Restrict workspace settings to admins and add audit history

[maschwenk]

Summary

• enforce admin-only writes for workspace-owned connections, integrations, OAuth clients, and tool policies across cloud and self-hosted hosts
• allow plain members to add and manage Personal connections while rejecting Workspace connection creation server-side, including direct credentials and OAuth
• remove the Personal/Workspace dropdown for members and force every member add flow to Personal; admins retain both choices
• preserve members’ ability to read and execute through existing shared connections
• record successful connection, integration, and OAuth-client lifecycle changes in a tenant-scoped audit log with safe identifiers only
• expose audit history to admins through GET /admin/audit-events and the Users page Activity tab
• add the cloud database migration and audit cleanup during organization deletion

Screenshots

Captured from a locally booted self-hosted Executor instance in Chromium at 1280×800 with seeded admin and member identities.

Member views

Connect link opens the Personal-only flow

No Personal/Workspace selector is rendered.

Workspace-admin navigation is hidden

Direct admin URL is refused

Admin views

Connection ownership selector

Admins retain both Personal and Workspace choices.

Workspace Users directory

Member Personal-connection detail

Audit Activity tab

Validation

• bun run format:check
• bun run lint
• bun run typecheck (44 packages)
• focused SDK, React permission/owner-option, and self-host multi-user tests
• targeted self-host browser E2E proving a member Personal connection succeeds, Workspace creation returns 403, and no scope dropdown is rendered
• targeted cloud browser E2Es for the Users directory, forced-Personal member add flow, multi-org connect-link scoping, and cross-subject catalog convergence
• full GitHub CI: 36/36 required checks passed