@tuturuuu/utils 0.20.0 → 0.21.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.21.0](https://github.com/tutur3u/platform/compare/utils-v0.20.0...utils-v0.21.0) (2026-07-28)
+
+
+### Features
+
+* **git:** add fast repository satellite ([51982ae](https://github.com/tutur3u/platform/commit/51982ae8618bb7463e30c97f6e731551ec673660))
+
+
+### Bug Fixes
+
+* **workspaces:** preserve creator administration access ([cea32ea](https://github.com/tutur3u/platform/commit/cea32ea22acaae6be6e39552be4af47e6f4dcdc7))
+
 ## [0.20.0](https://github.com/tutur3u/platform/compare/utils-v0.19.0...utils-v0.20.0) (2026-07-27)
 
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -24,7 +24,7 @@
     "@tiptap/react": "3.28.0",
     "@tuturuuu/google": "0.1.0",
     "@tuturuuu/icons": "0.1.0",
-    "@tuturuuu/internal-api": "0.24.0",
+    "@tuturuuu/internal-api": "0.25.0",
     "@tuturuuu/supabase": "0.5.0",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.0",
@@ -45,7 +45,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.23.0",
+    "@tuturuuu/types": "0.24.0",
     "@tuturuuu/typescript-config": "0.1.1",
     "@types/diff": "^8.0.0",
     "@types/node": "^26.1.1",

package/src/__tests__/app-url.test.ts

@@ -298,6 +298,7 @@ describe('Portless app origin registry', () => {
       'https://external.tuturuuu.localhost',
       'https://finance.tuturuuu.localhost',
       'https://forms.tuturuuu.localhost',
+      'https://git.tuturuuu.localhost',
       'https://hive.tuturuuu.localhost',
       'https://realtime.hive.tuturuuu.localhost',
       'https://infra.tuturuuu.localhost',

package/src/__tests__/permissions.test.tsx

@@ -32,6 +32,7 @@ describe('workspace permission catalog', () => {
     expect(permissionIds).not.toContain('view_infrastructure');
     expect(permissionIds).not.toContain('manage_infrastructure_stress_tests');
     expect(permissionIds).not.toContain('manage_internal_accounts');
+    expect(permissionIds).not.toContain('manage_git_repositories');
     expect(permissionIds).not.toContain('manage_workspace_secrets');
   });
 
@@ -42,6 +43,7 @@ describe('workspace permission catalog', () => {
     }).map((permission) => permission.id);
 
     expect(rootPermissionIds).toContain('manage_internal_accounts');
+    expect(rootPermissionIds).toContain('manage_git_repositories');
   });
 
   it('keeps internal account permission translations in shared role editors', () => {
@@ -75,6 +77,7 @@ describe('workspace permission catalog', () => {
     expect(permissionIds).toContain('view_infrastructure');
     expect(permissionIds).toContain('manage_infrastructure_stress_tests');
     expect(permissionIds).toContain('manage_internal_accounts');
+    expect(permissionIds).toContain('manage_git_repositories');
     expect(permissionIds).toContain('manage_external_migrations');
     expect(permissionIds).toContain('manage_workspace_secrets');
     expect(new Set(permissionIds).size).toBe(permissionIds.length);

