@shipfox/api-workspaces 10.2.0 → 12.0.0

package/src/db/index.ts

@@ -22,8 +22,17 @@ export {
   listMembershipsByWorkspace,
   removeMembership,
 } from './memberships.js';
+export type {
+  ConsumeWorkspacesRateLimitParams,
+  ConsumeWorkspacesRateLimitResult,
+} from './rate-limits.js';
+export {
+  consumeWorkspacesRateLimit,
+  pruneExpiredWorkspacesRateLimits,
+} from './rate-limits.js';
 export {workspacesAdminCommandResults} from './schema/admin-command-results.js';
 export {workspacesOutbox} from './schema/outbox.js';
+export {workspacesRateLimits} from './schema/rate-limits.js';
 export type {
   AdminWorkspaceRow,
   CreateWorkspaceParams,
@@ -36,6 +45,7 @@ export {
   createWorkspace,
   getWorkspaceById,
   getWorkspaceServiceMetrics,
+  isWorkspaceSlugAvailable,
   listAdminWorkspaces,
   updateWorkspace,
 } from './workspaces.js';

package/src/db/memberships.ts

@@ -59,6 +59,7 @@ export async function ensureMembership(params: EnsureMembershipParams): Promise<
 
 export interface MembershipWithWorkspace extends Membership {
   workspaceName: string;
+  workspaceSlug: string;
   workspaceStatus: Workspace['status'];
 }
 
@@ -69,6 +70,7 @@ export async function listMembershipsByUser(params: {
     .select({
       membership: memberships,
       workspaceName: workspaces.name,
+      workspaceSlug: workspaces.slug,
       workspaceStatus: workspaces.status,
     })
     .from(memberships)
@@ -79,6 +81,7 @@ export async function listMembershipsByUser(params: {
   return rows.map((row) => ({
     ...toMembership(row.membership),
     workspaceName: row.workspaceName,
+    workspaceSlug: row.workspaceSlug,
     workspaceStatus: row.workspaceStatus,
   }));
 }

package/src/db/rate-limits.test.ts

@@ -0,0 +1,74 @@
+import {and, eq, sql} from 'drizzle-orm';
+import {consumeWorkspacesRateLimit, pruneExpiredWorkspacesRateLimits} from '#db/rate-limits.js';
+import {db} from './db.js';
+import {workspacesRateLimits} from './schema/rate-limits.js';
+
+describe('workspaces rate limits db', () => {
+  it('atomically increments one bucket for concurrent attempts', async () => {
+    const identifierHmac = `hmac-${crypto.randomUUID()}`;
+    const params = {
+      action: 'slug-availability',
+      scope: 'ip',
+      identifierHmac,
+      windowStart: new Date('2026-06-23T00:00:00Z'),
+      expiresAt: new Date('2026-06-23T00:01:00Z'),
+      timeoutMs: 5_000,
+    };
+
+    await Promise.all(Array.from({length: 20}, () => consumeWorkspacesRateLimit(params)));
+
+    const [row] = await db()
+      .select({count: workspacesRateLimits.count})
+      .from(workspacesRateLimits)
+      .where(eq(workspacesRateLimits.identifierHmac, identifierHmac));
+    expect(row?.count).toBe(20);
+  });
+
+  it('prunes expired counters and keeps active counters', async () => {
+    const expiredIdentifierHmac = `expired-${crypto.randomUUID()}`;
+    const activeIdentifierHmac = `active-${crypto.randomUUID()}`;
+    await db()
+      .insert(workspacesRateLimits)
+      .values([
+        {
+          action: 'slug-availability',
+          scope: 'ip',
+          identifierHmac: expiredIdentifierHmac,
+          windowStart: new Date('2026-06-23T00:00:00Z'),
+          count: 1,
+          expiresAt: new Date('2026-06-23T00:01:00Z'),
+        },
+        {
+          action: 'slug-availability',
+          scope: 'ip',
+          identifierHmac: activeIdentifierHmac,
+          windowStart: new Date('2026-06-23T00:04:00Z'),
+          count: 1,
+          expiresAt: new Date('2026-06-23T00:06:00Z'),
+        },
+      ]);
+
+    const result = await pruneExpiredWorkspacesRateLimits({
+      now: new Date('2026-06-23T00:05:00Z'),
+      minIntervalMs: 0,
+    });
+
+    expect(result).toBeGreaterThanOrEqual(1);
+    expect(await countBucket(expiredIdentifierHmac)).toBe(0);
+    expect(await countBucket(activeIdentifierHmac)).toBe(1);
+  });
+
+  async function countBucket(identifierHmac: string): Promise<number> {
+    const [row] = await db()
+      .select({count: sql<number>`count(*)::int`})
+      .from(workspacesRateLimits)
+      .where(
+        and(
+          eq(workspacesRateLimits.action, 'slug-availability'),
+          eq(workspacesRateLimits.scope, 'ip'),
+          eq(workspacesRateLimits.identifierHmac, identifierHmac),
+        ),
+      );
+    return row?.count ?? 0;
+  }
+});

