wiki-viewer 1.7.2 → 1.8.1

package/.next/standalone/src/app/api/agent/internal/span/route.ts

@@ -8,7 +8,8 @@ import { revertProofSpan } from "@/lib/proof/proof-span";
 import { readSidecar, writeSidecar, emptySidecar } from "@/lib/proof/sidecar";
 import { withFileMutex } from "@/lib/proof/mutex";
 import { emitEvents } from "@/lib/proof/event-bus";
-import { getRootDir, safeRootPath } from "@/lib/root-dir";
+import { resolveWorkspaceForAgent } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 import { checkAuth, enforceScope } from "@/lib/proof/auth";
 
 export const runtime = "nodejs";
@@ -63,22 +64,25 @@ export async function POST(req: Request): Promise<NextResponse> {
 		return NextResponse.json({ error: "INVALID_PATH", message: "Path must be .md or .markdown" }, { status: 400 });
 	}
 
-	const absPath = safeRootPath(rel);
+	const wsx = await resolveWorkspaceForAgent(req);
+	if (!wsx.ok) return NextResponse.json({ error: wsx.code }, { status: wsx.status });
+	const { ws, rootDir } = wsx;
+
+	const absPath = safeWorkspacePath(rootDir, rel);
 	if (!absPath) {
 		return NextResponse.json({ error: "INVALID_PATH", message: "Path traversal rejected" }, { status: 400 });
 	}
 
-	const scopeCheck = enforceScope(authResult.agent, { filePath: rel, op: "mutate" });
+	const scopeCheck = enforceScope(authResult.agent, { filePath: rel, op: "mutate", workspaceId: ws.id });
 	if (!scopeCheck.ok) {
 		return NextResponse.json({ error: scopeCheck.code, message: scopeCheck.message }, { status: 403 });
 	}
 
-	const rootDir = getRootDir();
 	const actorId = authResult.agent.id;
 
 	let notFound = false;
 	try {
-		await withFileMutex(rel, async () => {
+		await withFileMutex(`${rootDir}\u0000${rel}`, async () => {
 			let content: string;
 			try {
 				content = await readFile(absPath, "utf-8");

package/.next/standalone/src/app/api/agent/register/route.ts

@@ -31,7 +31,15 @@ function validateScope(s: Record<string, unknown>): AgentScope | { error: string
 			return { error: `scope.ops values must be "read", "mutate", or "delete"` };
 		}
 	}
-	return { paths: s.paths as string[], ops: s.ops as Array<"read" | "mutate" | "delete"> };
+	// Optional workspaceId: if present must be a non-empty string ≤ 64 chars.
+	let workspaceId: string | undefined;
+	if (s.workspaceId !== undefined) {
+		if (typeof s.workspaceId !== "string" || s.workspaceId.length < 1 || s.workspaceId.length > 64) {
+			return { error: "scope.workspaceId must be a string of 1\u201364 characters" };
+		}
+		workspaceId = s.workspaceId;
+	}
+	return { paths: s.paths as string[], ops: s.ops as Array<"read" | "mutate" | "delete">, ...(workspaceId !== undefined ? { workspaceId } : {}) };
 }
 
 /** Exported for reuse in approve route. */

package/.next/standalone/src/app/api/agent/settings/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 import { checkAuth, enforceScope } from "@/lib/proof/auth";
-import { getRootDir } from "@/lib/root-dir";
+import { resolveWorkspaceForAgent } from "@/lib/workspace-context";
 import { readRegistry } from "@/lib/proof/registry";
 import { listPendingRegistrations } from "@/lib/proof/pending";
 
@@ -12,7 +12,11 @@ export async function GET(req: Request): Promise<NextResponse> {
 		return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
 	}
 