package/src/__tests__/workspace-helper.test.ts

@@ -560,24 +560,153 @@ describe('getPermissions membership type gate', () => {
     expect(adminAuthGetUser).not.toHaveBeenCalled();
     expect(personalWorkspaceQuery.eq).toHaveBeenCalledWith('personal', true);
     expect(personalWorkspaceQuery.eq).toHaveBeenCalledWith(
-      'workspace_members.user_id',
+      'creator_id',
       'user-1'
     );
     expect(membershipQuery.eq).toHaveBeenCalledWith(
       'ws_id',
       personalWorkspaceId
     );
-    expect(roleMembersQuery.eq).toHaveBeenCalledWith(
-      'workspace_roles.ws_id',
-      personalWorkspaceId
-    );
     expect(workspaceQuery.eq).toHaveBeenCalledWith('id', personalWorkspaceId);
-    expect(defaultPermissionsQuery.eq).toHaveBeenCalledWith(
-      'ws_id',
-      personalWorkspaceId
+    expect(roleMembersQuery.select).not.toHaveBeenCalled();
+    expect(defaultPermissionsQuery.select).not.toHaveBeenCalled();
+  });
+
+  it('grants full member permissions to a creator with a missing membership row', async () => {
+    const workspaceId = '11111111-1111-4111-8111-111111111111';
+    const membershipQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      maybeSingle: vi.fn(),
+    };
+    membershipQuery.select.mockReturnValue(membershipQuery);
+    membershipQuery.eq.mockReturnValue(membershipQuery);
+    membershipQuery.maybeSingle.mockResolvedValue({
+      data: null,
+      error: null,
+    });
+
+    const workspaceQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      single: vi.fn(),
+    };
+    workspaceQuery.select.mockReturnValue(workspaceQuery);
+    workspaceQuery.eq.mockReturnValue(workspaceQuery);
+    workspaceQuery.single.mockResolvedValue({
+      data: { creator_id: 'user-1' },
+      error: null,
+    });
+
+    mockCreateAdminClient.mockResolvedValue({
+      from: vi.fn((table: string) => {
+        if (table === 'workspace_members') return membershipQuery;
+        if (table === 'workspaces') return workspaceQuery;
+        throw new Error(`Unexpected admin table lookup: ${table}`);
+      }),
+    });
+
+    const permissions = await getPermissions({
+      user: { id: 'user-1', email: 'creator@example.com' },
+      wsId: workspaceId,
+    });
+
+    expect(permissions?.membershipType).toBe('MEMBER');
+    expect(permissions?.containsPermission('manage_workspace_settings')).toBe(
+      true
+    );
+    expect(permissions?.containsPermission('manage_workspace_members')).toBe(
+      true
+    );
+  });
+
+  it('normalizes a creator GUEST membership to effective MEMBER permissions', async () => {
+    const workspaceId = '11111111-1111-4111-8111-111111111111';
+    const membershipQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      maybeSingle: vi.fn(),
+    };
+    membershipQuery.select.mockReturnValue(membershipQuery);
+    membershipQuery.eq.mockReturnValue(membershipQuery);
+    membershipQuery.maybeSingle.mockResolvedValue({
+      data: { type: 'GUEST' },
+      error: null,
+    });
+
+    const workspaceQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      single: vi.fn(),
+    };
+    workspaceQuery.select.mockReturnValue(workspaceQuery);
+    workspaceQuery.eq.mockReturnValue(workspaceQuery);
+    workspaceQuery.single.mockResolvedValue({
+      data: { creator_id: 'user-1' },
+      error: null,
+    });
+
+    mockCreateAdminClient.mockResolvedValue({
+      from: vi.fn((table: string) => {
+        if (table === 'workspace_members') return membershipQuery;
+        if (table === 'workspaces') return workspaceQuery;
+        throw new Error(`Unexpected admin table lookup: ${table}`);
+      }),
+    });
+
+    const permissions = await getPermissions({
+      user: { id: 'user-1', email: 'creator@example.com' },
+      wsId: workspaceId,
+    });
+
+    expect(permissions?.membershipType).toBe('MEMBER');
+    expect(permissions?.containsPermission('manage_workspace_roles')).toBe(
+      true
     );
   });
 
+  it('denies an unrelated user when the membership row is missing', async () => {
+    const workspaceId = '11111111-1111-4111-8111-111111111111';
+    const membershipQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      maybeSingle: vi.fn(),
+    };
+    membershipQuery.select.mockReturnValue(membershipQuery);
+    membershipQuery.eq.mockReturnValue(membershipQuery);
+    membershipQuery.maybeSingle.mockResolvedValue({
+      data: null,
+      error: null,
+    });
+
+    const workspaceQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      single: vi.fn(),
+    };
+    workspaceQuery.select.mockReturnValue(workspaceQuery);
+    workspaceQuery.eq.mockReturnValue(workspaceQuery);
+    workspaceQuery.single.mockResolvedValue({
+      data: { creator_id: 'owner-1' },
+      error: null,
+    });
+
+    mockCreateAdminClient.mockResolvedValue({
+      from: vi.fn((table: string) => {
+        if (table === 'workspace_members') return membershipQuery;
+        if (table === 'workspaces') return workspaceQuery;
+        throw new Error(`Unexpected admin table lookup: ${table}`);
+      }),
+    });
+
+    const permissions = await getPermissions({
+      user: { id: 'user-1', email: 'unrelated@example.com' },
+      wsId: workspaceId,
+    });
+
+    expect(permissions).toBeNull();
+  });
+
   it('returns a read-only permission context for a guest without defaults', async () => {
     const membershipQuery = {
       select: vi.fn(),

