create-ailk 0.1.0 → 0.1.1

package/templates/apps/api/src/routes/workspaces/__tests__/tenant-isolation.test.ts

@@ -0,0 +1,671 @@
+// oss: false
+/**
+ * @file tenant-isolation.test.ts
+ *
+ * THE ACCEPTANCE GATE for the multi-tenant module (FEAT-042 / #3585):
+ * a member of Org A must not reach Org B's data by ANY route — read or write.
+ *
+ * Fixture: two orgs (org_00000000-0000-7000-8000-000000000aaa/org_00000000-0000-7000-8000-000000000bbb), alice = owner of org_00000000-0000-7000-8000-000000000aaa, bob = owner of org_00000000-0000-7000-8000-000000000bbb,
+ * carol = plain member of org_00000000-0000-7000-8000-000000000aaa, dave = cookie session pointing at wksp_00000000-0000-7000-8000-0000000000aa with NO
+ * membership (revoked). One workspace + one agent session + one artifact per
+ * org. The prisma mock HONORS where-clauses (id + workspaceId, membership
+ * compound key), so scoping is exercised behaviorally — a foreign-tenant
+ * lookup genuinely returns null — and cross-tenant denials are additionally
+ * asserted by "domain query never ran".
+ *
+ * Registration mirrors server.ts exactly: auth preHandler → context routes →
+ * nested scope { tenant guard → workspace/session routes }.
+ */
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn(), update: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+    workspace: { findUnique: jest.fn(), create: jest.fn(), count: jest.fn() },
+    membership: { findUnique: jest.fn(), findMany: jest.fn() },
+    agentSession: {
+      findMany: jest.fn(),
+      findFirst: jest.fn(),
+      create: jest.fn(),
+      updateMany: jest.fn(),
+    },
+    conversationEvent: { findMany: jest.fn() },
+    sessionReadReceipt: { findMany: jest.fn(), upsert: jest.fn() },
+    artifact: { findMany: jest.fn(), findFirst: jest.fn() },
+    artifactVersion: { findMany: jest.fn() },
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../../../middleware/auth.js";
+import { tenantPreHandlerPlugin } from "../../../middleware/tenant.js";
+import { workspaceContextRoutes, workspaceSessionRoutes } from "../index.js";
+import { sessionRoutes } from "../sessions.js";
+
+const FRONTEND = "https://app.example.com";
+const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
+
+// ── Fixture data ────────────────────────────────────────────────────────────
+
+const WORKSPACES = [
+  { id: "wksp_00000000-0000-7000-8000-0000000000aa", organizationId: "org_00000000-0000-7000-8000-000000000aaa", name: "A Main", slug: "a-main" },
+  { id: "wksp_00000000-0000-7000-8000-0000000000a2", organizationId: "org_00000000-0000-7000-8000-000000000aaa", name: "A Second", slug: "a-second" },
+  { id: "wksp_00000000-0000-7000-8000-0000000000bb", organizationId: "org_00000000-0000-7000-8000-000000000bbb", name: "B Main", slug: "b-main" },
+];
+
+const MEMBERSHIPS = [
+  { organizationId: "org_00000000-0000-7000-8000-000000000aaa", userId: "alice", role: "owner" },
+  { organizationId: "org_00000000-0000-7000-8000-000000000aaa", userId: "carol", role: "member" },
+  { organizationId: "org_00000000-0000-7000-8000-000000000bbb", userId: "bob", role: "owner" },
+];
+
+const AGENT_SESSIONS = [
+  {
+    id: "agsess_00000000-0000-7000-8000-0000000000aa",
+    workspaceId: "wksp_00000000-0000-7000-8000-0000000000aa",
+    title: "Org A session",
+    status: "idle",
+    lastSeq: 7,
+    lastMessageAt: new Date("2026-07-01T00:00:00Z"),
+    draftMessage: null,
