Skip to content

πŸ—ƒοΈ db(database): add workspace_id columns to existing tables#15446

Merged
arvinxx merged 3 commits into
canaryfrom
feat/workspace-id-columns
Jun 4, 2026
Merged

πŸ—ƒοΈ db(database): add workspace_id columns to existing tables#15446
arvinxx merged 3 commits into
canaryfrom
feat/workspace-id-columns

Conversation

@arvinxx

@arvinxx arvinxx commented Jun 3, 2026

Copy link
Copy Markdown
Member

πŸ’» Change Type

  • ✨ feat

πŸ”€ Description of Change

Adds a nullable workspace_id text column to user-owned business tables (agents, sessions, topics, messages, files, tasks, RAG/eval, RBAC, devices, connectors, etc.) so records can later be scoped to a workspace. The workspace tables themselves already landed on canary via #15439 (0105_add_usage_agent_share_workspace).

Also folds in the additive device schema from #15356: the structured working_dirs jsonb column + WorkingDirEntry type (recent_cwds kept, now @deprecated).

Scope is deliberately column-only β€” the lowest-risk slice of the workspace DB work. FK constraints, btree indexes, and the per-user β†’ workspace-scoped unique-constraint conversions are intentionally deferred to follow-up PRs, because each needs a production-safe execution path Drizzle's migration runner can't express (it wraps everything in one transaction):

Operation Risk Why deferred
ADD COLUMN … text (nullable) 🟒 none metadata-only, ~ms AccessExclusive lock per table, online-safe β€” this PR
ADD FOREIGN KEY β†’ workspaces 🟑 med needs two-step NOT VALID + VALIDATE
CREATE INDEX … workspace_id 🟑 low–med needs CREATE INDEX CONCURRENTLY (can't run in a txn)
convert unique constraints β†’ workspace-scoped partials πŸ”΄ high needs concurrent build + atomic swap in a low-traffic window

Migration 0106_add_workspace_id_columns is pure ALTER TABLE … ADD COLUMN IF NOT EXISTS (71 statements: 70 workspace_id + 1 working_dirs), idempotent. No application code changes β€” every column is NULL/[], so existing queries are unaffected.

Scoping decisions for recently-added tables

After rebasing, I audited every table with a user_id but no workspace_id:

  • Scoped (user-owned resources, same logic as api_keys / agent_bot_providers): devices, user_connectors, user_connector_tools.
  • Left user/device-level: push_tokens β€” an Expo push token is one per physical app install and receives a person's notifications across all their workspaces; there is no per-workspace token.
  • No column needed: agent_shares (no user_id; scoped transitively via agent_id β†’ agents.workspace_id), auth/identity infra (accounts, nextauth_*, oidc_*, two_factor), personal memory (user_memories*), and notifications (user-level by existing design).

πŸ§ͺ How to Test

  • Tested locally
  • Added/updated tests
  • No tests needed

drizzle-kit generate reports No schema changes, nothing to migrate β€” schema TS, snapshot, journal, and SQL are fully consistent. Diff vs canary is pure additions (the only deletion is #15356 adding the @deprecated note above recent_cwds).

πŸ“ Additional Information

Planned follow-ups (each its own PR, executed with the safe path above, lower-risk first):

  • PR A β€” workspace_id foreign keys (NOT VALID + VALIDATE)
  • PR B β€” workspace_id btree indexes (CREATE INDEX CONCURRENTLY, serial)
  • PR C β€” unique-constraint conversions to workspace-scoped partials (concurrent build + atomic swap, low-peak window)

Supersedes the column/table half of the WIP in #15414, and the schema layer of #15356 (its model/tRPC/UI consumers in #15353 remain).

πŸ€– Generated with Claude Code

@arvinxx arvinxx requested review from nekomeowww and tjx666 as code owners June 3, 2026 17:14

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @arvinxx, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

@vercel

vercel Bot commented Jun 3, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
lobehub Ready Ready Preview, Comment Jun 4, 2026 5:14am

Request Review

@dosubot dosubot Bot added size:XL This PR changes 500-999 lines, ignoring generated files. feature:team-workspace Team workspace application labels Jun 3, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9f8ff9a036

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with πŸ‘.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/database/src/schemas/rbac.ts Outdated
@codecov

codecov Bot commented Jun 3, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
βœ… Project coverage is 70.88%. Comparing base (a3a08c2) to head (9f9a4f1).
⚠️ Report is 8 commits behind head on canary.

