@synchronized-console/shared 2.25.7 → 2.31.14

package/src/authz/policies/workspace/canCreateWorkspace.spec.ts

@@ -0,0 +1,380 @@
+import { assert, describe, expect, it } from 'vitest'
+import {
+  EligibleForExclusiveWorkspaceError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  WorkspacesNotEnabledError
+} from '../../domain/authErrors.js'
+import { canCreateWorkspacePolicy } from './canCreateWorkspace.js'
+import { parseFeatureFlags } from '../../../environment/index.js'
+import cryptoRandomString from 'crypto-random-string'
+import { Roles } from '../../../core/constants.js'
+
+const createTestArgs = () => ({
+  userId: cryptoRandomString({ length: 10 })
+})
+
+describe('canCreateWorkspacePolicy creates a function, that handles', () => {
+  describe('server environment configuration by', () => {
+    it('forbids creation if the workspaces module is not enabled', async () => {
+      const result = await canCreateWorkspacePolicy({
+        getEnv: async () =>
+          parseFeatureFlags({
+            FF_WORKSPACES_MODULE_ENABLED: 'false'
+          }),
+        getServerRole: async () => {
+          assert.fail()
+        },
+        getUsersCurrentAndEligibleToBecomeAMemberWorkspaces: async () => {
+          assert.fail()
+        }
+      })(createTestArgs())
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacesNotEnabledError.code
+      })
+    })
+  })
+
+  describe('user server roles', () => {
+    it('forbids creation for users without a session', async () => {
+      const result = await canCreateWorkspacePolicy({
+        getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+        getServerRole: async () => {
+          return null
+        },
+        getUsersCurrentAndEligibleToBecomeAMemberWorkspaces: async () => {
+          assert.fail()
+        }
+      })({})
+
+      expect(result).toBeAuthErrorResult({
+        code: ServerNoSessionError.code
+      })
+    })
+
+    it('forbids creation for users with no server role', async () => {
+      const result = await canCreateWorkspacePolicy({
+        getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+        getServerRole: async () => {
+          return null
+        },
+        getUsersCurrentAndEligibleToBecomeAMemberWorkspaces: async () => {
+          assert.fail()
+        }
+      })({ userId: cryptoRandomString({ length: 10 }) })
+
+      expect(result).toBeAuthErrorResult({
+        code: ServerNoAccessError.code
+      })
+    })
+
+    it('forbids creation for users with insufficient server role', async () => {
+      const result = await canCreateWorkspacePolicy({
+        getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+        getServerRole: async () => {
+          return Roles.Server.Guest
+        },
+        getUsersCurrentAndEligibleToBecomeAMemberWorkspaces: async () => {
+          assert.fail()
+        }
+      })(createTestArgs())
+
+      expect(result).toBeAuthErrorResult({
+        code: ServerNotEnoughPermissionsError.code
+      })
+    })
+  })
+
+  describe('workspace eligibility', () => {
+    it('forbids creation for users eligible for exclusive workspaces', async () => {
+      const userId = cryptoRandomString({ length: 10 })
+      const result = await canCreateWorkspacePolicy({
+        getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+        getServerRole: async () => {
+          return Roles.Server.User
+        },
+        getUsersCurrentAndEligibleToBecomeAMemberWorkspaces: async ({
+          userId: queriedUserId
+        }) => {
+          expect(queriedUserId).toBe(userId)
+          return [
+            {
+              id: cryptoRandomString({ length: 10 }),
+              name: 'Regular Workspace',
+              slug: 'regular-workspace',
+              isExclusive: false
+            },
+            {
+              id: cryptoRandomString({ length: 10 }),
+              name: 'Exclusive Workspace',
+              slug: 'exclusive-workspace',
+              isExclusive: true
+            }
+          ]
+        }
+      })({ userId })
+
+      expect(result).toBeAuthErrorResult({
+        code: EligibleForExclusiveWorkspaceError.code
+      })
+    })
+
+    it('allows creation for users not eligible for any exclusive workspaces', async () => {
+      const userId = cryptoRandomString({ length: 10 })
