@shipfox/api-workspaces 10.2.0 → 11.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-workspaces",
   "license": "MIT",
-  "version": "10.2.0",
+  "version": "11.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -25,11 +25,11 @@
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
     "@shipfox/api-common-dto": "9.2.0",
+    "@shipfox/api-auth-context": "11.0.0",
     "@shipfox/api-auth-dto": "10.2.0",
-    "@shipfox/api-auth-context": "10.2.0",
     "@shipfox/api-projects-dto": "10.1.0",
     "@shipfox/api-runners-dto": "10.2.0",
-    "@shipfox/api-workspaces-dto": "10.2.0",
+    "@shipfox/api-workspaces-dto": "11.0.0",
     "@shipfox/config": "1.2.4",
     "@shipfox/inter-module": "0.2.2",
     "@shipfox/node-drizzle": "0.3.4",
@@ -38,8 +38,8 @@
     "@shipfox/node-mailer": "0.2.4",
     "@shipfox/node-module": "1.0.4",
     "@shipfox/node-opentelemetry": "0.6.3",
-    "@shipfox/node-outbox": "0.2.6",
     "@shipfox/node-postgres": "0.4.4",
+    "@shipfox/node-outbox": "0.2.6",
     "@shipfox/node-tokens": "0.3.2"
   },
   "imports": {

package/src/core/invitations.test.ts

@@ -105,7 +105,7 @@ describe('invitations core', () => {
       workspaceId: workspace.id,
       email,
       invitedByUserId: inviter.userId,
-      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin'}],
+      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin', workspaceStatus: 'active'}],
     });
 
     expect(invitation.email).toBe(email);
@@ -129,7 +129,7 @@ describe('invitations core', () => {
       email,
       invitedByUserId: inviter.userId,
       invitedByDisplay: 'Dana Scully',
-      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin'}],
+      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin', workspaceStatus: 'active'}],
     });
 
     const payload = await latestInvitationPayload(email);
@@ -157,7 +157,7 @@ describe('invitations core', () => {
       workspaceId: workspace.id,
       email,
       invitedByUserId: inviter.userId,
-      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin'}],
+      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin', workspaceStatus: 'active'}],
     });
 
     const payload = await latestInvitationPayload(email);
@@ -181,7 +181,7 @@ describe('invitations core', () => {
       email,
       invitedByUserId: inviter.userId,
       invitedByDisplay: '   ',
-      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin'}],
+      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin', workspaceStatus: 'active'}],
     });
 
     const payload = await latestInvitationPayload(email);
@@ -204,14 +204,14 @@ describe('invitations core', () => {
       workspaceId: workspace.id,
       email,
       invitedByUserId: inviter.userId,
-      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin'}],
+      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin', workspaceStatus: 'active'}],
     });
 
     const promise = createWorkspaceInvitation({
       workspaceId: workspace.id,
       email,
       invitedByUserId: inviter.userId,
-      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin'}],
+      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin', workspaceStatus: 'active'}],
     });
 
     await expect(promise).rejects.toBeInstanceOf(OpenInvitationExistsError);
@@ -233,7 +233,7 @@ describe('invitations core', () => {
       workspaceId: workspace.id,
       email: invitee.email,
       invitedByUserId: inviter.userId,
-      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin'}],
+      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin', workspaceStatus: 'active'}],
     });
     const token = extractToken((await latestInvitationPayload(invitee.email)).inviteLink);
 
@@ -269,7 +269,7 @@ describe('invitations core', () => {
       workspaceId: workspace.id,
       email,
       invitedByUserId: inviter.userId,
-      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin'}],
+      invitedByMemberships: [{workspaceId: workspace.id, role: 'admin', workspaceStatus: 'active'}],
     });
     const payload = await latestInvitationPayload(email);
     const token = extractToken(payload.inviteLink);

package/src/core/invitations.ts

@@ -46,6 +46,7 @@ export async function createWorkspaceInvitation(params: {
     workspaceId: params.workspaceId,
     userId: params.invitedByUserId,
     memberships: params.invitedByMemberships,
+    enforceWorkspaceStatus: false,
   });
 
