@synchronized-console/shared 2.25.7 → 2.31.14

package/src/authz/fragments/savedViews.ts

@@ -0,0 +1,245 @@
+import { err, ok } from 'true-myth/result'
+import {
+  ProjectNoAccessError,
+  ProjectNotEnoughPermissionsError,
+  ProjectNotFoundError,
+  SavedViewGroupNotFoundError,
+  SavedViewNoAccessError,
+  SavedViewNotFoundError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  UngroupedSavedViewGroupLockError,
+  WorkspaceNoAccessError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspaceReadOnlyError,
+  WorkspacesNotEnabledError,
+  WorkspaceSsoSessionNoAccessError
+} from '../domain/authErrors.js'
+import {
+  MaybeUserContext,
+  ProjectContext,
+  SavedViewContext,
+  SavedViewGroupContext
+} from '../domain/context.js'
+import { Loaders } from '../domain/loaders.js'
+import { AuthPolicyEnsureFragment } from '../domain/policies.js'
+import { SavedViewVisibility } from '../domain/savedViews/types.js'
+import {
+  ensureCanUseProjectWorkspacePlanFeatureFragment,
+  ensureImplicitProjectMemberWithWriteAccessFragment
+} from './projects.js'
+import { Roles } from '../../core/constants.js'
+import { WorkspacePlanFeatures } from '../../workspaces/index.js'
+import { isUngroupedGroup } from '../../saved-views/index.js'
+import { StringEnum, StringEnumValues, throwUncoveredError } from '../../core/index.js'
+
+export const WriteTypes = StringEnum([
+  'UpdateGeneral',
+  'MoveView',
+  'EditTitle',
+  'EditDescription',
+  'SetHomeView'
+])
+export type WriteTypes = StringEnumValues<typeof WriteTypes>
+
+/**
+ * Ensure the user can access the view
+ */
+export const ensureCanAccessSavedViewFragment: AuthPolicyEnsureFragment<
+  | typeof Loaders.getSavedView
+  | typeof Loaders.getProject
+  | typeof Loaders.getEnv
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspacePlan
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspaceSsoSession
+  | typeof Loaders.getAdminOverrideEnabled
+  | typeof Loaders.getProjectRole,
+  MaybeUserContext &
+    ProjectContext &
+    SavedViewContext & {
+      access: 'read' | WriteTypes
+      /**
+       * In some cases we want to just ignore a view being non-existant, instead of throwing
+       */
+      allowNonExistent?: boolean
+    },
+  InstanceType<
+    | typeof SavedViewNotFoundError
+    | typeof SavedViewNoAccessError
+    | typeof ProjectNotFoundError
+    | typeof ServerNoAccessError
+    | typeof ServerNoSessionError
+    | typeof ProjectNoAccessError
+    | typeof WorkspaceNoAccessError
+    | typeof WorkspaceSsoSessionNoAccessError
+    | typeof ServerNotEnoughPermissionsError
+    | typeof ProjectNotEnoughPermissionsError
+    | typeof WorkspaceNotEnoughPermissionsError
+    | typeof WorkspacesNotEnabledError
+    | typeof WorkspaceReadOnlyError
+    | typeof WorkspacePlanNoFeatureAccessError
+  >
+> =
+  (loaders) =>
+  async ({ userId, projectId, savedViewId, access, allowNonExistent }) => {
+    const canUseSavedViews = await ensureCanUseProjectWorkspacePlanFeatureFragment(
+      loaders
+    )({
+      projectId,
+      feature: WorkspacePlanFeatures.SavedViews
+    })
+    if (canUseSavedViews.isErr) return err(canUseSavedViews.error)
+
+    const savedView = await loaders.getSavedView({ projectId, savedViewId })
+    if (!savedView) {
+      if (allowNonExistent) return ok()
+      return err(new SavedViewNotFoundError())
+    }
+    const isPublic = savedView.visibility === SavedViewVisibility.public
+    const isAuthor = savedView.authorId === userId
+
+    // Validate read access
+    if (access === 'read') {
+      if (isAuthor || isPublic) {
+        return ok()
+      } else {
+        return err(
+          new SavedViewNoAccessError({
+            message: 'You do not have permission to read this saved view.'
+          })
+        )
+      }
+    }
+
+    // Validate write access
+    // Check for write access to project first