+    createdAt: new Date("2026-06-30T00:00:00Z"),
+    updatedAt: new Date("2026-07-01T00:00:00Z"),
+  },
+  {
+    id: "agsess_00000000-0000-7000-8000-0000000000bb",
+    workspaceId: "wksp_00000000-0000-7000-8000-0000000000bb",
+    title: "Org B session",
+    status: "idle",
+    lastSeq: 3,
+    lastMessageAt: new Date("2026-07-02T00:00:00Z"),
+    draftMessage: null,
+    createdAt: new Date("2026-06-29T00:00:00Z"),
+    updatedAt: new Date("2026-07-02T00:00:00Z"),
+  },
+];
+
+const EVENTS = [
+  {
+    id: "evA1",
+    sessionId: "agsess_00000000-0000-7000-8000-0000000000aa",
+    workspaceId: "wksp_00000000-0000-7000-8000-0000000000aa",
+    agentId: "agent-1",
+    seq: 1,
+    type: "user_message",
+    turnId: "t1",
+    payload: { content: "hi" },
+    createdAt: new Date("2026-07-01T00:00:01Z"),
+  },
+  {
+    id: "evB1",
+    sessionId: "agsess_00000000-0000-7000-8000-0000000000bb",
+    workspaceId: "wksp_00000000-0000-7000-8000-0000000000bb",
+    agentId: "agent-1",
+    seq: 1,
+    type: "user_message",
+    turnId: "t1",
+    payload: { content: "org B secret" },
+    createdAt: new Date("2026-07-02T00:00:01Z"),
+  },
+];
+
+const ARTIFACTS = [
+  {
+    id: "artif_00000000-0000-7000-8000-0000000000aa",
+    sessionId: "agsess_00000000-0000-7000-8000-0000000000aa",
+    workspaceId: "wksp_00000000-0000-7000-8000-0000000000aa",
+    type: "text/document",
+    title: "A doc",
+    createdAt: new Date(),
+    updatedAt: new Date(),
+  },
+  {
+    id: "artif_00000000-0000-7000-8000-0000000000bb",
+    sessionId: "agsess_00000000-0000-7000-8000-0000000000bb",
+    workspaceId: "wksp_00000000-0000-7000-8000-0000000000bb",
+    type: "text/document",
+    title: "B doc",
+    createdAt: new Date(),
+    updatedAt: new Date(),
+  },
+];
+
+const ARTIFACT_VERSIONS = [
+  { id: "artiv_00000000-0000-7000-8000-0000000000a1", artifactId: "artif_00000000-0000-7000-8000-0000000000aa", workspaceId: "wksp_00000000-0000-7000-8000-0000000000aa", isCurrent: true, savedAt: new Date() },
+  { id: "artiv_00000000-0000-7000-8000-0000000000b1", artifactId: "artif_00000000-0000-7000-8000-0000000000bb", workspaceId: "wksp_00000000-0000-7000-8000-0000000000bb", isCurrent: true, savedAt: new Date() },
+];
+
+/** Cookie token → Session row. Covers healthy, no-active, stale, revoked. */
+const SESSION_ROWS: Record<string, Record<string, unknown>> = {
+  cookie_alice: {
+    id: "sess_alice",
+    userId: "alice",
+    expiresAt: FUTURE,
+    activeOrganizationId: "org_00000000-0000-7000-8000-000000000aaa",
+    activeWorkspaceId: "wksp_00000000-0000-7000-8000-0000000000aa",
+  },
+  cookie_bob: {
+    id: "sess_bob",
+    userId: "bob",
+    expiresAt: FUTURE,
+    activeOrganizationId: "org_00000000-0000-7000-8000-000000000bbb",
+    activeWorkspaceId: "wksp_00000000-0000-7000-8000-0000000000bb",
+  },
+  cookie_carol: {
+    id: "sess_carol",
+    userId: "carol",
+    expiresAt: FUTURE,
+    activeOrganizationId: "org_00000000-0000-7000-8000-000000000aaa",
+    activeWorkspaceId: "wksp_00000000-0000-7000-8000-0000000000aa",
+  },
+  cookie_alice_no_active: {
+    id: "sess_alice2",
+    userId: "alice",
+    expiresAt: FUTURE,
+    activeOrganizationId: null,
+    activeWorkspaceId: null,
+  },
+  cookie_alice_stale: {
+    id: "sess_alice3",
+    userId: "alice",
+    expiresAt: FUTURE,
+    // Workspace of org A but session claims org B — must be denied.
