UI

Author: itsmeakhil

apps/backend/app/api/routes/workspaces/api.py

@@ -59,6 +59,24 @@ async def list_workspaces(
     org_id: str | None = Query(default=None),
 ) -> list[WorkspaceOut]:
     workspaces = await find_user_workspaces(uid, org_id=org_id)
+    # Auto-heal: any org the user belongs to but has no workspaces in (e.g.
+    # accepted an org-only invite under an older build) gets a Personal
+    # workspace seeded so the org-switcher has something to land on.
+    from app.api.routes.workspaces.repo import (
+        find_user_orgs,
+        upsert_personal_workspace,
+        upsert_ws_membership,
+    )
+    orgs_with_ws = {w["org_id"] for w in workspaces}
+    user_orgs = await find_user_orgs(uid)
+    missing = [o for o in user_orgs if o["_id"] not in orgs_with_ws]
+    if org_id is not None:
+        missing = [o for o in missing if o["_id"] == org_id]
+    if missing:
+        for org in missing:
+            ws_id = await upsert_personal_workspace(org["_id"], uid)
+            await upsert_ws_membership(ws_id, org["_id"], uid, "admin")
+        workspaces = await find_user_workspaces(uid, org_id=org_id)
     return [_ws_to_out(w) for w in workspaces]
 
 

apps/backend/app/api/routes/workspaces/invitations_service.py

@@ -4,7 +4,6 @@
 from app.api.routes.auth.users_repo import get_user_doc
 from app.api.routes.workspaces import invitations_repo, repo
 from app.api.routes.workspaces.schema import InvitationOut, InviteMemberRequest
-from app.core.email import send_invitation_email
 from app.utils.utils import create_timestamp, new_id
 
 INVITATION_TTL_SECONDS = 14 * 24 * 3600
@@ -64,33 +63,35 @@ async def invite_to_org(
     email = body.email.lower().strip()
     if body.role not in ("owner", "admin", "member", "viewer"):
         raise HTTPException(400, "Invalid org role")
-    now = create_timestamp()
+    # Optional bundled workspace grant on accept.
+    ws_id: str | None = body.workspace_id
+    ws_role: str | None = body.workspace_role
+    if ws_id:
+        if ws_role not in ("admin", "developer", "viewer"):
+            raise HTTPException(400, "Invalid workspace role")
+        ws = await repo.find_workspace(ws_id)
+        if not ws or ws.get("org_id") != org_id:
+            raise HTTPException(400, "Workspace does not belong to this org")
     invited_uid = await _find_uid_by_email(email)
+    if not invited_uid:
+        raise HTTPException(404, "No user found with that email. Ask them to sign up first.")
+    now = create_timestamp()
     doc = {
         "_id": new_id(),
         "org_id": org_id,
-        "workspace_id": None,
+        "workspace_id": ws_id,
         "invited_email": email,
         "invited_uid": invited_uid,
         "invited_role_org": body.role,
-        "invited_role_ws": None,
+        "invited_role_ws": ws_role,
         "token": _new_token(),
         "status": "pending",
         "invited_by": uid,
         "created_at": now,
         "expires_at": now + INVITATION_TTL_SECONDS * 1000,
     }
     await invitations_repo.create_invitation(doc)
-
-    inviter = await get_user_doc(uid) or {}
-    org = await repo.find_org(org_id) or {}
-    await send_invitation_email(
-        to=email,
-        token=doc["token"],
-        inviter_name=inviter.get("displayName") or inviter.get("email") or "A teammate",
-        org_name=org.get("name", "an org"),
-        workspace_name=None,
-    )
+    # In-app notification only — the invited user sees this via the bell.
     return _doc_to_out(doc)
 
