heyquilt 0.0.1 → 0.3.90

package/src/api/routes/workspace-invites.js

@@ -0,0 +1,196 @@
+// Inviting people to a workspace, and the invites waiting for you.
+//
+// A workspace admin invites a person they've worked with (or someone in the workspace's org)
+// or anyone by email; nothing changes until that person accepts, in the app's home or on the
+// website's dashboard. Agents have no inbox: they're still added straight away (members PUT).
+//
+// GET /v1/me/invites lists every invite waiting for the caller: workspace invites, and
+// session invites with their join link (kept only for the account or address it was sent to).
+// A person's confirmed sign-in address counts as theirs, so an invite sent to an email before
+// they had an account is waiting when they sign up.
+import { HttpError, needId, stripInvisible } from '../http.js'
+import { emailDomain } from '../domains.js'
+import { workspaceInviteEmail } from '../invite-email.js'
+import { cleanAccess } from '../workspace-access.js'
+import { workspaceReach } from '../workspace-reach.js'
+import { typeOfGrant } from '../access.js'
+import { collaboratorsOf } from './sessions.js'
+
+export const WORKSPACE_INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000
+const STRICT_EMAIL = /^[^\s@,;<>"()\\]+@[^\s@,;<>"()\\]+$/
+const PERSON = /^person:[A-Za-z0-9_-]{1,64}$/
+const TAKEN = 'They already have an open invite. Cancel it first.'
+
+export function workspaceInviteRoutes (ctx) {
+  const { store, person, now, site, mailer, log = () => {}, limitSend = () => {}, workspaces = false } = ctx
+  const { reach } = workspaceReach(ctx)
+  const gated = (fn) => (...args) => {
+    if (!workspaces) throw new HttpError(404, 'not found')
+    return fn(...args)
+  }
+  const statusOf = (i) => (i.acceptedAt ? 'accepted' : i.declinedAt ? 'declined' : i.cancelledAt ? 'cancelled' : i.expiresAt <= now() ? 'expired' : 'waiting')
+  // An account invite shows the name the inviter saw, never the person's email.
+  const view = (i) => ({ id: i.id, ...(i.email ? { email: i.email } : { account: i.account, name: i.accountName }), access: i.access, status: statusOf(i), createdAt: i.createdAt, expiresAt: i.expiresAt })
+  const nameOf = async (account) => {
+    const [kind, id] = String(account || '').split(':')
+    const raw = kind === 'agent' ? (await store.agentById(id).catch(() => null))?.name : kind === 'person' ? (await store.profile(id))?.name : ''
+    return stripInvisible(raw || '').join('').trim()
+  }
+
+  function cleanEmail (raw) {
+    const email = String(raw || '').trim().toLowerCase()
+    if (!email || email.length > 254 || !STRICT_EMAIL.test(email) || !emailDomain(email)) throw new HttpError(400, "That email doesn't look right.")
+    return email
+  }
+
+  /** Who the caller is to an invite: their account, and their confirmed sign-in address (if any). */
+  async function mine (req) {
+    const { userId } = await person(req)
+    const mail = await store.userEmail(userId)
+    const email = mail?.confirmed && mail.email ? String(mail.email).toLowerCase() : null
+    return { userId, account: `person:${userId}`, email }
+  }
+
+  async function send (to, { inviter, ws, access }) {
+    const msg = workspaceInviteEmail({ inviterName: (await nameOf(inviter)) || undefined, workspaceName: ws.name, access, site })
+    try {
+      await mailer.send({ to, ...msg })
+    } catch (err) {
+      log(`workspace invite email failed: ${err?.stack || err?.message || err}`)
+      throw new HttpError(502, "The invite was saved, but the email didn't send. It still shows in their Quilt; cancel and invite again to resend it.")
