feat(projects): move Project membership to the workspace column (#8830)

* feat(projects): prepare workspace project column compatibility

* test(projects): clean up compatibility fixtures atomically

* feat(projects): move membership to workspace column with rollout bridge

* test(projects): align transfer mocks with workspace membership

* improvement(workspaces): present API responses explicitly

* fix(projects): support PostgreSQL 16 column migration

* fix(projects): allow multi-batch copies to finish

* fix(projects): reconcile memberships during schema push

* fix(projects): use the direct connection for push reconciliation

* test(billing): wait for parked transactions before racing writers

* test(billing): freeze the clock for exact deadline assertions

* ci(projects): use the standard PostgreSQL test coverage

* fix(projects): support trigger-free column rollout

* fix(projects): retain healthy indexes during schema push

* fix(projects): correct rollout fixtures and schema-push index

* fix(projects): switch membership authority after compatible rollout

* test(projects): guard optional authority fixtures explicitly

* test(projects): seed authority in billing lock-order mock

* fix(projects): bound authority barriers and verify push replay

* docs(projects): record native constraint rollout decisions

* fix(projects): recognize completed rollout without its marker

* test(projects): model expansion authority in workspace move fixtures

Author: mzxchandra

apps/sim/app/api/workspaces/[id]/route.ts

@@ -10,6 +10,7 @@ import { getSession } from '@/lib/auth'
 import { changeWorkspaceStoragePayerInTx } from '@/lib/billing/storage/payer-transfer'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { archiveWorkspace } from '@/lib/workspaces/lifecycle'
+import { presentWorkspace } from '@/lib/workspaces/response'
 
 const logger = createLogger('WorkspaceByIdAPI')
 
@@ -51,7 +52,7 @@ export const GET = withRouteHandler(
 
     return NextResponse.json({
       workspace: {
-        ...workspaceDetails,
+        ...presentWorkspace(workspaceDetails),
         permissions: userPermission,
       },
     })
@@ -216,7 +217,7 @@ export const PATCH = withRouteHandler(
 
       return NextResponse.json({
         workspace: {
-          ...updatedWorkspace,
+          ...(updatedWorkspace ? presentWorkspace(updatedWorkspace) : {}),
           permissions: userPermission,
         },
       })

apps/sim/ee/workspace-forking/lib/create-fork.test.ts

@@ -1,4 +1,4 @@
-import { projectWorkspace, workspace } from '@sim/db/schema'
+import { workspace } from '@sim/db/schema'
 import { dbChainMockFns, queueTableRows, resetDbChainMock } from '@sim/testing'
 import { workflowsPersistenceUtilsMock } from '@sim/testing/mocks/workflows-persistence-utils.mock'
 import {
@@ -140,8 +140,9 @@ function forkParams(selection?: {
 describe('createFork storage headroom gate', () => {
   beforeEach(() => {
     resetDbChainMock()
-    queueTableRows(projectWorkspace, [{ projectId: 'project-source' }])
-    queueTableRows(projectWorkspace, [
+    dbChainMockFns.as.mockReturnValue(workspace)
+    queueTableRows(workspace, [{ projectId: 'project-source' }])
+    queueTableRows(workspace, [
       { project: { id: 'project-source', organizationId: null, archivedAt: null } },
     ])
     /**
@@ -215,8 +216,9 @@ describe('createFork storage headroom gate', () => {
 
   it('refuses when the parent changed organizations after the policy was captured', async () => {
     resetDbChainMock()
-    queueTableRows(projectWorkspace, [{ projectId: 'project-source' }])
-    queueTableRows(projectWorkspace, [
+    dbChainMockFns.as.mockReturnValue(workspace)
+    queueTableRows(workspace, [{ projectId: 'project-source' }])
+    queueTableRows(workspace, [
       { project: { id: 'project-source', organizationId: null, archivedAt: null } },
     ])
     /**
@@ -243,8 +245,9 @@ describe('createFork storage headroom gate', () => {
    */
   it('gives the child the source workspace personal API-key and fork-sync policies', async () => {
     resetDbChainMock()
-    queueTableRows(projectWorkspace, [{ projectId: 'project-source' }])
-    queueTableRows(projectWorkspace, [
+    dbChainMockFns.as.mockReturnValue(workspace)
+    queueTableRows(workspace, [{ projectId: 'project-source' }])
+    queueTableRows(workspace, [
       { project: { id: 'project-source', organizationId: null, archivedAt: null } },
     ])
     queueTableRows(workspace, [{ organizationId: null, forkSyncNewWorkflowsExcluded: true }])

apps/sim/ee/workspace-forking/lib/create-fork.ts

@@ -7,6 +7,7 @@ import { generateId } from '@sim/utils/id'
 import { and, eq } from 'drizzle-orm'
 import type { Workspace } from '@/lib/api/contracts/workspaces'
 import { enqueueOutboxEvent } from '@/lib/core/outbox/service'
+import { getProjectMembershipPhase } from '@/lib/projects/environment-source'
 import { requireForkProject } from '@/lib/projects/membership'
 import { buildDefaultWorkflowArtifacts } from '@/lib/workflows/defaults'
 import { insertNewWorkflowRow } from '@/lib/workflows/persistence/new-workflow-row'
@@ -210,6 +211,7 @@ export async function createFork(params: CreateForkParams): Promise<CreateForkRe
     workflowMcpServers: [],
   }
   const transaction = await db.transaction(async (tx) => {
+    const phase = await getProjectMembershipPhase(tx)
     await setForkLockTimeout(tx)
     if (admission) {
       await lockWorkspaceOperationRequest(tx, admission.workspaceId, admission.requestId)
@@ -303,6 +305,7 @@ export async function createFork(params: CreateForkParams): Promise<CreateForkRe
 
     await tx.insert(workspace).values({
       id: childWorkspaceId,
+      projectId: phase === 'column' ? (parentProject?.id ?? null) : null,
       name: childName,
       ownerId: userId,
       organizationId: policy.organizationId,
@@ -316,10 +319,11 @@ export async function createFork(params: CreateForkParams): Promise<CreateForkRe
       updatedAt: now,
     })
 