 
@@ -101,8 +102,10 @@ async def invite_to_workspace(
     email = body.email.lower().strip()
     if body.role not in ("admin", "developer", "viewer"):
         raise HTTPException(400, "Invalid ws role")
-    now = create_timestamp()
     invited_uid = await _find_uid_by_email(email)
+    if not invited_uid:
+        raise HTTPException(404, "No user found with that email. Ask them to sign up first.")
+    now = create_timestamp()
     doc = {
         "_id": new_id(),
         "org_id": ws["org_id"],
@@ -119,16 +122,7 @@ async def invite_to_workspace(
         "expires_at": now + INVITATION_TTL_SECONDS * 1000,
     }
     await invitations_repo.create_invitation(doc)
-
-    inviter = await get_user_doc(uid) or {}
-    org = await repo.find_org(ws["org_id"]) or {}
-    await send_invitation_email(
-        to=email,
-        token=doc["token"],
-        inviter_name=inviter.get("displayName") or inviter.get("email") or "A teammate",
-        org_name=org.get("name", "an org"),
-        workspace_name=ws["name"],
-    )
+    # In-app notification only — the invited user sees this via PendingInvitationsBadge.
     return _doc_to_out(doc)
 
 
@@ -166,6 +160,11 @@ async def accept_invitation(uid: str, token: str) -> dict:
             await repo.upsert_ws_membership(
                 inv["workspace_id"], inv["org_id"], uid, inv["invited_role_ws"],
             )
+    else:
+        # Org-only invite: seed a Personal workspace in this org so the user has
+        # somewhere to land when they switch to it. Mirrors signup behavior.
+        ws_id = await repo.upsert_personal_workspace(inv["org_id"], uid)
+        await repo.upsert_ws_membership(ws_id, inv["org_id"], uid, "admin")
     await invitations_repo.update_invitation_status(
         inv["_id"], "accepted",
         accepted_uid=uid, accepted_at=create_timestamp(),
@@ -177,10 +176,15 @@ async def revoke_invitation(uid: str, token: str) -> None:
     inv = await invitations_repo.find_invitation_by_token(token)
     if not inv:
         raise HTTPException(404, "Invitation not found")
+    # Allowed: original inviter, org owner/admin, OR the invitee themself (decline).
+    user = await get_user_doc(uid)
+    is_invitee = bool(
+        (inv.get("invited_uid") and inv["invited_uid"] == uid)
+        or (user and (user.get("email") or "").lower() == inv["invited_email"])
+    )
     org_mem = await repo.find_org_membership(inv["org_id"], uid)
-    if inv["invited_by"] != uid and not (
-        org_mem and org_mem["org_role"] in ("owner", "admin")
-    ):
+    is_admin = bool(org_mem and org_mem["org_role"] in ("owner", "admin"))
+    if not (inv["invited_by"] == uid or is_admin or is_invitee):
         raise HTTPException(403, "Cannot revoke this invitation")
     if inv["status"] != "pending":
         return

apps/backend/app/api/routes/workspaces/middleware.py

@@ -73,6 +73,21 @@ async def get_workspace_ctx(
     )
 
 
+def assert_writer(ctx: WorkspaceContext) -> None:
+    """Raise 403 if the active workspace role can't mutate. Viewers are read-only.
+    Call at the top of every create/update/delete service path."""
+    if ctx.ws_role == "viewer":
+        raise HTTPException(403, "Read-only role in this workspace.")
+
+
+async def get_workspace_write_ctx(
+    ctx: Annotated[WorkspaceContext, Depends(get_workspace_ctx)],
+) -> WorkspaceContext:
+    """FastAPI Depends for routes that mutate workspace data."""
+    assert_writer(ctx)
+    return ctx
+
+
 def apply_workspace_filter(
     ctx: WorkspaceContext, base_filter: dict[str, Any]
 ) -> dict[str, Any]:

