Akhil/add workspace

apps/backend/app/api/router.py

@@ -24,6 +24,7 @@
 from app.api.routes.url_shortener.api import router as url_shortener_router
 from app.api.routes.dns_lookup.api import router as dns_lookup_router
 from app.api.routes.audit_log.api import router as audit_log_router
+from app.api.routes.workspaces.api import router as workspaces_router
 
 api_router = APIRouter()
 api_router.include_router(health_router)
@@ -50,3 +51,4 @@
 api_router.include_router(url_shortener_router)
 api_router.include_router(dns_lookup_router)
 api_router.include_router(audit_log_router)
+api_router.include_router(workspaces_router)

apps/backend/app/api/routes/api_client/api.py

@@ -19,22 +19,24 @@
     ApiClientWorkspaceUpdate,
 )
 from app.api.routes.auth.services import get_current_uid
+from app.api.routes.workspaces.middleware import WorkspaceContext
+from app.api.routes.workspaces.rbac import require_permission
 
 router = APIRouter(prefix="/api-client", tags=["api-client"])
 router.include_router(collections_delta.router)
 
 
 @router.get("/collections", response_model=list[ApiClientCollectionOut], summary="List API client collections")
-async def list_collections(uid: str = Depends(get_current_uid)) -> list[ApiClientCollectionOut]:
-    return await api_client_svc.list_collections(uid=uid)
+async def list_collections(ctx: WorkspaceContext = Depends(require_permission("api-client", "read"))) -> list[ApiClientCollectionOut]:
+    return await api_client_svc.list_collections(ctx=ctx)
 
 
 @router.post("/collections", response_model=ApiClientCollectionOut, summary="Create API client collection")
 async def create_collection(
     body: ApiClientCollectionCreate,
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_permission("api-client", "write")),
 ) -> ApiClientCollectionOut:
-    return await api_client_svc.create_collection(uid, body)
+    return await api_client_svc.create_collection(ctx, body)
 
 
 @router.patch(
@@ -45,27 +47,27 @@ async def create_collection(
 async def patch_collection(
     collection_id: str,
     body: ApiClientCollectionUpdate,
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_permission("api-client", "write")),
 ) -> ApiClientCollectionOut:
-    return await api_client_svc.patch_collection(uid, collection_id, body)
+    return await api_client_svc.patch_collection(ctx, collection_id, body)
 
 
 @router.delete("/collections/{collection_id}", status_code=204, summary="Delete API client collection")
-async def delete_collection(collection_id: str, uid: str = Depends(get_current_uid)) -> None:
-    await api_client_svc.delete_collection(uid, collection_id)
+async def delete_collection(collection_id: str, ctx: WorkspaceContext = Depends(require_permission("api-client", "delete"))) -> None:
+    await api_client_svc.delete_collection(ctx, collection_id)
 
 
 @router.get("/environments", response_model=list[ApiClientEnvironmentOut], summary="List API client environments")
-async def list_environments(uid: str = Depends(get_current_uid)) -> list[ApiClientEnvironmentOut]:
-    return await api_client_svc.list_environments(uid=uid)
+async def list_environments(ctx: WorkspaceContext = Depends(require_permission("api-client", "read"))) -> list[ApiClientEnvironmentOut]:
+    return await api_client_svc.list_environments(ctx=ctx)
 
 
 @router.post("/environments", response_model=ApiClientEnvironmentOut, summary="Create API client environment")
 async def create_environment(
     body: ApiClientEnvironmentCreate,
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_permission("api-client", "write")),
 ) -> ApiClientEnvironmentOut:
-    return await api_client_svc.create_environment(uid, body)
+    return await api_client_svc.create_environment(ctx, body)
 
 
 @router.patch(
@@ -76,46 +78,48 @@ async def create_environment(
 async def patch_environment(
     environment_id: str,
     body: ApiClientEnvironmentUpdate,
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_permission("api-client", "write")),
 ) -> ApiClientEnvironmentOut:
-    return await api_client_svc.patch_environment(uid, environment_id, body)
+    return await api_client_svc.patch_environment(ctx, environment_id, body)
 
 
 @router.delete("/environments/{environment_id}", status_code=204, summary="Delete API client environment")
-async def delete_environment(environment_id: str, uid: str = Depends(get_current_uid)) -> None:
-    await api_client_svc.delete_environment(uid, environment_id)
+async def delete_environment(environment_id: str, ctx: WorkspaceContext = Depends(require_permission("api-client", "delete"))) -> None:
+    await api_client_svc.delete_environment(ctx, environment_id)
 
 
 @router.get("/history", response_model=list[ApiClientHistoryOut], summary="List API client request history")
 async def list_history(
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_permission("api-client", "read")),
     limit: int = Query(default=HISTORY_MAX_ITEMS, ge=1, le=HISTORY_MAX_ITEMS),
 ) -> list[ApiClientHistoryOut]:
-    return await api_client_svc.list_history(uid=uid, limit=limit)
+    return await api_client_svc.list_history(ctx=ctx, limit=limit)
 
 
 @router.post("/history", response_model=ApiClientHistoryOut, summary="Append API client history entry")
 async def create_history(
     body: ApiClientHistoryCreate,
     background_tasks: BackgroundTasks,
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_permission("api-client", "write")),
 ) -> ApiClientHistoryOut:
-    entry = await api_client_svc.create_history(uid, body)
-    background_tasks.add_task(api_client_svc.trim_history, uid)
+    entry = await api_client_svc.create_history(ctx, body)
+    background_tasks.add_task(api_client_svc.trim_history, ctx)
     return entry
 