package/src/db/rate-limits.ts

@@ -0,0 +1,59 @@
+import {
+  type ConsumeRateLimitParams,
+  type ConsumeRateLimitResult,
+  createRateLimitPersistence,
+} from '@shipfox/node-rate-limit';
+import {lt, sql} from 'drizzle-orm';
+import {db} from './db.js';
+import {workspacesRateLimits} from './schema/rate-limits.js';
+
+type WorkspacesRateLimitTransaction = Parameters<
+  Parameters<ReturnType<typeof db>['transaction']>[0]
+>[0];
+
+const persistence = createRateLimitPersistence<WorkspacesRateLimitTransaction>({
+  transaction: (callback) => db().transaction(callback),
+  setStatementTimeout: async (transaction, timeoutMs) => {
+    await transaction.execute(
+      sql`select set_config('statement_timeout', ${`${timeoutMs}ms`}, true)`,
+    );
+  },
+  consume: async (transaction, params) => {
+    const rows = await transaction
+      .insert(workspacesRateLimits)
+      .values({
+        action: params.action,
+        scope: params.scope,
+        identifierHmac: params.identifierHmac,
+        windowStart: params.windowStart,
+        count: 1,
+        expiresAt: params.expiresAt,
+      })
+      .onConflictDoUpdate({
+        target: [
+          workspacesRateLimits.action,
+          workspacesRateLimits.scope,
+          workspacesRateLimits.identifierHmac,
+          workspacesRateLimits.windowStart,
+        ],
+        set: {
+          count: sql`${workspacesRateLimits.count} + 1`,
+          updatedAt: sql`now()`,
+        },
+      })
+      .returning({count: workspacesRateLimits.count, expiresAt: workspacesRateLimits.expiresAt});
+
+    return rows[0];
+  },
+  prune: async (now) => {
+    const result = await db()
+      .delete(workspacesRateLimits)
+      .where(lt(workspacesRateLimits.expiresAt, now));
+    return result.rowCount ?? 0;
+  },
+});
+
+export type ConsumeWorkspacesRateLimitParams = ConsumeRateLimitParams<string, string>;
+export type ConsumeWorkspacesRateLimitResult = ConsumeRateLimitResult;
+export const consumeWorkspacesRateLimit = persistence.consume;
+export const pruneExpiredWorkspacesRateLimits = persistence.prune;

package/src/db/schema/rate-limits.ts

@@ -0,0 +1,27 @@
+import {index, integer, text, timestamp, uniqueIndex} from 'drizzle-orm/pg-core';
+import {pgTable} from './common.js';
+
+export const workspacesRateLimits = pgTable(
+  'rate_limits',
+  {
+    action: text('action').notNull(),
+    scope: text('scope').notNull(),
+    identifierHmac: text('identifier_hmac').notNull(),
+    windowStart: timestamp('window_start', {withTimezone: true}).notNull(),
+    count: integer('count').notNull().default(1),
+    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('workspaces_rate_limits_window_unique').on(
+      table.action,
+      table.scope,
+      table.identifierHmac,
+      table.windowStart,
+    ),
+    index('workspaces_rate_limits_expires_at_idx').on(table.expiresAt),
+  ],
+);
+
+export type WorkspaceRateLimitDb = typeof workspacesRateLimits.$inferSelect;

package/src/db/schema/workspaces.ts

@@ -1,5 +1,5 @@
 import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
-import {index, jsonb, pgEnum, text, timestamp, uuid} from 'drizzle-orm/pg-core';
+import {index, jsonb, pgEnum, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
 import type {Workspace, WorkspaceStatus} from '#core/entities/workspace.js';
 import {pgTable} from './common.js';
 
