@shipfox/api-logs 10.2.0 → 11.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-logs",
   "license": "MIT",
-  "version": "10.2.0",
+  "version": "11.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -25,7 +25,7 @@
     "@temporalio/workflow": "1.18.1",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@shipfox/api-auth-context": "10.2.0",
+    "@shipfox/api-auth-context": "11.0.0",
     "@shipfox/api-logs-dto": "10.2.0",
     "@shipfox/api-workflows-dto": "10.0.0",
     "@shipfox/workflow-document": "2.1.3",
@@ -34,9 +34,9 @@
     "@shipfox/node-error-monitoring": "0.3.0",
     "@shipfox/node-fastify": "0.4.0",
     "@shipfox/node-module": "1.0.4",
+    "@shipfox/node-opentelemetry": "0.6.3",
     "@shipfox/node-outbox": "0.2.6",
     "@shipfox/node-postgres": "0.4.4",
-    "@shipfox/node-opentelemetry": "0.6.3",
     "@shipfox/node-temporal": "0.4.4"
   },
   "imports": {

package/src/presentation/routes/read-logs.test.ts

@@ -50,13 +50,15 @@ const fakeUserAuth: AuthMethod = {
       throw new ClientError('Invalid user token', 'unauthorized', {status: 401});
     }
     const header = request.headers['x-test-workspace'];
-    const workspaceId = Array.isArray(header) ? header[0] : header;
+    const value = Array.isArray(header) ? header[0] : header;
+    const [workspaceId, status] = value?.split('|') ?? [];
+    const workspaceStatus = status === 'suspended' || status === 'deleted' ? status : 'active';
     setUserContext(
       request,
       buildUserContext({
         userId: 'user-1',
         email: 'user@example.com',
-        memberships: workspaceId ? [{workspaceId, role: 'admin'}] : [],
+        memberships: workspaceId ? [{workspaceId, role: 'admin', workspaceStatus}] : [],
       }),
     );
     return Promise.resolve();
@@ -174,11 +176,11 @@ describe('GET /steps/:stepId/attempts/:attempt/logs', () => {
     return `/steps/${stepId}/attempts/${attempt}/logs?cursor=${cursor}`;
   }
 
-  function authedGet(stream: AttemptStream, cursor: number, workspaceId = stream.workspaceId) {
+  function authedGet(stream: AttemptStream, cursor: number, workspaceClaim = stream.workspaceId) {
     return app.inject({
       method: 'GET',
       url: readUrl(stream.stepId, stream.attempt, cursor),
-      headers: {authorization: 'Bearer user', 'x-test-workspace': workspaceId},
+      headers: {authorization: 'Bearer user', 'x-test-workspace': workspaceClaim},
     });
   }
 
@@ -288,6 +290,18 @@ describe('GET /steps/:stepId/attempts/:attempt/logs', () => {
     expect(res.json().code).toBe('not-found');
   });
 
+  it('returns workspace-suspended for a suspended membership claim', async () => {
+    const stream = await arrangeStream({
+      workspaceId: crypto.randomUUID(),
+      chunks: [ndjsonBody(outputLine('secret\n'))],
+    });
+
+    const res = await authedGet(stream, 0, `${stream.workspaceId}|suspended`);
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   it('serves an open stream inline with the next cursor and stream state', async () => {
     const workspaceId = crypto.randomUUID();
     const lineA = outputLine('alpha\n');

package/src/presentation/routes/read-logs.ts

@@ -1,4 +1,4 @@
-import {requireUserContext} from '@shipfox/api-auth-context';
+import {requireWorkspaceResourceAccess} from '@shipfox/api-auth-context';
 import {readLogsQuerySchema, readLogsResponseSchema} from '@shipfox/api-logs-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -22,16 +22,20 @@ export const readLogsRoute = defineRoute({
     },
   },
   handler: async (request) => {
-    const user = requireUserContext(request);
     const {stepId, attempt} = request.params;
     const {cursor} = request.query;
 
     const stream = await getStreamByStepAttempt({stepId, attempt});
-    // 404 covers both "no such stream" and "not your workspace" so the endpoint never
-    // leaks the existence of another workspace's step.
-    if (!stream || !user.canAccess(stream.workspaceId)) {
+    // Missing streams and memberships remain 404 so the endpoint never leaks another
+    // workspace's step; lifecycle claims propagate their stable access errors.
+    if (!stream) {
       throw new ClientError('Logs not found', 'not-found', {status: 404});
     }
+    requireWorkspaceResourceAccess({
+      request,
+      workspaceId: stream.workspaceId,
+      notFoundError: new ClientError('Logs not found', 'not-found', {status: 404}),
+    });
 
     return toReadLogsDto(await buildLogReadResult(stream, cursor));
   },