+    }
+  }
+
+  async function create (fields) {
+    try {
+      return await store.createWorkspaceInvite({ ...fields, at: now() })
+    } catch (err) {
+      if (err.code === '23505') throw new HttpError(409, TAKEN)
+      throw err
+    }
+  }
+
+  /** Whether `account` is already in the workspace: its owner or a member. */
+  async function alreadyIn (ws, account) {
+    return (ws.ownerUserId && account === `person:${ws.ownerUserId}`) || !!(await store.workspaceMember(ws.id, account))
+  }
+
+  /** An invite waiting for the caller; 404 for anything else (theirs or not, so ids can't be probed). */
+  async function waitingFor (me, id) {
+    const i = await store.workspaceInviteById(needId(id, 'invite'))
+    if (!i || !((i.account && i.account === me.account) || (i.email && i.email === me.email))) throw new HttpError(404, 'no such invite')
+    if (statusOf(i) !== 'waiting') throw new HttpError(410, statusOf(i) === 'expired' ? 'This invite has expired. Ask for a new one.' : `This invite was already ${statusOf(i)}.`)
+    return i
+  }
+
+  const routes = [
+    ['GET', /^\/v1\/workspaces\/([^/]+)\/invites$/, gated(async (req, body, [id]) => {
+      const r = await reach(req, id)
+      r.needAdmin()
+      return { invites: (await store.listWorkspaceInvites(r.ws.id)).map(view) }
+    })],
+
+    // { to: { email } | { account: 'person:<id>' }, access }. A person, by account, is someone
+    // the inviter has worked with or someone in the workspace's org.
+    ['POST', /^\/v1\/workspaces\/([^/]+)\/invites$/, gated(async (req, body, [id]) => {
+      const r = await reach(req, id)
+      r.needAdmin()
+      if (!r.me.userId) throw new HttpError(403, 'Agents add agents; people invite people.')
+      limitSend(r.me.userId)
+      const access = cleanAccess(body.access || 'edit')
+      const to = body.to && typeof body.to === 'object' ? body.to : {}
+      const base = { workspaceId: r.ws.id, access, invitedBy: r.me.account, expiresAt: now() + WORKSPACE_INVITE_TTL_MS }
+
+      if (to.email !== undefined) {
+        const email = cleanEmail(to.email)
+        if (await store.openWorkspaceInvite(r.ws.id, { email }, now())) throw new HttpError(409, 'That address already has an open invite. Cancel it first.')
+        const invite = await create({ ...base, email })
+        await send(email, { inviter: r.me.account, ws: r.ws, access })
+        return { invite: view(invite) }
+      }
+
+      const account = String(to.account || '')
+      if (!PERSON.test(account)) throw new HttpError(400, 'Invite a person by email, or someone you have worked with. Agents are added, not invited.')
+      if (account === r.me.account) throw new HttpError(400, "That's you.")
+      const userId = account.slice('person:'.length)
+      const known = (await collaboratorsOf(store, r.me.account, now())).find((c) => c.account === account)
+      const inOrg = r.ws.orgId && await store.memberOf(r.ws.orgId, userId)
+      if (!known && !inOrg) throw new HttpError(404, "You can invite people you've worked with, or anyone by email.")
+      if (await alreadyIn(r.ws, account)) throw new HttpError(409, 'They are already in this workspace.')
+      if (await store.openWorkspaceInvite(r.ws.id, { account }, now())) throw new HttpError(409, TAKEN)
+      const name = known?.name || await nameOf(account)
+      const invite = await create({ ...base, account, accountName: String(name || '').slice(0, 64) })
+      // They hear about it at their sign-in email too (looked up here, never sent back).
+      const mail = await store.userEmail(userId)
+      if (mail?.confirmed && mail.email) await send(mail.email, { inviter: r.me.account, ws: r.ws, access })
+      return { invite: view(invite) }
+    })],
+
+    ['DELETE', /^\/v1\/workspaces\/([^/]+)\/invites\/([^/]+)$/, gated(async (req, body, [id, inviteId]) => {
+      const r = await reach(req, id)
+      r.needAdmin()
+      const i = await store.workspaceInviteById(needId(inviteId, 'invite'))
+      if (!i || i.workspaceId !== r.ws.id) throw new HttpError(404, 'no such invite')
+      if (!await store.answerWorkspaceInvite(i.id, 'cancelled')) throw new HttpError(409, 'That invite was already answered or cancelled.')
+      return { ok: true }
+    })],
+
+    // Every invite waiting for you, newest first: workspaces (with workspaces on) and sessions.
+    ['GET', /^\/v1\/me\/invites$/, async (req) => {
+      const me = await mine(req)
+      const t = now()
+      const out = []
+      if (workspaces) {
+        for (const i of await store.workspaceInvitesFor(me, t)) {
+          const ws = await store.workspaceById(i.workspaceId)
+          if (!ws) continue
+          const org = ws.orgId ? await store.orgById(ws.orgId) : null
+          out.push({ kind: 'workspace', id: i.id, workspace: { id: ws.id, name: ws.name, color: ws.color, org: org ? org.name : null }, access: i.access, from: { account: i.invitedBy, name: await nameOf(i.invitedBy) }, createdAt: i.createdAt, expiresAt: i.expiresAt })
+        }
+      }
+      for (const i of await store.sessionInvitesFor(me, t)) {
+        // An invite made before links were kept can't be joined from here: it's in their email.
