Phase 3C — Commit Summary

feat: workspaces — collaborative repo namespaces
Backend
- internal/models/workspace.go — Workspace (handle, displayName,
  description, createdBy) + WorkspaceMember (workspaceId, userId,
  username, role: owner/admin/member)
- internal/models/repo.go — added nullable workspace_id column; existing
  user repos unaffected
- internal/models/migrations/011_workspaces.go — syncs both tables +
  adds column to repository
- internal/api/handlers/workspace.go — ListWorkspaces, CreateWorkspace,
  GetWorkspace, UpdateWorkspace, DeleteWorkspace (blocks if repos
  remain), ListRepos, ListMembers, AddMember, UpdateMember, RemoveMember
- internal/api/handlers/repos.go — lookupRepo resolves workspace
  handles; Create accepts workspace field; List includes workspace
  member repos; withOwnerName uses workspace handle for workspace-owned
  repos
- internal/api/handlers/dashboard.go — recentRuns + repo list include
  workspace repos the user is a member of
- internal/api/router.go — /workspaces, /workspaces/:handle/* routes
  Workspace rules enforced:
- Handle globally unique across usernames + workspace handles (409 on
  collision)
- Creator auto-assigned owner role
- Delete blocked if repos exist
- Last owner cannot be demoted/removed
  ---
  feat: secret management hierarchy (Global → Workspace → Repo → Env)
  Backend
- internal/models/secret.go — Secret struct +
  EncryptSecret/DecryptSecret with AES-256-GCM (key = SHA-256 of
  SESSION_SECRET); values never serialised to JSON
- internal/models/migrations/012_secrets.go — syncs secret table
- internal/api/handlers/secret.go — List/Upsert/Delete for all four
  scopes; ResolveSecretsForRun builds merged env map for CI
- internal/domain/ci/executor.go — JobContext.Secrets field; secrets
  injected as --env KEY=VALUE into docker run; buildJobContext calls
  resolveSecrets(Global < Workspace < Repo < Env)
- internal/domain/ci/runner_manager.go — passes cfg.SessionSecret to
  buildJobContext
- internal/api/router.go — /repos/:owner/:repo/secrets,
  /environments/:envName/secrets, /workspaces/:handle/secrets,
  /admin/secrets
  ---
  feat: workspace + secret management UI
  Frontend
- types/api.ts — Workspace, WorkspaceWithMeta, WorkspaceMember,
  SecretListItem types
- api/queries/workspaces.ts — full CRUD hooks + WorkspaceRepo type
- api/queries/secrets.ts — repo/env/workspace secret hooks
- pages/WorkspacesPage.tsx — list + create modal
- pages/WorkspacePage.tsx — workspace dashboard with repo list
- pages/WorkspaceSettingsPage.tsx — general settings, members CRUD,
  workspace secrets, danger zone
- pages/RepoSecretsPage.tsx — repo secrets + per-environment secret
  sections with priority hierarchy callout
- pages/CreateRepoPage.tsx — ?workspace= query param pre-fills owner
  selector; only admin/owner workspaces shown
- components/layout/Sidebar.tsx — "Workspaces" global nav item +
  workspace quick-links; "Secrets" in RepoSubNav; new SecretsIcon,
  WorkspaceIcon
- App.tsx — routes for /workspaces, /workspaces/:handle,
  /workspaces/:handle/settings, /repos/:owner/:repo/secrets

internal/api/handlers/repos.go

@@ -46,19 +46,28 @@ func isValidRepoName(name string) bool {
 }
 
 func (h *RepoHandler) withOwnerName(repo *models.Repository) repoResponse {
-	var owner models.User
-	h.db.ID(repo.OwnerID).Get(&owner)
 	gitdomain.SetRepoRoot(h.cfg.RepoRoot)
 
+	ownerName := ""
+	if repo.WorkspaceID != nil && *repo.WorkspaceID != 0 {
+		var ws models.Workspace
+		h.db.ID(*repo.WorkspaceID).Cols("handle").Get(&ws)
+		ownerName = ws.Handle
+	} else {
+		var owner models.User
+		h.db.ID(repo.OwnerID).Cols("username").Get(&owner)
+		ownerName = owner.Username
+	}
+
 	avURL := ""
 	if _, err := os.Stat(avatarPath(h.cfg.RepoRoot, repo.ID)); err == nil {
-		avURL = "/api/v1/repos/" + owner.Username + "/" + repo.Name + "/avatar"
+		avURL = "/api/v1/repos/" + ownerName + "/" + repo.Name + "/avatar"
 	}
 
 	return repoResponse{
 		Repository: *repo,
 		AvatarURL:  avURL,
-		OwnerName:  owner.Username,
+		OwnerName:  ownerName,
 		IsEmpty:    gitdomain.IsEmpty(repo.DiskPath),
 	}
 }
@@ -75,10 +84,21 @@ func NewRepoHandler(db *xorm.Engine, cfg *config.Config) *RepoHandler {
 func (h *RepoHandler) List(w http.ResponseWriter, r *http.Request) {
 	userID, _ := middleware.UserIDFromContext(r.Context())
 
