@shipfox/api-triggers 10.2.0 → 12.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-triggers",
   "license": "MIT",
-  "version": "10.2.0",
+  "version": "12.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -22,23 +22,23 @@
     "cron-parser": "^5.6.1",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@shipfox/api-definitions-dto": "10.0.0",
-    "@shipfox/api-auth-context": "10.2.0",
-    "@shipfox/api-integration-core-dto": "9.0.2",
-    "@shipfox/api-workflows-dto": "10.0.0",
+    "@shipfox/api-auth-context": "12.0.0",
+    "@shipfox/api-workflows-dto": "12.0.0",
+    "@shipfox/api-integration-core-dto": "12.0.0",
     "@shipfox/api-triggers-dto": "9.0.2",
     "@shipfox/config": "1.2.4",
-    "@shipfox/expression": "1.2.0",
-    "@shipfox/inter-module": "0.2.2",
+    "@shipfox/api-definitions-dto": "12.0.0",
+    "@shipfox/inter-module": "0.2.3",
+    "@shipfox/node-drizzle": "0.3.5",
+    "@shipfox/expression": "2.0.0",
     "@shipfox/node-error-monitoring": "0.3.0",
-    "@shipfox/node-fastify": "0.4.0",
-    "@shipfox/node-drizzle": "0.3.4",
-    "@shipfox/node-module": "1.0.4",
-    "@shipfox/node-postgres": "0.4.4",
+    "@shipfox/node-module": "1.0.5",
+    "@shipfox/node-fastify": "0.4.1",
     "@shipfox/node-opentelemetry": "0.6.3",
     "@shipfox/node-outbox": "0.2.6",
-    "@shipfox/workflow-document": "2.1.3",
-    "@shipfox/node-temporal": "0.4.4"
+    "@shipfox/node-temporal": "0.4.4",
+    "@shipfox/node-postgres": "0.5.0",
+    "@shipfox/workflow-document": "3.0.0"
   },
   "imports": {
     "#*": "./dist/*"

package/src/core/config.test.ts

@@ -1,3 +1,4 @@
+import * as expression from '@shipfox/expression';
 import {evaluateStoredFilter, evaluateTriggerFilter, readConfigInputs} from './config.js';
 import type {TriggerSubscription} from './entities/subscription.js';
 
@@ -89,6 +90,28 @@ describe('evaluateTriggerFilter', () => {
     expect(misses).toEqual({kind: 'filtered'});
   });
 
+  test('passes trigger filters through the field-specific context projection', () => {
+    const projectContext = vi.spyOn(expression, 'projectWorkflowPredicateContext');
+    const payload = {ref: 'refs/heads/main'};
+
+    try {
+      const result = evaluateTriggerFilter({
+        subscription: subscriptionWithConfig({filter: 'event.ref == "refs/heads/main"'}),
+        source: 'github',
+        event: 'push',
+        payload,
+      });
+
+      expect(result).toEqual({kind: 'matched'});
+      expect(projectContext).toHaveBeenCalledWith('trigger.filter', {
+        event: payload,
+        trigger: {source: 'github', event: 'push'},
+      });
+    } finally {
+      projectContext.mockRestore();
+    }
+  });
+
   test('returns filter-error when the stored filter cannot be parsed', () => {
     const subscription = subscriptionWithConfig({filter: 'event.ref =='});
 

package/src/core/config.ts

@@ -2,6 +2,7 @@ import {
   createWorkflowExpression,
   evaluateWorkflowPredicateFailClosed,
   InvalidWorkflowExpressionError,
+  projectWorkflowPredicateContext,
   type WorkflowExpression,
 } from '@shipfox/expression';
 import type {TriggerSubscription} from './entities/subscription.js';
@@ -70,10 +71,10 @@ export function evaluateTriggerFilter(
 ): TriggerFilterEvaluation {
   return evaluateStoredFilter({
     value: params.subscription.config.filter,
-    context: {
+    context: projectWorkflowPredicateContext('trigger.filter', {
       event: params.payload,
       trigger: {source: params.source, event: params.event},
-    },
+    }),
     invalidReason: 'Trigger subscription filter must be a non-empty string when set',
     evaluationFailedReason: 'Trigger filter evaluation failed',
   });

