Workspaces, RBAC, invites

Author: anuphilipp3

apps/backend/app/api/routes/auth/api.py

@@ -12,14 +12,18 @@
 from app.api.routes.auth.schema import (
     BackupCodeDataOut,
     BackupCodeLookupRequest,
+    KeypairOut,
+    KeypairSetupRequest,
     MasterVaultOut,
     MasterVaultSetupRequest,
     OkResponse,
     SessionRequest,
     StoreBackupCodesRequest,
     UserProfileResponse,
+    UserPublicKeyOut,
     UpdateProfileRequest,
 )
+from app.api.routes.workspaces.services import shares_workspace
 from app.api.routes.auth.services import get_current_uid, get_current_user, verify_id_token, _token_cache_key
 from app.core.cache import bump_version, cache_invalidate
 from app.api.routes.auth.tokens import (
@@ -33,10 +37,13 @@
     complete_onboarding,
     find_uid_by_refresh_hash,
     get_backup_code_by_id,
+    get_keypair,
     get_master_vault,
+    get_public_key,
     get_user_doc,
     mark_backup_code_used,
     set_backup_codes,
+    set_keypair,
     set_master_vault,
     set_refresh_token_hash,
     upsert_user_from_firebase_claims,
@@ -327,6 +334,60 @@ async def setup_master_vault_endpoint(
     return MasterVaultOut(**vault)
 
 
+# ── Per-user keypair (envelope encryption for team secrets) ────────────────────
+
+
+@router.get(
+    "/keypair",
+    response_model=KeypairOut,
+    summary="Get the current user's keypair (public + master-key-wrapped private blob)",
+)
+async def get_keypair_endpoint(uid: Annotated[str, Depends(get_current_uid)]) -> KeypairOut:
+    kp = await get_keypair(uid)
+    if not kp:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Keypair not configured.")
+    return KeypairOut(**kp)
+
+
+@router.post(
+    "/keypair",
+    response_model=KeypairOut,
+    status_code=status.HTTP_201_CREATED,
+    summary="Set up the user's keypair once (public key + wrapped private key; both opaque to server)",
+)
+@limiter.limit("3/minute")
+async def setup_keypair_endpoint(
+    request: Request,
+    payload: KeypairSetupRequest,
+    uid: Annotated[str, Depends(get_current_uid)],
+) -> KeypairOut:
+    keypair = {
+        "public_key": payload.public_key,
+        "enc_private_key": payload.enc_private_key.model_dump(),
+        "createdAt": int(time.time() * 1000),
+    }
+    stored = await set_keypair(uid, keypair)
+    if not stored:
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Keypair already configured.")
+    return KeypairOut(public_key=keypair["public_key"], enc_private_key=payload.enc_private_key)
+
+
+@router.get(
+    "/users/{target_uid}/public-key",
+    response_model=UserPublicKeyOut,
+    summary="Get a member's public key (to wrap a workspace DEK to them)",
+)
+async def get_user_public_key_endpoint(
+    target_uid: str, uid: Annotated[str, Depends(get_current_uid)]
+) -> UserPublicKeyOut:
+    # Public keys are non-secret. Require sharing at least one workspace with the
+    # target to avoid an enumeration surface (self always allowed).
+    if target_uid != uid and not await shares_workspace(uid, target_uid):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not permitted.")
+    pub = await get_public_key(target_uid)
+    return UserPublicKeyOut(uid=target_uid, public_key=pub)
+
+
 # ── Backup codes ──────────────────────────────────────────────────────────────
 
