feat(api): org-owner-gated self-serve workspace deletion (#265)

[Zach Dunn (zachdunn)]

Implements #265: extends the self-serve workspace deletion/restore gate from creator-only to creator OR org owner, closing the gap where an org owner couldn't delete a workspace whose creator had left or handed over ownership.

What changed

• loadOwnedSelfServeRecord (apps/api/src/routes/workspaces.ts) now authorizes DELETE /v1/workspaces/:name and POST /v1/workspaces/:name/restore (same helper, identical gating) when the session user is the record creator or holds org role owner in that workspace's org — resolved via the same per-workspace membership lookup as the Workspace-governance token scopes for the org-admin tier (workspace:invite / workspace:manage) #262 gates.
• owner only, not admin: deletion is the most destructive governance action, so it sits above the invite/token powers the admin role gained in feat(api): workspace-governance token scopes for the org-admin tier (#262) #264.
• docs/deletion.md updated from creator-only to creator-or-owner language.

Deliberately unchanged

• Session-only: workspace:manage bearer tokens still cannot delete (pinned by a real-token 401 test) — soft deletion stays an interactive, attributable action.
• selfServe === true still required; non-self-serve workspaces stay undeletable on this surface regardless of role.
• Platform-admin role does not bypass (operators keep their own /admin/workspaces/:name surface).
• All feat(api): soft-delete workspaces with grace window + deletion policy doc (#247) #248/feat(auth,api,web): accidental-deletion guards for official clients, last admin, and communal org #260 machinery untouched: 14-day grace, restore, slug tombstones, official-client / last-admin / communal-org guards.
• apps/auth untouched.

Testing

pnpm --filter api test: 51 files / 572 tests passing; tsc --noEmit clean. New coverage: owner (non-creator) delete + restore, org admin 403, plain member 403, platform admin without org role 403, creator unchanged, non-self-serve blocked even for owner, workspace:manage token 401.

Closes #265

Summary by CodeRabbit

• New Features

  • Workspace owners can now delete and restore eligible self-serve workspaces, even if they did not create them.
  • Workspace admins and members remain unable to perform these actions.

• Bug Fixes

  • Preserved restrictions for communal, non-self-serve, and bearer-token access.

• Documentation

  • Clarified workspace deletion and restoration permissions, including session-only requirements.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	uploads-api	96fc312	Commit Preview URL Branch Preview URL	Jul 18 2026, 09:58 PM

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 709e32ab-a518-47fb-a860-c8316a0b647d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Self-serve workspace deletion and restoration now allow either the record creator or the workspace organization’s owner. Organization admins, members, platform-admin sessions without membership, non-self-serve records, and bearer-token requests remain denied.

Changes

Self-serve authorization

Layer / File(s)	Summary
Ownership helper and authorization gate apps/api/src/routes/me.ts, apps/api/src/routes/workspaces.ts	Adds non-throwing organization-owner lookup and applies it alongside creator authorization for self-serve delete and restore.
Authorization test coverage apps/api/src/routes/workspaces.test.ts	Adds session and organization stubs plus coverage for owners, admins, members, creators, platform admins, BYO records, and workspace:manage bearer tokens.
Deletion policy documentation docs/deletion.md	Documents the creator-or-owner rule, session-only behavior, exclusions, and separate admin endpoint.
Estimated code review effort: 3 (Moderate)	~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Session
  participant WorkspaceRoute
  participant isWorkspaceOwner
  participant myWorkspaces
  Session->>WorkspaceRoute: DELETE or restore workspace
  WorkspaceRoute->>isWorkspaceOwner: check organization owner role
  isWorkspaceOwner->>myWorkspaces: resolve workspace memberships
  myWorkspaces-->>isWorkspaceOwner: workspace role
  isWorkspaceOwner-->>WorkspaceRoute: owner status
  WorkspaceRoute-->>Session: authorize or return not_owner

Loading

Possibly related PRs

• buildinternet/uploads#95: Added the org-to-workspace membership plumbing used by this authorization.
• buildinternet/uploads#108: Added the membership mapping logic extended by isWorkspaceOwner.
• buildinternet/uploads#255: Introduced the existing self-serve delete and restore authorization path.

Poem

I’m a bunny guarding the workspace door,
Owners may enter, admins no more.
Creators can still make the call,
Bearer tokens cannot pass the wall.
Delete and restore hop in tune—
With grace preserved beneath the moon.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: org-owner-gated self-serve workspace deletion.
Linked Issues check	✅ Passed	The changes match #265 by allowing creators or org owners, keeping session-only access, and preserving the listed safeguards.
Out of Scope Changes check	✅ Passed	The added tests and docs are directly related to the authorization change and no unrelated scope is apparent.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/owner-gated-deletion

---

_{Comment @coderabbitai help to get the list of available commands.}