feat: add workspace permission controls and live access recovery

.eslintignore.web

@@ -13,6 +13,8 @@ playwright/
 playwright.config.ts
 playwright.integrations.config.ts
 playwright.bdd.config.ts
+playwright.permissions.config.ts
+playwright.permission-gallery.config.ts
 playwright-snapshot.config.ts
 deploy/*.test.ts
 deploy/*.integration.test.ts

playwright.permission-gallery.config.ts

@@ -0,0 +1,42 @@
+import { defineConfig, devices } from '@playwright/test';
+
+import { galleryLaunchOptions } from './playwright/support/permission-gallery-browser';
+
+/**
+ * Opt-in screenshot gallery and videos of the workspace permission UI (Web PR #621). Both seed a
+ * synthetic "Demo" workspace through the APIs of an isolated loopback stack; see
+ * playwright/e2e/app/permission-gallery.capture.spec.ts for the required variables, and
+ * permission-videos.capture.spec.ts for the videos (which also need APPFLOWY_PERMISSION_VIDEOS=1).
+ */
+export default defineConfig({
+  testDir: './playwright/e2e/app',
+  testMatch: ['permission-gallery.capture.spec.ts', 'permission-videos.capture.spec.ts'],
+  fullyParallel: false,
+  workers: 1,
+  retries: 0,
+  forbidOnly: !!process.env.CI,
+  timeout: 300000,
+  reporter: 'list',
+  outputDir: process.env.APPFLOWY_GALLERY_RESULTS_DIR ?? `test-results/permission-gallery-${Date.now()}`,
+  use: {
+    baseURL: process.env.BASE_URL,
+    viewport: { width: 1440, height: 900 },
+    deviceScaleFactor: 1,
+    trace: 'off',
+    video: 'off',
+    screenshot: 'only-on-failure',
+    actionTimeout: 15000,
+    navigationTimeout: 60000,
+  },
+  projects: [{
+    name: 'chromium',
+    use: {
+      ...devices['Desktop Chrome'],
+      viewport: { width: 1440, height: 900 },
+      deviceScaleFactor: 1,
+      // The gallery's Chromium and flags, shared with the video spec (see the helper).
+      launchOptions: galleryLaunchOptions(),
+    },
+  }],
+  expect: { timeout: 30000 },
+});

playwright.permissions.config.ts

@@ -0,0 +1,35 @@
+import { defineConfig, devices } from '@playwright/test';
+
+// Explicit opt-in fixture; no setup, seeding, server start, or .env mutation.
+export default defineConfig({
+  testDir: './playwright/e2e/app',
+  testMatch: ['space-group-permission-lifecycle.spec.ts', 'space-group-permission-boundaries.spec.ts'],
+  fullyParallel: false,
+  workers: 1,
+  retries: 0,
+  forbidOnly: !!process.env.CI,
+  timeout: 240000,
+  reporter: 'list',
+  outputDir: process.env.APPFLOWY_PERMISSION_OUTPUT_DIR ?? `test-results/permissions-${Date.now()}`,
+  use: {
+    baseURL: process.env.BASE_URL,
+    viewport: { width: 1440, height: 900 },
+    trace: 'off',
+    video: 'off',
+    screenshot: 'only-on-failure',
+    actionTimeout: 15000,
+    navigationTimeout: 60000,
+  },
+  projects: [{
+    name: 'chromium',
+    use: {
+      ...devices['Desktop Chrome'],
+      viewport: { width: 1440, height: 900 },
+      launchOptions: {
+        executablePath: process.env.APPFLOWY_TEST_CHROMIUM_EXECUTABLE,
+        args: ['--no-sandbox', '--disable-dev-shm-usage'],
+      },
+    },
+  }],
+  expect: { timeout: 30000 },
+});