@@ -14,13 +14,17 @@ export const workspaces = pgTable(
   {
     id: uuidv7PrimaryKey(),
     name: text('name').notNull(),
+    slug: text('slug').notNull(),
     status: workspaceStatusEnum('status').notNull().default('active'),
     settings: jsonb('settings').notNull().default({}),
     createdBy: uuid('created_by'),
     createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
     updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
   },
-  (table) => [index('workspaces_name_id_idx').on(table.name, table.id)],
+  (table) => [
+    index('workspaces_name_id_idx').on(table.name, table.id),
+    uniqueIndex('workspaces_slug_unique').on(table.slug),
+  ],
 );
 
 export type WorkspaceDb = typeof workspaces.$inferSelect;
@@ -30,6 +34,7 @@ export function toWorkspace(row: WorkspaceDb): Workspace {
   return {
     id: row.id,
     name: row.name,
+    slug: row.slug,
     status: row.status as WorkspaceStatus,
     settings: row.settings as Record<string, unknown>,
     createdBy: row.createdBy,

package/src/db/workspaces.ts

@@ -9,6 +9,8 @@ import {toWorkspace, workspaces} from './schema/workspaces.js';
 
 export interface CreateWorkspaceParams {
   name: string;
+  /** Existing database-only fixtures predate the required API slug. */
+  slug?: string | undefined;
 }
 
 export async function createWorkspace(params: CreateWorkspaceParams): Promise<Workspace> {
@@ -16,6 +18,7 @@ export async function createWorkspace(params: CreateWorkspaceParams): Promise<Wo
     .insert(workspaces)
     .values({
       name: params.name,
+      slug: params.slug ?? `workspace-${crypto.randomUUID().slice(0, 8)}`,
     })
     .returning();
 
@@ -28,19 +31,26 @@ export async function createWorkspace(params: CreateWorkspaceParams): Promise<Wo
 export interface UpdateWorkspaceParams {
   id: string;
   name?: string | undefined;
+  slug?: string | undefined;
   status?: WorkspaceStatus | undefined;
   settings?: Record<string, unknown> | undefined;
 }
 
+type WorkspaceDatabase = ReturnType<typeof db>;
+type WorkspaceTransaction = Parameters<Parameters<WorkspaceDatabase['transaction']>[0]>[0];
+
 export async function updateWorkspace(
   params: UpdateWorkspaceParams,
+  options: {tx?: WorkspaceDatabase | WorkspaceTransaction | undefined} = {},
 ): Promise<Workspace | undefined> {
+  const executor = options.tx ?? db();
   const set: Record<string, unknown> = {updatedAt: sql`NOW()`};
   if (params.name !== undefined) set.name = params.name;
+  if (params.slug !== undefined) set.slug = params.slug;
   if (params.status !== undefined) set.status = params.status;
   if (params.settings !== undefined) set.settings = params.settings;
 
-  const rows = await db()
+  const rows = await executor
     .update(workspaces)
     .set(set)
     .where(eq(workspaces.id, params.id))
@@ -58,6 +68,16 @@ export async function getWorkspaceById(id: string): Promise<Workspace | undefine
   return toWorkspace(row);
 }
 
+export async function isWorkspaceSlugAvailable(slug: string): Promise<boolean> {
+  const rows = await db()
+    .select({id: workspaces.id})
+    .from(workspaces)
+    .where(eq(workspaces.slug, slug))
+    .limit(1);
+
+  return rows.length === 0;
+}
+
 export interface AdminWorkspaceRow extends Workspace {
   memberCount: number;
 }

package/src/index.test.ts

@@ -4,6 +4,7 @@ import {
   WORKSPACES_MEMBER_INVITED,
   WORKSPACES_MEMBER_JOINED,
   WORKSPACES_WORKSPACE_CREATED,
+  WORKSPACES_WORKSPACE_UPDATED,
   workspacesEventSchemas,
 } from '@shipfox/api-workspaces-dto';
 import {workspacesModule} from './index.js';
@@ -27,6 +28,7 @@ describe('workspacesModule', () => {
     expect(Object.keys(publisher?.eventSchemas ?? {})).toEqual([
       WORKSPACES_INVITATION_SEND_REQUESTED,
       WORKSPACES_WORKSPACE_CREATED,
+      WORKSPACES_WORKSPACE_UPDATED,
       WORKSPACES_MEMBER_INVITED,
       WORKSPACES_MEMBER_JOINED,
       ADMINISTRATION_ACTION_PERFORMED,

package/src/index.ts

@@ -25,6 +25,7 @@ export {
   TokenExpiredError,
   TokenInvalidError,
   WorkspaceNotFoundError,
+  WorkspaceSlugConflictError,
 } from '#core/errors.js';
 export {
   acceptWorkspaceInvitation,

package/src/metrics/instance.ts

@@ -3,6 +3,7 @@ import {instanceMetrics} from '@shipfox/node-opentelemetry';
 export type WorkspacesInvitationEmailRequested = 'requested' | 'skipped';
 export type WorkspacesMembershipChangeAction = 'added' | 'removed';
 export type WorkspacesInvitationAcceptOutcome = 'added' | 'already_member';
+export type WorkspacesRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';
 
 const meter = instanceMetrics.getMeter('workspaces');
 