+    activeOrganizationId: "org_00000000-0000-7000-8000-000000000bbb",
+    activeWorkspaceId: "wksp_00000000-0000-7000-8000-0000000000aa",
+  },
+  cookie_alice_ws2: {
+    id: "sess_alice_ws2",
+    userId: "alice",
+    expiresAt: FUTURE,
+    activeOrganizationId: "org_00000000-0000-7000-8000-000000000aaa",
+    activeWorkspaceId: "wksp_00000000-0000-7000-8000-0000000000a2",
+  },
+  cookie_dave_revoked: {
+    id: "sess_dave",
+    userId: "dave",
+    expiresAt: FUTURE,
+    activeOrganizationId: "org_00000000-0000-7000-8000-000000000aaa",
+    activeWorkspaceId: "wksp_00000000-0000-7000-8000-0000000000aa",
+  },
+};
+
+// ── Where-clause-honoring mock wiring ──────────────────────────────────────
+
+type Where = Record<string, unknown>;
+
+function installFixtureMocks(): void {
+  (prisma.session.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { token?: string } }) =>
+      Promise.resolve(where.token ? (SESSION_ROWS[where.token] ?? null) : null),
+  );
+  (prisma.session.update as jest.Mock).mockResolvedValue({});
+
+  (prisma.workspace.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { id?: string } }) =>
+      Promise.resolve(WORKSPACES.find((w) => w.id === where.id) ?? null),
+  );
+
+  // This fixture is genuinely multi-tenant (3 workspaces across 2 orgs) — the
+  // #3627 single-tenant default-resolution branch (`count() === 1`) must
+  // never fire here, so an unbound session keeps denying (default-deny).
+  (prisma.workspace.count as jest.Mock).mockResolvedValue(WORKSPACES.length);
+
+  (prisma.membership.findUnique as jest.Mock).mockImplementation(
+    ({
+      where,
+    }: {
+      where: { organizationId_userId?: { organizationId: string; userId: string } };
+    }) => {
+      const key = where.organizationId_userId;
+      if (!key) return Promise.resolve(null);
+      return Promise.resolve(
+        MEMBERSHIPS.find(
+          (m) =>
+            m.organizationId === key.organizationId && m.userId === key.userId,
+        ) ?? null,
+      );
+    },
+  );
+
+  (prisma.membership.findMany as jest.Mock).mockImplementation(
+    ({ where }: { where: { userId?: string } }) => {
+      const rows = MEMBERSHIPS.filter((m) => m.userId === where.userId).map(
+        (m) => {
+          const org = { id: m.organizationId, name: m.organizationId, slug: m.organizationId };
+          return {
+            role: m.role,
+            createdAt: new Date(),
+            organization: {
+              ...org,
+              workspaces: WORKSPACES.filter(
+                (w) => w.organizationId === m.organizationId,
+              ).map((w) => ({ id: w.id, name: w.name, slug: w.slug })),
+            },
+          };
+        },
+      );
+      return Promise.resolve(rows);
+    },
+  );
+
+  (prisma.agentSession.findFirst as jest.Mock).mockImplementation(
+    ({ where }: { where: Where }) =>
+      Promise.resolve(
+        AGENT_SESSIONS.find(
+          (s) => s.id === where.id && s.workspaceId === where.workspaceId,
+        ) ?? null,
+      ),
+  );
+  (prisma.agentSession.findMany as jest.Mock).mockImplementation(
+    ({ where }: { where: Where }) =>
+      Promise.resolve(
+        AGENT_SESSIONS.filter((s) => s.workspaceId === where.workspaceId),
+      ),
+  );
+  (prisma.agentSession.create as jest.Mock).mockImplementation(
+    ({ data }: { data: Where }) =>
+      Promise.resolve({ id: "ses_new", ...data }),
+  );
+
+  (prisma.conversationEvent.findMany as jest.Mock).mockImplementation(
+    ({ where }: { where: Where }) =>
+      Promise.resolve(
+        EVENTS.filter(
+          (e) =>
+            e.sessionId === where.sessionId &&
+            e.workspaceId === where.workspaceId,
+        ),
+      ),
+  );
+
+  (prisma.sessionReadReceipt.findMany as jest.Mock).mockImplementation(
+    ({ where }: { where: Where }) =>
+      Promise.resolve(
+        [] as Array<{ sessionId: string; lastReadSeq: number }>,
+      ),
+  );
+  (prisma.sessionReadReceipt.upsert as jest.Mock).mockImplementation(
+    ({ create }: { create: Where }) => Promise.resolve(create),
+  );
+
+  (prisma.artifact.findFirst as jest.Mock).mockImplementation(