+        const type = await typeOfGrant(store, { typeId: i.typeId })
+        out.push({ kind: 'session', id: i.id, session: { room: i.room, name: i.sessionName || 'Untitled session' }, link: i.link || null, access: type.name, from: { account: i.invitedBy, name: await nameOf(i.invitedBy) }, createdAt: i.createdAt, expiresAt: i.expiresAt })
+      }
+      return { invites: out.sort((a, b) => b.createdAt - a.createdAt) }
+    }],
+
+    // Accepting a workspace invite makes you a member. (A session invite is accepted by
+    // joining with its link: the grant it made lets you straight in.)
+    ['POST', /^\/v1\/me\/invites\/([^/]+)\/accept$/, gated(async (req, body, [id]) => {
+      const me = await mine(req)
+      const i = await waitingFor(me, id)
+      const ws = await store.workspaceById(i.workspaceId)
+      if (!ws) throw new HttpError(404, 'That workspace was deleted.')
+      if (ws.orgId && !(await store.memberOf(ws.orgId, me.userId))) {
+        const org = await store.orgById(ws.orgId)
+        throw new HttpError(403, `This workspace belongs to ${org?.name || 'an org'}. Ask them to add you to the org, then accept again.`)
+      }
+      if (!await store.answerWorkspaceInvite(i.id, 'accepted', me.account)) throw new HttpError(410, 'This invite was already answered.')
+      // Never lower the access someone already has.
+      const had = await store.workspaceMember(ws.id, me.account)
+      const owner = ws.ownerUserId === me.userId
+      if (!owner && !(had && had.access === 'edit')) await store.putWorkspaceMember({ workspaceId: ws.id, account: me.account, access: i.access, addedBy: i.invitedBy })
+      return { workspace: { id: ws.id, name: ws.name } }
+    })],
+
+    // Declining: a workspace invite is answered; a session invite is cancelled and the access
+    // it gave is taken back (unless another open invite still needs it).
+    ['POST', /^\/v1\/me\/invites\/([^/]+)\/decline$/, async (req, body, [id]) => {
+      const me = await mine(req)
+      const inviteId = needId(id, 'invite')
+      const s = await store.sessionInviteForMe(inviteId, me)
+      if (s) {
+        if (!await store.cancelSessionInvite(s.id)) throw new HttpError(410, 'This invite was already used or cancelled.')
+        await store.deleteUnusedGrant(s.room, s.email ? `email:${s.email}` : s.account, now())
+        return { ok: true }
+      }
+      if (!workspaces) throw new HttpError(404, 'no such invite')
+      const i = await waitingFor(me, inviteId)
+      if (!await store.answerWorkspaceInvite(i.id, 'declined')) throw new HttpError(410, 'This invite was already answered.')
+      return { ok: true }
+    }]
+  ]
+  return routes
+}

package/src/api/routes/workspaces.js

@@ -0,0 +1,225 @@
+// Workspaces: a container owned by a person or an org, holding sessions and members.
+// Behind the QUILT_WORKSPACES flag (startApi({ workspaces })): off, every route answers 404.