package/src/core/dispatch-integration-event.history-failure.test.ts

@@ -2,6 +2,7 @@ import {triggerSubscriptionFactory} from '#test/index.js';
 
 const runWorkflow = vi.fn();
 const deliverEventToListener = vi.fn();
+const resolveWorkflowRunTriggerReference = vi.fn();
 const insertReceivedEvent = vi.fn();
 
 vi.mock('#db/event-history.js', () => ({
@@ -24,6 +25,8 @@ const {dispatchIntegrationEvent} = await import('./dispatch-integration-event.js
 const workflows = {
   startRunFromTrigger: (...args: unknown[]) => runWorkflow(...args),
   deliverEventToJobListener: (...args: unknown[]) => deliverEventToListener(...args),
+  resolveWorkflowRunTriggerReference: (...args: unknown[]) =>
+    resolveWorkflowRunTriggerReference(...args),
   getStepLogContext: async () => ({harness: 'pi' as const}),
   getLeasedAgentToolContext: async () => ({
     workspaceId: crypto.randomUUID(),
@@ -35,6 +38,8 @@ describe('dispatchIntegrationEvent resilience to history-write failure', () => {
   beforeEach(() => {
     runWorkflow.mockReset();
     deliverEventToListener.mockReset();
+    resolveWorkflowRunTriggerReference.mockReset();
+    resolveWorkflowRunTriggerReference.mockResolvedValue(null);
     deliverEventToListener.mockResolvedValue({buffered: true, skipped: false});
     insertReceivedEvent.mockReset();
     insertReceivedEvent.mockRejectedValue(new Error('history db down'));

package/src/core/dispatch-integration-event.test.ts

@@ -8,12 +8,15 @@ import {jobListenerSubscriptionFactory, triggerSubscriptionFactory} from '#test/
 
 const runWorkflow = vi.fn();
 const deliverEventToListener = vi.fn();
+const resolveWorkflowRunTriggerReference = vi.fn();
 
 const {dispatchIntegrationEvent} = await import('./dispatch-integration-event.js');
 
 const workflows = {
   startRunFromTrigger: (...args: unknown[]) => runWorkflow(...args),
   deliverEventToJobListener: (...args: unknown[]) => deliverEventToListener(...args),
+  resolveWorkflowRunTriggerReference: (...args: unknown[]) =>
+    resolveWorkflowRunTriggerReference(...args),
   getStepLogContext: async () => ({harness: 'pi' as const}),
   getLeasedAgentToolContext: async () => ({
     workspaceId: crypto.randomUUID(),
@@ -84,8 +87,10 @@ describe('dispatchIntegrationEvent', () => {
   beforeEach(() => {
     runWorkflow.mockReset();
     deliverEventToListener.mockReset();
+    resolveWorkflowRunTriggerReference.mockReset();
     runWorkflow.mockResolvedValue({id: crypto.randomUUID(), name: 'Build and test'});
     deliverEventToListener.mockResolvedValue({buffered: true, skipped: false});
+    resolveWorkflowRunTriggerReference.mockResolvedValue(null);
   });
 
   test('fires the workflow for each matching workspace subscription, regardless of project', async () => {
@@ -114,6 +119,7 @@ describe('dispatchIntegrationEvent', () => {
 
   test('passes the source, event, deliveryId and raw payload through as the trigger payload', async () => {
     const workspaceId = crypto.randomUUID();
+    const connectionId = crypto.randomUUID();
     const deliveryId = crypto.randomUUID();
     const payload = {ref: 'refs/heads/feature', headCommitSha: 'deadbeef'};
     await triggerSubscriptionFactory.create({
@@ -123,10 +129,11 @@ describe('dispatchIntegrationEvent', () => {
       config: {},
     });
 
