fix(api): keep workspace member operations in the operations registry and append the CLI user column

Author: waleedlatif1

apps/sim/app/api/v2/workspaces/[workspaceId]/members/[userId]/route.ts

@@ -7,9 +7,9 @@ import { presentWorkspaceMember } from '@/lib/api/server/workspace-presenters'
 import { v2WorkspaceErrorPolicies } from '@/lib/workspaces/api/route-policies'
 import { updateWorkspaceMember } from '@/lib/workspaces/application/manage-permissions'
 import {
-  removeWorkspaceMemberOperation,
+  workspaceMemberOperations,
   workspacePermissionOperations,
-} from '@/lib/workspaces/application/member-operations'
+} from '@/lib/workspaces/application/operations'
 import { removeWorkspaceMember } from '@/lib/workspaces/application/remove-member'
 
 /** PATCH /api/v2/workspaces/[workspaceId]/members/[userId] — Change one member's role. */
@@ -27,7 +27,7 @@ export const PATCH = defineV2JsonRoute({
 /** DELETE /api/v2/workspaces/[workspaceId]/members/[userId] — Remove a member, or leave. */
 export const DELETE = defineV2JsonRoute({
   contract: v2RemoveWorkspaceMemberContract,
-  operation: removeWorkspaceMemberOperation,
+  operation: workspaceMemberOperations.remove,
   auth: v2ApiKeyAuth,
   rateLimit: v2RateLimits.publicApi,
   errorPolicy: v2WorkspaceErrorPolicies.manageWorkspaceMembers,

apps/sim/app/api/workspaces/[id]/permissions/route.ts

@@ -23,7 +23,7 @@ import {
   readWorkspacePermissions,
   updateWorkspacePermissions,
 } from '@/lib/workspaces/application/manage-permissions'
-import { workspacePermissionOperations } from '@/lib/workspaces/application/member-operations'
+import { workspacePermissionOperations } from '@/lib/workspaces/application/operations'
 import { WorkspacePermissionError } from '@/lib/workspaces/permissions/management-store'
 
 function permissionErrorResponse(error: unknown): NextResponse {

apps/sim/app/api/workspaces/members/[id]/route.ts

@@ -11,14 +11,14 @@ import {
   NoWorkspaceAccessError,
 } from '@/lib/core/application/workspace-authorization'
 import { captureServerEvent } from '@/lib/posthog/server'
-import { removeWorkspaceMemberOperation } from '@/lib/workspaces/application/member-operations'
+import { workspaceMemberOperations } from '@/lib/workspaces/application/operations'
 import { removeWorkspaceMember } from '@/lib/workspaces/application/remove-member'
 import { WorkspaceBillingAccountRemovalError } from '@/lib/workspaces/utils'
 
 export const DELETE = defineInternalJsonRoute({
   contract: removeWorkspaceMemberContract,
   auth: internalSessionAuth,
-  operation: removeWorkspaceMemberOperation,
+  operation: workspaceMemberOperations.remove,
   rateLimit: internalRateLimits.none({
     reason: 'Preserve existing workspace member removal policy.',
   }),

apps/sim/lib/api/contracts/v2/openapi/resources.ts

@@ -108,10 +108,10 @@ import { secretOperations } from '@/lib/secrets/application/operations'
 import { skillOperations } from '@/lib/skills/application/operations'
 import { toolExecutionOperations } from '@/lib/tool-execution/application/operations'
 import {
-  removeWorkspaceMemberOperation,
+  workspaceMemberOperations,
+  workspaceOperations,
   workspacePermissionOperations,
-} from '@/lib/workspaces/application/member-operations'
-import { workspaceOperations } from '@/lib/workspaces/application/operations'
+} from '@/lib/workspaces/application/operations'
 
 const BLOCK_SUMMARY_EXAMPLE = {
   id: 'slack',
@@ -795,7 +795,7 @@ const declaredRoutes = [
   defineOpenApiRoute(
     v2RemoveWorkspaceMemberContract,
     resourceOperation('Workspaces', {
-      applicationOperation: removeWorkspaceMemberOperation,
+      applicationOperation: workspaceMemberOperations.remove,
       operationId: 'removeWorkspaceMember',
       summary: 'Remove workspace member',
       description: `Remove a member’s workspace access, or leave the workspace by naming yourself. Removing someone else requires workspace Admin access; any member may leave. The last Admin cannot leave, organization Admins hold access through their organization role and cannot be removed here, and the workspace billing account cannot be removed until billing is reassigned. Removing the workspace owner transfers ownership to the billing account. When this was the member’s last workspace in its organization, their organization membership and seat are removed too and all of their sessions end, since this endpoint is called with an API key or OAuth token rather than from a signed-in browser session. ${WORKSPACE_API_KEY_DENIED}`,