+    const ensuredWriteAccess = await ensureImplicitProjectMemberWithWriteAccessFragment(
+      loaders
+    )({
+      userId,
+      projectId
+    })
+    if (ensuredWriteAccess.isErr) {
+      if (ensuredWriteAccess.error.code === ProjectNotEnoughPermissionsError.code)
+        return err(
+          new ProjectNotEnoughPermissionsError({
+            message:
+              "Your role on this project doesn't give you permission to update views."
+          })
+        )
+      return err(ensuredWriteAccess.error)
+    }
+
+    if (isAuthor) {
+      // authors can write whatever
+      return ok()
+    }
+
+    // Non-author project writers can make specific changes
+    switch (access) {
+      case WriteTypes.MoveView:
+      case WriteTypes.EditTitle:
+      case WriteTypes.EditDescription:
+      case WriteTypes.SetHomeView:
+        return ok()
+      case WriteTypes.UpdateGeneral:
+        return err(
+          new SavedViewNoAccessError({
+            message: 'You do not have permission to edit the view in this way'
+          })
+        )
+      default:
+        throwUncoveredError(access)
+    }
+  }
+
+/**
+ * Ensure the user can access the view group
+ */
+export const ensureCanAccessSavedViewGroupFragment: AuthPolicyEnsureFragment<
+  | typeof Loaders.getSavedViewGroup
+  | typeof Loaders.getProject
+  | typeof Loaders.getEnv
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspacePlan
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspaceSsoSession
+  | typeof Loaders.getProjectRole,
+  MaybeUserContext &
+    ProjectContext &
+    SavedViewGroupContext & {
+      access: 'read' | 'write'
+    },
+  InstanceType<
+    | typeof SavedViewGroupNotFoundError
+    | typeof ProjectNotFoundError
+    | typeof ServerNoAccessError
+    | typeof ServerNoSessionError
+    | typeof ProjectNoAccessError
+    | typeof WorkspaceNoAccessError
+    | typeof WorkspaceSsoSessionNoAccessError
+    | typeof ServerNotEnoughPermissionsError
+    | typeof ProjectNotEnoughPermissionsError
+    | typeof WorkspaceNotEnoughPermissionsError
+    | typeof WorkspacesNotEnabledError
+    | typeof WorkspaceReadOnlyError
+    | typeof WorkspacePlanNoFeatureAccessError
+    | typeof UngroupedSavedViewGroupLockError
+  >
+> =
+  (loaders) =>
+  async ({ userId, projectId, savedViewGroupId, access }) => {
+    const canUseSavedViews = await ensureCanUseProjectWorkspacePlanFeatureFragment(
+      loaders
+    )({
+      projectId,
+      feature: WorkspacePlanFeatures.SavedViews
+    })
+    if (canUseSavedViews.isErr) return err(canUseSavedViews.error)
+
+    const savedViewGroup = await loaders.getSavedViewGroup({
+      projectId,
+      groupId: savedViewGroupId
+    })
+    if (!savedViewGroup) return err(new SavedViewGroupNotFoundError())
+
+    if (access === 'read') {
+      return ok() // read access available to everyone who has access to project
+    }
+
+    // Prevent default group updates (as it doesnt exist)
+    if (isUngroupedGroup(savedViewGroup.id)) {
+      return err(new UngroupedSavedViewGroupLockError())
+    }
+
+    // groups have no visibility (yet), so authors AND project owners can mutate
+    const isAuthor = savedViewGroup.authorId === userId
+    const expectedProjectRole = isAuthor ? Roles.Stream.Contributor : Roles.Stream.Owner
+
+    const ensuredWriteAccess = await ensureImplicitProjectMemberWithWriteAccessFragment(
+      loaders
+    )({
+      userId,
+      projectId,
+      role: expectedProjectRole
+    })
+    if (ensuredWriteAccess.isErr) {
+      if (ensuredWriteAccess.error.code === ProjectNotEnoughPermissionsError.code)
+        return err(
+          new ProjectNotEnoughPermissionsError({
+            message:
+              "Your role on this project doesn't give you permission to update view groups."
+          })
+        )
+      return err(ensuredWriteAccess.error)
+    }
+
+    return ok()
+  }

