fix(desktop): forward blocked members through the workspaces API

Author: waleedlatif1

apps/sim/app/api/workspaces/route.test.ts

@@ -16,8 +16,9 @@ import {
 } from '@sim/testing/mocks/workspaces-policy.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockCreateWorkspace } = vi.hoisted(() => ({
+const { mockCreateWorkspace, mockResolveRolledOutOrganizationId } = vi.hoisted(() => ({
   mockCreateWorkspace: vi.fn(),
+  mockResolveRolledOutOrganizationId: vi.fn(),
 }))
 
 vi.mock('@/lib/auth/session-response', () => ({
@@ -32,6 +33,10 @@ vi.mock('@/lib/workspaces/list', () => ({
   listWorkspacesForViewer: vi.fn(),
 }))
 
+vi.mock('@/lib/navigation/resolve-app-entry', () => ({
+  resolveRolledOutOrganizationId: mockResolveRolledOutOrganizationId,
+}))
+
 vi.mock('@/lib/posthog/server', () => posthogServerMock)
 
 vi.mock('@sim/audit', () => auditMock)
@@ -99,3 +104,42 @@ describe('POST /api/workspaces capability refusal', () => {
     await expect(response.json()).resolves.toEqual({ error: 'Unauthorized' })
   })
 })
+
+describe('GET /api/workspaces blocked viewer forwarding', () => {
+  const blockedList = {
+    workspaces: [],
+    lastActiveWorkspaceId: null,
+    pinnedWorkspaceIds: [],
+    creationPolicy: { canCreate: false },
+  }
+  const listRequest = () =>
+    createMockRequest('GET', undefined, {}, 'http://localhost/api/workspaces')
+
+  beforeEach(() => {
+    mockGetSession.mockResolvedValue({
+      user: { id: 'user-1', name: 'A', email: 'a@example.com' },
+    })
+    vi.mocked(listWorkspacesForViewer).mockResolvedValue(
+      blockedList as unknown as Awaited<ReturnType<typeof listWorkspacesForViewer>>
+    )
+  })
+
+  it('names the organization that can serve a viewer with nothing to pick', async () => {
+    mockResolveRolledOutOrganizationId.mockResolvedValue('org-1')
+    const response = await GET(listRequest())
+    expect((await response.json()).forwardOrganizationId).toBe('org-1')
+  })
+
+  it('leaves the blocked picker in place when no organization can serve them', async () => {
+    mockResolveRolledOutOrganizationId.mockResolvedValue(null)
+    const response = await GET(listRequest())
+    expect(await response.json()).not.toHaveProperty('forwardOrganizationId')
+  })
+
+  it('still returns the list when the organization lookup fails', async () => {
+    mockResolveRolledOutOrganizationId.mockRejectedValue(new Error('down'))
+    const response = await GET(listRequest())
+    expect(response.status).toBe(200)
+    expect(await response.json()).not.toHaveProperty('forwardOrganizationId')
+  })
+})

apps/sim/app/api/workspaces/route.ts

@@ -2,7 +2,7 @@ import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
 import { type WorkspaceMode, workflow } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { getPostgresErrorCode } from '@sim/utils/errors'
+import { getErrorMessage, getPostgresErrorCode } from '@sim/utils/errors'
 import { and, eq, isNull } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { listWorkspacesQuerySchema } from '@/lib/api/contracts'
@@ -11,6 +11,7 @@ import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { getActiveOrganizationId } from '@/lib/auth/session-response'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { resolveRolledOutOrganizationId } from '@/lib/navigation/resolve-app-entry'
 import { capabilityRefusalResponse } from '@/lib/permission-groups/capability-response'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { createWorkspace } from '@/lib/workspaces/create'
@@ -24,6 +25,20 @@ import {
 
 const logger = createLogger('Workspaces')
 
+/** A failed lookup leaves the viewer on the blocked picker rather than failing the list. */
+async function resolveForwardOrganizationId(session: {
+  user: { id: string }
+}): Promise<string | undefined> {
+  try {
+    return (await resolveRolledOutOrganizationId(session)) ?? undefined
+  } catch (error) {
+    logger.warn('Could not resolve an organization to forward a blocked viewer to', {
+      error: getErrorMessage(error),
+    })
+    return undefined
+  }
+}
+
 // Get all workspaces for the current user
 export const GET = withRouteHandler(async (request: Request) => {
   const session = await getSession()
@@ -58,6 +73,7 @@ export const GET = withRouteHandler(async (request: Request) => {
         lastActiveWorkspaceId,
         pinnedWorkspaceIds,
         creationPolicy,
+        forwardOrganizationId: await resolveForwardOrganizationId(session),
       })
     }
 