+    ({ where }: { where: Where }) =>
+      Promise.resolve(
+        ARTIFACTS.find(
+          (a) => a.id === where.id && a.workspaceId === where.workspaceId,
+        ) ?? null,
+      ),
+  );
+  (prisma.artifact.findMany as jest.Mock).mockImplementation(
+    ({ where }: { where: Where }) =>
+      Promise.resolve(
+        ARTIFACTS.filter(
+          (a) =>
+            a.sessionId === where.sessionId &&
+            a.workspaceId === where.workspaceId,
+        ),
+      ),
+  );
+  (prisma.artifactVersion.findMany as jest.Mock).mockImplementation(
+    ({ where }: { where: Where }) =>
+      Promise.resolve(
+        ARTIFACT_VERSIONS.filter(
+          (v) =>
+            v.artifactId === where.artifactId &&
+            v.workspaceId === where.workspaceId,
+        ),
+      ),
+  );
+}
+
+// ── App assembly (mirrors server.ts registration order) ────────────────────
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(workspaceContextRoutes);
+  app.register(async (scope) => {
+    await scope.register(tenantPreHandlerPlugin);
+    await scope.register(workspaceSessionRoutes);
+    await scope.register(sessionRoutes);
+  });
+  await app.ready();
+  return app;
+}
+
+function cookieHeaders(token: string, mutating = false): Record<string, string> {
+  return {
+    cookie: `better-auth.session_token=${token}`,
+    ...(mutating ? { origin: FRONTEND } : {}),
+  };
+}
+
+describe("tenant isolation — cross-org access denied on every route", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installFixtureMocks();
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  // ── Cross-org READS ──────────────────────────────────────────────────────
+
+  it("GET a foreign workspace's session list → 403, no domain query runs", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000bb/sessions",
+      headers: cookieHeaders("cookie_alice"),
+    });
+    expect(res.statusCode).toBe(403);
+    expect(prisma.agentSession.findMany).not.toHaveBeenCalled();
+  });
+
+  it("GET own workspace's session list → 200, scoped to own workspace only", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000aa/sessions",
+      headers: cookieHeaders("cookie_alice"),
+    });
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.ok).toBe(true);
+    expect(body.data.sessions).toHaveLength(1);
+    expect(body.data.sessions[0].id).toBe("agsess_00000000-0000-7000-8000-0000000000aa");
+    expect(prisma.agentSession.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: expect.objectContaining({ workspaceId: "wksp_00000000-0000-7000-8000-0000000000aa" }),
+      }),
+    );
+  });
+
+  it("replay a foreign session's conversation events → 404, events never queried", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/sessions/agsess_00000000-0000-7000-8000-0000000000bb/conversation-events?sinceSeq=0",
+      headers: cookieHeaders("cookie_alice"),
+    });
+    expect(res.statusCode).toBe(404);
+    expect(prisma.conversationEvent.findMany).not.toHaveBeenCalled();
+  });
+
+  it("replay own session's events → 200 with events + lastSeq", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/sessions/agsess_00000000-0000-7000-8000-0000000000aa/conversation-events?sinceSeq=0",
+      headers: cookieHeaders("cookie_alice"),
+    });
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.data.lastSeq).toBe(7);
+    expect(body.data.events).toHaveLength(1);
+    expect(body.data.events[0].payload.content).toBe("hi");
+  });
+
+  it("mint a ws-token for a foreign session → 404", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/sessions/agsess_00000000-0000-7000-8000-0000000000bb/ws-token",
+      headers: cookieHeaders("cookie_alice"),
+    });
+    expect(res.statusCode).toBe(404);
+  });
+
+  it("mint a ws-token for an own session → 200 with short-lived token", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/sessions/agsess_00000000-0000-7000-8000-0000000000aa/ws-token",
+      headers: cookieHeaders("cookie_alice"),
+    });
+    expect(res.statusCode).toBe(200);
+    expect(res.json().data.token).toMatch(/^[\w-]+\.[\w-]+\.[\w-]+$/);
