fix: scope actionable users to workspaces

Author: stefan-ernst

frontend/src/lib/editors/MilkdownEditor.svelte

@@ -812,6 +812,7 @@
   bind:open={mentionPickerOpen}
   query={mentionQuery}
   position={mentionPosition}
+  {workspaceId}
   {isPersonalWorkspace}
   onSelect={handleMentionSelect}
   onCancel={handleMentionCancel}

frontend/src/lib/features/items/Comments.svelte

@@ -26,7 +26,7 @@
 	// Get shortcut configuration (use same as description save)
 	const submitShortcut = getShortcut('description', 'save');
 
-	let { itemId, isPersonalWorkspace = false, isPortalRequest = false, enableInternalComments = false, onCommentsLoaded } = $props();
+	let { itemId, workspaceId = null, isPersonalWorkspace = false, isPortalRequest = false, enableInternalComments = false, onCommentsLoaded } = $props();
 
 	let comments = $state([]);
 	let newCommentContent = $state('');
@@ -537,6 +537,7 @@
 									showToolbar={true}
 									compact={true}
 									{itemId}
+									{workspaceId}
 									{isPersonalWorkspace}
 								/>
 								<div class="flex items-center justify-between mt-3">
@@ -605,6 +606,7 @@
 						compact={true}
 						testId="comment-composer"
 						{itemId}
+						{workspaceId}
 						{isPersonalWorkspace}
 					/>
 				</div>

frontend/src/lib/features/items/ItemDetailDescription.svelte

@@ -155,6 +155,7 @@
         placeholder={t('items.enterDescription')}
         showToolbar={true}
         itemId={item.id}
+        workspaceId={item.workspace_id}
         onImageInsert={handleImageInsert}
       />
       <div class="flex items-center gap-2">

frontend/src/lib/features/items/ItemDetailTabs.svelte

@@ -367,7 +367,7 @@
     <!-- Tab Content -->
     <div class="pt-6">
       {#if tab === 'comments'}
-        <Comments itemId={item.id} isPersonalWorkspace={workspace?.is_personal} isPortalRequest={!!item.request_type_id} enableInternalComments={workspace?.internal_comments_enabled} onCommentsLoaded={handleCommentsLoaded} />
+        <Comments itemId={item.id} workspaceId={item.workspace_id} isPersonalWorkspace={workspace?.is_personal} isPortalRequest={!!item.request_type_id} enableInternalComments={workspace?.internal_comments_enabled} onCommentsLoaded={handleCommentsLoaded} />
       {:else if tab === 'details'}
         <div class="grid gap-8" data-testid="item-details-overview">
           <section class="overflow-hidden rounded-xl border border-[var(--ds-border)] bg-[var(--ds-surface-raised)]" aria-label={t('items.healthOverview')}>

frontend/src/lib/features/personal/PersonalTaskDetail.svelte

@@ -457,7 +457,7 @@
           {/if}
         </div>
       </div>
-      <Comments itemId={item.id} isPersonalWorkspace={true} onCommentsLoaded={handleCommentsLoaded} />
+      <Comments itemId={item.id} workspaceId={item.workspace_id} isPersonalWorkspace={true} onCommentsLoaded={handleCommentsLoaded} />
     </div>
   {/if}
 {/snippet}

frontend/src/lib/mobile/MobileItemDetail.svelte

@@ -584,7 +584,7 @@
     <!-- Comments. Keyed on itemId so it reloads when navigating item → item. -->
     <section class="comments">
       {#key itemId}
-        <Comments {itemId} onCommentsLoaded={() => {}} />
+        <Comments {itemId} workspaceId={item.workspace_id} onCommentsLoaded={() => {}} />
       {/key}
     </section>
   </div>

frontend/src/lib/pickers/MentionPicker.svelte

@@ -15,6 +15,7 @@
     query = '',
     position = { x: 0, y: 0 },
     open = $bindable(false),
+    workspaceId = null,
     isPersonalWorkspace = false,
     onSelect = null,
     onCancel = null
@@ -23,6 +24,8 @@
   // State
   let users = $state([]);
   let loading = $state(false);
+  let loadedWorkspaceId = $state(undefined);
+  let loadRequest = 0;
   let highlightedIndex = $state(0);
   let containerElement = $state(null);
   // Measured menu size, used to keep the picker fully on-screen.
@@ -31,10 +34,11 @@
 