-    await dispatch({workspaceId, deliveryId, payload});
+    await dispatch({workspaceId, connectionId, deliveryId, payload});
 
     expect(runWorkflow).toHaveBeenCalledWith(
       expect.objectContaining({
+        triggerConnectionId: connectionId,
         triggerPayload: {
           provider: 'github',
           source: 'github',

package/src/core/dispatch-integration-event.ts

@@ -87,6 +87,7 @@ export async function dispatchIntegrationEvent(
         workspaceId: subscription.workspaceId,
         projectId: subscription.projectId,
         definitionId: subscription.workflowDefinitionId,
+        triggerConnectionId: params.connectionId,
         triggerPayload: {
           provider: params.provider,
           source: params.source,
@@ -116,6 +117,7 @@ export async function dispatchIntegrationEvent(
     history,
     eventRef: params.eventRef,
     workspaceId: params.workspaceId,
+    connectionId: params.connectionId,
     provider: params.provider,
     source: params.source,
     event: params.event,

package/src/core/route-event-to-job-listeners.test.ts

@@ -4,6 +4,7 @@ import {jobListenerSubscriptionFactory} from '#test/index.js';
 import type {TriggerHistoryRecorder} from './record-trigger-history.js';
 
 const deliverEventToListener = vi.fn();
+const resolveWorkflowRunTriggerReference = vi.fn();
 const findMatchingJobListenerSubscriptions = vi.fn();
 const listenerTriggered = vi.fn();
 const listenerFilterErrored = vi.fn();
@@ -33,11 +34,14 @@ const {routeEventToJobListeners} = await import('./route-event-to-job-listeners.
 
 const workflows = {
   deliverEventToJobListener: (...args: unknown[]) => deliverEventToListener(...args),
+  resolveWorkflowRunTriggerReference: (...args: unknown[]) =>
+    resolveWorkflowRunTriggerReference(...args),
 } as never;
 
 interface RouteOverrides {
   eventRef?: string;
   workspaceId?: string;
+  connectionId?: string;
   source?: string;
   event?: string;
   payload?: unknown;
@@ -49,6 +53,7 @@ function route(overrides: RouteOverrides = {}) {
     history: buildHistory(),
     eventRef: overrides.eventRef ?? crypto.randomUUID(),
     workspaceId: overrides.workspaceId ?? crypto.randomUUID(),
+    connectionId: overrides.connectionId ?? crypto.randomUUID(),
     provider: 'github',
     source: overrides.source ?? 'github',
     event: overrides.event ?? 'pull_request_review',
@@ -76,12 +81,14 @@ function buildHistory(): TriggerHistoryRecorder {
 describe('routeEventToJobListeners', () => {
   beforeEach(() => {
     deliverEventToListener.mockReset();
+    resolveWorkflowRunTriggerReference.mockReset();
     findMatchingJobListenerSubscriptions.mockReset();
     listenerTriggered.mockReset();
     listenerFilterErrored.mockReset();
     listenerDispatchErrored.mockReset();
     loggerWarn.mockReset();
     deliverEventToListener.mockResolvedValue({buffered: true, skipped: false});
+    resolveWorkflowRunTriggerReference.mockResolvedValue(null);
   });
 
   it('computes resolve as the effective disposition when on and until match one job', async () => {
@@ -121,6 +128,72 @@ describe('routeEventToJobListeners', () => {
     });
   });
 