+      const result = await canCreateWorkspacePolicy({
+        getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+        getServerRole: async () => {
+          return Roles.Server.User
+        },
+        getUsersCurrentAndEligibleToBecomeAMemberWorkspaces: async ({
+          userId: queriedUserId
+        }) => {
+          expect(queriedUserId).toBe(userId)
+          return [
+            {
+              id: cryptoRandomString({ length: 10 }),
+              name: 'Regular Workspace 1',
+              slug: 'regular-workspace-1',
+              isExclusive: false
+            },
+            {
+              id: cryptoRandomString({ length: 10 }),
+              name: 'Regular Workspace 2',
+              slug: 'regular-workspace-2',
+              isExclusive: false
+            }
+          ]
+        }
+      })({ userId })
+
+      expect(result).toBeAuthOKResult()
+    })
+
+    it('allows creation for users with no eligible workspaces', async () => {
+      const userId = cryptoRandomString({ length: 10 })
+      const result = await canCreateWorkspacePolicy({
+        getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+        getServerRole: async () => {
+          return Roles.Server.User
+        },
+        getUsersCurrentAndEligibleToBecomeAMemberWorkspaces: async ({
+          userId: queriedUserId
+        }) => {
+          expect(queriedUserId).toBe(userId)
+          return []
+        }
+      })({ userId })
+
+      expect(result).toBeAuthOKResult()
+    })
+
+    it('allows creation for admin users even if eligible for exclusive workspaces', async () => {
+      const userId = cryptoRandomString({ length: 10 })
+      const result = await canCreateWorkspacePolicy({
+        getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+        getServerRole: async () => {
+          return Roles.Server.Admin
+        },
+        getUsersCurrentAndEligibleToBecomeAMemberWorkspaces: async ({
+          userId: queriedUserId
+        }) => {
+          expect(queriedUserId).toBe(userId)
+          return [
+            {
+              id: cryptoRandomString({ length: 10 }),
+              name: 'Exclusive Workspace',
+              slug: 'exclusive-workspace',
+              isExclusive: true,
+              role: Roles.Workspace.Admin
+            }
+          ]
+        }
+      })({ userId })
+
+      expect(result).toBeAuthOKResult()
+    })
+
+    it('allows creation for workspace admins of exclusive workspaces', async () => {
+      const userId = cryptoRandomString({ length: 10 })
+      const result = await canCreateWorkspacePolicy({
+        getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+        getServerRole: async () => {
+          return Roles.Server.User
+        },
+        getUsersCurrentAndEligibleToBecomeAMemberWorkspaces: async ({
+          userId: queriedUserId
+        }) => {
+          expect(queriedUserId).toBe(userId)
+          return [
+            {
+              id: cryptoRandomString({ length: 10 }),
+              name: 'Exclusive Workspace',
+              slug: 'exclusive-workspace',
+              isExclusive: true,
+              role: Roles.Workspace.Admin
+            }
+          ]
+        }
+      })({ userId })
+
+      expect(result).toBeAuthOKResult()
+    })
+
+    it('allows creation for workspace guests of exclusive workspaces', async () => {
+      const userId = cryptoRandomString({ length: 10 })
+      const result = await canCreateWorkspacePolicy({
+        getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+        getServerRole: async () => {
+          return Roles.Server.User
+        },
+        getUsersCurrentAndEligibleToBecomeAMemberWorkspaces: async ({
+          userId: queriedUserId
+        }) => {
+          expect(queriedUserId).toBe(userId)
+          return [
+            {
+              id: cryptoRandomString({ length: 10 }),
+              name: 'Exclusive Workspace',
+              slug: 'exclusive-workspace',
+              isExclusive: true,
+              role: Roles.Workspace.Guest
+            }
+          ]
+        }
+      })({ userId })
+
+      expect(result).toBeAuthOKResult()
+    })
+
+    it('forbids creation for workspace members of exclusive workspaces', async () => {
+      const userId = cryptoRandomString({ length: 10 })
