Akhil check this carefully - RBAC and workspace API

Author: anuphilipp3

apps/backend/app/api/router.py

@@ -23,6 +23,7 @@
 from app.api.routes.url_shortener.api import router as url_shortener_router
 from app.api.routes.dns_lookup.api import router as dns_lookup_router
 from app.api.routes.audit_log.api import router as audit_log_router
+from app.api.routes.workspaces.api import router as workspaces_router
 
 api_router = APIRouter()
 api_router.include_router(health_router)
@@ -48,3 +49,4 @@
 api_router.include_router(url_shortener_router)
 api_router.include_router(dns_lookup_router)
 api_router.include_router(audit_log_router)
+api_router.include_router(workspaces_router)

apps/backend/app/api/routes/api_client/api.py

@@ -13,23 +13,28 @@
     ApiClientHistoryCreate,
     ApiClientHistoryOut,
 )
-from app.api.routes.auth.services import get_current_uid
+from app.api.routes.workspaces.deps import WorkspaceContext, require_tool
+
+# Every api-client endpoint requires the active role to have the api-client tool.
+# `require_tool` resolves the workspace from X-Workspace-Id, verifies membership,
+# and 403s if the role can't use this tool. This is the authoritative server gate.
+TOOL = "/app/api-client"
 
 router = APIRouter(prefix="/api-client", tags=["api-client"])
 router.include_router(collections_delta.router)
 
 
 @router.get("/collections", response_model=list[ApiClientCollectionOut], summary="List API client collections")
-async def list_collections(uid: str = Depends(get_current_uid)) -> list[ApiClientCollectionOut]:
-    return await api_client_svc.list_collections(uid=uid)
+async def list_collections(ctx: WorkspaceContext = Depends(require_tool(TOOL))) -> list[ApiClientCollectionOut]:
+    return await api_client_svc.list_collections(uid=ctx.uid, workspace_id=ctx.workspace_id)
 
 
 @router.post("/collections", response_model=ApiClientCollectionOut, summary="Create API client collection")
 async def create_collection(
     body: ApiClientCollectionCreate,
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_tool(TOOL)),
 ) -> ApiClientCollectionOut:
-    return await api_client_svc.create_collection(uid, body)
+    return await api_client_svc.create_collection(ctx.uid, ctx.workspace_id, body)
 
 
 @router.patch(
@@ -40,27 +45,27 @@ async def create_collection(
 async def patch_collection(
     collection_id: str,
     body: ApiClientCollectionUpdate,
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_tool(TOOL)),
 ) -> ApiClientCollectionOut:
-    return await api_client_svc.patch_collection(uid, collection_id, body)
+    return await api_client_svc.patch_collection(ctx.uid, ctx.workspace_id, collection_id, body)
 
 
 @router.delete("/collections/{collection_id}", status_code=204, summary="Delete API client collection")
-async def delete_collection(collection_id: str, uid: str = Depends(get_current_uid)) -> None:
-    await api_client_svc.delete_collection(uid, collection_id)
+async def delete_collection(collection_id: str, ctx: WorkspaceContext = Depends(require_tool(TOOL))) -> None:
+    await api_client_svc.delete_collection(ctx.uid, ctx.workspace_id, collection_id)
 
 
 @router.get("/environments", response_model=list[ApiClientEnvironmentOut], summary="List API client environments")
-async def list_environments(uid: str = Depends(get_current_uid)) -> list[ApiClientEnvironmentOut]:
-    return await api_client_svc.list_environments(uid=uid)
+async def list_environments(ctx: WorkspaceContext = Depends(require_tool(TOOL))) -> list[ApiClientEnvironmentOut]:
+    return await api_client_svc.list_environments(uid=ctx.uid, workspace_id=ctx.workspace_id)
 
 
 @router.post("/environments", response_model=ApiClientEnvironmentOut, summary="Create API client environment")
 async def create_environment(
     body: ApiClientEnvironmentCreate,
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_tool(TOOL)),
 ) -> ApiClientEnvironmentOut:
-    return await api_client_svc.create_environment(uid, body)
+    return await api_client_svc.create_environment(ctx.uid, ctx.workspace_id, body)
 