-	const scopeCheck = enforceScope(auth.agent, { op: "read" });
+	const wsx = await resolveWorkspaceForAgent(req);
+	if (!wsx.ok) return NextResponse.json({ error: wsx.code }, { status: wsx.status });
+	const { ws, rootDir } = wsx;
+
+	const scopeCheck = enforceScope(auth.agent, { op: "read", workspaceId: ws.id });
 	if (!scopeCheck.ok) {
 		return NextResponse.json({ error: scopeCheck.code, message: scopeCheck.message }, { status: 403 });
 	}
@@ -23,7 +27,7 @@ export async function GET(req: Request): Promise<NextResponse> {
 
 	return NextResponse.json({
 		rateLimit: Number(process.env.AGENT_RATE_LIMIT) || 60,
-		root: getRootDir(),
+		root: rootDir,
 		registeredAgents,
 		pendingRegistrations,
 	});

package/.next/standalone/src/app/api/agent/sidecar/[...path]/route.ts

@@ -1,7 +1,8 @@
 import { NextResponse } from "next/server";
 import { checkAuth, enforceScope } from "@/lib/proof/auth";
 import { readSidecar, emptySidecar } from "@/lib/proof/sidecar";
-import { getRootDir, safeRootPath } from "@/lib/root-dir";
+import { resolveWorkspaceForAgent } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 
 export const runtime = "nodejs";
 
@@ -32,17 +33,20 @@ export async function GET(
 		return NextResponse.json({ error: "INVALID_PATH", message: "Path must be .md or .markdown" }, { status: 400 });
 	}
 
-	const absPath = safeRootPath(rel);
+	const wsx = await resolveWorkspaceForAgent(req);
+	if (!wsx.ok) return NextResponse.json({ error: wsx.code }, { status: wsx.status });
+	const { ws, rootDir } = wsx;
+
+	const absPath = safeWorkspacePath(rootDir, rel);
 	if (!absPath) {
 		return NextResponse.json({ error: "INVALID_PATH", message: "Path traversal rejected" }, { status: 400 });
 	}
 
-	const scopeCheck = enforceScope(auth.agent, { filePath: rel, op: "read" });
+	const scopeCheck = enforceScope(auth.agent, { filePath: rel, op: "read", workspaceId: ws.id });
 	if (!scopeCheck.ok) {
 		return NextResponse.json({ error: scopeCheck.code, message: scopeCheck.message }, { status: 403 });
 	}
 
-	const rootDir = getRootDir();
 	const sidecar = (await readSidecar(rootDir, rel)) ?? emptySidecar(rel);
 
 	return NextResponse.json(sidecar);

package/.next/standalone/src/app/api/agents/install/route.ts

@@ -74,9 +74,25 @@ export async function GET(req: NextRequest): Promise<NextResponse> {
 			{ method: "GET",    path: "/api/agent/fs/ls/<path>",    auth: "bearer+agent-id", purpose: "Directory listing. ?recursive&limit&depth. Scope-filtered. Excludes .proof/." },
 			{ method: "POST",   path: "/api/agent/fs/move",         auth: "bearer+agent-id", purpose: "Move/rename. Body: {from, to, ifMatch?}. Moves .md sidecar too." },
 			{ method: "POST",   path: "/api/agent/fs/search",       auth: "bearer+agent-id", purpose: "Server-side grep or glob. Body: {kind:'grep'|'glob', query, path?, glob?, limit?}." },
+			// Settings (resolved workspace root, rate limit)
+			{ method: "GET",    path: "/api/agent/settings",        auth: "bearer+agent-id", purpose: "Returns rateLimit + resolved 'root' (the active workspace's directory for the X-Workspace you send)." },
 			// Human presence (for editor lease — drives active collab-state)
 			{ method: "POST",   path: "/api/wiki/presence",         auth: "session",          purpose: "Human editor lease heartbeat. Body: {path, action:'open'|'heartbeat'|'close'}." },
 		],
+		workspaces: {
+			description:
+				"This instance can serve multiple root directories ('workspaces'). Every agent path is relative to ONE workspace root.",
+			header: "X-Workspace: <workspaceId>",
+			queryParam: "ws=<workspaceId>",
+			default:
+				"If omitted, the server resolves to the most-recently-opened workspace. Correct for single-workspace instances; be explicit when several exist.",
+			discoverId:
+				"Ask the human for the workspace id, read it from the ?ws= param of a pasted wiki-viewer URL, or call GET /api/agent/settings (with X-Workspace) to confirm the resolved 'root'.",
+			scoped:
+				"A token may be pinned to one workspace (scope.workspaceId at approval). Requests resolving to a different workspace return 403 FORBIDDEN. A token with no pin is wildcard (any workspace).",
+			isolation:
+				"Paths in one workspace never touch another, even with identical relative paths.",
+		},
 		capabilities: {
 			maxFileBytes: MAX_FILE_BYTES,
 			supportsRange: true,
@@ -85,6 +101,8 @@ export async function GET(req: NextRequest): Promise<NextResponse> {
 			search: ["grep", "glob"],
 			globDialect: "**,*,?",
 			scopeOps: ["read", "mutate", "delete"],
+			scopeWorkspaceId: true,
+			workspaceHeader: "X-Workspace",
 			collabStates: ["active", "tracked", "untracked", "not-markdown"],
 			collabPrecondition: "If-Collab-Match",
 		},
@@ -103,8 +121,8 @@ export async function GET(req: NextRequest): Promise<NextResponse> {
 		mcpAdapter: {
 			package: "wiki-viewer-mcp",
 			invoke: "npx wiki-viewer-mcp",
-			env: ["WIKI_VIEWER_URL", "WIKI_VIEWER_TOKEN", "WIKI_VIEWER_AGENT_ID"],
-			description: "Thin MCP adapter mapping standard MCP filesystem tools onto these endpoints. Reads X-Collab-State and blocks or warns on raw writes to active .md files.",
+			env: ["WIKI_VIEWER_URL", "WIKI_VIEWER_TOKEN", "WIKI_VIEWER_AGENT_ID", "WIKI_VIEWER_WORKSPACE"],
+			description: "Thin MCP adapter mapping standard MCP filesystem tools onto these endpoints. Set WIKI_VIEWER_WORKSPACE to target a specific workspace (sends X-Workspace on every call). Reads X-Collab-State and blocks or warns on raw writes to active .md files.",
 		},
 		ops: [
 			"block.replace",