package/src/authz/fragments/workspaces.spec.ts

@@ -1,16 +1,35 @@
 import { describe, expect, it } from 'vitest'
 import {
   ensureWorkspaceRoleAndSessionFragment,
-  ensureWorkspacesEnabledFragment
+  ensureWorkspacesEnabledFragment,
+  ensureUserIsWorkspaceAdminFragment,
+  ensureCanUseWorkspacePlanFeatureFragment
 } from './workspaces.js'
 import cryptoRandomString from 'crypto-random-string'
 import {
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
   WorkspaceNoAccessError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspaceReadOnlyError,
   WorkspacesNotEnabledError,
   WorkspaceSsoSessionNoAccessError
 } from '../domain/authErrors.js'
 import { OverridesOf } from '../../tests/helpers/types.js'
 import { parseFeatureFlags } from '../../environment/index.js'
+import { Roles } from '../../core/constants.js'
+import {
+  getEnvFake,
+  getWorkspaceFake,
+  getWorkspacePlanFake
+} from '../../tests/fakes.js'
+import {
+  PaidWorkspacePlans,
+  PaidWorkspacePlanStatuses,
+  WorkspacePlanFeatures
+} from '../../workspaces/index.js'
 
 describe('ensureWorkspaceRoleAndSessionFragment', () => {
   it('hides non existing workspaces behind a WorkspaceNoAccessError', async () => {
@@ -35,7 +54,7 @@ describe('ensureWorkspaceRoleAndSessionFragment', () => {
   })
   it('returns WorkspaceNoAccessError if the user does not have a workspace role', async () => {
     const result = await ensureWorkspaceRoleAndSessionFragment({
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'aaa',
         slug: 'bbb'
       }),
@@ -56,7 +75,7 @@ describe('ensureWorkspaceRoleAndSessionFragment', () => {
   })
   it('returns ok w/o checking session if user is a workspace guest', async () => {
     const result = await ensureWorkspaceRoleAndSessionFragment({
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'aaa',
         slug: 'bbb'
       }),
@@ -75,7 +94,7 @@ describe('ensureWorkspaceRoleAndSessionFragment', () => {
   })
   it('returns just(ok()) if user is a member and workspace has no SSO provider', async () => {
     const result = await ensureWorkspaceRoleAndSessionFragment({
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'aaa',
         slug: 'bbb'
       }),
@@ -92,7 +111,7 @@ describe('ensureWorkspaceRoleAndSessionFragment', () => {
   })
   it('returns WorkspaceSsoSessionInvalidError if user does not have an SSO session', async () => {
     const result = ensureWorkspaceRoleAndSessionFragment({
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'aaa',
         slug: 'bbb'
       }),
@@ -120,7 +139,7 @@ describe('ensureWorkspaceRoleAndSessionFragment', () => {
     validUntil.setDate(validUntil.getDate() - 1)
 
     const result = await ensureWorkspaceRoleAndSessionFragment({
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'aaa',
         slug: 'bbb'
       }),
@@ -148,7 +167,7 @@ describe('ensureWorkspaceRoleAndSessionFragment', () => {
     validUntil.setDate(validUntil.getDate() + 100)
 