+  });
+
+  it("list a foreign session's artifacts → 404", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/sessions/agsess_00000000-0000-7000-8000-0000000000bb/artifacts",
+      headers: cookieHeaders("cookie_alice"),
+    });
+    expect(res.statusCode).toBe(404);
+    expect(prisma.artifact.findMany).not.toHaveBeenCalled();
+  });
+
+  it("list a foreign artifact's versions → 404, versions never queried", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/artifacts/artif_00000000-0000-7000-8000-0000000000bb/versions",
+      headers: cookieHeaders("cookie_alice"),
+    });
+    expect(res.statusCode).toBe(404);
+    expect(prisma.artifactVersion.findMany).not.toHaveBeenCalled();
+  });
+
+  it("list an own artifact's versions → 200", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/artifacts/artif_00000000-0000-7000-8000-0000000000aa/versions",
+      headers: cookieHeaders("cookie_alice"),
+    });
+    expect(res.statusCode).toBe(200);
+    expect(res.json().data.versions).toHaveLength(1);
+  });
+
+  it("the switcher listing never contains foreign orgs", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/workspaces",
+      headers: cookieHeaders("cookie_alice"),
+    });
+    expect(res.statusCode).toBe(200);
+    const orgs = res.json().data.organizations;
+    expect(orgs.map((o: { id: string }) => o.id)).toEqual(["org_00000000-0000-7000-8000-000000000aaa"]);
+  });
+
+  // ── Cross-org WRITES ─────────────────────────────────────────────────────
+
+  it("create a session in a foreign workspace → 403, create never runs", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000bb/sessions",
+      headers: cookieHeaders("cookie_alice", true),
+      payload: { title: "intrusion" },
+    });
+    expect(res.statusCode).toBe(403);
+    expect(prisma.agentSession.create).not.toHaveBeenCalled();
+  });
+
+  it("create a session in own workspace → 201 scoped to own workspace", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000aa/sessions",
+      headers: cookieHeaders("cookie_alice", true),
+      payload: { title: "mine" },
+    });
+    expect(res.statusCode).toBe(201);
+    expect(prisma.agentSession.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ workspaceId: "wksp_00000000-0000-7000-8000-0000000000aa" }),
+      }),
+    );
+  });
+
+  it("mark-read on a foreign session → 404, upsert never runs", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/sessions/agsess_00000000-0000-7000-8000-0000000000bb/mark-read",
+      headers: cookieHeaders("cookie_alice", true),
+      payload: {},
+    });
+    expect(res.statusCode).toBe(404);
+    expect(prisma.sessionReadReceipt.upsert).not.toHaveBeenCalled();
+  });
+
+  it("activate a workspace in an org the caller is not a member of → 404, session untouched", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000bb/activate",
+      headers: cookieHeaders("cookie_alice", true),
+    });
+    expect(res.statusCode).toBe(404);
+    expect(prisma.session.update).not.toHaveBeenCalled();
+  });
+
+  it("activate an own-org workspace → 200 and updates the session row", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000aa/activate",
+      headers: cookieHeaders("cookie_alice", true),
+    });
+    expect(res.statusCode).toBe(200);
+    expect(prisma.session.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { id: "sess_alice" },
+        data: { activeWorkspaceId: "wksp_00000000-0000-7000-8000-0000000000aa", activeOrganizationId: "org_00000000-0000-7000-8000-000000000aaa" },
+      }),
+    );
+  });
+
+  it("create a workspace in a foreign org → 404, create never runs", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/workspaces",
+      headers: cookieHeaders("cookie_alice", true),
+      payload: { organizationId: "org_00000000-0000-7000-8000-000000000bbb", name: "Intrusion" },
+    });
+    expect(res.statusCode).toBe(404);
+    expect(prisma.workspace.create).not.toHaveBeenCalled();
+  });
+
+  it("create a workspace below the admin role floor → 403 (carol is member)", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/workspaces",