+      const result = await canCreateWorkspacePolicy({
+        getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+        getServerRole: async () => {
+          return Roles.Server.User
+        },
+        getUsersCurrentAndEligibleToBecomeAMemberWorkspaces: async ({
+          userId: queriedUserId
+        }) => {
+          expect(queriedUserId).toBe(userId)
+          return [
+            {
+              id: cryptoRandomString({ length: 10 }),
+              name: 'Exclusive Workspace',
+              slug: 'exclusive-workspace',
+              isExclusive: true,
+              role: Roles.Workspace.Member
+            }
+          ]
+        }
+      })({ userId })
+
+      expect(result).toBeAuthErrorResult({
+        code: EligibleForExclusiveWorkspaceError.code
+      })
+    })
+
+    it('forbids creation for workspace admins if they have a member role on an exclusive workspace', async () => {
+      const userId = cryptoRandomString({ length: 10 })
+      const result = await canCreateWorkspacePolicy({
+        getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+        getServerRole: async () => {
+          return Roles.Server.User
+        },
+        getUsersCurrentAndEligibleToBecomeAMemberWorkspaces: async ({
+          userId: queriedUserId
+        }) => {
+          expect(queriedUserId).toBe(userId)
+          return [
+            {
+              id: cryptoRandomString({ length: 10 }),
+              name: 'Exclusive Workspace 1',
+              slug: 'exclusive-workspace-1',
+              isExclusive: true,
+              role: Roles.Workspace.Admin
+            },
+            {
+              id: cryptoRandomString({ length: 10 }),
+              name: 'Exclusive Workspace 2',
+              slug: 'exclusive-workspace-2',
+              isExclusive: true,
+              role: Roles.Workspace.Member
+            }
+          ]
+        }
+      })({ userId })
+
+      expect(result).toBeAuthErrorResult({
+        code: EligibleForExclusiveWorkspaceError.code
+      })
+    })
+
+    it('allows creation for workspace admins even with mixed exclusive workspace roles', async () => {
+      const userId = cryptoRandomString({ length: 10 })
+      const result = await canCreateWorkspacePolicy({
+        getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+        getServerRole: async () => {
+          return Roles.Server.User
+        },
+        getUsersCurrentAndEligibleToBecomeAMemberWorkspaces: async ({
+          userId: queriedUserId
+        }) => {
+          expect(queriedUserId).toBe(userId)
+          return [
+            {
+              id: cryptoRandomString({ length: 10 }),
+              name: 'Exclusive Workspace 1',
+              slug: 'exclusive-workspace-1',
+              isExclusive: true,
+              role: Roles.Workspace.Admin
+            },
+            {
+              id: cryptoRandomString({ length: 10 }),
+              name: 'Exclusive Workspace 2',
+              slug: 'exclusive-workspace-2',
+              isExclusive: true,
+              role: Roles.Workspace.Guest
+            }
+          ]
+        }
+      })({ userId })
+
+      expect(result).toBeAuthOKResult()
+    })
+
+    it('allows creation when all workspace roles pass the policy', async () => {
+      const userId = cryptoRandomString({ length: 10 })
+      const result = await canCreateWorkspacePolicy({
+        getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+        getServerRole: async () => {
+          return Roles.Server.User
+        },
+        getUsersCurrentAndEligibleToBecomeAMemberWorkspaces: async ({
+          userId: queriedUserId
+        }) => {
+          expect(queriedUserId).toBe(userId)
+          return [
+            {
+              id: cryptoRandomString({ length: 10 }),
+              name: 'Exclusive Workspace 1',
+              slug: 'exclusive-workspace-1',
+              isExclusive: false,
+              role: Roles.Workspace.Member
+            },
+            {
+              id: cryptoRandomString({ length: 10 }),
+              name: 'Exclusive Workspace 2',
+              slug: 'exclusive-workspace-2',
+              isExclusive: true,
+              role: Roles.Workspace.Guest
+            }
+          ]
+        }
+      })({ userId })
+
+      expect(result).toBeAuthOKResult()
+    })
+  })
+})