 
 @router.patch(
@@ -71,40 +76,40 @@ async def create_environment(
 async def patch_environment(
     environment_id: str,
     body: ApiClientEnvironmentUpdate,
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_tool(TOOL)),
 ) -> ApiClientEnvironmentOut:
-    return await api_client_svc.patch_environment(uid, environment_id, body)
+    return await api_client_svc.patch_environment(ctx.uid, ctx.workspace_id, environment_id, body)
 
 
 @router.delete("/environments/{environment_id}", status_code=204, summary="Delete API client environment")
-async def delete_environment(environment_id: str, uid: str = Depends(get_current_uid)) -> None:
-    await api_client_svc.delete_environment(uid, environment_id)
+async def delete_environment(environment_id: str, ctx: WorkspaceContext = Depends(require_tool(TOOL))) -> None:
+    await api_client_svc.delete_environment(ctx.uid, ctx.workspace_id, environment_id)
 
 
 @router.get("/history", response_model=list[ApiClientHistoryOut], summary="List API client request history")
 async def list_history(
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_tool(TOOL)),
     limit: int = Query(default=HISTORY_MAX_ITEMS, ge=1, le=HISTORY_MAX_ITEMS),
 ) -> list[ApiClientHistoryOut]:
-    return await api_client_svc.list_history(uid=uid, limit=limit)
+    return await api_client_svc.list_history(uid=ctx.uid, workspace_id=ctx.workspace_id, limit=limit)
 
 
 @router.post("/history", response_model=ApiClientHistoryOut, summary="Append API client history entry")
 async def create_history(
     body: ApiClientHistoryCreate,
     background_tasks: BackgroundTasks,
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_tool(TOOL)),
 ) -> ApiClientHistoryOut:
-    entry = await api_client_svc.create_history(uid, body)
-    background_tasks.add_task(api_client_svc.trim_history, uid)
+    entry = await api_client_svc.create_history(ctx.uid, ctx.workspace_id, body)
+    background_tasks.add_task(api_client_svc.trim_history, ctx.uid, ctx.workspace_id)
     return entry
 
 
 @router.delete("/history/clear", status_code=204, summary="Clear all API client history")
-async def clear_history(uid: str = Depends(get_current_uid)) -> None:
-    await api_client_svc.clear_history(uid)
+async def clear_history(ctx: WorkspaceContext = Depends(require_tool(TOOL))) -> None:
+    await api_client_svc.clear_history(ctx.uid, ctx.workspace_id)
 
 
 @router.delete("/history/{entry_id}", status_code=204, summary="Delete one history entry")
-async def delete_history_entry(entry_id: str, uid: str = Depends(get_current_uid)) -> None:
-    await api_client_svc.delete_history_entry(uid, entry_id)
+async def delete_history_entry(entry_id: str, ctx: WorkspaceContext = Depends(require_tool(TOOL))) -> None:
+    await api_client_svc.delete_history_entry(ctx.uid, ctx.workspace_id, entry_id)

apps/backend/app/api/routes/api_client/collections_delta.py

@@ -27,11 +27,14 @@
     Op,
     UpdateItemOp,
 )
-from app.api.routes.auth.services import get_current_uid
+from app.api.routes.workspaces.deps import WorkspaceContext, require_tool
 from app.core.cache import bump_version
 from app.database import db_manager
 from app.utils.collection_name import API_CLIENT_COLLECTIONS
 
+# ponytail: cache scope stays "user"; Phase 2 (multi-member) must key invalidation on workspace_id.
+TOOL = "/app/api-client"
+
 router = APIRouter()
 
 
@@ -200,13 +203,14 @@ def _apply_move(
 
 async def apply_collection_delta(
     uid: str,
+    workspace_id: str,
     collection_id: str,
     ops: list[Op],
 ) -> ApiClientCollectionOut:
     oid = _parse_oid(collection_id, kind="collection")
 
     # Fetch + ownership check BEFORE any mutation
-    doc = await db_manager.find_one(API_CLIENT_COLLECTIONS, {"_id": oid, "created_by": uid})
+    doc = await db_manager.find_one(API_CLIENT_COLLECTIONS, {"_id": oid, "workspace_id": workspace_id})
     if not doc:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Collection not found.")
 
@@ -245,7 +249,7 @@ async def apply_collection_delta(
     try:
         updated_doc = await db_manager.find_one_and_update(
             API_CLIENT_COLLECTIONS,
-            {"_id": oid, "created_by": uid},
+            {"_id": oid, "workspace_id": workspace_id},
             {"$set": {"items": items}},
             return_document=ReturnDocument.AFTER,
         )
@@ -274,7 +278,7 @@ async def apply_collection_delta(
 async def apply_delta(
     collection_id: str,
     body: ApplyDeltaRequest,
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_tool(TOOL)),
 ) -> ApplyDeltaResponse:
-    collection = await apply_collection_delta(uid, collection_id, body.ops)
+    collection = await apply_collection_delta(ctx.uid, ctx.workspace_id, collection_id, body.ops)
     return ApplyDeltaResponse(collection=collection)

apps/backend/app/api/routes/api_client/services.py

@@ -26,6 +26,8 @@
 )
 from app.utils.crud import safe_delete_one, safe_insert, safe_update_one
 
+# ponytail: cache scope stays "user"; Phase 2 (multi-member) must key invalidation on workspace_id.
+
 HISTORY_TRIM_BATCH_SIZE = 500
 
 
@@ -58,80 +60,80 @@ def _env_to_out(doc: dict[str, Any]) -> ApiClientEnvironmentOut:
 
 
 @cached(ns="api_client", ttl=300, scope="user")
-async def list_collections(*, uid: str) -> list[ApiClientCollectionOut]:
+async def list_collections(*, uid: str, workspace_id: str) -> list[ApiClientCollectionOut]:
     docs = await db_manager.find(
         API_CLIENT_COLLECTIONS,
-        {"created_by": uid},
+        {"workspace_id": workspace_id},
         {"_id": 1, "name": 1, "items": 1},
         sort=[("name", 1), ("_id", 1)],
     )
     return [_collection_to_out(d) for d in docs]
 
 
-async def create_collection(uid: str, body: ApiClientCollectionCreate) -> ApiClientCollectionOut:
-    doc: dict[str, Any] = {"created_by": uid, "name": body.name, "items": []}
+async def create_collection(uid: str, workspace_id: str, body: ApiClientCollectionCreate) -> ApiClientCollectionOut:
+    doc: dict[str, Any] = {"workspace_id": workspace_id, "created_by": uid, "name": body.name, "items": []}
     await safe_insert(API_CLIENT_COLLECTIONS, doc, name="Collection")
     await bump_version(ns="api_client", uid=uid)
     return _collection_to_out(doc)
 
 
-async def patch_collection(uid: str, collection_id: str, body: ApiClientCollectionUpdate) -> ApiClientCollectionOut:
+async def patch_collection(uid: str, workspace_id: str, collection_id: str, body: ApiClientCollectionUpdate) -> ApiClientCollectionOut:
     oid = _parse_oid(collection_id, kind="collection")
     patch = body.model_dump(exclude_unset=True)
     if not patch:
-        doc = await db_manager.find_one(API_CLIENT_COLLECTIONS, {"_id": oid, "created_by": uid})
+        doc = await db_manager.find_one(API_CLIENT_COLLECTIONS, {"_id": oid, "workspace_id": workspace_id})
         if not doc:
             raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Collection not found.")
         return _collection_to_out(doc)
     doc = await safe_update_one(
-        API_CLIENT_COLLECTIONS, {"_id": oid, "created_by": uid}, patch, name="Collection"
+        API_CLIENT_COLLECTIONS, {"_id": oid, "workspace_id": workspace_id}, patch, name="Collection"
     )
     await bump_version(ns="api_client", uid=uid)
     return _collection_to_out(doc)
 