package/src/internal-domains.ts

@@ -116,6 +116,10 @@ export const PRODUCTION_INTERNAL_APP_DOMAINS = [
     name: 'forms',
     url: 'https://forms.tuturuuu.com',
   },
+  {
+    name: 'git',
+    url: 'https://git.tuturuuu.com',
+  },
   {
     name: 'hive',
     url: 'https://hive.tuturuuu.com',
@@ -231,6 +235,10 @@ export const PORTLESS_INTERNAL_APP_DOMAINS = [
     name: 'forms',
     url: getTuturuuuPortlessAppOrigin('forms'),
   },
+  {
+    name: 'git',
+    url: getTuturuuuPortlessAppOrigin('git'),
+  },
   {
     name: 'hive',
     url: getTuturuuuPortlessAppOrigin('hive'),
@@ -342,6 +350,10 @@ export const LOCALHOST_INTERNAL_APP_DOMAINS = [
     name: 'forms',
     url: 'http://localhost:7828',
   },
+  {
+    name: 'git',
+    url: 'http://localhost:7830',
+  },
   {
     name: 'hive',
     url: 'http://localhost:7814',

package/src/launchable-apps.test.ts

@@ -32,6 +32,7 @@ describe('launchable apps', () => {
     });
     expect(getLaunchableAppByTitle('Tuturuuu')?.slug).toBe('platform');
     expect(getLaunchableAppByTitle('questionnaires')?.slug).toBe('forms');
+    expect(getLaunchableAppByTitle('repositories')?.slug).toBe('git');
     expect(getLaunchableAppByTitle('apps gateway')?.slug).toBe('apps');
   });
 
@@ -45,6 +46,11 @@ describe('launchable apps', () => {
     expect(getLaunchableApp('external')).toBeNull();
     expect(getLaunchableApp('playground')).toBeNull();
     expect(getLaunchableApp('platform')?.category).toBe('productivity');
+    expect(getLaunchableApp('git')).toMatchObject({
+      defaultPath: '/tutur3u/platform',
+      localhostOrigin: 'http://localhost:7830',
+      productionUrl: 'https://git.tuturuuu.com',
+    });
     expect(getLaunchableApp('apps')?.category).toBe('miscellaneous');
     expect(getLaunchableApp('cms')?.category).toBe('operations');
     expect(getLaunchableApp('rewise')?.category).toBe('ai');

package/src/launchable-apps.ts

@@ -113,6 +113,18 @@ export const LAUNCHABLE_APPS = [
     title: 'Drive',
     workspacePathResolver: workspaceRootPath,
   },
+  {
+    aliases: ['Source', 'Repositories', 'GitHub', 'Code'],
+    appRoot: 'apps/git',
+    category: 'productivity',
+    defaultPath: '/tutur3u/platform',
+    localhostOrigin: 'http://localhost:7830',
+    packageName: '@tuturuuu/git',
+    portlessApp: 'git',
+    productionUrl: 'https://git.tuturuuu.com',
+    slug: 'git',
+    title: 'Git',
+  },
   {
     aliases: ['App Launcher', 'Gateway', 'Apps Gateway'],
     appRoot: 'apps/apps',

package/src/permissions.tsx

@@ -19,6 +19,7 @@ import {
   FileKey2,
   FileText,
   FlaskConical,
+  GitBranch,
   HandCoins,
   HardDrive,
   House,
@@ -131,6 +132,16 @@ export const permissionGroups = ({
                   disableOnProduction: false,
                   disabled: false,
                 },
+                {
+                  id: 'manage_git_repositories' as PermissionId,
+                  icon: <GitBranch />,
+                  title: t('ws-roles.manage_git_repositories'),
+                  description: t(
+                    'ws-roles.manage_git_repositories_description'
+                  ),
+                  disableOnProduction: false,
+                  disabled: false,
+                },
                 {
                   id: 'manage_mobile_deployment_vault' as PermissionId,
                   icon: <FileKey2 />,

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.29.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.30.0'); // x-release-please-version
   });
 
   it('preserves the source timestamp in builtAt and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.29.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.30.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   /** ISO timestamp of the source commit used for the build, not deployment time. */

package/src/portless.ts

@@ -17,6 +17,7 @@ export const TUTURUUU_PORTLESS_APP_ORIGINS = {
   external: `https://external.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   finance: `https://finance.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   forms: `https://forms.${TUTURUUU_PORTLESS_ROOT_HOST}`,
+  git: `https://git.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   hive: `https://hive.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   'hive-realtime': `https://realtime.hive.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   infra: `https://infra.${TUTURUUU_PORTLESS_ROOT_HOST}`,

package/src/workspace-helper.ts

@@ -689,19 +689,32 @@ async function resolveWorkspaceIdForPermissions({
     return normalizeWorkspaceId(wsId, authorizationClient);
   }
 
-  const { data: workspace, error } = await authorizationClient
-    .from('workspaces')
-    .select('id, workspace_members!inner(user_id, type)')
-    .eq('personal', true)
-    .eq('workspace_members.user_id', principal.id)
-    .eq('workspace_members.type', 'MEMBER')
-    .maybeSingle();
+  const { data: creatorWorkspace, error: creatorWorkspaceError } =
+    await authorizationClient
+      .from('workspaces')
+      .select('id')
+      .eq('personal', true)
+      .eq('creator_id', principal.id)
+      .maybeSingle();
+
+  if (!creatorWorkspaceError && creatorWorkspace?.id) {
+    return creatorWorkspace.id;
+  }
 