+import { HttpError, cleanName } from '../http.js'
+import { orgAccess } from '../org-access.js'
+import { workspaceAccess, cleanColor, cleanDescription, cleanAccess, autoColor } from '../workspace-access.js'
+import { workspaceReach, canSeeFiles } from '../workspace-reach.js'
+import { listedFiles, usageView, removeObjects } from './workspace-files.js'
+import { workspaceAgents, cleanMemberSessions, placementCandidates, FOREIGN_JOINS } from './workspace-agents.js'
+import { sameOwnerAgent } from '../agent-placement.js'
+import { typeOfGrant } from '../access.js'
+import { effectiveAccess } from '../../session-access.js'
+
+const ROOM = /^[A-Za-z0-9_-]{1,64}$/
+const ACCOUNT = /^(person|agent):[A-Za-z0-9_-]{1,64}$/
+const OPEN_MS = 10 * 60 * 1000
+
+export function workspaceRoutes (ctx) {
+  const { store, now, files: fileStore, workspaces = false, log = () => {} } = ctx
+  const { caller, grantsIn, reach } = workspaceReach(ctx)
+  /** A handler that answers 404 while the flag is off (a route's own 404, not a missing route). */
+  const gated = (fn) => (...args) => {
+    if (!workspaces) throw new HttpError(404, 'not found')
+    return fn(...args)
+  }
+
+  const nameOf = async (account) => {
+    const [kind, id] = account.split(':')
+    if (kind === 'agent') return (await store.agentById(id))?.name
+    return (await store.profile(id))?.name
+  }
+  const kindOf = (account) => account.split(':')[0]
+  const isOpen = (s, t) => t - s.lastActiveAt < OPEN_MS
+  const sessionView = (s, t) => ({ room: s.room, name: s.name, ownerAccount: s.ownerAccount, lastActiveAt: s.lastActiveAt, open: isOpen(s, t) })
+
+  /**
+   * Moving a session into a workspace brings its people and agents along: everyone with a
+   * grant there (edit or view, as the grant gives files) and everyone who has been in it
+   * (edit, as an invite link lets them), except its owner, agents kept out of it, people
+   * the owner removed last time, and, in an org's workspace, anyone outside the org. Nobody
+   * loses access they already had here. Answers who was added.
+   */
+  async function bringPeople (ws, room, by) {
+    const want = new Map()
+    for (const g of await store.listGrants(room)) {
+      if (!ACCOUNT.test(g.account)) continue // an email's grant waits for that person to sign in
+      want.set(g.account, effectiveAccess(await typeOfGrant(store, g), g.tighten).files === 'edit' ? 'edit' : 'view')
+    }
+    const last = new Map()
+    for (const v of await store.visitsInRooms([room])) if (ACCOUNT.test(v.account)) last.set(v.account, v)
+    for (const [account, v] of last) if (!want.has(account) && v.endReason !== 'removed') want.set(account, 'edit')
+    const keptOut = new Set((await store.listSessionAgentExclusions(room).catch(() => [])).map((e) => `agent:${e.agentId}`))
+    const added = []
+    for (const [account, access] of want) {
+      if (account === by || keptOut.has(account) || (ws.ownerUserId && account === `person:${ws.ownerUserId}`)) continue
+      const [kind, id] = account.split(':')
+      if (kind === 'agent' ? !(await store.agentById(id).catch(() => null)) : !(await store.profile(id))) continue
+      if (ws.orgId && !(kind === 'agent' ? await store.memberByAgent(ws.orgId, id) : await store.memberOf(ws.orgId, id))) continue
+      const had = await store.workspaceMember(ws.id, account)
+      if (had && (had.access === 'edit' || access === 'view')) continue
+      await store.putWorkspaceMember({ workspaceId: ws.id, account, access, addedBy: by })
+      added.push({ account, name: (await nameOf(account)) || last.get(account)?.accountName || '', kind, access })
+    }
+    return added
+  }
+
+  async function spaceOf (ws) {
+    if (!ws.orgId) return { kind: 'personal' }
+    const org = await store.orgById(ws.orgId)
+    return { kind: 'org', slug: org?.slug || '', name: org?.name || '' }
+  }
+
+  async function listView (ws, access, t) {
+    const sessions = await store.listWorkspaceSessions(ws.id)
+    const members = await store.listWorkspaceMembers(ws.id)
+    return {
+      id: ws.id,
+      name: ws.name,
+      description: ws.description,
+      color: ws.color,
+      createdAt: ws.createdAt,
+      archivedAt: ws.archivedAt,
+      space: await spaceOf(ws),
+      access: access.access,
+      admin: access.admin,
+      via: access.via,
+      // files: the row's count, kept by every upload, delete and sweep (setWorkspaceUsage).
+      counts: { sessions: sessions.length, members: members.length, open: sessions.filter((s) => isOpen(s, t)).length, files: ws.fileCount ?? 0 }
+    }
+  }
+
+  const routes = [
+    // Every workspace the caller can reach: their own, their orgs' (per their role), and the ones they're a member of.