package/src/authz/policies/workspace/canCreateWorkspace.ts

@@ -0,0 +1,77 @@
+import { err, ok } from 'true-myth/result'
+import {
+  EligibleForExclusiveWorkspaceError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  WorkspacesNotEnabledError
+} from '../../domain/authErrors.js'
+import { MaybeUserContext } from '../../domain/context.js'
+import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js'
+import { AuthPolicy } from '../../domain/policies.js'
+import { ensureWorkspacesEnabledFragment } from '../../fragments/workspaces.js'
+import { ensureMinimumServerRoleFragment } from '../../fragments/server.js'
+import { Roles } from '../../../core/constants.js'
+import { throwUncoveredError } from '../../../core/index.js'
+
+type PolicyArgs = MaybeUserContext
+type PolicyLoaderKeys =
+  | typeof AuthCheckContextLoaderKeys.getEnv
+  | typeof AuthCheckContextLoaderKeys.getUsersCurrentAndEligibleToBecomeAMemberWorkspaces
+  | typeof AuthCheckContextLoaderKeys.getServerRole
+
+type PolicyErrors = InstanceType<
+  | typeof WorkspacesNotEnabledError
+  | typeof ServerNoSessionError
+  | typeof ServerNoAccessError
+  | typeof ServerNotEnoughPermissionsError
+  | typeof EligibleForExclusiveWorkspaceError
+>
+
+export const canCreateWorkspacePolicy: AuthPolicy<
+  PolicyLoaderKeys,
+  PolicyArgs,
+  PolicyErrors
+> =
+  (loaders) =>
+  async ({ userId }) => {
+    const ensuredWorkspacesEnabled = await ensureWorkspacesEnabledFragment(loaders)({})
+    if (ensuredWorkspacesEnabled.isErr) return err(ensuredWorkspacesEnabled.error)
+
+    const ensuredServerRole = await ensureMinimumServerRoleFragment(loaders)({
+      userId,
+      role: Roles.Server.User
+    })
+    if (ensuredServerRole.isErr) return err(ensuredServerRole.error)
+
+    // userId is not null here, ensured by the serverRoleFragment
+    const workspaces =
+      await loaders.getUsersCurrentAndEligibleToBecomeAMemberWorkspaces({
+        userId: userId!
+      })
+    const isUserEligibleForExclusiveWorkspaces = workspaces.some((w) => {
+      if (w.isExclusive) {
+        // if the user has no role in the workspace, means they are eligible
+        // to join it via an invite or discovery
+        if (!w.role) return true
+        // for exclusive workspaces, if the user has a role, some of them are not affected by this policy
+        // ie.: Workspace admins of exclusive workspaces should be able to create new ones
+        //      also guests should not be bound by this rule
+        switch (w.role) {
+          case Roles.Workspace.Admin:
+          case Roles.Workspace.Guest:
+            return false
+          case Roles.Workspace.Member:
+            return true
+          default:
+            throwUncoveredError(w.role)
+        }
+      }
+      return false
+    })
+
+    if (isUserEligibleForExclusiveWorkspaces) {
+      return err(new EligibleForExclusiveWorkspaceError())
+    }
+    return ok()
+  }

package/src/authz/policies/workspace/canListDashboards.ts

@@ -0,0 +1,53 @@
+import { err, ok } from 'true-myth/result'
+import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js'
+import { MaybeUserContext, WorkspaceContext } from '../../domain/context.js'
+import {
+  DashboardsNotEnabledError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError
+} from '../../domain/authErrors.js'
+import { AuthPolicy } from '../../domain/policies.js'
+import {
+  ensureDashboardsEnabledFragment,
+  ensureWorkspaceDashboardsFeatureAccessFragment
+} from '../../fragments/dashboards.js'
+import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js'
+import { Roles } from '../../../core/constants.js'
+
+type PolicyLoaderKeys =
+  | typeof AuthCheckContextLoaderKeys.getEnv
+  | typeof AuthCheckContextLoaderKeys.getWorkspaceRole
+  | typeof AuthCheckContextLoaderKeys.getWorkspacePlan
+
+type PolicyArgs = MaybeUserContext & WorkspaceContext
+
+type PolicyErrors = InstanceType<
+  | typeof DashboardsNotEnabledError
+  | typeof WorkspaceNotEnoughPermissionsError
+  | typeof WorkspacePlanNoFeatureAccessError
+>
+
+export const canListDashboardsPolicy: AuthPolicy<
+  PolicyLoaderKeys,
+  PolicyArgs,
+  PolicyErrors
+> =
+  (loaders) =>
+  async ({ userId, workspaceId }) => {
+    const isDashboardsEnabled = await ensureDashboardsEnabledFragment(loaders)({})
+    if (isDashboardsEnabled.isErr) return err(isDashboardsEnabled.error)
+
+    const ensuredFeatureAccess = await ensureWorkspaceDashboardsFeatureAccessFragment(
+      loaders
+    )({ workspaceId })
+    if (ensuredFeatureAccess.isErr) return err(ensuredFeatureAccess.error)
+
+    const isWorkspaceMember = await hasMinimumWorkspaceRole(loaders)({
+      userId: userId!,
+      workspaceId,
+      role: Roles.Workspace.Member
+    })
+    if (!isWorkspaceMember) return err(new WorkspaceNotEnoughPermissionsError())
+
+    return ok()
+  }

