[waleedlatif1]

Summary

• PATCH/PUT /api/workspaces/[id] queried the DB and decided authorization in the route; it now runs through workspaces.update (admin, session-only, workspace keys denied) on the shared internal route builder
• Chat could not rename a workspace. New workspaces.identity.update (admin, Copilot-delegated, sim:settings) accepts only name and logoUrl via a strict pick, so billedAccountUserId and allowPersonalApiKeys are rejected; exposed as a settings workspace/general section with a workspaces.identity.read read
• Route behavior preserved: same order, 403 Insufficient permissions for non-admin/non-member/archived, billed-account 400s, payer transfer in the transaction, WORKSPACE_UPDATED audit with the same changes metadata. Differences from the shared builder: error bodies carry requestId, response is contract-validated, and a row vanishing mid-request returns 404 instead of an empty 200
• No approval gates added

Type of Change

• Improvement

Testing

• New update-workspace.integration.ts (real Postgres, real route and settings tool): 11/11; each guard reverted alone turns its case red (identity role lowered, identity schema widened, delegated principals admitted to full update, 403 mapping removed)
• settings.test.ts, settings-management-boundary.test.ts (30), copilot-route-inventory.test.ts
• bun run lint, check:api-validation:strict, check:boundaries, check:route-verbs, check:api-contract-routes, check:principal-kind-parity, check:application-graph, check:permission-group-enforcement, check:test-types, pre-push type-check

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 3, 2026 3:39am UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable new issues were found.

Summary

Moves workspace updates into an authorized application operation and lets Chat change workspace names and logos.

• Workspace PATCH and PUT updates share an admin-only operation.
• Chat can update a workspace name and logo as an admin.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[PATCH or PUT] --> B[Session-only admin operation]
  C[Chat settings] --> D[Delegated admin operation]
  D --> E[Strict name and logo patch]
  B --> F[Apply workspace update]
  E --> F
  F --> G{Workspace still active?}
  G -->|Yes| H[Return updated row and record audit]
  G -->|No| I[Reject and roll back any payer transfer]

Loading

_{Reviews (2) · Last reviewed commit: "fix(workspaces): recheck active state at..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 8 files

_{Turn on auto-fix | Re-trigger cubic}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 8 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}