Additional details and impacted files
@@             Coverage Diff             @@
##           canary   #15446       +/-   ##
===========================================
- Coverage   89.70%   70.88%   -18.82%     
===========================================
  Files         862     3223     +2361     
  Lines      105731   319681   +213950     
  Branches    10246    29088    +18842     
===========================================
+ Hits        94841   226593   +131752     
- Misses      10714    92912    +82198     
  Partials      176      176               
Flag Coverage Ξ”
app 61.58% <0.00%> (?)
database 92.49% <ΓΈ> (ΓΈ)
packages/agent-runtime 80.48% <ΓΈ> (ΓΈ)
packages/builtin-tool-lobe-agent 18.52% <ΓΈ> (ΓΈ)
packages/context-engine 84.17% <ΓΈ> (ΓΈ)
packages/conversation-flow 91.29% <ΓΈ> (ΓΈ)
packages/file-loaders 87.89% <ΓΈ> (ΓΈ)
packages/memory-user-memory 74.99% <ΓΈ> (ΓΈ)
packages/model-bank 99.99% <ΓΈ> (ΓΈ)
packages/model-runtime 84.51% <ΓΈ> (ΓΈ)
packages/prompts 72.49% <ΓΈ> (ΓΈ)
packages/python-interpreter 92.90% <ΓΈ> (ΓΈ)
packages/ssrf-safe-fetch 0.00% <ΓΈ> (ΓΈ)
packages/types 35.36% <ΓΈ> (ΓΈ)
packages/utils 88.77% <ΓΈ> (ΓΈ)
packages/web-crawler 88.08% <ΓΈ> (ΓΈ)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components Coverage Ξ”
Store 68.47% <0.00%> (βˆ…)
Services 54.58% <ΓΈ> (βˆ…)
Server 71.89% <ΓΈ> (βˆ…)
Libs 57.01% <ΓΈ> (βˆ…)
Utils 81.44% <ΓΈ> (-18.56%) ⬇️
πŸš€ New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • πŸ“¦ JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@arvinxx arvinxx force-pushed the feat/workspace-id-columns branch from 9f8ff9a to 923db11 Compare June 3, 2026 17:35
@dosubot dosubot Bot added size:L This PR changes 100-499 lines, ignoring generated files. and removed size:XL This PR changes 500-999 lines, ignoring generated files. labels Jun 3, 2026
Add a nullable `workspace_id text` column to user-owned business tables
(agents, sessions, topics, messages, files, tasks, RAG/eval, RBAC, devices,
connectors, etc.) so records can later be scoped to a workspace. Workspace
tables themselves already landed on canary via 0105_add_usage_agent_share_workspace.

Also folds in the additive device schema from #15356: the structured
`working_dirs` jsonb column + `WorkingDirEntry` type (recent_cwds kept,
now @deprecated).

Scope is deliberately column-only β€” the lowest-risk slice:
- migration 0106 is pure `ADD COLUMN IF NOT EXISTS` (metadata-only, ~ms locks
  per table, online-safe, no app code change since columns are all NULL).
- FKs, btree indexes, and the per-user→workspace-scoped unique-constraint
  conversions are intentionally deferred to follow-up PRs so each can use the
  production-safe execution path Drizzle can't express (NOT VALID + VALIDATE,
  CREATE INDEX CONCURRENTLY, atomic unique swap).

Scoping notes:
- devices / user_connectors / user_connector_tools: scoped (user-owned resources).
- push_tokens: left user/device-level β€” an Expo token is one per app install and
  receives a person's notifications across all their workspaces.
- agent_shares: no workspace_id β€” scoped transitively via agent_id β†’ agents.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@arvinxx arvinxx force-pushed the feat/workspace-id-columns branch from 923db11 to b8ca57c Compare June 3, 2026 17:46
@arvinxx arvinxx changed the title πŸ—ƒοΈ feat(database): add workspace_id columns to existing tables πŸ—ƒοΈ db(database): add workspace_id columns to existing tables Jun 4, 2026
@arvinxx arvinxx changed the title πŸ—ƒοΈ db(database): add workspace_id columns to existing tables πŸ—ƒοΈ db(database): add workspace_id columns to existing tables Jun 4, 2026
Adding workspace_id made it a required key in the Drizzle-inferred row types
($inferSelect), breaking call sites that build those shapes by hand:
- rbac.getUserRoles: include workspace_id in the explicit select projection
- session action: add workspaceId to the constructed chat-group literal
- test mocks (apiKey / generation / generationBatch / generationTopic): add
  workspaceId: null

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The two `expect(createdTopic).toEqual({ ...full literal })` snapshots broke
on every new column (here: workspace_id). Switch them to toMatchObject so the
returned row may carry extra columns without churning the expected literal.
The dbTopic↔createdTopic strict comparisons are left as toEqual.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@arvinxx arvinxx merged commit 133675a into canary Jun 4, 2026
35 checks passed
@arvinxx arvinxx deleted the feat/workspace-id-columns branch June 4, 2026 05:18
arvinxx added a commit that referenced this pull request Jun 10, 2026
# πŸš€ LobeHub Release (20260610)

**Release Date:** June 10, 2026  
**Since v2.2.2:** 131 merged PRs Β· 13 contributors

> This weekly release strengthens agent collaboration across cloud,
desktop, CLI, and workspace flows, with steadier runtime behavior and a
broader foundation for workspace-scoped data.