package/.next/standalone/src/app/api/assets/[...path]/route.ts

@@ -1,7 +1,8 @@
 import { readFile, stat } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
-import { getRootDir } from "@/lib/root-dir";
+import { resolveWorkspaceForAgent } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 
 const MIME_MAP: Record<string, string> = {
 	jpg: "image/jpeg",
@@ -38,15 +39,19 @@ const MIME_MAP: Record<string, string> = {
 };
 
 export async function GET(
-	_request: Request,
+	request: Request,
 	{ params }: { params: Promise<{ path: string[] }> },
 ) {
+	const wsx = await resolveWorkspaceForAgent(request);
+	if (!wsx.ok) return NextResponse.json({ error: wsx.code }, { status: wsx.status });
+	const { rootDir } = wsx;
+
 	const segments = (await params).path;
 	const rel = segments.join("/");
 
 	// Path traversal guard
-	const resolved = path.resolve(getRootDir(), rel);
-	if (resolved !== getRootDir() && !resolved.startsWith(getRootDir() + path.sep)) {
+	const resolved = safeWorkspacePath(rootDir, rel);
+	if (!resolved) {
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 	}
 

package/.next/standalone/src/app/api/system/admins/route.ts

@@ -0,0 +1,103 @@
+/**
+ * Admin management API.
+ *
+ * GET  /api/system/admins  — any signed-in user (returns isAdmin flag, admin list,
+ *                            and user roster if caller is admin).
+ * POST   { userId }        — admin-only: promote user to admin.
+ * DELETE { userId }        — admin-only: demote user; refuses to remove last admin.
+ *
+ * Bootstrap: first authenticated request triggers ensureBootstrapAdmin so the
+ * first user to sign in becomes admin when no WIKI_ADMIN_EMAILS is set.
+ */
+import { NextResponse } from "next/server";
+import Database from "better-sqlite3";
+import path from "node:path";
+import os from "node:os";
+import { mkdirSync } from "node:fs";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
+import {
+	isAdmin,
+	listAdmins,
+	addAdmin,
+	removeAdmin,
+	requireAdmin,
+	ensureBootstrapAdmin,
+} from "@/lib/auth/admin";
+
+export const runtime = "nodejs";
+
+interface UserRow {
+	id: string;
+	email: string;
+	name: string;
+}
+
+function queryAllUsers(): UserRow[] {
+	try {
+		const dir = path.join(process.env.HOME ?? os.homedir(), ".wiki-viewer");
+		mkdirSync(dir, { recursive: true });
+		const db = new Database(path.join(dir, "auth.db"));
+		db.pragma("journal_mode = WAL");
+		return db.prepare("SELECT id, email, name FROM user").all() as UserRow[];
+	} catch {
+		return [];
+	}
+}
+
+export async function GET(request: Request) {
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
+	// Bootstrap: first authenticated user becomes admin if no admin set yet.
+	await ensureBootstrapAdmin(auth.user.id);
+
+	const admin = await isAdmin(auth.user.id, auth.user.email);
+	const admins = await listAdmins();
+	const users = admin ? queryAllUsers() : [];
+
+	return NextResponse.json({ admins, isAdmin: admin, users });
+}
+
+export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	const authResult = await requireAdmin(request);
+	if (!authResult.ok)
+		return NextResponse.json({ error: authResult.code }, { status: authResult.status });
+
+	const body: { userId?: string } = await request.json();
+	if (!body.userId?.trim())