apps/sim/app/workspace/page.test.tsx

@@ -1,62 +1,78 @@
 /**
- * @vitest-environment node
+ * @vitest-environment jsdom
  */
-import { authMockFns } from '@sim/testing/mocks/auth.mock'
-import { nextNavigationMock } from '@sim/testing/mocks/next-navigation.mock'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { act } from 'react'
+import { authClientMock, authClientMockFns } from '@sim/testing/mocks/auth-client.mock'
+import { nextNavigationMock, nextNavigationMockFns } from '@sim/testing/mocks/next-navigation.mock'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockResolveWorkspacelessMemberPath } = vi.hoisted(() => ({
-  mockResolveWorkspacelessMemberPath: vi.fn(),
+const { mockUseWorkspacesWithMetadata } = vi.hoisted(() => ({
+  mockUseWorkspacesWithMetadata: vi.fn(),
 }))
 
 vi.mock('next/navigation', () => nextNavigationMock)
-
-vi.mock('@/lib/navigation/resolve-app-entry', () => ({
-  resolveWorkspacelessMemberPath: mockResolveWorkspacelessMemberPath,
+vi.mock('@/lib/auth/client', () => authClientMock)
+vi.mock('@/hooks/queries/workspace', () => ({
+  useWorkspacesWithMetadata: mockUseWorkspacesWithMetadata,
 }))
 
-vi.mock('@/app/workspace/workspace-entry', () => ({ WorkspaceEntry: () => null }))
-
 import WorkspacePage from '@/app/workspace/page'
 
-const mockGetSession = authMockFns.mockGetSession
-const session = { user: { id: 'viewer' } }
+const mockReplace = nextNavigationMockFns.router.replace
+
+describe('WorkspacePage for a viewer with nothing to pick', () => {
+  let container: HTMLDivElement
+  let root: Root
 
-function visit(search: { redirect?: string } = {}) {
-  return WorkspacePage({ searchParams: Promise.resolve(search) })
-}
+  function visit(search: string, list: { forwardOrganizationId?: string }) {
+    window.history.pushState({}, '', `/workspace${search}`)
+    mockUseWorkspacesWithMetadata.mockReturnValue({
+      data: {
+        workspaces: [],
+        lastActiveWorkspaceId: null,
+        pinnedWorkspaceIds: [],
+        creationPolicy: { canCreate: false, workspaceMode: 'organization' },
+        ...list,
+      },
+      isLoading: false,
+      error: null,
+    })
+    act(() => root.render(<WorkspacePage />))
+  }
 
-describe('WorkspacePage', () => {
   beforeEach(() => {
-    mockGetSession.mockResolvedValue(session)
-    mockResolveWorkspacelessMemberPath.mockResolvedValue(null)
+    vi.stubGlobal('IS_REACT_ACT_ENVIRONMENT', true)
+    mockReplace.mockClear()
+    authClientMockFns.mockUseSession.mockReturnValue({
+      data: { user: { id: 'viewer' } },
+      isPending: false,
+      error: null,
+    })
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
   })
 
-  it('forwards a workspaceless member before the picker renders', async () => {
-    mockResolveWorkspacelessMemberPath.mockResolvedValue('/o/org-1/home')
-    await expect(visit()).rejects.toThrow('NEXT_REDIRECT:/o/org-1/home')
-    expect(mockResolveWorkspacelessMemberPath).toHaveBeenCalledWith(session, 'home')
+  afterEach(() => {
+    act(() => root.unmount())
+    container.remove()
   })
 
-  it('carries a settings request through to the destination', async () => {
-    mockResolveWorkspacelessMemberPath.mockResolvedValue('/o/org-1/settings/general')
-    await expect(visit({ redirect: 'settings' })).rejects.toThrow(
-      'NEXT_REDIRECT:/o/org-1/settings/general'
-    )
-    expect(mockResolveWorkspacelessMemberPath).toHaveBeenCalledWith(session, 'settings')
+  it('forwards to the organization without showing the blocked card', () => {
+    visit('', { forwardOrganizationId: 'org-1' })
+    expect(mockReplace).toHaveBeenCalledExactlyOnceWith('/o/org-1/home')
+    expect(container.querySelector('h1')).toBeNull()
   })
 
-  it('leaves a stale session on the recovery surface', async () => {
-    mockGetSession.mockResolvedValue(null)
-    await expect(visit()).resolves.toBeTruthy()
-    expect(mockResolveWorkspacelessMemberPath).not.toHaveBeenCalled()
+  it('carries a settings request to the organization settings', () => {
+    visit('?redirect=settings', { forwardOrganizationId: 'org-1' })
+    expect(mockReplace).toHaveBeenCalledExactlyOnceWith('/o/org-1/settings/general')
   })
 
-  it.each([
-    ['session', () => mockGetSession.mockRejectedValue(new Error('down'))],
-    ['destination', () => mockResolveWorkspacelessMemberPath.mockRejectedValue(new Error('down'))],
-  ])('keeps the recovery surface when the %s lookup fails', async (_label, fail) => {
-    fail()
-    await expect(visit()).resolves.toBeTruthy()
+  it('stays on the blocked card when no organization can serve them', () => {
+    visit('', {})
+    expect(mockReplace).not.toHaveBeenCalled()
+    expect(container.querySelector('h1')).not.toBeNull()
   })
 })