   const rawToken = generateOpaqueToken('invitation');
@@ -216,6 +217,7 @@ export async function listWorkspaceInvitations(params: {
     workspaceId: params.workspaceId,
     userId: params.requesterUserId,
     memberships: params.requesterMemberships,
+    enforceWorkspaceStatus: false,
   });
 
   return listOpenInvitationsByWorkspace({workspaceId: params.workspaceId});
@@ -231,6 +233,7 @@ export async function revokeWorkspaceInvitation(params: {
     workspaceId: params.workspaceId,
     userId: params.requesterUserId,
     memberships: params.requesterMemberships,
+    enforceWorkspaceStatus: false,
   });
 
   const invitation = await findInvitationById({id: params.invitationId});

package/src/core/workspaces.test.ts

@@ -5,7 +5,7 @@ import {findMembership} from '#db/memberships.js';
 import {workspacesOutbox} from '#db/schema/outbox.js';
 import {updateWorkspace} from '#db/workspaces.js';
 import {userFactory} from '#test/index.js';
-import {MembershipRequiredError, WorkspaceNotFoundError} from './errors.js';
+import {MembershipRequiredError, WorkspaceInactiveError, WorkspaceNotFoundError} from './errors.js';
 import {
   createWorkspaceForUser,
   getWorkspaceOperatingState,
@@ -64,7 +64,7 @@ describe('workspaces core', () => {
     const result = await requireWorkspaceMembership({
       workspaceId: workspace.id,
       userId: user.userId,
-      memberships: [{workspaceId: workspace.id, role: 'admin'}],
+      memberships: [{workspaceId: workspace.id, role: 'admin', workspaceStatus: 'active'}],
     });
 
     expect(result.workspace.id).toBe(workspace.id);
@@ -85,6 +85,25 @@ describe('workspaces core', () => {
     expect(await getWorkspaceOperatingState({workspaceId: workspace.id})).toBe('suspended');
   });
 
+  test('requireWorkspaceMembership rejects a suspended workspace', async () => {
+    const user = userFactory.build();
+    const workspace = await createWorkspaceForUser({
+      name: 'Suspended Workspace',
+      userId: user.userId,
+      userEmail: user.email,
+      userName: user.name,
+    });
+    await updateWorkspace({id: workspace.id, status: 'suspended'});
+
+    const membership = requireWorkspaceMembership({
+      workspaceId: workspace.id,
+      userId: user.userId,
+      memberships: [{workspaceId: workspace.id, role: 'admin', workspaceStatus: 'active'}],
+    });
+
+    await expect(membership).rejects.toBeInstanceOf(WorkspaceInactiveError);
+  });
+
   test('requireWorkspaceMembership rejects when memberships do not include the workspace', async () => {
     const owner = userFactory.build();
     const outsider = userFactory.build();
@@ -110,7 +129,7 @@ describe('workspaces core', () => {
     const missingWorkspace = requireWorkspaceMembership({
       workspaceId: ghostId,
       userId: owner.userId,
-      memberships: [{workspaceId: ghostId, role: 'admin'}],
+      memberships: [{workspaceId: ghostId, role: 'admin', workspaceStatus: 'active'}],
     });
 
     await expect(missingWorkspace).rejects.toBeInstanceOf(WorkspaceNotFoundError);

package/src/core/workspaces.ts

@@ -31,6 +31,7 @@ export interface RequireWorkspaceMembershipParams {
   workspaceId: string;
   userId: string;
   memberships: ReadonlyArray<UserContextMembership>;
+  enforceWorkspaceStatus?: boolean;
 }
 
 export interface RequireWorkspaceMembershipResult {
@@ -52,7 +53,7 @@ export async function requireWorkspaceMembership(
   if (!workspace) {
     throw new WorkspaceNotFoundError(params.workspaceId);
   }
-  if (workspace.status !== 'active') {
+  if (params.enforceWorkspaceStatus !== false && workspace.status !== 'active') {
     throw new WorkspaceInactiveError(params.workspaceId);
   }
 