+    ['GET', /^\/v1\/me\/workspaces$/, async (req) => {
+      const me = await caller(req)
+      const t = now()
+      const seen = new Map()
+      const add = async (ws) => {
+        if (seen.has(ws.id)) return
+        const access = await workspaceAccess(store, ws, me.account, { orgGrants: await grantsIn(ws, me) })
+        if (access) seen.set(ws.id, await listView(ws, access, t))
+      }
+      if (me.userId) {
+        for (const ws of await store.listWorkspacesOwnedBy(me.userId)) await add(ws)
+        for (const org of await store.orgsForUser(me.userId)) for (const ws of await store.listWorkspacesOfOrg(org.id)) await add(ws)
+      }
+      for (const ws of await store.listWorkspacesForMember(me.account)) await add(ws)
+      // An agent also finds the workspaces its placement reaches (its owner's or its org's;
+      // workspaceAccess answers null for the rest).
+      if (me.account.startsWith('agent:')) for (const ws of await placementCandidates(store, me.agent || await store.agentById(me.account.slice(6)))) await add(ws)
+      return { workspaces: [...seen.values()].sort((a, b) => a.name.localeCompare(b.name)) }
+    }],
+
+    ['POST', /^\/v1\/workspaces$/, async (req, body) => {
+      const me = await caller(req)
+      if (!me.userId) throw new HttpError(403, 'agents do not make workspaces')
+      const name = cleanName(body.name, 80, 'give the workspace a name')
+      // Colour and description are set later, in settings; a new workspace gets a colour from its name.
+      const fields = { name, description: cleanDescription(body.description), color: cleanColor(body.color) || autoColor(name), createdBy: me.account }
+      if (body.org) {
+        const a = await orgAccess(store, me.userId, body.org)
+        a.need('workspaces', 'c')
+        return { workspace: await store.createWorkspace({ ...fields, orgId: a.org.id }) }
+      }
+      return { workspace: await store.createWorkspace({ ...fields, ownerUserId: me.userId }) }
+    }],
+
+    ['GET', /^\/v1\/workspaces\/([^/]+)$/, async (req, body, [id]) => {
+      const { ws, access, canDelete } = await reach(req, id)
+      const t = now()
+      const members = await Promise.all((await store.listWorkspaceMembers(ws.id)).map(async (m) => ({ account: m.account, name: (await nameOf(m.account)) || '', kind: kindOf(m.account), access: m.access, addedAt: m.addedAt })))
+      const ownerAccount = ws.ownerUserId ? `person:${ws.ownerUserId}` : null
+      const owner = ownerAccount ? { account: ownerAccount, name: (await nameOf(ownerAccount)) || '' } : { account: null, name: (await store.orgById(ws.orgId))?.name || '' }
+      const sessions = (await store.listWorkspaceSessions(ws.id)).map((s) => sessionView(s, t))
+      const files = canSeeFiles(access) ? await listedFiles(store, await store.listWorkspaceFiles(ws.id)) : []
+      const agents = await workspaceAgents(store, ws, { admin: access.admin })
+      return { workspace: ws, access, canDelete, owner, members, agents, sessions, files, usage: await usageView(store, ws, ctx) }
+    }],
+
+    ['PATCH', /^\/v1\/workspaces\/([^/]+)$/, async (req, body, [id]) => {
+      const r = await reach(req, id)
+      r.needAdmin()
+      const patch = {}
+      if (body.name !== undefined) patch.name = cleanName(body.name, 80, 'give the workspace a name')
+      if (body.description !== undefined) patch.description = cleanDescription(body.description)
+      if (body.color !== undefined) patch.color = cleanColor(body.color)
+      if (body.archived !== undefined) patch.archivedAt = body.archived ? now() : null
+      return { workspace: await store.updateWorkspace(r.ws.id, patch) }
+    }],
+
+    ['DELETE', /^\/v1\/workspaces\/([^/]+)$/, async (req, body, [id]) => {
+      const r = await reach(req, id)
+      if (r.ws.orgId) {
+        if (!r.me.userId) throw new HttpError(403, 'agents do not delete workspaces')
+        const a = await orgAccess(store, r.me.userId, (await store.orgById(r.ws.orgId)).slug)
+        a.need('workspaces', 'd')
+      } else if (r.access.via !== 'owner') throw new HttpError(403, 'only the owner can delete a workspace')
+      // Its files' bytes go first (every version, and files deleted but not yet swept): once
+      // the rows are gone nothing would ever name these objects again.
