Scope workspace roots per account

SovereignAI-Starter/app/main.py

@@ -236,10 +236,15 @@ class WorkspaceAgentRequest(AgentRequest):
 
 
 @app.post("/v1/agent/workspace/files", dependencies=[Depends(get_authenticated_user_id)])
-async def list_workspace_files(request: WorkspaceFilesRequest) -> dict[str, Any]:
+async def list_workspace_files(
+    request: WorkspaceFilesRequest,
+    user_id: str = Depends(get_authenticated_user_id),
+) -> dict[str, Any]:
     """Return bounded relative file names from the folder chosen by the desktop user."""
     try:
-        root = workspace.selected_root(request.workspace_path)
+        root = workspace.selected_root(request.workspace_path, user_id=user_id)
+    except workspace.WorkspaceAccessDenied as exc:
+        raise HTTPException(status_code=403, detail=str(exc)) from exc
     except ValueError as exc:
         raise HTTPException(status_code=422, detail=str(exc)) from exc
     if root is None:
@@ -592,7 +597,9 @@ async def index_workspace_knowledge(
 ) -> dict[str, Any]:
     """Index selected files and optionally add local semantic vectors."""
     try:
-        root = workspace.selected_root(request.workspace_path)
+        root = workspace.selected_root(request.workspace_path, user_id=user_id)
+    except workspace.WorkspaceAccessDenied as exc:
+        raise HTTPException(status_code=403, detail=str(exc)) from exc
     except ValueError as exc:
         raise HTTPException(status_code=422, detail=str(exc)) from exc
     if root is None:
@@ -721,7 +728,9 @@ def delete_workspace_knowledge(
 ) -> dict[str, Any]:
     """Delete selected files from this user's local knowledge index."""
     try:
-        root = workspace.selected_root(request.workspace_path)
+        root = workspace.selected_root(request.workspace_path, user_id=user_id)
+    except workspace.WorkspaceAccessDenied as exc:
+        raise HTTPException(status_code=403, detail=str(exc)) from exc
     except ValueError as exc:
         raise HTTPException(status_code=422, detail=str(exc)) from exc
     if root is None:
@@ -747,7 +756,9 @@ async def search_workspace_knowledge(
     user_id: str = Depends(get_authenticated_user_id),
 ) -> dict[str, Any]:
     try:
-        root = workspace.selected_root(request.workspace_path)
+        root = workspace.selected_root(request.workspace_path, user_id=user_id)
+    except workspace.WorkspaceAccessDenied as exc:
+        raise HTTPException(status_code=403, detail=str(exc)) from exc
     except ValueError as exc:
         raise HTTPException(status_code=422, detail=str(exc)) from exc
     if root is None:
@@ -1453,7 +1464,9 @@ async def _execute_agent(
 
     await report("يتحقق من المهمة ومساحة العمل المحددة.")
     try:
-        selected_workspace = workspace.selected_root(request.workspace_path)
+        selected_workspace = workspace.selected_root(request.workspace_path, user_id=user_id)
+    except workspace.WorkspaceAccessDenied as exc:
+        raise HTTPException(status_code=403, detail=str(exc)) from exc
     except ValueError as exc:
         raise HTTPException(status_code=422, detail=str(exc)) from exc
     selected_skill = skills.get_skill(request.skill_id)