 

apps/backend/app/api/routes/auth/schema.py

@@ -157,6 +157,38 @@ class MasterVaultOut(BaseModel):
     createdAt: int
 
 
+class WrappedPrivateKey(BaseModel):
+    """PKCS8 private key wrapped (AES-GCM) with the user's master key. Opaque to the server."""
+
+    model_config = ConfigDict(extra="ignore")
+
+    v: int = 1
+    alg: str = "AES-GCM"
+    encrypted: str = Field(min_length=1)
+    iv: str = Field(min_length=1)
+
+
+class KeypairSetupRequest(BaseModel):
+    """Client sends its SPKI public key (non-secret) + master-key-wrapped private key."""
+
+    public_key: str = Field(min_length=1)
+    enc_private_key: WrappedPrivateKey
+
+
+class KeypairOut(BaseModel):
+    model_config = ConfigDict(extra="ignore")
+
+    public_key: str | None = None
+    enc_private_key: WrappedPrivateKey | None = None
+
+
+class UserPublicKeyOut(BaseModel):
+    """A member's public key (for wrapping a workspace DEK to them). Never includes the private blob."""
+
+    uid: str
+    public_key: str | None = None
+
+
 # ── Backup codes ──────────────────────────────────────────────────────────────
 
 class BackupCodeEntry(BaseModel):

apps/backend/app/api/routes/auth/users_repo.py

@@ -92,6 +92,34 @@ async def set_master_vault(uid: str, vault: dict[str, Any]) -> None:
     await bump_version(ns="auth_user", uid=uid)
 
 
+async def get_keypair(uid: str) -> dict[str, Any] | None:
+    doc = await get_user_doc(uid)
+    if not doc:
+        return None
+    return doc.get("keypair") or None
+
+
+async def set_keypair(uid: str, keypair: dict[str, Any]) -> bool:
+    """Set-once. Returns True if stored, False if a keypair already existed (race-safe)."""
+    now = create_timestamp()
+    result = await db_manager.update_one(
+        USERS,
+        {"_id": uid, "keypair": {"$exists": False}},
+        {"$set": {"keypair": keypair, "updated_at": now}},
+    )
+    if getattr(result, "modified_count", 0):
+        await bump_version(ns="auth_user", uid=uid)
+        return True
+    return False
+
+
+async def get_public_key(uid: str) -> str | None:
+    doc = await get_user_doc(uid)
+    if not doc:
+        return None
+    return (doc.get("keypair") or {}).get("public_key")
+
+
 async def set_backup_codes(uid: str, codes: list[dict[str, Any]]) -> None:
     now = create_timestamp()
     await db_manager.update_one(USERS, {"_id": uid}, {"$set": {"backup_codes": codes, "updated_at": now}})

apps/backend/app/api/routes/workspaces/api.py

@@ -1,19 +1,22 @@
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, HTTPException, status
 
 from app.api.routes.auth.schema import UserProfileResponse
 from app.api.routes.auth.services import get_current_uid, get_current_user
 from app.api.routes.workspaces import services as ws_svc
 from app.api.routes.workspaces.schema import (
     CreateWorkspaceRequest,
+    GrantKeyRequest,
     InviteOut,
     InvitePreviewOut,
     InviteRequest,
+    KeyAccessRow,
     MemberOut,
     ToolPermissionMatrixOut,
     ToolPermissionUpdate,
     UpdateRoleRequest,
     UpdateWorkspaceRequest,
     WorkspaceDetailOut,
+    WorkspaceKeyOut,
     WorkspaceOut,
 )
 
@@ -71,6 +74,11 @@ async def delete_workspace(workspace_id: str, uid: str = Depends(get_current_uid
     await ws_svc.delete_workspace(workspace_id)
 
 
+@router.post("/{workspace_id}/leave", status_code=204, summary="Leave a workspace (any member; not last owner / Personal)")
+async def leave_workspace(workspace_id: str, uid: str = Depends(get_current_uid)) -> None:
+    await ws_svc.leave_workspace(workspace_id, uid)
+
+
 # ── Members ──────────────────────────────────────────────────────────────────
 