   // Editors keep the picker mounted while it is closed. Defer the user
   // catalog until somebody actually types an @ mention; pages with several
-  // editors otherwise issue one identical /users request per editor.
+  // editors otherwise issue one identical roster request per editor.
   $effect(() => {
     const shouldLoad = open;
-    if (shouldLoad) untrack(() => void loadUsers());
+    const requestedWorkspaceId = workspaceId;
+    if (shouldLoad) untrack(() => void loadUsers(requestedWorkspaceId));
   });
 
   // Re-measure after result changes so the transient menu clamp stays accurate.
@@ -82,17 +86,29 @@
     { capture: true }
   );
 
-  async function loadUsers() {
-    if (loading || users.length > 0) return;
+  async function loadUsers(requestedWorkspaceId) {
+    const scopedWorkspaceId = requestedWorkspaceId || null;
+    if (users.length > 0 && loadedWorkspaceId === scopedWorkspaceId) return;
+
+    const request = ++loadRequest;
     try {
       loading = true;
-      users = await api.getUsers() || [];
+      const roster = scopedWorkspaceId
+        ? await api.getAssignableUsers(scopedWorkspaceId)
+        : await api.getUsers();
+      if (request !== loadRequest) return;
+
+      // The backend roster is shared with assignment and already enforces
+      // workspace access plus ready agent bindings.
+      users = roster || [];
+      loadedWorkspaceId = scopedWorkspaceId;
     } catch (err) {
+      if (request !== loadRequest) return;
       if (err?.name === 'AbortError') return;
       console.error('Failed to load users:', err);
       users = [];
     } finally {
-      loading = false;
+      if (request === loadRequest) loading = false;
     }
   }
 

internal/handlers/users.go

@@ -7,7 +7,6 @@ import (
 	"log/slog"
 	"math/big"
 	"net/http"
-	"strconv"
 
 	"windshift/internal/logger"
 	"windshift/internal/models"
@@ -28,13 +27,12 @@ type UserHandler struct {
 	offboardUser       func(id int) error
 	deactivateCascade  func(id int) (services.AgentDeactivationResult, error)
 	invalidateSessions func(id int)
-	agentPresence      *services.AgentPresenceService // optional; nil when the agent harness is off
+	workspaceUsers     *services.WorkspaceUserResolver
 }
 
-// SetAgentPresenceService wires the optional presence resolver used to
-// decorate agent users in the assignable-users response (WI-272).
-func (h *UserHandler) SetAgentPresenceService(s *services.AgentPresenceService) {
-	h.agentPresence = s
+// SetWorkspaceUserResolver wires the shared picker and validation roster.
+func (h *UserHandler) SetWorkspaceUserResolver(resolver *services.WorkspaceUserResolver) {
+	h.workspaceUsers = resolver
 }
 
 func (h *UserHandler) invalidateUserSessions(userID int) {
@@ -770,44 +768,34 @@ func (h *UserHandler) ResetPassword(w http.ResponseWriter, r *http.Request) {
 	respondJSONOK(w, response)
 }
 