+  it('passes the source connection to listener delivery', async () => {
+    const workspaceId = crypto.randomUUID();
+    const connectionId = crypto.randomUUID();
+    const jobId = crypto.randomUUID();
+    await jobListenerSubscriptionFactory.create({
+      workspaceId,
+      jobId,
+      kind: 'on',
+      matcherOrdinal: 0,
+      source: 'github',
+      event: 'pull_request_review',
+    });
+
+    await route({workspaceId, connectionId});
+
+    expect(deliverEventToListener).toHaveBeenCalledWith(
+      expect.objectContaining({jobId, triggerConnectionId: connectionId}),
+    );
+  });
+
+  it('resolves one trigger reference for all fire deliveries', async () => {
+    const workspaceId = crypto.randomUUID();
+    const connectionId = crypto.randomUUID();
+    const triggerReference = {
+      project: {id: crypto.randomUUID()},
+      repository: 'acme/api',
+      ref: 'refs/heads/main',
+      commit: 'a'.repeat(40),
+    };
+    for (const jobId of [crypto.randomUUID(), crypto.randomUUID()]) {
+      await jobListenerSubscriptionFactory.create({
+        workspaceId,
+        jobId,
+        kind: 'on',
+        matcherOrdinal: 0,
+        source: 'github',
+        event: 'pull_request_review',
+      });
+    }
+    resolveWorkflowRunTriggerReference.mockResolvedValue(triggerReference);
+
+    await route({workspaceId, connectionId});
+
+    expect(resolveWorkflowRunTriggerReference).toHaveBeenCalledTimes(1);
+    expect(resolveWorkflowRunTriggerReference).toHaveBeenCalledWith({
+      workspaceId,
+      triggerConnectionId: connectionId,
+      triggerPayload: {
+        provider: 'github',
+        source: 'github',
+        event: 'pull_request_review',
+        deliveryId: expect.any(String),
+        data: {action: 'submitted'},
+      },
+    });
+    expect(deliverEventToListener).toHaveBeenCalledTimes(2);
+    expect(deliverEventToListener).toHaveBeenNthCalledWith(
+      1,
+      expect.objectContaining({triggerReference}),
+    );
+    expect(deliverEventToListener).toHaveBeenNthCalledWith(
+      2,
+      expect.objectContaining({triggerReference}),
+    );
+  });
+
   it('does not deliver when no listener subscription matches', async () => {
     const workspaceId = crypto.randomUUID();
     await jobListenerSubscriptionFactory.create({
@@ -266,6 +339,32 @@ describe('routeEventToJobListeners', () => {
     expect(result).toMatchObject({engagedCount: 0, matchedJobCount: 0, acceptedJobCount: 0});
   });
 
+  it.each([
+    'on',
+    'until',
+  ] as const)('fails closed when a %s listener snapshot contains a foreign root', async (kind) => {
+    const workspaceId = crypto.randomUUID();
+    await jobListenerSubscriptionFactory.create({
+      workspaceId,
+      kind,
+      source: 'github',
+      event: 'pull_request_review',
+      config: {
+        filter: 'executions.size() > 0',
+        filter_snapshot: {executions: [{status: 'succeeded'}]},
+      },
+    });
+
+    const result = await route({workspaceId});
+
+    expect(deliverEventToListener).not.toHaveBeenCalled();
+    expect(listenerFilterErrored).toHaveBeenCalledWith(
+      expect.objectContaining({kind}),
+      'Listener filter evaluation failed',
+    );
+    expect(result).toMatchObject({engagedCount: 1, matchedJobCount: 0, acceptedJobCount: 0});
+  });
+
   it.each([
     {name: 'missing jobs snapshot', filterSnapshot: {}},
     {name: 'empty jobs snapshot', filterSnapshot: {jobs: {}}},

package/src/core/route-event-to-job-listeners.ts

@@ -1,3 +1,4 @@
+import {projectWorkflowPredicateContext} from '@shipfox/expression';
 import {logger} from '@shipfox/node-opentelemetry';
 import {findMatchingJobListenerSubscriptions} from '#db/job-listener-subscriptions.js';
 import {evaluateStoredFilter, type StoredFilterEvaluation} from './config.js';
@@ -13,6 +14,7 @@ export interface RouteEventToJobListenersParams {
   history: TriggerHistoryRecorder;
   eventRef: string;
   workspaceId: string;
+  connectionId: string;
   provider: string;
   source: string;
   event: string;
@@ -65,6 +67,23 @@ export async function routeEventToJobListeners(
     }
   }
 