@@ -128,6 +129,7 @@ export async function listWorkspaceMembers(params: {
     workspaceId: params.workspaceId,
     userId: params.requesterUserId,
     memberships: params.requesterMemberships,
+    enforceWorkspaceStatus: false,
   });
 
   return listMembershipsByWorkspace({workspaceId: params.workspaceId});
@@ -143,6 +145,7 @@ export async function removeWorkspaceMember(params: {
     workspaceId: params.workspaceId,
     userId: params.requesterUserId,
     memberships: params.requesterMemberships,
+    enforceWorkspaceStatus: false,
   });
 
   if (params.userId === params.requesterUserId) {

package/src/presentation/inter-module.test.ts

@@ -1,3 +1,4 @@
+import {buildUserContext, requireWorkspaceAccess, setUserContext} from '@shipfox/api-auth-context';
 import {workspacesInterModuleContract} from '@shipfox/api-workspaces-dto/inter-module';
 import {isInterModuleKnownError} from '@shipfox/inter-module';
 import {createInMemoryInterModuleTransport} from '@shipfox/node-module/inter-module';
@@ -54,6 +55,56 @@ describe('Workspaces inter-module presentation', () => {
     expect(result).toEqual({creatorUserId: null});
   });
 
+  test('carries workspace status into token claims', async () => {
+    const client = createClient();
+    const userId = crypto.randomUUID();
+    const active = await createWorkspaceForUser({name: 'Active Workspace', userId});
+    const suspended = await createWorkspaceForUser({name: 'Suspended Workspace', userId});
+    const deleted = await createWorkspaceForUser({name: 'Deleted Workspace', userId});
+    await updateWorkspace({id: suspended.id, status: 'suspended'});
+    await updateWorkspace({id: deleted.id, status: 'deleted'});
+
+    expect(await client.listMembershipsForTokenClaims({userId})).toEqual({
+      memberships: [
+        {workspaceId: active.id, role: 'admin', workspaceStatus: 'active'},
+        {workspaceId: deleted.id, role: 'admin', workspaceStatus: 'deleted'},
+        {workspaceId: suspended.id, role: 'admin', workspaceStatus: 'suspended'},
+      ],
+    });
+
+    await updateWorkspace({id: suspended.id, status: 'active'});
+
+    expect(await client.listMembershipsForTokenClaims({userId})).toEqual({
+      memberships: [
+        {workspaceId: active.id, role: 'admin', workspaceStatus: 'active'},
+        {workspaceId: deleted.id, role: 'admin', workspaceStatus: 'deleted'},
+        {workspaceId: suspended.id, role: 'admin', workspaceStatus: 'active'},
+      ],
+    });
+  });
+
+  test('preserves suspended-workspace access errors through the claim boundary', async () => {
+    const client = createClient();
+    const userId = crypto.randomUUID();
+    const workspace = await createWorkspaceForUser({name: 'Suspended Access Workspace', userId});
+    await updateWorkspace({id: workspace.id, status: 'suspended'});
+
+    const claims = await client.listMembershipsForTokenClaims({userId});
+    const request = {};
+    setUserContext(
+      request,
+      buildUserContext({
+        userId,
+        email: `user-${userId}@example.com`,
+        memberships: claims.memberships,
+      }),
+    );
+
+    expect(() => requireWorkspaceAccess({request, workspaceId: workspace.id})).toThrow(
+      expect.objectContaining({code: 'workspace-suspended', status: 409}),
+    );
+  });
+
   test('returns only the current workspace operating state', async () => {
     const client = createClient();
     const workspace = await createWorkspace({name: 'Operating State Workspace'});

package/src/presentation/inter-module.ts

@@ -26,10 +26,13 @@ export function createWorkspacesInterModulePresentation(): InterModulePresentati
 > {
   return defineInterModulePresentation(workspacesInterModuleContract, {
     listMembershipsForTokenClaims: async ({userId}) => ({
-      memberships: (await listMembershipsByUser({userId})).map(({workspaceId}) => ({
-        workspaceId,
-        role: 'admin' as const,
-      })),
+      memberships: (await listMembershipsByUser({userId})).map(
+        ({workspaceId, workspaceStatus}) => ({
+          workspaceId,
+          role: 'admin' as const,
+          workspaceStatus,
+        }),
+      ),
     }),
     getWorkspaceCreator: async (input) => {
       try {