-// GetAssignable returns only active users with limited fields for assignment
-// pickers. Agent users are decorated with a workspace-scoped presence signal
-// (online/offline/local/unbound, WI-272) so assigners can see whether
-// assigning to the agent would actually start a run.
+// GetAssignable returns the shared mention and assignment roster. Every user
+// can view the workspace; agents also have a ready binding there.
 func (h *UserHandler) GetAssignable(w http.ResponseWriter, r *http.Request) {
-	if _, ok := RequireAuth(w, r); !ok {
+	currentUser, ok := RequireAuth(w, r)
+	if !ok {
 		return
 	}
-
-	users, err := h.userSvc.ListAll()
+	workspaceID, ok := requireIDParam(w, r, "workspaceId")
+	if !ok {
+		return
+	}
+	canView, err := h.permissionService.HasWorkspacePermission(currentUser.ID, workspaceID, models.PermissionItemView)
 	if err != nil {
 		respondInternalError(w, r, err)
 		return
 	}
-
-	// Presence enrichment is best-effort: a resolver failure degrades to
-	// undecorated users, never a failed picker.
-	var presence map[int]string
-	if h.agentPresence != nil {
-		if workspaceID, err := strconv.Atoi(r.PathValue("workspaceId")); err == nil && workspaceID > 0 {
-			if presence, err = h.agentPresence.ForWorkspace(r.Context(), workspaceID); err != nil {
-				slog.Warn("assignable users: resolve agent presence", "workspace_id", workspaceID, "error", err)
-				presence = nil
-			}
-		}
+	if !canView {
+		respondNotFound(w, r, "workspace")
+		return
 	}
-
-	for i := range users {
-		users[i].Email = ""
-		users[i].Timezone = ""
-		users[i].Language = ""
-		if users[i].IsAgent && presence != nil {
-			if p, ok := presence[users[i].ID]; ok {
-				users[i].AgentPresence = p
-			} else {
-				users[i].AgentPresence = services.AgentPresenceUnbound
-			}
-		}
+	if h.workspaceUsers == nil {
+		respondInternalError(w, r, errors.New("workspace user resolver is not configured"))
+		return
+	}
+	users, err := h.workspaceUsers.List(r.Context(), workspaceID)
+	if err != nil {
+		respondInternalError(w, r, err)
+		return
 	}
 
 	respondJSONOK(w, users)

internal/handlers/workspace_bootstrap.go

@@ -191,32 +191,10 @@ func emptyHomepageLayout() models.WorkspaceHomepageLayout {
 }
 
 func (h *WorkspaceBootstrapHandler) listAssignableUsers(ctx context.Context, workspaceID int) ([]models.User, error) {
-	users, err := h.users.userSvc.ListAll()
-	if err != nil {
-		return nil, err
-	}
-
-	var presence map[int]string
-	if h.users.agentPresence != nil {
-		presence, err = h.users.agentPresence.ForWorkspace(ctx, workspaceID)
-		if err != nil {
-			slog.Warn("workspace bootstrap: resolve agent presence", "workspace_id", workspaceID, "error", err)
-			presence = nil
-		}
-	}
-	for i := range users {
-		users[i].Email = ""
-		users[i].Timezone = ""
-		users[i].Language = ""
-		if users[i].IsAgent && presence != nil {
-			if value, ok := presence[users[i].ID]; ok {
-				users[i].AgentPresence = value
-			} else {
-				users[i].AgentPresence = services.AgentPresenceUnbound
-			}
-		}
+	if h.users.workspaceUsers == nil {
+		return nil, errors.New("workspace user resolver is not configured")
 	}
-	return users, nil
+	return h.users.workspaceUsers.List(ctx, workspaceID)
 }
 
 func (h *WorkspaceBootstrapHandler) listMilestones(userID, workspaceID int) ([]models.Milestone, error) {

internal/models/user.go

@@ -42,8 +42,8 @@ type User struct {
 	AgentProvenance string `json:"agent_provenance,omitempty"`
 	OAuthClientID   *int   `json:"oauth_client_id,omitempty"`
 	// AgentPresence is a transient, workspace-scoped availability signal for
-	// assignment pickers (WI-272): online | offline | local | unbound. Never
-	// persisted; populated only by the assignable-users endpoint.
+	// actionable-user pickers (WI-272): online | offline | local. Unbound agents
+	// are omitted from workspace rosters.
 	AgentPresence string `json:"agent_presence,omitempty"`
 }