From 148da0b3d9f9912d72a8d16befaf6c02c96eb634 Mon Sep 17 00:00:00 2001
From: Hare <kei.hiracchi.0928@gmail.com>
Date: Thu, 8 Oct 2026 19:41:41 +0900
Subject: [PATCH] test(workspace): preserve member-facing access without
 repositories

Apply T-717 item6/thread7 user decision: settings stay owner-controlled, ordinary non-owner viewing remains permitted under existing authentication. Add real HTTP assertions for non-owner workspace reads and absent management permissions; existing owner-only repository/deletion mutations and anonymous rejection remain exercised. Replace obsolete pending-policy documentation; no production authorization policy change.

Validation: targeted repository-free HTTP test, root cargo check, yoi-workspace-server 639 lib + 11 bin tests, canonical OpenAPI freshness, cargo fmt and baseline/HEAD diff checks pass. Rust tests/documentation only; rendered UI and previously reviewed browser/visual evidence are unchanged.
---
 crates/workspace-server/src/server.rs        | 17 +++++++++++++++++
 docs/design/workspace-optional-repository.md | 12 +++++++-----
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/crates/workspace-server/src/server.rs b/crates/workspace-server/src/server.rs
index 848f0cfad..a4f948195 100644
--- a/crates/workspace-server/src/server.rs
+++ b/crates/workspace-server/src/server.rs
@@ -45115,6 +45115,23 @@ mod tests {
             StatusCode::OK,
         )
         .await;
+        let non_owner_workspace = request_json_authenticated(
+            app.clone(),
+            "GET",
+            &format!("{scoped}/workspace"),
+            None,
+            &foreign,
+            StatusCode::OK,
+        )
+        .await;
+        assert_eq!(
+            non_owner_workspace["permissions"]["manage_repositories"],
+            false
+        );
+        assert_eq!(
+            non_owner_workspace["permissions"]["delete_workspace"],
+            false
+        );
         request_json(
             app.clone(),
             "GET",
diff --git a/docs/design/workspace-optional-repository.md b/docs/design/workspace-optional-repository.md
index fef47485a..9d585bfa7 100644
--- a/docs/design/workspace-optional-repository.md
+++ b/docs/design/workspace-optional-repository.md
@@ -47,8 +47,10 @@ a Repository, replay always returns `null`, even after other assets are added.
   Reopening and deletion use the usual Workspace authority and lifecycle guards;
   in particular, the last-accessible-Workspace deletion guard is unchanged.
 
-The existing authenticated non-owner viewing policy is unchanged by optional
-creation. Owner-only mutations and owner-scoped catalog discovery are retained;
-these are not a claim that authentication alone proves per-Workspace viewing
-permission. The T-717 viewing-policy decision remains separate from the creation
-contract.
+Optional creation preserves the existing owner/member responsibility split:
+settings are owner-controlled, while ordinary viewing and use are member-facing.
+Non-ownership alone is not a reason to deny ordinary viewing. Existing
+member-facing non-owner reads, owner-gated settings mutations, owner-scoped
+catalog discovery, authentication and operation-permission checks are unchanged.
+This creation change does not introduce a membership authority or an owner-only
+viewing filter.