 
-async def delete_collection(uid: str, collection_id: str) -> None:
+async def delete_collection(uid: str, workspace_id: str, collection_id: str) -> None:
     oid = _parse_oid(collection_id, kind="collection")
-    await safe_delete_one(API_CLIENT_COLLECTIONS, {"_id": oid, "created_by": uid}, name="Collection")
+    await safe_delete_one(API_CLIENT_COLLECTIONS, {"_id": oid, "workspace_id": workspace_id}, name="Collection")
     await bump_version(ns="api_client", uid=uid)
 
 
 @cached(ns="api_client", ttl=300, scope="user")
-async def list_environments(*, uid: str) -> list[ApiClientEnvironmentOut]:
+async def list_environments(*, uid: str, workspace_id: str) -> list[ApiClientEnvironmentOut]:
     docs = await db_manager.find(
         API_CLIENT_ENVIRONMENTS,
-        {"created_by": uid},
+        {"workspace_id": workspace_id},
         {"_id": 1, "name": 1, "variables": 1},
         sort=[("name", 1), ("_id", 1)],
     )
     return [_env_to_out(d) for d in docs]
 
 
-async def create_environment(uid: str, body: ApiClientEnvironmentCreate) -> ApiClientEnvironmentOut:
-    doc: dict[str, Any] = {"created_by": uid, "name": body.name, "variables": []}
+async def create_environment(uid: str, workspace_id: str, body: ApiClientEnvironmentCreate) -> ApiClientEnvironmentOut:
+    doc: dict[str, Any] = {"workspace_id": workspace_id, "created_by": uid, "name": body.name, "variables": []}
     await safe_insert(API_CLIENT_ENVIRONMENTS, doc, name="Environment")
     await bump_version(ns="api_client", uid=uid)
     return _env_to_out(doc)
 
 
-async def patch_environment(uid: str, environment_id: str, body: ApiClientEnvironmentUpdate) -> ApiClientEnvironmentOut:
+async def patch_environment(uid: str, workspace_id: str, environment_id: str, body: ApiClientEnvironmentUpdate) -> ApiClientEnvironmentOut:
     oid = _parse_oid(environment_id, kind="environment")
     patch = body.model_dump(exclude_unset=True)
     if not patch:
-        doc = await db_manager.find_one(API_CLIENT_ENVIRONMENTS, {"_id": oid, "created_by": uid})
+        doc = await db_manager.find_one(API_CLIENT_ENVIRONMENTS, {"_id": oid, "workspace_id": workspace_id})
         if not doc:
             raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Environment not found.")
         return _env_to_out(doc)
     doc = await safe_update_one(
-        API_CLIENT_ENVIRONMENTS, {"_id": oid, "created_by": uid}, patch, name="Environment"
+        API_CLIENT_ENVIRONMENTS, {"_id": oid, "workspace_id": workspace_id}, patch, name="Environment"
     )
     await bump_version(ns="api_client", uid=uid)
     return _env_to_out(doc)
 
 
-async def delete_environment(uid: str, environment_id: str) -> None:
+async def delete_environment(uid: str, workspace_id: str, environment_id: str) -> None:
     oid = _parse_oid(environment_id, kind="environment")
-    await safe_delete_one(API_CLIENT_ENVIRONMENTS, {"_id": oid, "created_by": uid}, name="Environment")
+    await safe_delete_one(API_CLIENT_ENVIRONMENTS, {"_id": oid, "workspace_id": workspace_id}, name="Environment")
     await bump_version(ns="api_client", uid=uid)
 
 
@@ -154,8 +156,8 @@ def _history_doc_to_out(doc: dict[str, Any]) -> ApiClientHistoryOut:
     )
 
 
-async def trim_history(uid: str) -> None:
-    filt = {"created_by": uid}
+async def trim_history(uid: str, workspace_id: str) -> None:
+    filt = {"workspace_id": workspace_id}
     stale_docs = await db_manager.find(
         API_CLIENT_HISTORY,
         filt,
@@ -167,20 +169,21 @@ async def trim_history(uid: str) -> None:
     if not stale_docs:
         return
     ids = [d["_id"] for d in stale_docs]
-    await db_manager.delete_many(API_CLIENT_HISTORY, {"_id": {"$in": ids}, "created_by": uid})
+    await db_manager.delete_many(API_CLIENT_HISTORY, {"_id": {"$in": ids}, "workspace_id": workspace_id})
     await bump_version(ns="api_client", uid=uid)
 