@@ -28,6 +29,20 @@ const invitationAcceptedCount = meter.createCounter<{
   description: 'Workspace invitations accepted by membership outcome',
 });
 
+const workspaceRateLimitCheckCount = meter.createCounter<{
+  action: 'slug-availability';
+  outcome: WorkspacesRateLimitOutcome;
+}>('workspaces_rate_limit_checks', {
+  description: 'Workspace rate-limit checks by action and outcome',
+});
+
+const workspaceRateLimitPruneFailureCount = meter.createCounter(
+  'workspaces_rate_limit_prune_failures',
+  {
+    description: 'Workspace rate-limit prune failures',
+  },
+);
+
 function recordMetric(record: () => void): void {
   try {
     record();
@@ -55,3 +70,14 @@ export function recordWorkspaceInvitationAccepted(
 ): void {
   recordMetric(() => invitationAcceptedCount.add(1, {outcome}));
 }
+
+export function recordWorkspaceRateLimitCheck(params: {
+  action: 'slug-availability';
+  outcome: WorkspacesRateLimitOutcome;
+}): void {
+  recordMetric(() => workspaceRateLimitCheckCount.add(1, params));
+}
+
+export function recordWorkspaceRateLimitPruneFailure(): void {
+  recordMetric(() => workspaceRateLimitPruneFailureCount.add(1));
+}

package/src/presentation/dto/membership.ts

@@ -9,6 +9,7 @@ export function toMembershipWithWorkspaceDto(
     user_id: membership.userId,
     workspace_id: membership.workspaceId,
     workspace_name: membership.workspaceName,
+    workspace_slug: membership.workspaceSlug,
     workspace_status: membership.workspaceStatus,
     created_at: membership.createdAt.toISOString(),
     updated_at: membership.updatedAt.toISOString(),

package/src/presentation/dto/workspace.ts

@@ -5,6 +5,7 @@ export function toWorkspaceDto(workspace: Workspace): WorkspaceDto {
   return {
     id: workspace.id,
     name: workspace.name,
+    slug: workspace.slug,
     status: workspace.status,
     settings: workspace.settings,
     created_at: workspace.createdAt.toISOString(),

package/src/presentation/e2eRoutes/create-workspace.ts

@@ -2,7 +2,8 @@ import {
   e2eCreateWorkspaceBodySchema,
   e2eCreateWorkspaceResponseSchema,
 } from '@shipfox/api-workspaces-dto';
-import {defineRoute} from '@shipfox/node-fastify';
+import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {WorkspaceSlugConflictError} from '#core/errors.js';
 import {createWorkspaceForUser} from '#core/index.js';
 import {toWorkspaceDto} from '#presentation/dto/index.js';
 
@@ -16,9 +17,16 @@ export const createE2eWorkspaceRoute = defineRoute({
       201: e2eCreateWorkspaceResponseSchema,
     },
   },
+  errorHandler: (error) => {
+    if (error instanceof WorkspaceSlugConflictError) {
+      throw new ClientError('Workspace slug is already taken', 'slug-conflict', {status: 409});
+    }
+    throw error;
+  },
   handler: async (request, reply) => {
     const workspace = await createWorkspaceForUser({
       name: request.body.name,
+      slug: request.body.slug ?? `e2e-workspace-${crypto.randomUUID().slice(0, 8)}`,
       userId: request.body.user_id,
       userEmail: request.body.user_email,
       userName: request.body.user_name,