package/src/presentation/routes/invitations/create.test.ts

@@ -66,6 +66,21 @@ describe('POST /workspaces/:workspaceId/invitations', () => {
     expect(await invitationOutboxEventsTo(inviteeEmail)).toHaveLength(1);
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = `claim:${crypto.randomUUID()}:suspended-invite-create@example.com:${workspaceId}:suspended`;
+
+    const res = await app.inject({
+      method: 'POST',
+      url: `/workspaces/${workspaceId}/invitations`,
+      headers: {authorization: `Bearer ${token}`},
+      payload: {email: uniqueEmail('suspended-invite')},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('transforms a whitespace/case-equivalent duplicate open invitation into 409', async () => {
     const owner = await signupVerifyLogin(app, 'invite-create-duplicate-equivalent');
     const workspaceId = await createWorkspace(app, owner.token);

package/src/presentation/routes/invitations/create.ts

@@ -1,4 +1,4 @@
-import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {AUTH_USER, getUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {createInvitationBodySchema, invitationDtoSchema} from '@shipfox/api-workspaces-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -45,6 +45,7 @@ export const createInvitationRoute = defineRoute({
     }
 
     const {workspaceId} = request.params;
+    requireWorkspaceAccess({request, workspaceId});
     const {email} = request.body;
     const invitation = await createWorkspaceInvitation({
       workspaceId,

package/src/presentation/routes/invitations/list.test.ts

@@ -1,4 +1,5 @@
 import type {FastifyInstance} from 'fastify';
+import {updateWorkspace} from '#db/workspaces.js';
 import {
   createExpiredInvite,
   createInvite,
@@ -46,6 +47,21 @@ describe('GET /workspaces/:workspaceId/invitations', () => {
     ]);
   });
 
+  test('keeps an active claim usable when the workspace row is suspended', async () => {
+    const owner = await signupVerifyLogin(app, 'invite-list-snapshot');
+    const workspaceId = await createWorkspace(app, owner.token);
+    await updateWorkspace({id: workspaceId, status: 'suspended'});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/invitations`,
+      headers: {authorization: `Bearer ${owner.token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json().invitations).toEqual([]);
+  });
+
   test('excludes expired unaccepted invitations', async () => {
     const owner = await signupVerifyLogin(app, 'invite-list-expired-owner');
     const workspaceId = await createWorkspace(app, owner.token);
@@ -65,6 +81,20 @@ describe('GET /workspaces/:workspaceId/invitations', () => {
     expect(res.json().invitations).toEqual([]);
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = `claim:${crypto.randomUUID()}:suspended-invite-list@example.com:${workspaceId}:suspended`;
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/invitations`,
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('transforms missing membership into 403', async () => {
     const outsider = await signupVerifyLogin(app, 'invite-list-outsider');
     const workspaceId = crypto.randomUUID();

package/src/presentation/routes/invitations/list.ts

@@ -1,4 +1,4 @@
-import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {AUTH_USER, getUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {listInvitationsResponseSchema} from '@shipfox/api-workspaces-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -40,6 +40,7 @@ export const listInvitationsRoute = defineRoute({
     }
 
     const {workspaceId} = request.params;
+    requireWorkspaceAccess({request, workspaceId});
     const invitations = await listWorkspaceInvitations({
       workspaceId,
       requesterUserId: client.userId,

package/src/presentation/routes/invitations/revoke.test.ts

@@ -82,6 +82,20 @@ describe('DELETE /workspaces/:workspaceId/invitations/:invitationId', () => {
     expect(res.json().code).toBe('forbidden');
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = `claim:${crypto.randomUUID()}:suspended-invite-revoke@example.com:${workspaceId}:suspended`;
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/workspaces/${workspaceId}/invitations/${crypto.randomUUID()}`,
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('transforms missing membership into 403', async () => {
     const outsider = await signupVerifyLogin(app, 'invite-revoke-outsider');
     const workspaceId = crypto.randomUUID();

package/src/presentation/routes/invitations/revoke.ts

@@ -1,4 +1,4 @@
-import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {AUTH_USER, getUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {
@@ -51,6 +51,7 @@ export const revokeInvitationRoute = defineRoute({
     }
 
     const {workspaceId, invitationId} = request.params;
+    requireWorkspaceAccess({request, workspaceId});
 
     await revokeWorkspaceInvitation({
       workspaceId,

package/src/presentation/routes/members/list.test.ts

@@ -1,5 +1,5 @@
 import type {FastifyInstance} from 'fastify';
-import {createWorkspace as createWorkspaceRow} from '#db/workspaces.js';
+import {createWorkspace as createWorkspaceRow, updateWorkspace} from '#db/workspaces.js';
 import {
   createInvite,
   createWorkspace,
@@ -50,6 +50,20 @@ describe('GET /workspaces/:workspaceId/members', () => {
     ).toEqual([guest.email, owner.email].sort());
   });
 