 @router.get("/{workspace_id}/members", response_model=list[MemberOut], summary="List members")
@@ -131,3 +139,29 @@ async def set_tool_permission(
 ) -> ToolPermissionMatrixOut:
     await ws_svc.assert_role(workspace_id, uid, "admin")
     return await ws_svc.set_tool_permission(workspace_id, body.role, body.slug, body.enabled)
+
+
+# ── Envelope-encryption keys (Phase 3) ────────────────────────────────────────
+
+@router.get("/{workspace_id}/my-key", response_model=WorkspaceKeyOut, summary="My wrapped workspace DEK")
+async def get_my_key(workspace_id: str, uid: str = Depends(get_current_uid)) -> WorkspaceKeyOut:
+    await ws_svc.assert_role(workspace_id, uid, "viewer")  # any active member
+    key = await ws_svc.get_my_workspace_key(workspace_id, uid)
+    if not key:
+        # 404 = member but no secret access yet (an admin must grant).
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="No secret access yet.")
+    return key
+
+
+@router.post("/{workspace_id}/grant-key", status_code=201, summary="Grant secret access to a member (Admin+)")
+async def grant_key(
+    workspace_id: str, body: GrantKeyRequest, uid: str = Depends(get_current_uid)
+) -> None:
+    await ws_svc.assert_role(workspace_id, uid, "admin")
+    await ws_svc.grant_key(workspace_id, body.target_uid, body.wrapped_dek, uid)
+
+
+@router.get("/{workspace_id}/key-access", response_model=list[KeyAccessRow], summary="Who has secret access")
+async def key_access(workspace_id: str, uid: str = Depends(get_current_uid)) -> list[KeyAccessRow]:
+    await ws_svc.assert_role(workspace_id, uid, "viewer")
+    return await ws_svc.list_key_access(workspace_id)

apps/backend/app/api/routes/workspaces/schema.py

@@ -74,3 +74,27 @@ class ToolPermissionMatrixOut(BaseModel):
     matrix: dict[str, dict[str, bool]]
     overrides: dict[str, dict[str, bool]] = Field(default_factory=dict)
     roles: list[str] = Field(default_factory=lambda: list(ROLES))
+
+
+# ── Envelope encryption (Phase 3) ─────────────────────────────────────────────
+
+
+class WorkspaceKeyOut(BaseModel):
+    """The caller's RSA-wrapped workspace DEK (opaque ciphertext)."""
+
+    wrapped_dek: str
+    alg: str = "RSA-OAEP-256"
+    v: int = 1
+
+
+class GrantKeyRequest(BaseModel):
+    target_uid: str = Field(min_length=1)
+    wrapped_dek: str = Field(min_length=1)  # DEK RSA-wrapped to target's public key
+
+
+class KeyAccessRow(BaseModel):
+    uid: str | None = None
+    email: str | None = None
+    display_name: str | None = None
+    role: str
+    has_key: bool

apps/backend/app/api/routes/workspaces/services.py

@@ -10,9 +10,11 @@
 from app.api.routes.workspaces.schema import (
     InviteOut,
     InvitePreviewOut,
+    KeyAccessRow,
     MemberOut,
     ToolPermissionMatrixOut,
     WorkspaceDetailOut,
+    WorkspaceKeyOut,
     WorkspaceOut,
 )
 from app.core.rbac import ALL_TOOL_SLUGS, ROLES, can_access_tool, resolve_tool_matrix, role_meets
@@ -21,6 +23,7 @@
 from app.utils.collection_name import (
     USERS,
     WORKSPACE_INVITES,
+    WORKSPACE_KEYS,
     WORKSPACE_MEMBERS,
     WORKSPACES,
 )
@@ -65,6 +68,15 @@ async def list_memberships(uid: str) -> list[dict[str, Any]]:
     )
 
 
+async def shares_workspace(uid_a: str, uid_b: str) -> bool:
+    """True if both users are active members of at least one common workspace."""
+    a = {m["workspace_id"] for m in await list_memberships(uid_a)}
+    if not a:
+        return False
+    b = {m["workspace_id"] for m in await list_memberships(uid_b)}
+    return bool(a & b)
+
+
 async def count_owners(workspace_id: str) -> int:
     return await db_manager.count_documents(
         WORKSPACE_MEMBERS, {"workspace_id": workspace_id, "role": "owner", "status": "active"}
@@ -260,6 +272,25 @@ async def update_member_role(workspace_id: str, target_uid: str, role: str) -> N
     )
 
 
+async def leave_workspace(workspace_id: str, uid: str) -> None:
+    """A member removes themselves. Cannot leave Personal or as the last owner."""
+    member = await get_membership(workspace_id, uid)
+    if not member:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="You are not a member.")
+    ws = await get_workspace(workspace_id)
+    if ws and ws.get("is_personal"):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST, detail="You cannot leave your Personal workspace."
+        )
+    if member["role"] == "owner" and await count_owners(workspace_id) <= 1:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Transfer ownership to someone else before leaving — you're the last owner.",
+        )
+    await db_manager.delete_one(WORKSPACE_MEMBERS, {"workspace_id": workspace_id, "uid": uid})
+    await db_manager.delete_one(WORKSPACE_KEYS, {"workspace_id": workspace_id, "uid": uid})
+
+
 async def remove_member(workspace_id: str, target_uid: str) -> None:
     member = await get_membership(workspace_id, target_uid)
     if not member:
@@ -278,6 +309,12 @@ async def remove_member(workspace_id: str, target_uid: str) -> None:
     await db_manager.delete_one(
         WORKSPACE_MEMBERS, {"workspace_id": workspace_id, "uid": target_uid}
     )
+    # Revoke future secret access. ponytail: the DEK itself is NOT rotated here —
+    # a removed member who cached the DEK could still read old secrets. The manual
+    # "Rotate workspace key" admin action covers the untrusted-member case.
+    await db_manager.delete_one(
+        WORKSPACE_KEYS, {"workspace_id": workspace_id, "uid": target_uid}
+    )
 
 
 # ── Tool permissions ─────────────────────────────────────────────────────────
@@ -438,3 +475,51 @@ async def accept_invite(token: str, uid: str, user_email: str | None) -> Workspa
     ws = await get_workspace(workspace_id)
     role = existing["role"] if existing else invite["role"]
     return _workspace_out(ws or {"_id": workspace_id, "name": ""}, role)
+
+
+# ── Envelope-encryption keys (Phase 3) ────────────────────────────────────────
+# The server only ever stores opaque RSA-wrapped DEK ciphertext — never the DEK.
+
+async def get_my_workspace_key(workspace_id: str, uid: str) -> WorkspaceKeyOut | None:
+    doc = await db_manager.find_one(WORKSPACE_KEYS, {"workspace_id": workspace_id, "uid": uid})
+    if not doc:
+        return None
+    return WorkspaceKeyOut(
+        wrapped_dek=doc["wrapped_dek"], alg=doc.get("alg", "RSA-OAEP-256"), v=int(doc.get("v", 1))
+    )
+
+
+async def grant_key(workspace_id: str, target_uid: str, wrapped_dek: str, granted_by: str) -> None:
+    """Store the workspace DEK wrapped to a member's public key. Idempotent upsert."""
+    if not await get_membership(workspace_id, target_uid):
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="That user is not an active member of this workspace.",
+        )
+    await db_manager.update_one(
+        WORKSPACE_KEYS,
+        {"workspace_id": workspace_id, "uid": target_uid},
+        {
+            "$set": {"wrapped_dek": wrapped_dek, "alg": "RSA-OAEP-256", "v": 1, "granted_by": granted_by},
+            "$setOnInsert": {"_id": new_id(), "createdAt": create_timestamp()},
+        },
+        upsert=True,
+    )
+
+
+async def list_key_access(workspace_id: str) -> list[KeyAccessRow]:
+    members = await list_members(workspace_id)
+    key_docs = await db_manager.find(
+        WORKSPACE_KEYS, {"workspace_id": workspace_id}, projection={"uid": 1}
+    )
+    have = {d["uid"] for d in key_docs}
+    return [
+        KeyAccessRow(
+            uid=m.uid,
+            email=m.email,
+            display_name=m.display_name,
+            role=m.role,
+            has_key=m.uid in have,
+        )
+        for m in members
+    ]