package/src/authz/policies/workspace/canReadMemberEmail.spec.ts

@@ -1,8 +1,6 @@
-import cryptoRandomString from 'crypto-random-string'
 import { Roles } from '../../../core/constants.js'
 import { parseFeatureFlags } from '../../../environment/index.js'
-import { Workspace } from '../../domain/workspaces/types.js'
-import { WorkspacePlan } from '../../../workspaces/index.js'
+import cryptoRandomString from 'crypto-random-string'
 import { describe, expect, it } from 'vitest'
 import {
   ServerNoAccessError,
@@ -13,45 +11,36 @@ import {
   WorkspacesNotEnabledError
 } from '../../domain/authErrors.js'
 import { canReadMemberEmailPolicy } from './canReadMemberEmail.js'
+import { getWorkspaceFake, getWorkspacePlanFake } from '../../../tests/fakes.js'
 
-const buildCanReadMemberEmailPolicy = (
-  overrides?: Partial<Parameters<typeof canReadMemberEmailPolicy>[0]>
-) => {
+describe('canReadMemberEmailPolicy', () => {
   const workspaceId = cryptoRandomString({ length: 9 })
 
-  return canReadMemberEmailPolicy({
-    getEnv: async () =>
-      parseFeatureFlags({
-        FF_WORKSPACES_MODULE_ENABLED: 'true'
-      }),
-    getServerRole: async () => Roles.Server.Admin,
-    getWorkspace: async () => {
-      return {
+  const buildCanReadMemberEmailPolicy = (
+    overrides?: Partial<Parameters<typeof canReadMemberEmailPolicy>[0]>
+  ) => {
+    return canReadMemberEmailPolicy({
+      getEnv: async () =>
+        parseFeatureFlags({
+          FF_WORKSPACES_MODULE_ENABLED: 'true'
+        }),
+      getServerRole: async () => Roles.Server.Admin,
+      getWorkspace: getWorkspaceFake({
         id: workspaceId,
         slug: cryptoRandomString({ length: 9 })
-      } as Workspace
-    },
-    getWorkspaceRole: async () => Roles.Workspace.Admin,
-    getWorkspaceSsoProvider: async () => null,
-    getWorkspaceSsoSession: async () => null,
-    getWorkspacePlan: async () => {
-      return {
-        workspaceId,
-        name: 'unlimited',
-        status: 'valid',
-        createdAt: new Date()
-      } as WorkspacePlan
-    },
-    ...overrides
-  })
-}
-
-const getPolicyArgs = () => ({
-  userId: cryptoRandomString({ length: 9 }),
-  workspaceId: cryptoRandomString({ length: 9 })
-})
+      }),
+      getWorkspaceRole: async () => Roles.Workspace.Admin,
+      getWorkspaceSsoProvider: async () => null,
+      getWorkspaceSsoSession: async () => null,
+      getWorkspacePlan: getWorkspacePlanFake({ workspaceId }),
+      ...overrides
+    })
+  }
 
-describe('canReadMemberEmailPolicy', () => {
+  const getPolicyArgs = () => ({
+    userId: cryptoRandomString({ length: 9 }),
+    workspaceId
+  })
   it('returns error if workspaces is not enabled', async () => {
     const policy = buildCanReadMemberEmailPolicy({
       getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'false' })