+      const keys = []
+      for (const f of await store.listWorkspaceFiles(r.ws.id, { includeDeleted: true })) {
+        if (f.kind !== 'file') continue
+        if (f.objectKey) keys.push(f.objectKey)
+        for (const v of await store.listWorkspaceFileVersions(f.id)) if (v.objectKey) keys.push(v.objectKey)
+      }
+      if (fileStore) await removeObjects(fileStore, keys, log)
+      await store.deleteWorkspace(r.ws.id)
+      return { ok: true }
+    }],
+
+    ['PUT', /^\/v1\/workspaces\/([^/]+)\/members\/([^/]+)$/, async (req, body, [id, account]) => {
+      const r = await reach(req, id)
+      r.needAdmin()
+      if (!ACCOUNT.test(account)) throw new HttpError(400, 'that is not an account')
+      const access = cleanAccess(body.access)
+      const [kind, who] = account.split(':')
+      // Whether an agent also joins every session here as it starts; kept when not sent.
+      const sessions = cleanMemberSessions(body.sessions, kind)
+      if (kind === 'agent' ? !(await store.agentById(who)) : !(await store.profile(who))) throw new HttpError(404, 'no such account')
+      if (r.ws.orgId && kind === 'person' && !(await store.memberOf(r.ws.orgId, who))) throw new HttpError(404, 'that person is not in the org')
+      if (r.ws.orgId && kind === 'agent' && !(await store.memberByAgent(r.ws.orgId, who))) throw new HttpError(404, 'that agent is not in the org')
+      // Someone else's agent can be added for access, but only its owner makes it join every session.
+      if (sessions === 'all' && !(await sameOwnerAgent(store, r.ws, who))) throw new HttpError(400, FOREIGN_JOINS)
+      const member = await store.putWorkspaceMember({ workspaceId: r.ws.id, account, access, addedBy: r.me.account, sessions })
+      // Answered as GET reports it: an old 'all' on someone else's agent has no effect.
+      if (kind === 'agent' && member.sessions === 'all' && !(await sameOwnerAgent(store, r.ws, who))) return { member: { ...member, sessions: 'invited' } }
+      return { member }
+    }],
+
+    ['DELETE', /^\/v1\/workspaces\/([^/]+)\/members\/([^/]+)$/, async (req, body, [id, account]) => {
+      const r = await reach(req, id)
+      r.needAdmin()
+      if (!(await store.removeWorkspaceMember(r.ws.id, account))) throw new HttpError(404, 'not a member')
+      return { ok: true }
+    }],
+
+    // Puts a session in the workspace. The app calls this as soon as it has made the room,
+    // usually before the relay's first presence report. The API records who linked it, never
+    // an owner: only the relay names that, and members get in only once the two agree (access.js).
+    ['POST', /^\/v1\/workspaces\/([^/]+)\/sessions$/, async (req, body, [id]) => {
+      const r = await reach(req, id)
+      if (r.access.access !== 'edit') throw new HttpError(403, 'you can only view this workspace')
+      const room = String(body.room || '')
+      if (!ROOM.test(room)) throw new HttpError(400, 'room must be a session name')
+      const existing = await store.sessionByRoom(room)
+      if (existing && existing.ownerAccount && existing.ownerAccount !== r.me.account) throw new HttpError(403, 'only the session owner can move it')
+      const session = await store.setSessionWorkspace(room, r.ws.id, { linkedBy: r.me.account, at: now() })
+      // Its people come along when the owner manages the workspace; an editor's move leaves
+      // the workspace's people as they are, and says so (`peopleNeedAdmin`).
+      const owner = existing && existing.ownerAccount === r.me.account
+      if (!owner) return { session, added: [] }
+      if (!r.access.admin) return { session, added: [], peopleNeedAdmin: true }
+      return { session, added: await bringPeople(r.ws, room, r.me.account) }
+    }],
+
+    ['DELETE', /^\/v1\/workspaces\/([^/]+)\/sessions\/([^/]+)$/, async (req, body, [id, room]) => {
+      const r = await reach(req, id)
+      const s = await store.sessionByRoom(room)
+      if (!s || s.workspaceId !== r.ws.id) throw new HttpError(404, 'that session is not in this workspace')
+      if (s.ownerAccount !== r.me.account && !r.access.admin) throw new HttpError(403, 'only the session owner or a workspace admin can do that')
+      await store.setSessionWorkspace(room, null, { linkedBy: null, at: now() })
+      return { ok: true }
+    }]
+  ]
+  return routes.map(([method, pattern, fn, ...options]) => [method, pattern, gated(fn), ...options])
+}