+  const fireDeliveryNeeded = [...effectiveMatchByJobId.values()].some(
+    (subscription) => listenerDisposition(subscription) === 'fire',
+  );
+  const triggerReference = fireDeliveryNeeded
+    ? await params.workflows.resolveWorkflowRunTriggerReference({
+        workspaceId: params.workspaceId,
+        triggerConnectionId: params.connectionId,
+        triggerPayload: {
+          provider: params.provider,
+          source: params.source,
+          event: params.event,
+          deliveryId: params.deliveryId,
+          data: params.payload,
+        },
+      })
+    : null;
+
   let acceptedJobCount = 0;
   let deliveredCount = 0;
   let sawTransientError = false;
@@ -82,6 +101,8 @@ export async function routeEventToJobListeners(
         source: params.source,
         event: params.event,
         provider: params.provider,
+        triggerConnectionId: params.connectionId,
+        triggerReference,
         payload: params.payload,
         receivedAt: params.receivedAt.toISOString(),
       });
@@ -121,7 +142,10 @@ function evaluateListenerFilter(params: EvaluateListenerFilterParams): StoredFil
   if (typeof filter !== 'string' || filter.trim() === '') {
     return evaluateStoredFilter({
       value: filter,
-      context: {event: params.payload},
+      context: projectWorkflowPredicateContext(
+        params.subscription.kind === 'on' ? 'listener.on' : 'listener.until',
+        {event: params.payload},
+      ),
       invalidReason: 'Listener subscription filter must be a non-empty string when set',
       evaluationFailedReason: 'Listener filter evaluation failed',
     });
@@ -132,7 +156,10 @@ function evaluateListenerFilter(params: EvaluateListenerFilterParams): StoredFil
 
   return evaluateStoredFilter({
     value: filter,
-    context: {...snapshot.value, event: params.payload},
+    context: projectWorkflowPredicateContext(
+      params.subscription.kind === 'on' ? 'listener.on' : 'listener.until',
+      {...snapshot.value, event: params.payload},
+    ),
     invalidReason: 'Listener subscription filter must be a non-empty string when set',
     evaluationFailedReason: 'Listener filter evaluation failed',
   });

package/src/core/workflows-client.test.ts

@@ -52,6 +52,7 @@ function localWorkflowsClient(): WorkflowsModuleClient {
           {definitionId},
         );
       },
+      resolveWorkflowRunTriggerReference: () => null,
       deliverEventToJobListener: ({jobId}) => {
         if (jobId === listenerErrorInput.jobId) {
           throw createInterModuleKnownError(
@@ -92,6 +93,13 @@ async function runConsumerSuite(client: WorkflowsModuleClient): Promise<void> {
     buffered: true,
     skipped: false,
   });
+  await expect(
+    client.resolveWorkflowRunTriggerReference({
+      workspaceId: input.workspaceId,
+      triggerConnectionId: crypto.randomUUID(),
+      triggerPayload: input.triggerPayload,
+    }),
+  ).resolves.toBeNull();
   await expect(client.deliverEventToJobListener(listenerErrorInput)).rejects.toMatchObject({
     code: 'workspace-not-found',
     details: {workspaceId: input.workspaceId},

package/src/presentation/routes/fire-manual.test.ts

@@ -22,7 +22,11 @@ const workflows = {} as WorkflowsModuleClient;
 describe('POST /:definitionId/fire-manual', () => {
   let app: FastifyInstance;
   let workspaceId: string;
-  let memberships: Array<{workspaceId: string; role: 'admin'}>;
+  let memberships: Array<{
+    workspaceId: string;
+    role: 'admin';
+    workspaceStatus: 'active' | 'suspended' | 'deleted';
+  }>;
 
   beforeAll(async () => {
     app = Fastify();
@@ -41,7 +45,7 @@ describe('POST /:definitionId/fire-manual', () => {
 
   beforeEach(() => {
     workspaceId = crypto.randomUUID();
-    memberships = [{workspaceId, role: 'admin'}];
+    memberships = [{workspaceId, role: 'admin', workspaceStatus: 'active'}];
     fireManualSubscriptionMock.mockReset();
   });
 