package/src/authz/policies/workspace/canReadMemberEmail.ts

@@ -1,11 +1,7 @@
-import { err, ok } from 'true-myth/result'
 import { MaybeUserContext, WorkspaceContext } from '../../domain/context.js'
 import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js'
 import { AuthPolicy } from '../../domain/policies.js'
-import {
-  ensureWorkspaceRoleAndSessionFragment,
-  ensureWorkspacesEnabledFragment
-} from '../../fragments/workspaces.js'
+import { ensureUserIsWorkspaceAdminFragment } from '../../fragments/workspaces.js'
 import {
   ServerNoAccessError,
   ServerNoSessionError,
@@ -15,8 +11,6 @@ import {
   WorkspacesNotEnabledError,
   WorkspaceSsoSessionNoAccessError
 } from '../../domain/authErrors.js'
-import { ensureMinimumServerRoleFragment } from '../../fragments/server.js'
-import { Roles } from '../../../core/constants.js'
 
 type PolicyArgs = MaybeUserContext & WorkspaceContext
 
@@ -29,14 +23,15 @@ type PolicyLoaderKeys =
   | typeof AuthCheckContextLoaderKeys.getWorkspaceSsoSession
   | typeof AuthCheckContextLoaderKeys.getWorkspacePlan
 
-type PolicyErrors =
-  | InstanceType<typeof WorkspaceNoAccessError>
-  | InstanceType<typeof WorkspaceSsoSessionNoAccessError>
-  | InstanceType<typeof WorkspacesNotEnabledError>
-  | InstanceType<typeof ServerNoSessionError>
-  | InstanceType<typeof ServerNoAccessError>
-  | InstanceType<typeof ServerNotEnoughPermissionsError>
-  | InstanceType<typeof WorkspaceNotEnoughPermissionsError>
+type PolicyErrors = InstanceType<
+  | typeof WorkspaceNoAccessError
+  | typeof WorkspaceSsoSessionNoAccessError
+  | typeof WorkspacesNotEnabledError
+  | typeof ServerNoSessionError
+  | typeof ServerNoAccessError
+  | typeof ServerNotEnoughPermissionsError
+  | typeof WorkspaceNotEnoughPermissionsError
+>
 
 export const canReadMemberEmailPolicy: AuthPolicy<
   PolicyLoaderKeys,
@@ -45,23 +40,5 @@ export const canReadMemberEmailPolicy: AuthPolicy<
 > =
   (loaders) =>
   async ({ userId, workspaceId }) => {
-    const ensuredWorkspacesEnabled = await ensureWorkspacesEnabledFragment(loaders)({})
-    if (ensuredWorkspacesEnabled.isErr) return err(ensuredWorkspacesEnabled.error)
-
-    const ensuredServerRole = await ensureMinimumServerRoleFragment(loaders)({
-      userId,
-      role: Roles.Server.User
-    })
-
-    if (ensuredServerRole.isErr) return err(ensuredServerRole.error)
-
-    const ensuredWorkspaceAccess = await ensureWorkspaceRoleAndSessionFragment(loaders)(
-      {
-        userId: userId!,
-        workspaceId,
-        role: Roles.Workspace.Admin
-      }
-    )
-    if (ensuredWorkspaceAccess.isErr) return err(ensuredWorkspaceAccess.error)
-    return ok()
+    return ensureUserIsWorkspaceAdminFragment(loaders)({ userId, workspaceId })
   }

package/src/authz/policies/workspace/canReceiveProjectsUpdatedMessage.spec.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { canReceiveWorkspaceProjectsUpdatedMessagePolicy } from './canReceiveProjectsUpdatedMessage.js'
 import { OverridesOf } from '../../../tests/helpers/types.js'
-import { getProjectFake } from '../../../tests/fakes.js'
+import { getProjectFake, getWorkspaceFake } from '../../../tests/fakes.js'
 import { Roles } from '../../../core/constants.js'
 import { TIME_MS } from '../../../core/index.js'
 import { parseFeatureFlags } from '../../../environment/index.js'
@@ -25,10 +25,7 @@ describe('canReceiveWorkspaceProjectsUpdatedMessagePolicy', () => {
       }),
       getProjectRole: async () => Roles.Stream.Reviewer,
       getServerRole: async () => Roles.Server.Guest,
-      getWorkspace: async () => ({
-        id: 'workspace-id',
-        slug: 'workspace-slug'
-      }),
+      getWorkspace: getWorkspaceFake({ id: 'workspace-id', slug: 'workspace-slug' }),
       getWorkspaceRole: async () => Roles.Workspace.Guest,
       getWorkspaceSsoProvider: async () => ({
         providerId: 'provider-id'