feat: add guarded workspace deletion workflow

This commit is contained in:
2026-09-06 07:22:33 +09:00
parent 668a9062b3
commit e3e9e83bc1
11 changed files with 1940 additions and 83 deletions
@@ -48,6 +48,74 @@ export type WorkspacePermissionSummary = {
manage_repositories: boolean;
manage_secrets: boolean;
manage_runtimes: boolean;
delete_workspace: boolean;
};
export type WorkspaceDeletionState =
| "queued"
| "running"
| "blocked"
| "failed"
| "succeeded";
export type WorkspaceDeletionBlockerKind =
| "last_accessible_workspace"
| "revision_conflict"
| "dirty_workdir"
| "worker_removal_blocked"
| "workdir_removal_blocked"
| "retention_hold"
| "cleanup_unavailable";
export type WorkspaceDeletionBlocker = {
kind: WorkspaceDeletionBlockerKind;
resource_kind: string | null;
resource_key: string | null;
message: string;
};
export type WorkspaceDeletionResourceCounts = {
workers: number;
workdirs: number;
repositories: number;
runtime_bindings: number;
secrets: number;
artifacts: number;
};
export type WorkspaceDeletionPreflightResponse = {
workspace_id: string;
display_name: string;
/**
* Opaque persisted Workspace metadata revision used as a CAS fence.
*/
expected_revision: string;
can_delete: boolean;
force_delete_dirty_workdirs_available: boolean;
resources: WorkspaceDeletionResourceCounts;
blockers: Array<WorkspaceDeletionBlocker>;
};
export type WorkspaceDeletionRequest = {
operation_id: string;
expected_revision: string;
confirmation: string;
force_delete_dirty_workdirs: boolean;
};
export type WorkspaceDeletionOperationResponse = {
operation_id: string;
workspace_id: string;
display_name: string;
state: WorkspaceDeletionState;
force_delete_dirty_workdirs: boolean;
resources: WorkspaceDeletionResourceCounts;
child_operation_ids: Array<string>;
blockers: Array<WorkspaceDeletionBlocker>;
failure_category: string | null;
created_at: string;
updated_at: string;
completed_at: string | null;
};
export type DiagnosticSeverity = "info" | "warning" | "error";
@@ -14,6 +14,12 @@ import type {
WorkspaceAuthConfig,
WorkspaceCatalogListResponse,
WorkspaceCreateResponse,
WorkspaceDeletionBlocker,
WorkspaceDeletionBlockerKind,
WorkspaceDeletionOperationResponse,
WorkspaceDeletionPreflightResponse,
WorkspaceDeletionResourceCounts,
WorkspaceDeletionState,
WorkspaceExtensionPoints,
WorkspaceExtensionPointState,
WorkspacePermissionSummary,
@@ -32,6 +38,8 @@ export type {
RepositorySummary,
WorkspaceCatalogListResponse,
WorkspaceCreateResponse,
WorkspaceDeletionOperationResponse,
WorkspaceDeletionPreflightResponse,
WorkspacePermissionSummary,
WorkspaceResponse,
WorkspaceSummary,
@@ -369,7 +377,12 @@ function permissions(value: unknown, path: string): WorkspacePermissionSummary {
const item = object(value, path);
exactKeys(
item,
["manage_repositories", "manage_secrets", "manage_runtimes"],
[
"manage_repositories",
"manage_secrets",
"manage_runtimes",
"delete_workspace",
],
path,
);
return {
@@ -379,6 +392,10 @@ function permissions(value: unknown, path: string): WorkspacePermissionSummary {
),
manage_secrets: boolean(item.manage_secrets, `${path}.manage_secrets`),
manage_runtimes: boolean(item.manage_runtimes, `${path}.manage_runtimes`),
delete_workspace: boolean(
item.delete_workspace,
`${path}.delete_workspace`,
),
};
}
@@ -566,6 +583,202 @@ export function parseRepositoryDetailResponse(
};
}
const deletionStates = new Set<WorkspaceDeletionState>([
"queued",
"running",
"blocked",
"failed",
"succeeded",
]);
const deletionBlockerKinds = new Set<WorkspaceDeletionBlockerKind>([
"last_accessible_workspace",
"revision_conflict",
"dirty_workdir",
"worker_removal_blocked",
"workdir_removal_blocked",
"retention_hold",
"cleanup_unavailable",
]);
function deletionState(value: unknown, path: string): WorkspaceDeletionState {
const candidate = string(value, path) as WorkspaceDeletionState;
if (!deletionStates.has(candidate)) throw new Error(`${path} is invalid`);
return candidate;
}
function deletionBlocker(
value: unknown,
path: string,
): WorkspaceDeletionBlocker {
const item = object(value, path);
exactKeys(item, ["kind", "resource_kind", "resource_key", "message"], path);
const kind = string(
item.kind,
`${path}.kind`,
) as WorkspaceDeletionBlockerKind;
if (!deletionBlockerKinds.has(kind)) {
throw new Error(`${path}.kind is invalid`);
}
return {
kind,
resource_kind:
optionalNullableString(item.resource_kind, `${path}.resource_kind`) ??
null,
resource_key:
optionalNullableString(item.resource_key, `${path}.resource_key`) ?? null,
message: string(item.message, `${path}.message`),
};
}
function deletionResourceCounts(
value: unknown,
path: string,
): WorkspaceDeletionResourceCounts {
const item = object(value, path);
exactKeys(item, [
"workers",
"workdirs",
"repositories",
"runtime_bindings",
"secrets",
"artifacts",
], path);
return {
workers: integer(item.workers, `${path}.workers`),
workdirs: integer(item.workdirs, `${path}.workdirs`),
repositories: integer(item.repositories, `${path}.repositories`),
runtime_bindings: integer(
item.runtime_bindings,
`${path}.runtime_bindings`,
),
secrets: integer(item.secrets, `${path}.secrets`),
artifacts: integer(item.artifacts, `${path}.artifacts`),
};
}
export function parseWorkspaceDeletionPreflightResponse(
value: unknown,
): WorkspaceDeletionPreflightResponse {
const item = object(value, "Workspace deletion preflight");
exactKeys(item, [
"workspace_id",
"display_name",
"expected_revision",
"can_delete",
"force_delete_dirty_workdirs_available",
"resources",
"blockers",
], "Workspace deletion preflight");
return {
workspace_id: string(
item.workspace_id,
"Workspace deletion preflight.workspace_id",
),
display_name: string(
item.display_name,
"Workspace deletion preflight.display_name",
),
expected_revision: string(
item.expected_revision,
"Workspace deletion preflight.expected_revision",
),
can_delete: boolean(
item.can_delete,
"Workspace deletion preflight.can_delete",
),
force_delete_dirty_workdirs_available: boolean(
item.force_delete_dirty_workdirs_available,
"Workspace deletion preflight.force_delete_dirty_workdirs_available",
),
resources: deletionResourceCounts(
item.resources,
"Workspace deletion preflight.resources",
),
blockers: array(item.blockers, "Workspace deletion preflight.blockers").map(
(entry, index) =>
deletionBlocker(
entry,
`Workspace deletion preflight.blockers[${index}]`,
),
),
};
}
export function parseWorkspaceDeletionOperationResponse(
value: unknown,
): WorkspaceDeletionOperationResponse {
const item = object(value, "Workspace deletion operation");
exactKeys(item, [
"operation_id",
"workspace_id",
"display_name",
"state",
"force_delete_dirty_workdirs",
"resources",
"child_operation_ids",
"blockers",
"failure_category",
"created_at",
"updated_at",
"completed_at",
], "Workspace deletion operation");
return {
operation_id: string(
item.operation_id,
"Workspace deletion operation.operation_id",
),
workspace_id: string(
item.workspace_id,
"Workspace deletion operation.workspace_id",
),
display_name: string(
item.display_name,
"Workspace deletion operation.display_name",
),
state: deletionState(item.state, "Workspace deletion operation.state"),
force_delete_dirty_workdirs: boolean(
item.force_delete_dirty_workdirs,
"Workspace deletion operation.force_delete_dirty_workdirs",
),
resources: deletionResourceCounts(
item.resources,
"Workspace deletion operation.resources",
),
child_operation_ids: array(
item.child_operation_ids,
"Workspace deletion operation.child_operation_ids",
).map((entry, index) =>
string(
entry,
`Workspace deletion operation.child_operation_ids[${index}]`,
)
),
blockers: array(item.blockers, "Workspace deletion operation.blockers").map(
(entry, index) =>
deletionBlocker(
entry,
`Workspace deletion operation.blockers[${index}]`,
),
),
failure_category: optionalNullableString(
item.failure_category,
"Workspace deletion operation.failure_category",
) ?? null,
created_at: string(
item.created_at,
"Workspace deletion operation.created_at",
),
updated_at: string(