+		return NextResponse.json({ error: "Missing userId" }, { status: 400 });
+
+	await addAdmin(body.userId.trim());
+	const admins = await listAdmins();
+	return NextResponse.json({ ok: true, admins });
+}
+
+export async function DELETE(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	const authResult = await requireAdmin(request);
+	if (!authResult.ok)
+		return NextResponse.json({ error: authResult.code }, { status: authResult.status });
+
+	const body: { userId?: string } = await request.json();
+	if (!body.userId?.trim())
+		return NextResponse.json({ error: "Missing userId" }, { status: 400 });
+
+	try {
+		await removeAdmin(body.userId.trim());
+	} catch (e) {
+		const msg = e instanceof Error ? e.message : String(e);
+		if (msg.startsWith("LAST_ADMIN")) {
+			return NextResponse.json({ error: "LAST_ADMIN", message: msg }, { status: 409 });
+		}
+		throw e;
+	}
+
+	const admins = await listAdmins();
+	return NextResponse.json({ ok: true, admins });
+}

package/.next/standalone/src/app/api/system/reveal/route.ts

@@ -2,14 +2,15 @@ import { exec } from "node:child_process";
 import path from "node:path";
 import { NextResponse } from "next/server";
 import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
-import { getRootDir } from "@/lib/root-dir";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 
 export async function POST(request: Request) {
 	const csrf = checkOrigin(request);
 	if (csrf) return csrf;
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const body: { path?: string } = await request.json();
 	const rel = body.path;
@@ -17,8 +18,8 @@ export async function POST(request: Request) {
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 
 	// Path traversal guard
-	const resolved = path.resolve(getRootDir(), rel);
-	if (resolved !== getRootDir() && !resolved.startsWith(getRootDir() + path.sep))
+	const resolved = safeWorkspacePath(rootDir, rel);
+	if (!resolved)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 
 	// Open in system file manager

package/.next/standalone/src/app/api/system/set-root/route.ts

@@ -1,9 +1,25 @@
+/**
+ * Legacy set-root endpoint — back-compat shim for D1.
+ *
+ * Behaviour:
+ *  1. Validate dir (same as before).
+ *  2. Create (or find) a workspace for rootDir in the registry.
+ *  3. Keep setting the process-global rootDir + writing lastOpenedPath to config
+ *     so the legacy fallback path still works for the existing client.
+ *  4. Return { ok, path, workspaceId } — added workspaceId for D2 migration.
+ *
+ * NOTE: NOT admin-gated here so the current single-user flow is unaffected.
+ * The new POST /api/system/workspaces route is admin-gated; D2 will switch the
+ * UI to use that endpoint.
+ */
 import { stat } from "node:fs/promises";
 import { NextResponse } from "next/server";
 import { checkOrigin } from "@/lib/auth/csrf";
 import { requireUser } from "@/lib/auth/server";
 import { writeConfig } from "@/lib/config";
 import { setRootDir } from "@/lib/root-dir";
+import { listWorkspaces, createWorkspace } from "@/lib/workspaces";
+import path from "node:path";
 
 export async function POST(request: Request) {
 	const csrf = checkOrigin(request);
@@ -24,7 +40,14 @@ export async function POST(request: Request) {
 		return NextResponse.json({ error: "Directory not found" }, { status: 404 });
 	}
 