     const result = await ensureWorkspaceRoleAndSessionFragment({
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'aaa',
         slug: 'bbb'
       }),
@@ -194,3 +213,211 @@ describe('ensureWorkspacesEnabledFragment', () => {
     })
   })
 })
+
+describe('ensureUserIsWorkspaceAdminFragment', () => {
+  const buildEnsureUserIsWorkspaAdminFragment = (
+    overrides?: Partial<Parameters<typeof ensureUserIsWorkspaceAdminFragment>[0]>
+  ) => {
+    const workspaceId = cryptoRandomString({ length: 9 })
+
+    return ensureUserIsWorkspaceAdminFragment({
+      getEnv: async () =>
+        parseFeatureFlags({
+          FF_WORKSPACES_MODULE_ENABLED: 'true'
+        }),
+      getServerRole: async () => Roles.Server.Admin,
+      getWorkspace: getWorkspaceFake({
+        id: workspaceId,
+        slug: cryptoRandomString({ length: 9 })
+      }),
+      getWorkspaceRole: async () => Roles.Workspace.Admin,
+      getWorkspaceSsoProvider: async () => null,
+      getWorkspaceSsoSession: async () => null,
+      getWorkspacePlan: getWorkspacePlanFake({ workspaceId }),
+      ...overrides
+    })
+  }
+
+  const getPolicyArgs = () => ({
+    userId: cryptoRandomString({ length: 9 }),
+    workspaceId: cryptoRandomString({ length: 9 })
+  })
+  it('returns error if workspaces is not enabled', async () => {
+    const policy = buildEnsureUserIsWorkspaAdminFragment({
+      getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'false' })
+    })
+
+    const result = await policy({
+      ...getPolicyArgs(),
+      userId: undefined
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspacesNotEnabledError.code
+    })
+  })
+  it('returns error if user is not logged in', async () => {
+    const policy = buildEnsureUserIsWorkspaAdminFragment()
+
+    const result = await policy({
+      ...getPolicyArgs(),
+      userId: undefined
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: ServerNoSessionError.code
+    })
+  })
+
+  it('returns error if user is not found', async () => {
+    const policy = buildEnsureUserIsWorkspaAdminFragment({
+      getServerRole: async () => null
+    })
+
+    const result = await policy(getPolicyArgs())
+
+    expect(result).toBeAuthErrorResult({
+      code: ServerNoAccessError.code
+    })
+  })
+
+  it('returns error if user is a server guest', async () => {
+    const policy = buildEnsureUserIsWorkspaAdminFragment({
+      getServerRole: async () => Roles.Server.Guest
+    })
+
+    const result = await policy(getPolicyArgs())
+
+    expect(result).toBeAuthErrorResult({
+      code: ServerNotEnoughPermissionsError.code
+    })
+  })
+
+  it('returns error if workspace does not exist', async () => {
+    const policy = buildEnsureUserIsWorkspaAdminFragment({
+      getWorkspace: async () => null
+    })
+
+    const result = await policy(getPolicyArgs())
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspaceNoAccessError.code
+    })
+  })
+
+  it('returns error if user is not workspace admin', async () => {
+    const policy = buildEnsureUserIsWorkspaAdminFragment({
