feat: Public community rooms infrastructure (bd-viral-001)#295
feat: Public community rooms infrastructure (bd-viral-001)#295khaliqgant wants to merge 3 commits intomainfrom
Conversation
- Add isPublic field to workspace schema - Create migration for workspace visibility - Update workspace API to support public workspaces - Add admin endpoint to list public workspaces - Update provisioner to set isPublic flag - Add seed script for community workspace setup Infrastructure ready for always-on AI agents deployment (bd-agent-public-001). Implements bd-viral-001 viral growth feature.
🤖 My Senior Dev — Analysis Complete👤 For @khaliqgant📁 Expert in View your contributor analytics → 📊 7 files reviewed • 3 high risk • 3 need attention 🚨 High Risk:
🚀 Open Interactive Review →The full interface unlocks features not available in GitHub:
💬 Chat here: 📖 View all 12 personas & slash commandsYou can interact with me by mentioning In PR comments or on any line of code:
Slash commands:
AI Personas (mention to get their perspective):
For the best experience, view this PR on myseniordev.com — includes AI chat, file annotations, and interactive reviews. |
- Fix chained .where() calls in findPublic() to use and() for proper filtering - Fix incorrect getDb() usage in admin endpoint to use db query object - Resolves security issue where all running workspaces were returned - Resolves runtime error where findAll() didn't exist on raw Drizzle instance
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| import { getDb } from '../packages/cloud/src/db/drizzle.js'; | ||
| import { getProvisioner } from '../packages/cloud/src/provisioner/index.js'; | ||
|
|
||
| async function seedCommunityWorkspace() { | ||
| const config = getConfig(); | ||
| const db = getDb(); |
There was a problem hiding this comment.
🔴 Seed script imports wrong db interface - will crash at runtime
The seed script imports getDb from drizzle.ts and assigns it to db, but then uses it with query namespace methods like db.users.findByGithubUsername() and db.workspaces.findByUserId().
Click to expand
Root Cause
getDb() returns a raw Drizzle database instance (drizzle(getPool(), { schema })), not the db object with query namespaces exported from db/index.ts.
In scripts/seed-community-workspace.ts:19 and scripts/seed-community-workspace.ts:24:
import { getDb } from '../packages/cloud/src/db/drizzle.js';
// ...
const db = getDb();Usage at lines 29, 41, 54:
const systemUser = await db.users.findByGithubUsername('agent-relay');
const existingWorkspaces = await db.workspaces.findByUserId(systemUser.id);
await db.workspaces.update(communityWorkspace.id, { isPublic: true });Actual vs Expected
- Actual:
getDb()returns a Drizzle ORM instance which doesn't have.usersor.workspacesproperties with these query methods. - Expected: Should import
dbfrom../packages/cloud/src/db/index.jswhich exports the object with query namespaces.
Impact
The seed script will crash with a TypeError when trying to access db.users.findByGithubUsername because the property doesn't exist on the Drizzle instance.
Recommendation: Change import to: import { db } from '../packages/cloud/src/db/index.js'; and remove the const db = getDb(); line.
Was this helpful? React with 👍 or 👎 to provide feedback.
| if (workspace.isPublic && workspace.status === 'running') { | ||
| setCachedAccess(userId, workspaceId, { hasAccess: true, accessType: 'public', permission: 'read' }); | ||
| return { hasAccess: true, accessType: 'public', permission: 'read' }; |
There was a problem hiding this comment.
🔴 Cache staleness when public workspace status changes
The checkWorkspaceAccess function caches access results for 5 minutes, but when a workspace's isPublic flag or status changes, the cache is never invalidated.
Click to expand
Root Cause
At packages/cloud/src/api/workspaces.ts:346-348, access is granted based on workspace.isPublic && workspace.status === 'running' and cached:
if (workspace.isPublic && workspace.status === 'running') {
setCachedAccess(userId, workspaceId, { hasAccess: true, accessType: 'public', permission: 'read' });
return { hasAccess: true, accessType: 'public', permission: 'read' };
}The _invalidateCachedAccess function exists at line 51 but is never called anywhere in the codebase when workspace visibility or status changes.
Actual vs Expected
- Actual: If a public workspace is made private or stops running, users may still have cached
hasAccess: truefor up to 5 minutes. Conversely, if a workspace becomes public, users who previously checked access may be denied for up to 5 minutes. - Expected: Cache should be invalidated when
isPublicorstatuschanges.
Impact
- Users could access a workspace that was made private (security issue)
- Users could access a workspace that is no longer running
- Users may be denied access to newly public workspaces
Recommendation: Call _invalidateCachedAccess when workspace visibility or status changes. Since access is cached per user-workspace pair, consider broadcasting cache invalidation when isPublic changes, or reduce the cache TTL for public workspace access checks.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Adds infrastructure for public community workspaces.
Infrastructure ready for always-on AI agents deployment (bd-agent-public-001).
Implements bd-viral-001 viral growth feature.