 
 @cached(ns="api_client", ttl=300, scope="user")
-async def list_history(*, uid: str, limit: int = HISTORY_MAX_ITEMS) -> list[ApiClientHistoryOut]:
+async def list_history(*, uid: str, workspace_id: str, limit: int = HISTORY_MAX_ITEMS) -> list[ApiClientHistoryOut]:
     lim = max(1, min(limit, HISTORY_MAX_ITEMS))
-    docs = await db_manager.find(API_CLIENT_HISTORY, {"created_by": uid}, sort=[("timestamp", -1)], limit=lim)
+    docs = await db_manager.find(API_CLIENT_HISTORY, {"workspace_id": workspace_id}, sort=[("timestamp", -1)], limit=lim)
     return [_history_doc_to_out(d) for d in docs]
 
 
-async def create_history(uid: str, body: ApiClientHistoryCreate) -> ApiClientHistoryOut:
+async def create_history(uid: str, workspace_id: str, body: ApiClientHistoryCreate) -> ApiClientHistoryOut:
     ts = body.timestamp if body.timestamp is not None else int(time.time() * 1000)
     doc: dict[str, Any] = {
+        "workspace_id": workspace_id,
         "created_by": uid,
         "method": body.method,
         "url": body.url,
@@ -197,15 +200,15 @@ async def create_history(uid: str, body: ApiClientHistoryCreate) -> ApiClientHis
     return _history_doc_to_out(doc)
 
 
-async def delete_history_entry(uid: str, entry_id: str) -> None:
+async def delete_history_entry(uid: str, workspace_id: str, entry_id: str) -> None:
     oid = _parse_oid(entry_id, kind="history")
-    await safe_delete_one(API_CLIENT_HISTORY, {"_id": oid, "created_by": uid}, name="History entry")
+    await safe_delete_one(API_CLIENT_HISTORY, {"_id": oid, "workspace_id": workspace_id}, name="History entry")
     await bump_version(ns="api_client", uid=uid)
 
 
-async def clear_history(uid: str) -> None:
+async def clear_history(uid: str, workspace_id: str) -> None:
     try:
-        await db_manager.delete_many(API_CLIENT_HISTORY, {"created_by": uid})
+        await db_manager.delete_many(API_CLIENT_HISTORY, {"workspace_id": workspace_id})
     except PyMongoError as exc:
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="Failed to clear history."

apps/backend/app/api/routes/auth/api.py

@@ -186,6 +186,9 @@ async def update_profile(
     current_user: Annotated[UserProfileResponse, Depends(get_current_user)],
 ) -> UserProfileResponse:
     updates = {}
+    if payload.persona is not None:
+        updates["persona"] = payload.persona or None
+
     if payload.github_username is not None:
         updates["github_username"] = payload.github_username
 

apps/backend/app/api/routes/auth/schema.py

@@ -108,10 +108,12 @@ class UserProfileResponse(BaseModel):
     certifications: list[Certification] = Field(default_factory=list)
     portfolio_settings: PortfolioSettings | None = None
     personal_info: PersonalInfo | None = None
+    persona: str | None = None
     onboarding_completed: bool = False
 
 
 class UpdateProfileRequest(BaseModel):
+    persona: str | None = None
     github_username: str | None = None
     username: str | None = None
     bio: str | None = None

apps/backend/app/api/routes/auth/services.py

@@ -129,5 +129,6 @@ async def get_current_user(
         certifications=[Certification(**c) for c in doc.get("certifications") or []],
         portfolio_settings=doc.get("portfolio_settings"),
         personal_info=PersonalInfo(**doc["personal_info"]) if doc.get("personal_info") else None,
+        persona=doc.get("persona"),
         onboarding_completed=bool(doc.get("onboarding_completed", False)),
     )