item.updated_at,
"Workspace deletion operation.updated_at",
),
completed_at: optionalNullableString(
item.completed_at,
"Workspace deletion operation.completed_at",
) ?? null,
};
}
export function parseRepositoryLogResponse(
value: unknown,
): RepositoryLogResponse {
@@ -0,0 +1,63 @@
import type {
WorkspaceDeletionOperationResponse,
WorkspaceDeletionPreflightResponse,
WorkspaceDeletionRequest,
} from "$lib/generated/workspace-api";
import {
parseWorkspaceDeletionOperationResponse,
parseWorkspaceDeletionPreflightResponse,
} from "$lib/workspace/api/workspace-model";
async function responseJson(
response: Response,
context: string,
): Promise<unknown> {
const value: unknown = await response.json().catch(() => null);
if (!response.ok) {
const message = typeof value === "object" && value !== null &&
"error" in value && typeof value.error === "string"
? value.error
: `${context} failed (${response.status})`;
throw new Error(message);
}
return value;
}
export async function preflightWorkspaceDeletion(
workspaceId: string,
): Promise<WorkspaceDeletionPreflightResponse> {
const response = await fetch(
`/api/workspaces/${encodeURIComponent(workspaceId)}/deletion`,
);
return parseWorkspaceDeletionPreflightResponse(
await responseJson(response, "Workspace deletion preflight"),
);
}
export async function startWorkspaceDeletion(
workspaceId: string,
request: WorkspaceDeletionRequest,
): Promise<WorkspaceDeletionOperationResponse> {
const response = await fetch(
`/api/workspaces/${encodeURIComponent(workspaceId)}/deletion`,
{
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify(request),
},
);
return parseWorkspaceDeletionOperationResponse(
await responseJson(response, "Workspace deletion"),
);
}
export async function getWorkspaceDeletion(
operationId: string,
): Promise<WorkspaceDeletionOperationResponse> {
const response = await fetch(
`/api/workspace-deletions/${encodeURIComponent(operationId)}`,
);
return parseWorkspaceDeletionOperationResponse(
await responseJson(response, "Workspace deletion status"),
);
}
@@ -1,8 +1,17 @@
<script lang="ts">
import type {
Diagnostic,
WorkspaceDeletionOperationResponse,
WorkspaceDeletionPreflightResponse,
WorkspaceMetadataSettingsResponse,
} from '$lib/generated/workspace-api';
import { goto } from '$app/navigation';
import { disposeWorkspaceMultiplexer } from '$lib/workspace/multiplexer';
import {
getWorkspaceDeletion,
preflightWorkspaceDeletion,
startWorkspaceDeletion,
} from '$lib/workspace/settings/workspace-deletion-api';
import DiagnosticsList from '$lib/workspace/settings/DiagnosticsList.svelte';
import {
fetchWorkspaceMetadata,
@@ -19,6 +28,15 @@
let submitting = $state(false);
let message = $state<string | null>(null);
let diagnostics = $state<Diagnostic[]>([]);
let deletionOpen = $state(false);
let deletionLoading = $state(false);
let deletionSubmitting = $state(false);
let deletionConfirmation = $state('');
let forceDeleteDirtyWorkdirs = $state(false);
let deletionPreflight = $state<WorkspaceDeletionPreflightResponse | null>(null);
let deletionOperation = $state<WorkspaceDeletionOperationResponse | null>(null);
let deletionOperationId = $state('');
let deletionError = $state<string | null>(null);
$effect(() => {
if (!workspaceId) {
@@ -69,6 +87,51 @@
submitting = false;
}
}
async function openDeletionConfirmation() {
deletionOpen = true;
deletionLoading = true;
deletionError = null;
deletionOperation = null;
deletionOperationId = crypto.randomUUID();
deletionConfirmation = '';
forceDeleteDirtyWorkdirs = false;
try {
deletionPreflight = await preflightWorkspaceDeletion(workspaceId);
} catch (err) {
deletionError = err instanceof Error ? err.message : 'Workspace deletion preflight failed';
} finally {
deletionLoading = false;
}
}
async function deleteWorkspace() {
if (!deletionPreflight) return;
deletionSubmitting = true;
deletionError = null;
try {
let operation = await startWorkspaceDeletion(workspaceId, {
operation_id: deletionOperationId,
expected_revision: deletionPreflight.expected_revision,
confirmation: deletionConfirmation,
force_delete_dirty_workdirs: forceDeleteDirtyWorkdirs,
});
deletionOperation = operation;
while (operation.state === 'queued' || operation.state === 'running') {
await new Promise((resolve) => setTimeout(resolve, 500));
operation = await getWorkspaceDeletion(operation.operation_id);
deletionOperation = operation;
}
if (operation.state === 'succeeded') {
disposeWorkspaceMultiplexer(workspaceId);
await goto('/');
}
} catch (err) {
deletionError = err instanceof Error ? err.message : 'Workspace deletion failed';
} finally {
deletionSubmitting = false;
}
}
</script>
<svelte:head>
@@ -113,3 +176,74 @@
{/if}
<DiagnosticsList {diagnostics} />
</section>
{#if data.workspace?.permissions.delete_workspace}
<section class="settings-section danger-zone" aria-labelledby="workspace-danger-title">
<div>
<h2 id="workspace-danger-title">Danger zone</h2>
<p>Deleting this Workspace permanently removes its Workers, Workdirs, repositories, configuration, Memory, Tickets, and audit data.</p>
</div>
<button class="danger-button" type="button" onclick={() => void openDeletionConfirmation()}>Delete Workspace</button>
</section>
{/if}
{#if deletionOpen}
<div class="modal-backdrop" role="presentation">
<div class="deletion-dialog" role="dialog" aria-modal="true" aria-labelledby="delete-workspace-title">
<h2 id="delete-workspace-title">Delete {deletionPreflight?.display_name ?? 'Workspace'}?</h2>
{#if deletionLoading}
<p>Loading deletion impact…</p>
{:else if deletionPreflight}
<p>This operation cannot be undone. It will remove:</p>
<ul>
<li>{deletionPreflight.resources.workers} Workers</li>
<li>{deletionPreflight.resources.workdirs} Workdirs</li>
<li>{deletionPreflight.resources.repositories} repositories</li>
<li>{deletionPreflight.resources.runtime_bindings} Runtime bindings</li>
<li>{deletionPreflight.resources.secrets} secret records</li>
<li>{deletionPreflight.resources.artifacts} artifacts</li>
</ul>
{#each deletionPreflight.blockers as blocker}
<p class="status-message error">{blocker.message}</p>
{/each}
<label>
<span>Type <strong>delete {deletionPreflight.display_name}</strong> to confirm</span>
<input bind:value={deletionConfirmation} autocomplete="off" />
</label>
{#if deletionPreflight.force_delete_dirty_workdirs_available}
<label class="force-delete-option">
<input type="checkbox" bind:checked={forceDeleteDirtyWorkdirs} disabled={deletionOperation !== null} />
<span>Force-delete dirty Workdirs after reviewing the impact</span>
</label>
{/if}
{/if}
{#if deletionOperation}
<p class="status-message">Deletion state: {deletionOperation.state}</p>
{#each deletionOperation.blockers as blocker}
<p class="status-message error">{blocker.message}</p>
{/each}
{/if}
{#if deletionError}<p class="status-message error">{deletionError}</p>{/if}
<div class="dialog-actions">
<button type="button" onclick={() => { deletionOpen = false; }} disabled={deletionSubmitting}>Cancel</button>
<button
class="danger-button"
type="button"
onclick={() => void deleteWorkspace()}
disabled={deletionSubmitting || !deletionPreflight?.can_delete || deletionConfirmation !== `delete ${deletionPreflight?.display_name ?? ''}`}
>{deletionSubmitting ? 'Deleting…' : 'Delete Workspace'}</button>
</div>
</div>
</div>
{/if}
<style>
.danger-zone { display: flex; justify-content: space-between; align-items: start; gap: var(--space-4); border-top: 1px solid var(--color-danger, #b42318); }
.danger-zone p { max-width: 68ch; }
.danger-button { color: white; background: var(--color-danger, #b42318); border-color: var(--color-danger, #b42318); }
.modal-backdrop { position: fixed; inset: 0; z-index: 100; display: grid; place-items: center; padding: var(--space-4); background: rgb(0 0 0 / 0.55); }
.deletion-dialog { width: min(34rem, 100%); max-height: calc(100vh - 2rem); overflow: auto; padding: var(--space-5); background: var(--color-surface, white); border: 1px solid var(--color-border); }
.deletion-dialog label { display: grid; gap: var(--space-2); margin-block: var(--space-4); }
.force-delete-option { grid-template-columns: auto 1fr !important; align-items: start; }
.dialog-actions { display: flex; justify-content: flex-end; gap: var(--space-2); margin-top: var(--space-5); }
</style>
@@ -6,6 +6,8 @@ declare const Deno: {
import {
parseRepositoryListApiResult,
parseRepositoryListResponse,
parseWorkspaceDeletionOperationResponse,
parseWorkspaceDeletionPreflightResponse,
parseWorkspaceResponse,
} from "../src/lib/workspace/api/workspace-model.ts";
@@ -109,6 +111,91 @@ Deno.test("workspace response requires the permission projection", () => {
);
});
Deno.test("Workspace deletion DTOs fail closed and preserve durable operation state", () => {
const preflight = parseWorkspaceDeletionPreflightResponse({
workspace_id: "workspace-a",
display_name: "Alpha",
expected_revision: "2026-01-01T00:00:00Z",
can_delete: true,
force_delete_dirty_workdirs_available: true,
resources: {
workers: 2,
workdirs: 1,
repositories: 1,
runtime_bindings: 1,
secrets: 0,
artifacts: 3,
},
blockers: [],
});
if (preflight.resources.workers !== 2) {
throw new Error("worker count was not preserved");
}
const operation = parseWorkspaceDeletionOperationResponse({
operation_id: "delete-alpha",
workspace_id: "workspace-a",
display_name: "Alpha",
state: "blocked",
force_delete_dirty_workdirs: false,
resources: preflight.resources,
child_operation_ids: ["worker-remove:arcadia/7"],
blockers: [{
kind: "dirty_workdir",
resource_kind: "workdir",
resource_key: "WD-1",
message: "Workdir is dirty",
}],
failure_category: null,
created_at: "2026-01-01T00:00:00Z",
updated_at: "2026-01-01T00:01:00Z",
completed_at: null,
});
if (operation.state !== "blocked") {
throw new Error("operation state was not preserved");
}
assertThrows(
() =>
parseWorkspaceDeletionPreflightResponse({
...preflight,
unexpected: true,
}),
"unexpected is not part",
);
assertThrows(
() =>
parseWorkspaceDeletionOperationResponse({
...operation,
state: "unknown",
}),
".state is invalid",
);
});
Deno.test("Workspace settings exposes owner-gated typed destructive confirmation", async () => {
const source = await Deno.readTextFile(
new URL(
"../src/routes/w/[workspaceId]/settings/workspace/+page.svelte",
import.meta.url,
),
);
for (
const token of [
"permissions.delete_workspace",
"preflightWorkspaceDeletion",
"startWorkspaceDeletion",
"delete ${",
"force_delete_dirty_workdirs",
"disposeWorkspaceMultiplexer(workspaceId)",
]
) {
if (!source.includes(token)) {
throw new Error(`Workspace deletion UI should include ${token}`);
}
}
});
Deno.test("Repository settings consume the validated shared wire shape", async () => {
const [loadSource, pageSource] = await Promise.all([
Deno.readTextFile(