+      headers: cookieHeaders("cookie_carol", true),
+      payload: { organizationId: "org_00000000-0000-7000-8000-000000000aaa", name: "Nope" },
+    });
+    expect(res.statusCode).toBe(403);
+    expect(prisma.workspace.create).not.toHaveBeenCalled();
+  });
+
+  // ── Default-deny tenant context ──────────────────────────────────────────
+
+  it("bearer-authenticated request (no workspace binding, #3591) → 403", async () => {
+    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
+      id: "tok1",
+      userId: "alice",
+      expiresAt: null,
+      revokedAt: null,
+    });
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000aa/sessions",
+      headers: { authorization: "Bearer tok_raw" },
+    });
+    expect(res.statusCode).toBe(403);
+    expect(prisma.agentSession.findMany).not.toHaveBeenCalled();
+  });
+
+  it("cookie session with no active workspace → 403", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000aa/sessions",
+      headers: cookieHeaders("cookie_alice_no_active"),
+    });
+    expect(res.statusCode).toBe(403);
+  });
+
+  it("stale session context (active org ≠ workspace's org) → 403", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000aa/sessions",
+      headers: cookieHeaders("cookie_alice_stale"),
+    });
+    expect(res.statusCode).toBe(403);
+  });
+
+  it("revoked membership with a still-active session context → 403", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000aa/sessions",
+      headers: cookieHeaders("cookie_dave_revoked"),
+    });
+    expect(res.statusCode).toBe(403);
+    expect(prisma.agentSession.findMany).not.toHaveBeenCalled();
+  });
+
+  it("after switching to another own-org workspace, the PREVIOUS workspace is unreachable", async () => {
+    // alice's session now points at wksp_00000000-0000-7000-8000-0000000000a2 (same org) — wksp_00000000-0000-7000-8000-0000000000aa, her previous
+    // active workspace, must 403 like any non-active target (I5b).
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000aa/sessions",
+      headers: cookieHeaders("cookie_alice_ws2"),
+    });
+    expect(res.statusCode).toBe(403);
+    expect(prisma.agentSession.findMany).not.toHaveBeenCalled();
+
+    const own = await app.inject({
+      method: "GET",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000a2/sessions",
+      headers: cookieHeaders("cookie_alice_ws2"),
+    });
+    expect(own.statusCode).toBe(200);
+  });
+
+  it("activate is not an existence oracle: foreign and nonexistent ids are identical 404s", async () => {
+    // carol (org A member) probing org B's workspace vs a made-up id (I5c).
+    const foreign = await app.inject({
+      method: "POST",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000bb/activate",
+      headers: cookieHeaders("cookie_carol", true),
+    });
+    const missing = await app.inject({
+      method: "POST",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-00000000dead/activate",
+      headers: cookieHeaders("cookie_carol", true),
+    });
+    expect(foreign.statusCode).toBe(404);
+    expect(missing.statusCode).toBe(404);
+    expect(foreign.body).toBe(missing.body);
+    expect(prisma.session.update).not.toHaveBeenCalled();
+
+    // A malformed id never reaches the service — rejected at the boundary by
+    // the zWorkspaceId schema (ADR-0031 rule 5), before any lookup runs.
+    const malformed = await app.inject({
+      method: "POST",
+      url: "/v1/workspaces/ws_does_not_exist/activate",
+      headers: cookieHeaders("cookie_carol", true),
+    });
+    expect(malformed.statusCode).toBe(400);
+  });
+
+  it("unauthenticated → 401", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000aa/sessions",
+    });
+    expect(res.statusCode).toBe(401);
+  });
+
+  it("bob CAN read his own org's data (the grant path works for both tenants)", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000bb/sessions",
+      headers: cookieHeaders("cookie_bob"),
+    });
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.data.sessions.map((s: { id: string }) => s.id)).toEqual(["agsess_00000000-0000-7000-8000-0000000000bb"]);
+  });
+});