+  test('keeps an active claim usable when the workspace row is suspended', async () => {
+    const owner = await signupVerifyLogin(app, 'members-list-snapshot');
+    const workspaceId = await createWorkspace(app, owner.token);
+    await updateWorkspace({id: workspaceId, status: 'suspended'});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/members`,
+      headers: {authorization: `Bearer ${owner.token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+  });
+
   test('authorizes from a static membership claim without a membership row', async () => {
     const userId = crypto.randomUUID();
     const email = `members-list-claim-${crypto.randomUUID()}@example.com`;
@@ -66,6 +80,20 @@ describe('GET /workspaces/:workspaceId/members', () => {
     expect(res.json().members).toEqual([]);
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = `claim:${crypto.randomUUID()}:suspended-list@example.com:${workspaceId}:suspended`;
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/members`,
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('transforms missing membership into 403', async () => {
     const outsider = await signupVerifyLogin(app, 'members-list-outsider');
     const workspaceId = crypto.randomUUID();

package/src/presentation/routes/members/list.ts

@@ -1,4 +1,4 @@
-import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {AUTH_USER, getUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {listMembersResponseSchema} from '@shipfox/api-workspaces-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -40,6 +40,7 @@ export const listMembersRoute = defineRoute({
     }
 
     const {workspaceId} = request.params;
+    requireWorkspaceAccess({request, workspaceId});
     const members = await listWorkspaceMembers({
       workspaceId,
       requesterUserId: client.userId,

package/src/presentation/routes/members/remove.test.ts

@@ -79,6 +79,20 @@ describe('DELETE /workspaces/:workspaceId/members/:userId', () => {
     expect(res.json().code).toBe('self-removal-not-allowed');
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = `claim:${crypto.randomUUID()}:suspended-member-remove@example.com:${workspaceId}:suspended`;
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/workspaces/${workspaceId}/members/${crypto.randomUUID()}`,
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('transforms missing membership into 403', async () => {
     const outsider = await signupVerifyLogin(app, 'members-remove-outsider');
     const workspaceId = crypto.randomUUID();

package/src/presentation/routes/members/remove.ts

@@ -1,4 +1,4 @@
-import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {AUTH_USER, getUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {
@@ -53,6 +53,7 @@ export const removeMemberRoute = defineRoute({
     }
 
     const {workspaceId, userId} = request.params;
+    requireWorkspaceAccess({request, workspaceId});
 
     await removeWorkspaceMember({
       workspaceId,

package/test/routes.ts

@@ -52,14 +52,15 @@ const fakeUserAuth: AuthMethod = {
   authenticate: async (request) => {
     const raw = request.headers.authorization?.replace(BEARER_RE, '');
     if (raw?.startsWith('claim:')) {
-      const [, userId, email, workspaceId] = raw.split(':');
+      const [, userId, email, workspaceId, status] = raw.split(':');
       if (!userId || !email || !workspaceId) throw new Error('Invalid test user claim token');
+      const workspaceStatus = status === 'suspended' || status === 'deleted' ? status : 'active';
       setUserContext(
         request,
         buildUserContext({
           userId,
           email,
-          memberships: [{workspaceId, role: 'admin'}],
+          memberships: [{workspaceId, role: 'admin', workspaceStatus}],
         }),
       );
       return;
@@ -74,7 +75,11 @@ const fakeUserAuth: AuthMethod = {
         userId,
         email,
         name: encodedName ? decodeURIComponent(encodedName) : null,
-        memberships: memberships.map((m) => ({workspaceId: m.workspaceId, role: 'admin' as const})),
+        memberships: memberships.map((m) => ({
+          workspaceId: m.workspaceId,
+          role: 'admin' as const,
+          workspaceStatus: 'active' as const,
+        })),
       }),
     );
   },