apps/sim/lib/workspaces/application/manage-permissions.ts

@@ -6,7 +6,7 @@ import { defineAuthorizedWorkspaceUseCase, ForbiddenOperationError } from '@/lib
 import { OrchestrationError, type OrchestrationErrorCode } from '@/lib/core/orchestration/types'
 import { HttpError } from '@/lib/core/utils/http-error'
 import { resolveActiveWorkspaceApplicationContext } from '@/lib/workspaces/application/context'
-import { workspacePermissionOperations } from '@/lib/workspaces/application/member-operations'
+import { workspacePermissionOperations } from '@/lib/workspaces/application/operations'
 import {
   type WorkspacePermissionUpdate,
   workspacePermissionUpdatesSchema,

apps/sim/lib/workspaces/application/member-operations.ts

@@ -39,3 +39,41 @@ export const workspaceOperations = {
     delegatedServices: ['copilot'],
   }),
 } as const
+
+export const workspacePermissionOperations = {
+  /** permission-group-exempt: the roster describes the workspace the caller belongs to. */
+  read: defineWorkspaceOperation({
+    id: 'workspaces.permissions.read',
+    minimumRole: 'read',
+    workspaceApiKey: 'deny',
+    principalKinds: ['session', 'delegated'],
+    delegatedServices: ['copilot'],
+    capability: 'none',
+    contentDelivery: 'none',
+  }),
+  /** permission-group-exempt: workspace administrators manage existing collaborator roles. */
+  update: defineWorkspaceOperation({
+    id: 'workspaces.permissions.update',
+    minimumRole: 'admin',
+    workspaceApiKey: 'deny',
+    oauthScope: 'api:write',
+    principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'delegated'],
+    delegatedServices: ['copilot'],
+    capability: 'none',
+    contentDelivery: 'none',
+  }),
+} as const
+
+export const workspaceMemberOperations = {
+  /** permission-group-exempt: members may leave; workspace administrators may remove existing collaborators. */
+  remove: defineWorkspaceOperation({
+    id: 'workspaces.members.remove',
+    minimumRole: 'read',
+    workspaceApiKey: 'deny',
+    capability: 'none',
+    contentDelivery: 'none',
+    oauthScope: 'api:write',
+    principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'delegated'],
+    delegatedServices: ['copilot'],
+  }),
+} as const

apps/sim/lib/workspaces/application/operations.ts

@@ -3,7 +3,7 @@ import { requirePrincipalSubjectUserId } from '@sim/auth/principal'
 import { defineAuthorizedWorkspaceUseCase, requireCurrentHumanRole } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { resolveActiveWorkspaceApplicationContext } from '@/lib/workspaces/application/context'
-import { removeWorkspaceMemberOperation } from '@/lib/workspaces/application/member-operations'
+import { workspaceMemberOperations } from '@/lib/workspaces/application/operations'
 import { removeWorkspaceMemberRecord } from '@/lib/workspaces/permissions/member-removal-store'
 
 export interface RemoveWorkspaceMemberInput {
@@ -12,7 +12,7 @@ export interface RemoveWorkspaceMemberInput {
 }
 
 export const removeWorkspaceMember = defineAuthorizedWorkspaceUseCase({
-  operation: removeWorkspaceMemberOperation,
+  operation: workspaceMemberOperations.remove,
   resolveContext: ({ input }: { input: RemoveWorkspaceMemberInput }) =>
     resolveActiveWorkspaceApplicationContext(input.workspaceId),
   authorizationOptions: { delegation: { audience: 'sim:settings', isWithinScope: () => true } },

apps/sim/lib/workspaces/application/remove-member.ts

@@ -1525,14 +1525,15 @@ export const CLI_CONTRACT: CliContract = {
     describe: 'List workspace members',
     profileWorkspacePath: true,
     // `members update` and `members remove` take the user id, and the listing
-    // is where a caller finds it.
+    // is where a caller finds it. Appended last so the shipped text columns keep
+    // their positions for scripts that read them by field.
     columns: [
-      { header: 'user', path: 'userId' },
       { header: 'email' },
       { header: 'name' },
       { header: 'role' },
       { header: 'external', path: 'isExternal', format: 'bool' },
       { header: 'joined', path: 'joinedAt', format: 'timestamp' },
+      { header: 'user', path: 'userId' },
     ],
   },
   updateWorkspaceMember: {