-  if (error || !workspace?.id) {
+  const { data: memberWorkspace, error: memberWorkspaceError } =
+    await authorizationClient
+      .from('workspaces')
+      .select('id, workspace_members!inner(user_id, type)')
+      .eq('personal', true)
+      .eq('workspace_members.user_id', principal.id)
+      .eq('workspace_members.type', 'MEMBER')
+      .maybeSingle();
+
+  if (memberWorkspaceError || !memberWorkspace?.id) {
     throw new Error('Personal workspace not found');
   }
 
-  return workspace.id;
+  return memberWorkspace.id;
 }
 
 /**
@@ -761,7 +774,7 @@ async function getPermissionsImpl({
   let resolvedWorkspaceId: string;
   try {
     resolvedWorkspaceId = await resolveWorkspaceIdForPermissions({
-      authorizationClient: authorizationClient as TypedSupabaseClient,
+      authorizationClient: sbAdmin,
       principal,
       wsId,
     });
@@ -769,21 +782,39 @@ async function getPermissionsImpl({
     return null;
   }
 
-  const membership = await verifyWorkspaceMembershipType({
-    wsId: resolvedWorkspaceId,
-    userId,
-    supabase: authorizationClient as TypedSupabaseClient,
-    requiredType: 'ANY',
-  });
+  const [membership, workspaceRes] = await Promise.all([
+    verifyWorkspaceMembershipType({
+      wsId: resolvedWorkspaceId,
+      userId,
+      supabase: authorizationClient as TypedSupabaseClient,
+      requiredType: 'ANY',
+    }),
+    sbAdmin
+      .from('workspaces')
+      .select('creator_id')
+      .eq('id', resolvedWorkspaceId)
+      .single(),
+  ]);
 
-  if (!membership.ok) {
+  const { data: workspaceData, error: workspaceError } = workspaceRes;
+
+  if (workspaceError || !workspaceData) {
+    console.info('Workspace not found in getPermissions', resolvedWorkspaceId);
     return null;
   }
 
-  const membershipType = membership.membershipType ?? 'MEMBER';
+  const isCreator = workspaceData.creator_id === userId;
+
+  if (!isCreator && !membership.ok) {
+    return null;
+  }
+
+  const membershipType = isCreator
+    ? 'MEMBER'
+    : (membership.membershipType ?? 'MEMBER');
 
   const permissionsQuery =
-    membershipType === 'MEMBER'
+    membershipType === 'MEMBER' && !isCreator
       ? sbAdmin
           .from('workspace_role_members')
           .select(
@@ -794,40 +825,26 @@ async function getPermissionsImpl({
           .eq('workspace_roles.workspace_role_permissions.enabled', true)
       : Promise.resolve({ data: [], error: null });
 
-  const workspaceQuery = sbAdmin
-    .from('workspaces')
-    .select('creator_id')
-    .eq('id', resolvedWorkspaceId)
-    .single();
+  const defaultQuery = isCreator
+    ? Promise.resolve({ data: [], error: null })
+    : sbAdmin
+        .from('workspace_default_permissions')
+        .select('permission')
+        .eq('ws_id', resolvedWorkspaceId)
+        .eq('member_type', membershipType)
+        .eq('enabled', true);
 
-  const defaultQuery = sbAdmin
-    .from('workspace_default_permissions')
-    .select('permission')
-    .eq('ws_id', resolvedWorkspaceId)
-    .eq('member_type', membershipType)
-    .eq('enabled', true);
-
-  const [permissionsRes, workspaceRes, defaultRes] = await Promise.all([
+  const [permissionsRes, defaultRes] = await Promise.all([
     permissionsQuery,
-    workspaceQuery,
     defaultQuery,
   ]);
 
   const { data: permissionsData, error: permissionsError } = permissionsRes;
-  const { data: workspaceData, error: workspaceError } = workspaceRes;
   const { data: defaultData, error: defaultError } = defaultRes;
 
-  if (!workspaceData) {
-    console.info('Workspace not found in getPermissions', resolvedWorkspaceId);
-    return null;
-  }
-
   if (permissionsError) return null;
-  if (workspaceError) return null;
   if (defaultError) return null;
 
-  const isCreator =
-    membershipType === 'MEMBER' && workspaceData.creator_id === userId;
   // if (DEV_MODE) {
   //   console.log('--------------------');
   //   console.log('Is creator', isCreator);