareId: share.id,
                 participantName: guest.name,
                 title,
@@ -397,7 +548,7 @@ export function createShareService(deps) {
             if (!share || !isShareLive(share)) {
                 return { status: 'unauthorized' };
             }
-            if (share.id !== auth.shareId || share.projectId !== auth.projectId) {
+            if (!shareMatchesGuest(share, auth)) {
                 return { status: 'unauthorized' };
             }
             const guest = await getGuestSessionById(db, auth.guestSessionId);

package/dist/services/sync.d.ts

@@ -41,7 +41,7 @@ export declare function createSyncService(deps: SyncServiceDeps): {
     pull(projectId: string, remote: SyncRemote): Promise<{
         pulled: number;
     }>;
-    listTriage(projectId: string, status?: ShareSubmissionStatus): Promise<SerializedSubmission[]>;
+    listTriage(projectId: string, status?: ShareSubmissionStatus): Promise<SerializedSubmission[] | undefined>;
     getSubmission(submissionId: string): Promise<SerializedSubmission | undefined>;
     setRemote(projectId: string, remote: SyncRemote): Promise<void>;
     getRemote(projectId: string): Promise<SyncRemote | undefined>;

package/dist/services/sync.js

@@ -1,5 +1,6 @@
 import { getPullCursor, getSubmission as dbGetSubmission, getSyncRemote, listSubmissions, setPullCursor, setSubmissionStatus, setSyncRemote, upsertSubmission, } from '@plandesk/db';
-import { assertPermission } from './org-scope.js';
+import { assertPermission, resolveOrgId } from './org-scope.js';
+import { assertProjectInOrg, ProjectNotInOrgError } from './scope.js';
 export class SyncUnavailableError extends Error {
     constructor(message = 'sync server unavailable') {
         super(message);
@@ -80,6 +81,18 @@ export function createSyncService(deps) {
     return {
         async pull(projectId, remote) {
             assertPermission(deps, 'task', 'update');
+            // Cross-scope chokepoint: a workspace-A key must not pull a remote into
+            // (or read state from) a project outside its scope. Same 404 no-leak
+            // shape as the rest of the service: out-of-scope → no rows pulled.
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return { pulled: 0 };
+                }
+                throw error;
+            }
             const cursor = await getPullCursor(db, projectId);
             const base = remote.serverUrl.replace(/\/$/, '');
             const url = new URL(`${base}/api/sync/v1/projects/${encodeURIComponent(remote.globalProjectId)}/submissions`);
@@ -134,6 +147,15 @@ export function createSyncService(deps) {
             return { pulled };
         },
         async listTriage(projectId, status) {
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             return (await listSubmissions(db, projectId, status)).map(serializeSubmission);
         },
         async getSubmission(submissionId) {
@@ -142,6 +164,15 @@ export function createSyncService(deps) {
         },
         async setRemote(projectId, remote) {
             assertPermission(deps, 'task', 'update');
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return;
+                }
+                throw error;
+            }
             await setSyncRemote(db, projectId, {
                 serverUrl: remote.serverUrl,
                 globalProjectId: remote.globalProjectId,
@@ -149,6 +180,15 @@ export function createSyncService(deps) {
             });
         },
         async getRemote(projectId) {
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             const row = await getSyncRemote(db, projectId);
             if (row === undefined) {
                 return undefined;
@@ -168,6 +208,17 @@ export function createSyncService(deps) {
             if (submission === undefined) {
                 throw new InvalidTriageError();
             }
+            // Workspace/org chokepoint: the submission's project must be in the
+            // caller's scope before any triage mutation (cross-workspace/org → 404).
+            try {
+                await assertProjectInOrg(db, submission.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    throw new InvalidTriageError();
+                }
+                throw error;
+            }
             if (submission.status !== 'pending') {
                 // Idempotent retry recovery: a prior triage may have committed the terminal
                 // status locally but failed to ack the remote (legacy remote briefly down),

package/dist/services/tags.js

@@ -56,6 +56,15 @@ export function createTagService(deps) {
             if (!existing) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, existing.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             let name;
             if (input.name !== undefined) {
                 name = normalizeTagName(input.name);
@@ -80,6 +89,15 @@ export function createTagService(deps) {
             if (!existing) {
                 return false;
             }
+            try {
+                await assertProjectInOrg(db, existing.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return false;
+                }
+                throw error;
+            }
             const deleted = await dbDeleteTag(db, id);
             if (!deleted) {
                 return false;