package/src/presentation/inter-module.test.ts

@@ -1,3 +1,4 @@
+import {buildUserContext, requireWorkspaceAccess, setUserContext} from '@shipfox/api-auth-context';
 import {workspacesInterModuleContract} from '@shipfox/api-workspaces-dto/inter-module';
 import {isInterModuleKnownError} from '@shipfox/inter-module';
 import {createInMemoryInterModuleTransport} from '@shipfox/node-module/inter-module';
@@ -20,6 +21,7 @@ describe('Workspaces inter-module presentation', () => {
     const creatorUserId = crypto.randomUUID();
     const workspace = await createWorkspaceForUser({
       name: 'Creator Workspace',
+      slug: `creator-${crypto.randomUUID().slice(0, 8)}`,
       userId: creatorUserId,
     });
     await createMembership({workspaceId: workspace.id, userId: crypto.randomUUID()});
@@ -34,6 +36,7 @@ describe('Workspaces inter-module presentation', () => {
     const creatorUserId = crypto.randomUUID();
     const workspace = await createWorkspaceForUser({
       name: 'Outlasted Creator Workspace',
+      slug: `outlasted-${crypto.randomUUID().slice(0, 8)}`,
       userId: creatorUserId,
     });
     const remainingUserId = crypto.randomUUID();
@@ -54,6 +57,72 @@ describe('Workspaces inter-module presentation', () => {
     expect(result).toEqual({creatorUserId: null});
   });
 
+  test('carries workspace status into token claims', async () => {
+    const client = createClient();
+    const userId = crypto.randomUUID();
+    const active = await createWorkspaceForUser({
+      name: 'Active Workspace',
+      slug: `active-${crypto.randomUUID().slice(0, 8)}`,
+      userId,
+    });
+    const suspended = await createWorkspaceForUser({
+      name: 'Suspended Workspace',
+      slug: `suspended-${crypto.randomUUID().slice(0, 8)}`,
+      userId,
+    });
+    const deleted = await createWorkspaceForUser({
+      name: 'Deleted Workspace',
+      slug: `deleted-${crypto.randomUUID().slice(0, 8)}`,
+      userId,
+    });
+    await updateWorkspace({id: suspended.id, status: 'suspended'});
+    await updateWorkspace({id: deleted.id, status: 'deleted'});
+
+    expect(await client.listMembershipsForTokenClaims({userId})).toEqual({
+      memberships: [
+        {workspaceId: active.id, role: 'admin', workspaceStatus: 'active'},
+        {workspaceId: deleted.id, role: 'admin', workspaceStatus: 'deleted'},
+        {workspaceId: suspended.id, role: 'admin', workspaceStatus: 'suspended'},
+      ],
+    });
+
+    await updateWorkspace({id: suspended.id, status: 'active'});
+
+    expect(await client.listMembershipsForTokenClaims({userId})).toEqual({
+      memberships: [
+        {workspaceId: active.id, role: 'admin', workspaceStatus: 'active'},
+        {workspaceId: deleted.id, role: 'admin', workspaceStatus: 'deleted'},
+        {workspaceId: suspended.id, role: 'admin', workspaceStatus: 'active'},
+      ],
+    });
+  });
+
+  test('preserves suspended-workspace access errors through the claim boundary', async () => {
+    const client = createClient();
+    const userId = crypto.randomUUID();
+    const workspace = await createWorkspaceForUser({
+      name: 'Suspended Access Workspace',
+      slug: `suspended-access-${crypto.randomUUID().slice(0, 8)}`,
+      userId,
+    });
+    await updateWorkspace({id: workspace.id, status: 'suspended'});
+
+    const claims = await client.listMembershipsForTokenClaims({userId});
+    const request = {};
+    setUserContext(
+      request,
+      buildUserContext({
+        userId,
+        email: `user-${userId}@example.com`,
+        memberships: claims.memberships,
+      }),
+    );
+
+    expect(() => requireWorkspaceAccess({request, workspaceId: workspace.id})).toThrow(
+      expect.objectContaining({code: 'workspace-suspended', status: 409}),
+    );
+  });
+
   test('returns only the current workspace operating state', async () => {
     const client = createClient();
     const workspace = await createWorkspace({name: 'Operating State Workspace'});

package/src/presentation/inter-module.ts

@@ -26,10 +26,13 @@ export function createWorkspacesInterModulePresentation(): InterModulePresentati
 > {
   return defineInterModulePresentation(workspacesInterModuleContract, {
     listMembershipsForTokenClaims: async ({userId}) => ({
-      memberships: (await listMembershipsByUser({userId})).map(({workspaceId}) => ({
-        workspaceId,
-        role: 'admin' as const,
-      })),
+      memberships: (await listMembershipsByUser({userId})).map(
+        ({workspaceId, workspaceStatus}) => ({
+          workspaceId,
+          role: 'admin' as const,
+          workspaceStatus,
+        }),
+      ),
     }),
     getWorkspaceCreator: async (input) => {
       try {