@@ -89,6 +93,22 @@ describe('POST /:definitionId/fire-manual', () => {
     });
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const definitionId = crypto.randomUUID();
+    await triggerSubscriptionFactory.create({workspaceId, workflowDefinitionId: definitionId});
+    memberships = [{workspaceId, role: 'admin', workspaceStatus: 'suspended'}];
+
+    const res = await app.inject({
+      method: 'POST',
+      url: `/${definitionId}/fire-manual`,
+      payload: {},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+    expect(fireManualSubscriptionMock).not.toHaveBeenCalled();
+  });
+
   test('maps suspended workspace to 409', async () => {
     const definitionId = crypto.randomUUID();
     await triggerSubscriptionFactory.create({workspaceId, workflowDefinitionId: definitionId});

package/src/presentation/routes/fire-manual.ts

@@ -1,4 +1,4 @@
-import {requireUserContext} from '@shipfox/api-auth-context';
+import {requireUserContext, requireWorkspaceResourceAccess} from '@shipfox/api-auth-context';
 import {
   fireManualTriggerBodySchema,
   fireManualTriggerResponseSchema,
@@ -81,10 +81,18 @@ export function createFireManualTriggerRoute(workflows: WorkflowsModuleClient) {
       const userContext = requireUserContext(request);
 
       const subscription = await getManualSubscriptionByDefinitionId(definitionId);
-      // 404 covers both "no such manual trigger" and "not your workspace" to avoid leaking existence.
-      if (!subscription || !userContext.canAccess(subscription.workspaceId)) {
+      // Missing triggers and memberships remain 404 to avoid leaking existence; lifecycle claims
+      // propagate their stable access errors.
+      if (!subscription) {
         throw new ManualTriggerNotFoundError(definitionId);
       }
+      requireWorkspaceResourceAccess({
+        request,
+        workspaceId: subscription.workspaceId,
+        notFoundError: new ClientError('Manual trigger not found', 'manual-trigger-not-found', {
+          status: 404,
+        }),
+      });
 
       const run = await fireManualSubscription({
         workflows,

package/src/presentation/routes/get-trigger-event.test.ts

@@ -10,7 +10,11 @@ import {getTriggerEventRoute} from './get-trigger-event.js';
 describe('GET /trigger-events/:id', () => {
   let app: FastifyInstance;
   let workspaceId: string;
-  let memberships: Array<{workspaceId: string; role: 'admin'}>;
+  let memberships: Array<{
+    workspaceId: string;
+    role: 'admin';
+    workspaceStatus: 'active' | 'suspended' | 'deleted';
+  }>;
 
   beforeAll(async () => {
     app = Fastify();
@@ -29,7 +33,7 @@ describe('GET /trigger-events/:id', () => {
 
   beforeEach(() => {
     workspaceId = crypto.randomUUID();
-    memberships = [{workspaceId, role: 'admin'}];
+    memberships = [{workspaceId, role: 'admin', workspaceStatus: 'active'}];
   });
 
   test('returns the event with its decisions and full payload', async () => {
@@ -160,6 +164,16 @@ describe('GET /trigger-events/:id', () => {
     expect(res.json().decisions).toEqual([]);
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const event = await receivedEventFactory.create({workspaceId});
+    memberships = [{workspaceId, role: 'admin', workspaceStatus: 'suspended'}];
+
+    const res = await app.inject({method: 'GET', url: `/trigger-events/${event.id}`});
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('returns 404 for an unknown event id', async () => {
     const res = await app.inject({method: 'GET', url: `/trigger-events/${crypto.randomUUID()}`});
 

package/src/presentation/routes/get-trigger-event.ts

@@ -1,4 +1,4 @@
-import {requireUserContext} from '@shipfox/api-auth-context';
+import {requireWorkspaceResourceAccess} from '@shipfox/api-auth-context';
 import {triggerEventDetailResponseSchema} from '@shipfox/api-triggers-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -19,13 +19,18 @@ export const getTriggerEventRoute = defineRoute({
   },
   handler: async (request) => {
     const {id} = request.params;
-    const userContext = requireUserContext(request);
 
     const event = await getTriggerEventById(id);
-    // 404 covers both "no such event" and "not your workspace" to avoid leaking existence.
-    if (!event || !userContext.canAccess(event.workspaceId)) {
+    // Missing events and memberships remain 404 to avoid leaking existence; lifecycle claims
+    // propagate their stable access errors.
+    if (!event) {
       throw new ClientError('Trigger event not found', 'not-found', {status: 404});
     }
+    requireWorkspaceResourceAccess({
+      request,
+      workspaceId: event.workspaceId,
+      notFoundError: new ClientError('Trigger event not found', 'not-found', {status: 404}),
+    });
 
     const decisions = await listDecisionsByReceivedEventId(event.id);
 

package/src/presentation/routes/list-trigger-event-facets.test.ts

@@ -13,7 +13,11 @@ const facets = (res: {
 describe('GET /trigger-events/facets', () => {
   let app: FastifyInstance;
   let workspaceId: string;
-  let memberships: Array<{workspaceId: string; role: 'admin'}>;
+  let memberships: Array<{
+    workspaceId: string;
+    role: 'admin';
+    workspaceStatus: 'active' | 'suspended' | 'deleted';
+  }>;
 
   beforeAll(async () => {
     app = Fastify();
@@ -32,7 +36,7 @@ describe('GET /trigger-events/facets', () => {
 
   beforeEach(() => {
     workspaceId = crypto.randomUUID();
-    memberships = [{workspaceId, role: 'admin'}];
+    memberships = [{workspaceId, role: 'admin', workspaceStatus: 'active'}];
   });
 
   test('returns distinct sources and events with counts, ordered by count desc', async () => {
@@ -93,6 +97,18 @@ describe('GET /trigger-events/facets', () => {
     expect(res.json()).toEqual({sources: [], events: []});
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    memberships = [{workspaceId, role: 'admin', workspaceStatus: 'suspended'}];
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/trigger-events/facets?workspace_id=${workspaceId}`,
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('denies a workspace the caller does not belong to', async () => {
     const otherWorkspaceId = crypto.randomUUID();
 

package/src/presentation/routes/list-trigger-event-facets.ts

@@ -1,9 +1,9 @@
-import {requireUserContext} from '@shipfox/api-auth-context';
+import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {
   triggerEventFacetsQuerySchema,
   triggerEventFacetsResponseSchema,
 } from '@shipfox/api-triggers-dto';
-import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {defineRoute} from '@shipfox/node-fastify';
 import {listTriggerEventFacets} from '#db/index.js';
 
 export const listTriggerEventFacetsRoute = defineRoute({
@@ -19,10 +19,7 @@ export const listTriggerEventFacetsRoute = defineRoute({
   handler: async (request) => {
     const {workspace_id: workspaceId} = request.query;
 
-    const userContext = requireUserContext(request);
-    if (!userContext.canAccess(workspaceId)) {
-      throw new ClientError('Not a member of this workspace', 'forbidden', {status: 403});
-    }
+    requireWorkspaceAccess({request, workspaceId});
 
     return await listTriggerEventFacets({workspaceId});
   },