+	// Legacy: keep the global + config in sync for the fallback resolver.
 	setRootDir(dir);
 	await writeConfig({ lastOpenedPath: dir });
-	return NextResponse.json({ ok: true, path: dir });
+
+	// Find or create a workspace for this rootDir so the registry is populated.
+	const resolved = path.resolve(dir);
+	const existing = (await listWorkspaces()).find((w) => w.rootDir === resolved);
+	const ws = existing ?? (await createWorkspace({ rootDir: dir, createdBy: auth.user.id }));
+
+	return NextResponse.json({ ok: true, path: dir, workspaceId: ws.id });
 }

package/.next/standalone/src/app/api/system/users/route.ts

@@ -0,0 +1,120 @@
+/**
+ * POST /api/system/users  (admin only)
+ *
+ * Admin creates a new account with a generated temporary password, returned
+ * once in the response. The new user signs in and changes it. The signup
+ * allowlist is bypassed for admin-initiated creation (the admin is the gate).
+ *
+ * This calls auth.api.signUpEmail server-side; the session it would mint for
+ * the new user is discarded (we never forward those Set-Cookie headers), so
+ * the admin's own session is untouched.
+ */
+export const runtime = "nodejs";
+
+import { NextResponse } from "next/server";
+import { randomBytes } from "node:crypto";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireAdmin } from "@/lib/auth/admin";
+import { auth, authReady, withAdminUserCreate, passwordAuthEnabled, db } from "@/lib/auth/server";
+
+const EMAIL_RE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
+
+/** Readable temp password: 4 groups, mixed case + digits, no ambiguous chars. */
+function generateTempPassword(): string {
+	const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789";
+	const bytes = randomBytes(16);
+	let out = "";
+	for (let i = 0; i < 16; i++) {
+		out += alphabet[bytes[i] % alphabet.length];
+		if (i % 4 === 3 && i < 15) out += "-";
+	}
+	return out; // e.g. "k7Pm-9QrT-x2Vn-bL4w"
+}
+
+export async function POST(req: Request): Promise<NextResponse> {
+	const csrf = checkOrigin(req);
+	if (csrf) return csrf;
+
+	const admin = await requireAdmin(req);
+	if (!admin.ok) {
+		return NextResponse.json({ error: admin.code }, { status: admin.status });
+	}
+
+	if (!passwordAuthEnabled) {
+		return NextResponse.json(
+			{ error: "PASSWORD_AUTH_DISABLED", message: "Email/password sign-in is disabled; cannot create password accounts." },
+			{ status: 400 },
+		);
+	}
+
+	let body: { email?: unknown; name?: unknown };
+	try {
+		body = (await req.json()) as { email?: unknown; name?: unknown };
+	} catch {
+		return NextResponse.json({ error: "INVALID_PAYLOAD", message: "Invalid JSON" }, { status: 400 });
+	}
+
+	const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
+	const name = typeof body.name === "string" && body.name.trim() ? body.name.trim() : email.split("@")[0];
+
+	if (!EMAIL_RE.test(email)) {
+		return NextResponse.json({ error: "INVALID_EMAIL", message: "A valid email is required" }, { status: 400 });
+	}
+
+	const tempPassword = generateTempPassword();
+
+	await authReady();
+	// Reject duplicates up front (signUpEmail may otherwise create a second
+	// credential row or silently succeed depending on Better Auth internals).
+	try {
+		const existing = db
+			.prepare("SELECT 1 FROM user WHERE lower(email) = ? LIMIT 1")
+			.get(email);
+		if (existing) {
+			return NextResponse.json(
+				{ error: "USER_EXISTS", message: "A user with that email already exists." },
+				{ status: 409 },
+			);
+		}
+	} catch {
+		// If the lookup fails, fall through and let signUpEmail decide.
+	}
+
+	try {
+		// Bypass the signup allowlist for this admin-initiated creation. The
+		// returned response (and any session cookie) is intentionally discarded.
+		const result = await withAdminUserCreate(() =>
+			auth.api.signUpEmail({
+				body: { email, password: tempPassword, name },
+				asResponse: true,
+			}),
+		);
+		if (!result.ok) {
+			const text = await result.text().catch(() => "");
+			if (/exist|unique|already/i.test(text)) {
+				return NextResponse.json(
+					{ error: "USER_EXISTS", message: "A user with that email already exists." },
+					{ status: 409 },
+				);
+			}
+			return NextResponse.json(
+				{ error: "CREATE_FAILED", message: text || "Failed to create user" },
+				{ status: 500 },
+			);
+		}
+	} catch (e) {
+		const msg = e instanceof Error ? e.message : "";
+		if (/exist|unique|already/i.test(msg)) {
+			return NextResponse.json(
+				{ error: "USER_EXISTS", message: "A user with that email already exists." },
+				{ status: 409 },
+			);
+		}
+		return NextResponse.json(
+			{ error: "CREATE_FAILED", message: msg || "Failed to create user" },
+			{ status: 500 },
+		);
+	}
+
+	return NextResponse.json({ ok: true, email, name, tempPassword });
+}