 
 @router.delete("/history/clear", status_code=204, summary="Clear all API client history")
-async def clear_history(uid: str = Depends(get_current_uid)) -> None:
-    await api_client_svc.clear_history(uid)
+async def clear_history(ctx: WorkspaceContext = Depends(require_permission("api-client", "admin"))) -> None:
+    await api_client_svc.clear_history(ctx)
 
 
 @router.delete("/history/{entry_id}", status_code=204, summary="Delete one history entry")
-async def delete_history_entry(entry_id: str, uid: str = Depends(get_current_uid)) -> None:
-    await api_client_svc.delete_history_entry(uid, entry_id)
+async def delete_history_entry(entry_id: str, ctx: WorkspaceContext = Depends(require_permission("api-client", "delete"))) -> None:
+    await api_client_svc.delete_history_entry(ctx, entry_id)
 
 
 # ── Public mocks ─────────────────────────────────────────────────────────────
+# Public mocks retain uid-based ownership management (not workspace-scoped).
+# See services.py for rationale.
 
 
 @router.get(
@@ -170,8 +174,8 @@ async def get_public_mock_anonymous(mock_id: str) -> ApiClientPublicMockOut:
     response_model=list[ApiClientWorkspaceOut],
     summary="List the caller's workspaces",
 )
-async def list_workspaces(uid: str = Depends(get_current_uid)) -> list[ApiClientWorkspaceOut]:
-    return await api_client_svc.list_workspaces(uid=uid)
+async def list_workspaces(ctx: WorkspaceContext = Depends(require_permission("api-client", "read"))) -> list[ApiClientWorkspaceOut]:
+    return await api_client_svc.list_workspaces(ctx=ctx)
 
 
 @router.post(
@@ -181,9 +185,9 @@ async def list_workspaces(uid: str = Depends(get_current_uid)) -> list[ApiClient
 )
 async def create_workspace(
     body: ApiClientWorkspaceCreate,
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_permission("api-client", "write")),
 ) -> ApiClientWorkspaceOut:
-    return await api_client_svc.create_workspace(uid, body)
+    return await api_client_svc.create_workspace(ctx, body)
 
 
 @router.patch(
@@ -194,15 +198,15 @@ async def create_workspace(
 async def patch_workspace(
     workspace_id: str,
     body: ApiClientWorkspaceUpdate,
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_permission("api-client", "write")),
 ) -> ApiClientWorkspaceOut:
-    return await api_client_svc.patch_workspace(uid, workspace_id, body)
+    return await api_client_svc.patch_workspace(ctx, workspace_id, body)
 
 
 @router.delete(
     "/workspaces/{workspace_id}",
     status_code=204,
     summary="Delete a workspace (collections reset to default)",
 )
-async def delete_workspace(workspace_id: str, uid: str = Depends(get_current_uid)) -> None:
-    await api_client_svc.delete_workspace(uid, workspace_id)
+async def delete_workspace(workspace_id: str, ctx: WorkspaceContext = Depends(require_permission("api-client", "delete"))) -> None:
+    await api_client_svc.delete_workspace(ctx, workspace_id)

apps/backend/app/api/routes/api_client/collections_delta.py

@@ -27,8 +27,8 @@
     Op,
     UpdateItemOp,
 )
-from app.api.routes.auth.services import get_current_uid
-from app.core.cache import bump_version
+from app.api.routes.workspaces.middleware import WorkspaceContext, apply_workspace_filter
+from app.api.routes.workspaces.rbac import require_permission
 from app.database import db_manager
 from app.utils.collection_name import API_CLIENT_COLLECTIONS
 
@@ -199,14 +199,15 @@ def _apply_move(
 # ── Service ───────────────────────────────────────────────────────────────────
 
 async def apply_collection_delta(
-    uid: str,
+    ctx: WorkspaceContext,
     collection_id: str,
     ops: list[Op],
 ) -> ApiClientCollectionOut:
     oid = _parse_oid(collection_id, kind="collection")
 
     # Fetch + ownership check BEFORE any mutation
-    doc = await db_manager.find_one(API_CLIENT_COLLECTIONS, {"_id": oid, "created_by": uid})
+    flt = apply_workspace_filter(ctx, {"_id": oid, "created_by": ctx.uid})
+    doc = await db_manager.find_one(API_CLIENT_COLLECTIONS, flt)
     if not doc:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Collection not found.")
 
@@ -245,7 +246,7 @@ async def apply_collection_delta(
     try:
         updated_doc = await db_manager.find_one_and_update(
             API_CLIENT_COLLECTIONS,
-            {"_id": oid, "created_by": uid},
+            flt,
             {"$set": {"items": items}},
             return_document=ReturnDocument.AFTER,
         )
@@ -258,8 +259,7 @@ async def apply_collection_delta(
     if not updated_doc:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Collection not found.")
 
-    # Invalidate cache (same namespace as patch_collection / delete_collection)
-    await bump_version(ns="api_client", uid=uid)
+    # ponytail: cache removed during workspace refactor; re-add with (workspace_id, uid) key if hot
 
     return _collection_to_out(updated_doc)
 
@@ -274,7 +274,7 @@ async def apply_collection_delta(
 async def apply_delta(
     collection_id: str,
     body: ApplyDeltaRequest,
-    uid: str = Depends(get_current_uid),
+    ctx: WorkspaceContext = Depends(require_permission("api-client", "write")),
 ) -> ApplyDeltaResponse:
-    collection = await apply_collection_delta(uid, collection_id, body.ops)
+    collection = await apply_collection_delta(ctx, collection_id, body.ops)
     return ApplyDeltaResponse(collection=collection)