---

## ✨ Highlights

- **Agent execution across devices** β€” Unifies per-device working
directories, project skill discovery, and sub-agent suspend/resume
behavior across server, QStash, and device RPC flows. (#15543, #15566,
#15481, #15620, #15591)
- **Connector and sandbox platform** β€” Expands connector permissions,
custom OAuth MCP connector onboarding, sandbox provider support, and
user-uploaded file sync into cloud sandbox runs. (#15463, #15546,
#15184, #15550)
- **Desktop and CLI reliability** β€” Fixes desktop cold-start,
auto-update, Windows build, CLI skill discovery, and `lh connect` agent
dispatch paths. (#15547, #15525, #15527, #15562, #15632, #15634)
- **Pages and sharing** β€” Refreshes topic sharing, improves Page Editor
layout behavior, and routes Page Agent tool execution through the
server-side editor path. (#15581, #15556, #15588, #15023, #15610)
- **Model availability and provider updates** β€” Adds user-scoped LobeHub
model availability, Claude Fable 5, Qwen thinking preservation, and
MiniMax M3 updates. (#15590, #15639, #13494, #15376)

---

## πŸ—οΈ Core Product & Architecture

### Agent Runtime & Heterogeneous Agents

- Improves sub-agent lifecycle handling, including async suspend/resume,
queue-mode QStash resume delivery, and blocking nested sub-agent calls.
(#15481, #15620, #15575)
- Stabilizes heterogeneous agent ingestion and streaming with raw stream
dumps, per-turn usage, image forwarding on regenerate, and
duplicate-text fixes. (#15602, #15577, #15592, #15585)
- Adds execution-device and working-directory controls across device
RPC, legacy defaults, and remote-spawned Claude Code sessions. (#15543,
#15566, #15591, #15572)
- Improves runtime diagnostics and compatibility, including Gemini
multimodal output capture, abort stream semantics, and trace quality
analysis. (#15535, #13677, #15508)

---

## πŸ“± Platforms, Integrations & UX

### Connectors, Sandbox & Tools

- Ships API-level connector tool permissions, custom OAuth MCP connector
onboarding, and connector-first runtime execution. (#15463, #15546)
- Adds sandbox provider support, cloud sandbox file sync, and safer
external URL file input handling with SSRF validation. (#15184, #15550,
#12657)
- Improves tool visibility and execution with pinned app-fixed tools,
ANSI output rendering, gateway-tunneled MCP calls, and automatic
headless tool runs. (#15509, #15516, #15469, #15492)

### Desktop, CLI & Web UX

- Restores desktop startup and reload behavior, preserves IPC error
causes, and keeps the tab bar new-tab action visible across routes.
(#15547, #15597, #15638)
- Fixes desktop update and build stability for browser quit guards,
macOS update signing, and Windows Visual Studio detection. (#15525,
#15527, #15562)
- Shows the plan-limit upgrade UI on desktop builds. (#15628)
- Adds the Agent Run delivery checker and fixes CLI device dispatch plus
skill list/search output. (#15489, #15634, #15632)
- Refreshes onboarding, auth source preservation, topic UI states,
referral/Fable campaign copy, and chat-input control bar behavior.
(#15629, #15544, #15573, #15614, #15616, #15617, #15622, #15643)

---

## πŸ”’ Security, Reliability & Rollout Notes

- External URL file input now includes SSRF validation for safer Google
file handling. (#12657)
- Database workspace-scope migrations are part of this release;
self-hosted operators should run the normal migration path before
serving the updated app. (#15446, #15465, #15468, #15472)
- The release branch was re-cut from `canary` and includes the latest
`main` release-version commit so `v2.2.2` is the verified compare base.

---

## πŸ‘₯ Contributors

@ONLY-yours, @sxjeru, @hardy-one, @xujingli, @hezhijie0327, @Coooolfan,
@arvinxx, @tjx666, @Innei, @rivertwilight, @rdmclin2, @cy948,
@AmAzing129

**Full Changelog**:
v2.2.2...release/weekly-20260610-recut-3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

feature:team-workspace Team workspace application size:L This PR changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant