From f3fdc98319bfb4560a778a964c35971662a312cd Mon Sep 17 00:00:00 2001 From: Hare Date: Tue, 7 Jul 2026 05:52:46 +0900 Subject: [PATCH] ticket: approve workspace id route scoping --- .yoi/tickets/00001KWWE8E04/item.md | 2 +- .yoi/tickets/00001KWWE8E04/thread.md | 26 ++++++++++++++++++++++++++ 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/.yoi/tickets/00001KWWE8E04/item.md b/.yoi/tickets/00001KWWE8E04/item.md index 444f5dca..f044f2f9 100644 --- a/.yoi/tickets/00001KWWE8E04/item.md +++ b/.yoi/tickets/00001KWWE8E04/item.md @@ -2,7 +2,7 @@ title: 'Scope Workspace Browser routes and API by workspace id' state: 'inprogress' created_at: '2026-07-06T19:25:08Z' -updated_at: '2026-07-06T20:45:34Z' +updated_at: '2026-07-06T20:52:40Z' assignee: null queued_by: 'workspace-panel' queued_at: '2026-07-06T19:53:14Z' diff --git a/.yoi/tickets/00001KWWE8E04/thread.md b/.yoi/tickets/00001KWWE8E04/thread.md index 04ad53e6..e510d2a4 100644 --- a/.yoi/tickets/00001KWWE8E04/thread.md +++ b/.yoi/tickets/00001KWWE8E04/thread.md @@ -243,3 +243,29 @@ Review-fix implementation report: - Requesting follow-up external review against `f6ad9cfc..71340b89` and full combined implementation。 --- + + + +## Review: approve + +External follow-up review result: approve + +Blockers: none. + +Evidence reviewed in implementation worktree: +- Ticket `00001KWWE8E04`, fix commit `71340b89`, and combined relevant implementation。 + +Findings: +- Prior blocker 1 resolved: unscoped browser routes now bootstrap only through `/api/workspace` and redirect to `/w//...`; when no workspace id is available, layout returns empty/null state instead of loading workspace datasets through unscoped `/api/...`。 +- Prior blocker 2 resolved: canonical maintained UI/control logic is under `web/workspace/src/routes/w/[workspaceId]/...`; unscoped route files are thin empty-load/component shims and no longer duplicate critical page logic。 +- Frontend scoped API construction uses `/api/w//...` via shared helpers; scoped routes and links use `/w//...`。 +- Backend has scoped `/api/w/{workspace_id}/...` routes with centralized workspace-id assertion. Mismatches return typed/sanitized 404 diagnostic (`workspace_id_mismatch`) without raw paths, store paths, or runtime internals。 +- Runtime `/v1/...` API surface was not touched。 +- Tests meaningfully cover scoped API behavior, mismatch diagnostics, static unscoped redirect behavior, frontend scoped API/link construction, and unscoped shim/source-shape expectations。 + +Validation note: +- Reviewer did not rerun the full validation; reviewer relied on Orchestrator-reported passing validation and performed read-only inspection。 + +No merge-blocking issues found. + +---