-    if (parentProject)
+    if (phase === 'connector' && parentProject) {
       await tx
         .insert(projectWorkspace)
         .values({ projectId: parentProject.id, workspaceId: childWorkspaceId })
+    }
 
     const sourcePermissions = await tx
       .select({ userId: permissions.userId, permissionType: permissions.permissionType })

apps/sim/lib/api/contracts/workspaces.ts

@@ -13,6 +13,7 @@ export type WorkspacePermission = z.output<typeof workspacePermissionSchema>
 export const workspaceSchema = z.object({
   id: z.string(),
   name: z.string(),
+  color: z.string().optional(),
   logoUrl: z.string().nullable().optional(),
   ownerId: z.string(),
   organizationId: z.string().nullable(),
@@ -28,6 +29,17 @@ export const workspaceSchema = z.object({
   isOrgAdmin: z.boolean().optional(),
   billedAccountUserId: z.string().nullable().optional(),
   allowPersonalApiKeys: z.boolean().optional(),
+  storageUsedBytes: z.number().nonnegative().optional(),
+  inboxEnabled: z.boolean().optional(),
+  inboxAddress: z.string().nullable().optional(),
+  inboxProviderId: z.string().nullable().optional(),
+  inboxSecretScope: z.string().optional(),
+  inboxMountedSecrets: z.array(z.string()).optional(),
+  archivedAt: z.string().datetime().nullable().optional(),
+  organizationAssignedAt: z.string().datetime().nullable().optional(),
+  forkSyncNewWorkflowsExcluded: z.boolean().optional(),
+  createdAt: z.string().datetime().optional(),
+  updatedAt: z.string().datetime().optional(),
   inviteMembersEnabled: z.boolean().optional(),
   inviteDisabledReason: z.string().nullable().optional(),
   inviteUpgradeRequired: z.boolean().optional(),

apps/sim/lib/billing/core/usage-log.test.ts

@@ -5,7 +5,7 @@ import {
   billingSubscriptionUtilsMock,
   billingSubscriptionUtilsMockFns,
 } from '@sim/testing/mocks/billing-subscription-utils.mock'
-import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
   mockInsert,
@@ -455,10 +455,15 @@ describe('ledger aggregates', () => {
   ]
 
   beforeEach(() => {
+    vi.useFakeTimers({ toFake: ['Date'] })
     installSharedDbMocks()
     vi.spyOn(Date, 'now').mockReturnValue(billingPeriod.start.getTime())
   })
 
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
   for (const aggregate of aggregates) {
     it(`${aggregate.name} reads through the bounded ledger transaction`, async () => {
       const execute = vi.fn().mockResolvedValue([])

apps/sim/lib/billing/organizations/lock-order.test.ts

@@ -11,6 +11,7 @@ import {
   organization,
   outboxEvent,
   permissions,
+  projectMembershipRollout,
   subscription as subscriptionTable,
   user,
   userStats,
@@ -181,11 +182,14 @@ describe('workspace payer-change transaction lock ordering', () => {
   it('locks nonzero workspaces before join billing or aggregate payer changes', async () => {
     const ops: Array<{ op: 'lock' | 'payer-transfer' | 'update'; table: unknown }> = []
     let memberSelectCount = 0
-    const rowsForTable = (table: unknown): unknown[] => {
+    const rowsForTable = (table: unknown, fields?: Record<string, unknown>): unknown[] => {
+      if (table === projectMembershipRollout) return [{ phase: 'column' }]
       if (table === workspace) {
+        if (fields?.id === workspace.projectId) return [{ id: null }]
         return [
           {
             id: 'workspace-1',
+            projectId: null,
             billedAccountUserId: 'user-1',
             organizationId: null,
             storageUsedBytes: 128,
@@ -203,7 +207,7 @@ describe('workspace payer-change transaction lock ordering', () => {
       if (table === userStats) return [{ currentPeriodCost: '5' }]
       return []
     }
-    const select = () => {
+    const select = (fields?: Record<string, unknown>) => {
       let table: unknown
       const chain = {
         from(source: unknown) {
@@ -216,19 +220,22 @@ describe('workspace payer-change transaction lock ordering', () => {
         orderBy() {
           return chain
         },
+        as() {
+          return table
+        },
         for() {
           ops.push({ op: 'lock', table })
           return chain
         },
-        limit: async () => rowsForTable(table),
+        limit: async () => rowsForTable(table, fields),
         then(resolve: (rows: unknown[]) => unknown, reject: (error: unknown) => unknown) {
-          return Promise.resolve(rowsForTable(table)).then(resolve, reject)
+          return Promise.resolve(rowsForTable(table, fields)).then(resolve, reject)
         },
       }
       return chain
     }
     const tx = {
-      execute: async () => [],
+      execute: async () => [{ marker: true, complete: false }],
       select,
       selectDistinct: select,
       insert: () => ({