+	// User-owned repos.
 	var repos []models.Repository
-	if err := h.db.Where("owner_id = ?", userID).Find(&repos); err != nil {
-		jsonError(w, "could not list repositories", http.StatusInternalServerError)
-		return
+	h.db.Where("owner_id = ? AND workspace_id IS NULL", userID).Find(&repos)
+
+	// Workspace repos where user is a member.
+	var memberships []models.WorkspaceMember
+	h.db.Where("user_id = ?", userID).Find(&memberships)
+	if len(memberships) > 0 {
+		wsIDs := make([]int64, len(memberships))
+		for i, m := range memberships {
+			wsIDs[i] = m.WorkspaceID
+		}
+		var wsRepos []models.Repository
+		h.db.In("workspace_id", wsIDs).Find(&wsRepos)
+		repos = append(repos, wsRepos...)
 	}
 
 	result := make([]repoResponse, len(repos))
@@ -98,6 +118,7 @@ func (h *RepoHandler) Create(w http.ResponseWriter, r *http.Request) {
 		DefaultBranch string `json:"defaultBranch"`
 		InitReadme    string `json:"initReadme"`    // "none" | "blank" | "tutorial"
 		InitGitignore bool   `json:"initGitignore"` // true → add .gitignore
+		Workspace     string `json:"workspace"`     // optional workspace handle
 	}
 	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
 		jsonError(w, "invalid request body", http.StatusBadRequest)
@@ -112,10 +133,35 @@ func (h *RepoHandler) Create(w http.ResponseWriter, r *http.Request) {
 		branch = "main"
 	}
 
-	diskPath := filepath.Join(h.cfg.RepoRoot, strconv.FormatInt(userID, 10), body.Name+".git")
+	// Determine owner: workspace or user.
+	var workspaceID *int64
+	var diskPath string
+	if body.Workspace != "" {
+		var ws models.Workspace
+		if found, _ := h.db.Where("handle = ?", body.Workspace).Get(&ws); !found {
+			jsonError(w, "workspace not found", http.StatusNotFound)
+			return
+		}
+		// Caller must be a member with write access.
+		var member models.WorkspaceMember
+		if found, _ := h.db.Where("workspace_id = ? AND user_id = ?", ws.ID, userID).Get(&member); !found {
+			jsonError(w, "not a member of this workspace", http.StatusForbidden)
+			return
+		}
+		if member.Role == models.WorkspaceRoleMember {
+			jsonError(w, "admin or owner required to create repos in a workspace", http.StatusForbidden)
+			return
+		}
+		wsID := ws.ID
+		workspaceID = &wsID
+		diskPath = diskPathForWorkspaceRepo(h.cfg.RepoRoot, ws.ID, body.Name)
+	} else {
+		diskPath = filepath.Join(h.cfg.RepoRoot, strconv.FormatInt(userID, 10), body.Name+".git")
+	}
 
 	repo := &models.Repository{
 		OwnerID:       userID,
+		WorkspaceID:   workspaceID,
 		Name:          body.Name,
 		Description:   body.Description,
 		IsPrivate:     body.IsPrivate,
@@ -559,33 +605,48 @@ func (h *RepoHandler) Diff(w http.ResponseWriter, r *http.Request) {
 	jsonOK(w, diffs)
 }
 
-// lookupRepo resolves {owner}/{repo} URL params to a DB row, enforcing access.
+// lookupRepo resolves {owner}/{repo} URL params to a DB row.
+// The owner segment can be either a username (user-owned repo) or a
+// workspace handle (workspace-owned repo).
 func (h *RepoHandler) lookupRepo(w http.ResponseWriter, r *http.Request) (*models.Repository, bool) {
 	ownerName := chi.URLParam(r, "owner")
 	repoName := chi.URLParam(r, "repo")
+	callerID, _ := middleware.UserIDFromContext(r.Context())
 
-	var owner models.User
-	found, err := h.db.Where("username = ?", ownerName).Get(&owner)
-	if err != nil || !found {
-		jsonError(w, "repository not found", http.StatusNotFound)
-		return nil, false
-	}
-
-	var repo models.Repository
-	found, err = h.db.Where("owner_id = ? AND name = ?", owner.ID, repoName).Get(&repo)
-	if err != nil || !found {
-		jsonError(w, "repository not found", http.StatusNotFound)
-		return nil, false
-	}
-
-	// Private repo: only the owner may access (RBAC will be expanded in Phase 3)
-	if repo.IsPrivate {
-		callerID, _ := middleware.UserIDFromContext(r.Context())
-		if callerID != repo.OwnerID {
-			jsonError(w, "repository not found", http.StatusNotFound)
-			return nil, false
+	// 1. Try user namespace first.
+	var user models.User
+	if found, _ := h.db.Where("username = ?", ownerName).Get(&user); found {
+		var repo models.Repository
+		if found2, _ := h.db.Where("owner_id = ? AND name = ? AND workspace_id IS NULL", user.ID, repoName).Get(&repo); found2 {
+			if repo.IsPrivate && callerID != repo.OwnerID {
+				// Check repo membership for private user repos.
+				var m models.RepoMember
+				if mfound, _ := h.db.Where("repo_id = ? AND user_id = ?", repo.ID, callerID).Get(&m); !mfound {
+					jsonError(w, "repository not found", http.StatusNotFound)
+					return nil, false
+				}
+			}
+			return &repo, true
 		}
 	}
 
-	return &repo, true
+	// 2. Try workspace namespace.
+	var ws models.Workspace
+	if found, _ := h.db.Where("handle = ?", ownerName).Get(&ws); found {
+		var repo models.Repository
+		if found2, _ := h.db.Where("workspace_id = ? AND name = ?", ws.ID, repoName).Get(&repo); found2 {
+			if repo.IsPrivate {
+				// Private workspace repo: caller must be a workspace member.
+				var m models.WorkspaceMember
+				if mfound, _ := h.db.Where("workspace_id = ? AND user_id = ?", ws.ID, callerID).Get(&m); !mfound {
+					jsonError(w, "repository not found", http.StatusNotFound)
+					return nil, false
+				}
+			}
+			return &repo, true
+		}
+	}
+
+	jsonError(w, "repository not found", http.StatusNotFound)
+	return nil, false
 }