apps/backend/app/api/routes/workspaces/schema.py

@@ -77,6 +77,9 @@ class MemberOut(BaseModel):
 class InviteMemberRequest(BaseModel):
     email: str = Field(min_length=1)
     role: str
+    # Org-level invite only — optionally also grant a workspace membership on accept.
+    workspace_id: str | None = None
+    workspace_role: str | None = None
 
 
 class ChangeRoleRequest(BaseModel):

apps/web/src/components/api-key-vault/add-api-key-dialog.tsx

@@ -16,7 +16,8 @@ import { auth } from "@/database/firebase"
 import { createApiKeyEntry, updateApiKeyEntry } from "@/lib/api-key-vault-api"
 import { cn } from "@/lib/utils"
 import { toast } from "sonner"
-import { useCipherKey } from "@/lib/use-cipher-key"
+import { useCipherKey, cipherKeyErrorMessage } from "@/lib/use-cipher-key"
+import { useActiveToolPermissions } from "@/lib/workspace-rbac"
 
 type FormState = {
     name: string
@@ -257,10 +258,19 @@ export function AddApiKeyDialog({ children }: { children?: React.ReactNode }) {
     const { addEntry } = useApiKeyVaultStore()
     const [open, setOpen] = useState(false)
     const isMobile = useIsMobile()
+    const { canWrite } = useActiveToolPermissions()
+
+    // Viewers in shared workspaces — hide the Add button entirely. Personal
+    // workspace + admin/developer still see it (canWrite is true for both).
+    if (!canWrite) return null
 
     const handleSubmit = async (data: FormState) => {
-        if (!encryptionKey || !auth.currentUser) {
-            toast.error("Vault is locked")
+        if (!auth.currentUser) {
+            toast.error("Sign in to continue")
+            return
+        }
+        if (!encryptionKey) {
+            toast.error(cipherKeyErrorMessage())
             return
         }
         try {
@@ -329,12 +339,19 @@ export function EditApiKeyDialog({
     const encryptionKey = useCipherKey()
     const { updateEntry } = useApiKeyVaultStore()
     const isMobile = useIsMobile()
+    const { canWrite } = useActiveToolPermissions()
 
     if (!entry) return null
+    // Viewers can open the row but the edit dialog itself is no-op for them.
+    if (!canWrite) return null
 
     const handleSubmit = async (data: FormState) => {
-        if (!encryptionKey || !auth.currentUser) {
-            toast.error("Vault is locked")
+        if (!auth.currentUser) {
+            toast.error("Sign in to continue")
+            return
+        }
+        if (!encryptionKey) {
+            toast.error(cipherKeyErrorMessage())
             return
         }
         try {

apps/web/src/components/environment-manager/add-environment-set-dialog.tsx

@@ -14,6 +14,7 @@ import {
     type EnvVariableRow,
 } from "@/store/environment-manager-store"
 import { useCipherKey } from "@/lib/use-cipher-key"
+import { useActiveToolPermissions } from "@/lib/workspace-rbac"
 import { Badge } from "@/components/ui/badge"
 import { EnvPasteCollapsible } from "@/components/environment-manager/env-paste-collapsible"
 import { encryptData } from "@/lib/encryption"
@@ -35,6 +36,8 @@ export function AddEnvironmentSetDialog({ children }: { children?: React.ReactNo
     const { addSet } = useEnvironmentManagerStore()
     const [open, setOpen] = useState(false)
     const [loading, setLoading] = useState(false)
+    const { canWrite } = useActiveToolPermissions()
+    if (!canWrite) return null
     const [showValues, setShowValues] = useState(false)
     const [project, setProject] = useState("")
     const [environment, setEnvironment] = useState("")

apps/web/src/components/invite-member-dialog.tsx

@@ -1,6 +1,6 @@
 "use client"
 
-import { useState } from "react"
+import { useMemo, useState } from "react"
 import { Loader2 } from "lucide-react"
 import {
   Dialog,
@@ -20,6 +20,7 @@ import {
 } from "@/components/ui/select"
 import { toast } from "sonner"
 import { inviteToOrg, inviteToWorkspace } from "@/lib/invitations-api"
+import { useWorkspaceStore } from "@/store/workspace-store"
 
 const ORG_ROLES = [
   { value: "admin", label: "Admin" },
@@ -33,6 +34,8 @@ const WS_ROLES = [
   { value: "viewer", label: "Viewer" },
 ]
 
+const NO_WORKSPACE = "__none__"
+
 export function InviteMemberDialog({
   scope,
   scopeId,
@@ -47,13 +50,26 @@ export function InviteMemberDialog({
   const roles = scope === "org" ? ORG_ROLES : WS_ROLES
   const defaultRole = roles[1].value
 
+  const allWorkspaces = useWorkspaceStore((s) => s.workspaces)
+  const orgWorkspaces = useMemo(
+    () =>
+      scope === "org"
+        ? allWorkspaces.filter((w) => w.org_id === scopeId && !w.is_personal)
+        : [],
+    [allWorkspaces, scope, scopeId],
+  )
+
   const [email, setEmail] = useState("")
   const [role, setRole] = useState(defaultRole)
+  const [workspaceId, setWorkspaceId] = useState<string>(NO_WORKSPACE)
+  const [workspaceRole, setWorkspaceRole] = useState<string>("developer")
   const [loading, setLoading] = useState(false)
 
   function reset() {
     setEmail("")
     setRole(defaultRole)
+    setWorkspaceId(NO_WORKSPACE)
+    setWorkspaceRole("developer")
     setLoading(false)
   }
 
@@ -73,11 +89,15 @@ export function InviteMemberDialog({
     setLoading(true)
     try {
       if (scope === "org") {
-        await inviteToOrg(scopeId, trimmedEmail, role)
+        const extras =
+          workspaceId !== NO_WORKSPACE
+            ? { workspaceId, workspaceRole }
+            : undefined
+        await inviteToOrg(scopeId, trimmedEmail, role, extras)
       } else {
         await inviteToWorkspace(scopeId, trimmedEmail, role)
       }
-      toast.success(`Invitation sent to ${trimmedEmail}`)
+      toast.success(`${trimmedEmail} will see an in-app invitation to approve.`)
       reset()
       onOpenChange(false)
     } catch (err) {
@@ -123,6 +143,53 @@ export function InviteMemberDialog({
               </SelectContent>
             </Select>
           </div>
+
+          {scope === "org" && (
+            <div className="space-y-2">
+              <Label htmlFor="invite-ws">Add to workspace (optional)</Label>
+              <Select
+                value={workspaceId}
+                onValueChange={setWorkspaceId}
+                disabled={loading || orgWorkspaces.length === 0}
+              >
+                <SelectTrigger id="invite-ws">
+                  <SelectValue placeholder="Org membership only" />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value={NO_WORKSPACE}>Org membership only</SelectItem>
+                  {orgWorkspaces.map((w) => (
+                    <SelectItem key={w.id} value={w.id}>
+                      {w.name}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+              {workspaceId !== NO_WORKSPACE && (
+                <div className="pt-1">
+                  <Label htmlFor="invite-ws-role" className="text-xs text-muted-foreground">
+                    Workspace role
+                  </Label>
+                  <Select
+                    value={workspaceRole}
+                    onValueChange={setWorkspaceRole}
+                    disabled={loading}
+                  >
+                    <SelectTrigger id="invite-ws-role" className="mt-1">
+                      <SelectValue />
+                    </SelectTrigger>
+                    <SelectContent>
+                      {WS_ROLES.map((r) => (
+                        <SelectItem key={r.value} value={r.value}>
+                          {r.label}
+                        </SelectItem>
+                      ))}
+                    </SelectContent>
+                  </Select>
+                </div>
+              )}
+            </div>
+          )}
+
           <div className="flex justify-end gap-2 pt-1">
             <Button
               type="button"