+      getWorkspaceRole: async () => Roles.Workspace.Member
+    })
+
+    const result = await policy(getPolicyArgs())
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspaceNotEnoughPermissionsError.code
+    })
+  })
+
+  it('returns ok if user is workspace admin', async () => {
+    const policy = buildEnsureUserIsWorkspaAdminFragment()
+
+    const result = await policy(getPolicyArgs())
+
+    expect(result).toBeAuthOKResult()
+  })
+})
+
+describe('ensureCanUseWorkspacePlanFeatureFragment', () => {
+  const buildSUT = (
+    overrides?: OverridesOf<typeof ensureCanUseWorkspacePlanFeatureFragment>
+  ) =>
+    ensureCanUseWorkspacePlanFeatureFragment({
+      getEnv: getEnvFake({
+        FF_WORKSPACES_MODULE_ENABLED: true,
+        FF_SAVED_VIEWS_ENABLED: true
+      }),
+      getWorkspacePlan: getWorkspacePlanFake({
+        name: PaidWorkspacePlans.Pro,
+        status: PaidWorkspacePlanStatuses.Valid
+      }),
+      ...overrides
+    })
+
+  it('succeeds w/ valid workspace w/ feature access', async () => {
+    const sut = buildSUT()
+
+    const result = await sut({
+      workspaceId: cryptoRandomString({ length: 10 }),
+      feature: WorkspacePlanFeatures.HideSynchronizedBranding
+    })
+
+    expect(result).toBeOKResult()
+  })
+
+  it('fails if workspaces disabled', async () => {
+    const sut = buildSUT({
+      getEnv: getEnvFake({
+        FF_WORKSPACES_MODULE_ENABLED: false
+      })
+    })
+
+    const result = await sut({
+      workspaceId: cryptoRandomString({ length: 10 }),
+      feature: WorkspacePlanFeatures.HideSynchronizedBranding
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspacesNotEnabledError.code
+    })
+  })
+
+  it('fails if workspace plan readonly', async () => {
+    const sut = buildSUT({
+      getWorkspacePlan: getWorkspacePlanFake({
+        name: PaidWorkspacePlans.Pro,
+        status: PaidWorkspacePlanStatuses.Canceled
+      })
+    })
+
+    const result = await sut({
+      workspaceId: cryptoRandomString({ length: 10 }),
+      feature: WorkspacePlanFeatures.HideSynchronizedBranding
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspaceReadOnlyError.code
+    })
+  })
+
+  it('fails w/o plan', async () => {
+    const sut = buildSUT({
+      getWorkspacePlan: async () => null
+    })
+
+    const result = await sut({
+      workspaceId: cryptoRandomString({ length: 10 }),
+      feature: WorkspacePlanFeatures.HideSynchronizedBranding
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspaceNoAccessError.code
+    })
+  })
+
+  it('it fails if plan doesnt have access to feature', async () => {
+    const sut = buildSUT({
+      getWorkspacePlan: getWorkspacePlanFake({
+        name: PaidWorkspacePlans.Team,
+        status: PaidWorkspacePlanStatuses.Valid
+      })
+    })
+
+    const result = await sut({
+      workspaceId: cryptoRandomString({ length: 10 }),
+      feature: WorkspacePlanFeatures.HideSynchronizedBranding
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspacePlanNoFeatureAccessError.code
+    })
+  })
+})