package/.next/standalone/src/app/api/system/workspaces/[id]/open/route.ts

@@ -0,0 +1,34 @@
+/**
+ * POST /api/system/workspaces/[id]/open
+ *
+ * Client calls this when switching to a workspace.  Records lastOpenedAt so
+ * the most-recently-used workspace can be selected on next load.
+ */
+import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
+import { isAdmin } from "@/lib/auth/admin";
+import { getWorkspace, touchWorkspace, userCanAccess } from "@/lib/workspaces";
+
+export const runtime = "nodejs";
+
+type Params = { params: Promise<{ id: string }> };
+
+export async function POST(request: Request, { params }: Params) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
+	const { id } = await params;
+	const ws = await getWorkspace(id);
+	if (!ws) return NextResponse.json({ error: "WORKSPACE_NOT_FOUND" }, { status: 404 });
+
+	const admin = await isAdmin(auth.user.id, auth.user.email);
+	if (!userCanAccess(ws, auth.user.id, admin))
+		return NextResponse.json({ error: "WORKSPACE_FORBIDDEN" }, { status: 403 });
+
+	await touchWorkspace(id);
+	return NextResponse.json({ ok: true });
+}

package/.next/standalone/src/app/api/system/workspaces/[id]/route.ts

@@ -0,0 +1,74 @@
+/**
+ * Per-workspace management API.
+ *
+ * PATCH  /api/system/workspaces/[id]  — update name, pinnedPaths (any user with
+ *                                       access), or allowedUserIds (admin-only).
+ * DELETE /api/system/workspaces/[id]  — admin-only: remove workspace from registry
+ *                                       (never touches the filesystem directory).
+ */
+import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
+import { isAdmin, requireAdmin } from "@/lib/auth/admin";
+import {
+	getWorkspace,
+	renameWorkspace,
+	removeWorkspace,
+	setWorkspaceAccess,
+	setWorkspacePins,
+	userCanAccess,
+} from "@/lib/workspaces";
+
+export const runtime = "nodejs";
+
+type Params = { params: Promise<{ id: string }> };
+
+export async function PATCH(request: Request, { params }: Params) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
+	const { id } = await params;
+	const ws = await getWorkspace(id);
+	if (!ws) return NextResponse.json({ error: "WORKSPACE_NOT_FOUND" }, { status: 404 });
+
+	const admin = await isAdmin(auth.user.id, auth.user.email);
+	if (!userCanAccess(ws, auth.user.id, admin))
+		return NextResponse.json({ error: "WORKSPACE_FORBIDDEN" }, { status: 403 });
+
+	const body: {
+		name?: string;
+		pinnedPaths?: string[];
+		allowedUserIds?: string[];
+	} = await request.json();
+
+	// allowedUserIds is admin-only
+	if (body.allowedUserIds !== undefined && !admin)
+		return NextResponse.json({ error: "ADMIN_REQUIRED" }, { status: 403 });
+
+	// Apply each field
+	if (body.name !== undefined) await renameWorkspace(id, body.name.trim());
+	if (body.pinnedPaths !== undefined) await setWorkspacePins(id, body.pinnedPaths);
+	if (body.allowedUserIds !== undefined) await setWorkspaceAccess(id, body.allowedUserIds);
+
+	const updated = await getWorkspace(id);
+	return NextResponse.json({ ok: true, workspace: updated });
+}
+
+export async function DELETE(request: Request, { params }: Params) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	const authResult = await requireAdmin(request);
+	if (!authResult.ok)
+		return NextResponse.json({ error: authResult.code }, { status: authResult.status });
+
+	const { id } = await params;
+	const ws = await getWorkspace(id);
+	if (!ws) return NextResponse.json({ error: "WORKSPACE_NOT_FOUND" }, { status: 404 });
+
+	await removeWorkspace(id);
+	return NextResponse.json({ ok: true });
+}