package/src/presentation/routes/index.ts

@@ -5,7 +5,12 @@ import type {RouteGroup} from '@shipfox/node-fastify';
 import {createAdminWorkspacesRoutes} from './admin-workspaces.js';
 import {invitationsAcceptGroup, invitationsWorkspaceScopedRoutes} from './invitations/index.js';
 import {memberRoutes} from './members/index.js';
-import {createWorkspaceRoute, listUserWorkspacesRoute} from './workspaces/index.js';
+import {
+  createWorkspaceRoute,
+  listUserWorkspacesRoute,
+  updateWorkspaceRoute,
+  workspaceSlugAvailabilityRoute,
+} from './workspaces/index.js';
 
 export const workspacesRoutes: RouteGroup[] = [
   invitationsAcceptGroup,
@@ -14,6 +19,8 @@ export const workspacesRoutes: RouteGroup[] = [
     routes: [
       listUserWorkspacesRoute,
       createWorkspaceRoute,
+      workspaceSlugAvailabilityRoute,
+      updateWorkspaceRoute,
       {
         prefix: '/:workspaceId/members',
         routes: memberRoutes,

package/src/presentation/routes/invitations/create.test.ts

@@ -66,6 +66,21 @@ describe('POST /workspaces/:workspaceId/invitations', () => {
     expect(await invitationOutboxEventsTo(inviteeEmail)).toHaveLength(1);
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = `claim:${crypto.randomUUID()}:suspended-invite-create@example.com:${workspaceId}:suspended`;
+
+    const res = await app.inject({
+      method: 'POST',
+      url: `/workspaces/${workspaceId}/invitations`,
+      headers: {authorization: `Bearer ${token}`},
+      payload: {email: uniqueEmail('suspended-invite')},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('transforms a whitespace/case-equivalent duplicate open invitation into 409', async () => {
     const owner = await signupVerifyLogin(app, 'invite-create-duplicate-equivalent');
     const workspaceId = await createWorkspace(app, owner.token);

package/src/presentation/routes/invitations/create.ts

@@ -1,4 +1,4 @@
-import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {AUTH_USER, getUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {createInvitationBodySchema, invitationDtoSchema} from '@shipfox/api-workspaces-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -45,6 +45,7 @@ export const createInvitationRoute = defineRoute({
     }
 
     const {workspaceId} = request.params;
+    requireWorkspaceAccess({request, workspaceId});
     const {email} = request.body;
     const invitation = await createWorkspaceInvitation({
       workspaceId,

package/src/presentation/routes/invitations/list.test.ts

@@ -1,4 +1,5 @@
 import type {FastifyInstance} from 'fastify';
+import {updateWorkspace} from '#db/workspaces.js';
 import {
   createExpiredInvite,
   createInvite,
@@ -46,6 +47,21 @@ describe('GET /workspaces/:workspaceId/invitations', () => {
     ]);
   });
 
+  test('keeps an active claim usable when the workspace row is suspended', async () => {
+    const owner = await signupVerifyLogin(app, 'invite-list-snapshot');
+    const workspaceId = await createWorkspace(app, owner.token);
+    await updateWorkspace({id: workspaceId, status: 'suspended'});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/invitations`,
+      headers: {authorization: `Bearer ${owner.token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json().invitations).toEqual([]);
+  });
+
   test('excludes expired unaccepted invitations', async () => {
     const owner = await signupVerifyLogin(app, 'invite-list-expired-owner');
     const workspaceId = await createWorkspace(app, owner.token);
@@ -65,6 +81,20 @@ describe('GET /workspaces/:workspaceId/invitations', () => {
     expect(res.json().invitations).toEqual([]);
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = `claim:${crypto.randomUUID()}:suspended-invite-list@example.com:${workspaceId}:suspended`;
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/invitations`,
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('transforms missing membership into 403', async () => {
     const outsider = await signupVerifyLogin(app, 'invite-list-outsider');
     const workspaceId = crypto.randomUUID();

package/src/presentation/routes/invitations/list.ts

@@ -1,4 +1,4 @@
-import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {AUTH_USER, getUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {listInvitationsResponseSchema} from '@shipfox/api-workspaces-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -40,6 +40,7 @@ export const listInvitationsRoute = defineRoute({
     }
 
     const {workspaceId} = request.params;
+    requireWorkspaceAccess({request, workspaceId});
     const invitations = await listWorkspaceInvitations({
       workspaceId,
       requesterUserId: client.userId,