package/src/authz/fragments/workspaces.ts

@@ -7,10 +7,14 @@ import {
 import {
   PersonalProjectsLimitedError,
   ProjectNotFoundError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
   WorkspaceLimitsReachedError,
   WorkspaceNoAccessError,
   WorkspaceNoEditorSeatError,
   WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError,
   WorkspaceReadOnlyError,
   WorkspacesNotEnabledError,
   WorkspaceSsoSessionNoAccessError
@@ -25,6 +29,11 @@ import {
 } from '../domain/context.js'
 import { isWorkspacePlanStatusReadOnly } from '../../workspaces/helpers/plans.js'
 import { hasEditorSeat } from '../checks/workspaceSeat.js'
+import { ensureMinimumServerRoleFragment } from './server.js'
+import {
+  WorkspacePlanFeatures,
+  workspacePlanHasAccessToFeature
+} from '../../workspaces/helpers/features.js'
 
 /**
  * Ensure user has a workspace role, and a valid SSO session (if SSO is configured)
@@ -303,3 +312,78 @@ export const ensureModelCanBeCreatedFragment: AuthPolicyEnsureFragment<
       return ok()
     }
   }
+
+export const ensureUserIsWorkspaceAdminFragment: AuthPolicyEnsureFragment<
+  | typeof Loaders.getEnv
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspaceSsoSession
+  | typeof Loaders.getWorkspacePlan,
+  WorkspaceContext & MaybeUserContext,
+  InstanceType<
+    | typeof WorkspaceNoAccessError
+    | typeof WorkspaceSsoSessionNoAccessError
+    | typeof WorkspacesNotEnabledError
+    | typeof ServerNoSessionError
+    | typeof ServerNoAccessError
+    | typeof ServerNotEnoughPermissionsError
+    | typeof WorkspaceNotEnoughPermissionsError
+  >
+> =
+  (loaders) =>
+  async ({ userId, workspaceId }) => {
+    const ensuredWorkspacesEnabled = await ensureWorkspacesEnabledFragment(loaders)({})
+    if (ensuredWorkspacesEnabled.isErr) return err(ensuredWorkspacesEnabled.error)
+
+    const ensuredServerRole = await ensureMinimumServerRoleFragment(loaders)({
+      userId,
+      role: Roles.Server.User
+    })
+
+    if (ensuredServerRole.isErr) return err(ensuredServerRole.error)
+
+    const ensuredWorkspaceAccess = await ensureWorkspaceRoleAndSessionFragment(loaders)(
+      {
+        userId: userId!,
+        workspaceId,
+        role: Roles.Workspace.Admin
+      }
+    )
+    if (ensuredWorkspaceAccess.isErr) return err(ensuredWorkspaceAccess.error)
+    return ok()
+  }
+
+/**
+ * Check if workspace has access to a specific feature
+ */
+export const ensureCanUseWorkspacePlanFeatureFragment: AuthPolicyEnsureFragment<
+  typeof Loaders.getWorkspacePlan | typeof Loaders.getEnv,
+  WorkspaceContext & { feature: WorkspacePlanFeatures },
+  | InstanceType<typeof WorkspaceNoAccessError>
+  | InstanceType<typeof WorkspaceReadOnlyError>
+  | InstanceType<typeof WorkspacePlanNoFeatureAccessError>
+  | InstanceType<typeof WorkspacesNotEnabledError>
+> =
+  (loaders) =>
+  async ({ workspaceId, feature }) => {
+    const ensuredWorkspacesEnabled = await ensureWorkspacesEnabledFragment(loaders)({})
+    if (ensuredWorkspacesEnabled.isErr) return err(ensuredWorkspacesEnabled.error)
+
+    const ensuredNotReadOnly = await ensureWorkspaceNotReadOnlyFragment(loaders)({
+      workspaceId
+    })
+    if (ensuredNotReadOnly.isErr) return err(ensuredNotReadOnly.error)
+
+    const workspacePlan = await loaders.getWorkspacePlan({ workspaceId })
+    if (!workspacePlan) return err(new WorkspaceNoAccessError())
+
+    const featureFlags = await loaders.getEnv()
+    const canUseFeature = workspacePlanHasAccessToFeature({
+      plan: workspacePlan.name,
+      feature,
+      featureFlags
+    })
+    return canUseFeature ? ok() : err(new WorkspacePlanNoFeatureAccessError())
+  }

package/src/authz/helpers/graphql.ts

@@ -6,7 +6,7 @@ export type GraphqlPermissionCheckResult = {
   authorized: boolean
   code: string
   message: string
-  payload: unknown
+  payload: Record<string, unknown> | null
 }
 
 export const toGraphqlResult = (
@@ -25,7 +25,7 @@ export const toGraphqlResult = (
       authorized: false,
       code: error.code,
       message: error.message,
-      payload: error.payload || null
+      payload: (error.payload || null) as Record<string, unknown> | null
     }
   }
 }

package/src/authz/index.ts

@@ -8,3 +8,4 @@ export * from './helpers/graphql.js'
 export * from './domain/authErrors.js'
 export { AuthPolicyResult } from './domain/policies.js'
 export { PersonalProjectsLimits } from './domain/projects/limits.js'
+export * from './domain/workspaces/operations.js'