playwright/bdd/evidence/space-group-permission-lifecycle/validation.json

@@ -0,0 +1,63 @@
+{
+  "date": "2026-10-12",
+  "scope": "Web workspace permission implementation draft PR",
+  "checks": {
+    "affected_jest_suites": {
+      "status": "passed; 1021 tests, 70 suites",
+      "local_log": "pr1367-web-pr-tests.log",
+      "log_sha256": "abe44d7c28e058861a5d7f393ef4645e6fb3a2e78e1ea22a454f6b3eadc4611c"
+    },
+    "lint_only_followup": {
+      "status": "passed; 38 tests, 3 suites",
+      "local_log": "pr1367-web-pr-lintfix-tests.log",
+      "log_sha256": "ba80f1ca7025cc8ec1ae4a454d9cf39df139a295f70fcd2918bca3a5380ca37c"
+    },
+    "production_types": {
+      "status": "passed",
+      "local_log": "pr1367-web-pr-typecheck.log",
+      "log_sha256": "1314ed95803fcc4bbe81fb7906f3f2aa87b0c2e6d713dbf2c113bf2aefa372fa"
+    },
+    "permission_harness_types": {
+      "status": "passed",
+      "local_log": "pr1367-web-pr-playwright-tsc.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "python_guards": {
+      "status": "passed; 10 tests",
+      "local_log": "pr1367-web-pr-python-guards.log",
+      "log_sha256": "45629e08d8c41ba474e149425cf4477b6ed2d14afbd48b41a5dea35ddb36ae32"
+    },
+    "offline_browser_guards": {
+      "status": "passed; 4 tests",
+      "local_log": "pr1367-web-pr-boundaries.log",
+      "log_sha256": "9e0fd43a777d43163ab3d03363181185817910f4e13224d8ee0fbd7da1ace814"
+    },
+    "indexeddb_browser": {
+      "status": "passed; real Chromium and IndexedDB",
+      "local_log": "pr1367-web-pr-indexeddb.log",
+      "log_sha256": "b8f897e6c1689479af8c4f0637ab163f31fb07e9d520e127c59ff9b2ba3faefc"
+    },
+    "bdd_generation": {
+      "status": "passed; generation only",
+      "local_log": "pr1367-web-pr-bddgen.log",
+      "log_sha256": "bff5996bd1af4ba577930723a705fb379013de8d3e4cc41b63c619375717dfca"
+    },
+    "fresh_captures": {
+      "status": "passed; 5 screenshots",
+      "local_log": "pr1367-web-pr-capture-final2.log",
+      "log_sha256": "703404bf95e72f174671f244e687d1dd49b94986d7d0904eeeaeb5b8e09ff4f7"
+    },
+    "full_application_lint": {
+      "status": "passed; pnpm lint (production TypeScript and complete application ESLint)",
+      "local_log": "pr1367-web-pr-full-lint-final.log",
+      "log_sha256": "c483c36c55a8dff072344ae418f3ffff7d78f6b37eb386082770be0f95f5b49e"
+    }
+  },
+  "limits": [
+    "Affected Jest suites only, not the entire repository Jest suite.",
+    "Full connected lifecycle was not rerun against final four Rust review fixes; previous 44-check result stays separately qualified.",
+    "Fresh captures are read-only and unsaved coverage drafts.",
+    "No cross-browser, packaged Desktop, external provider, AI search or deployment acceptance claim."
+  ],
+  "followup": "Three test files received type/lint-only cleanup after the 1021-test run; all 38 tests in those suites were rerun and passed. Production code did not change. The standalone Playwright config uses the same application-lint exclusion as its sibling configs and passes its separate TypeScript project. One extra EOF blank line in a new file was removed."
+}

playwright/bdd/features/workspace/space-custom-permissions.feature

@@ -227,16 +227,16 @@ Feature: Seeded Public, Private and Custom space permissions
     And the Manage Space members list shows seeded scp0822 "outsider" as "Space member" with the subtitle "Workspace member"
 
   # (j) PRD §17/§39 Custom General: both collective dropdowns offer all five access levels and
-  # Can view and comment applies like any other level.
+  # Can comment applies like any other level.
   Scenario: The collective dropdowns offer every access level including comment-only
     Given I sign in as seeded scp0822 "owner"
     When I open the seeded scp0822 "custom space" manage space panel
     Then the Custom permissions "space members" dropdown offers every access level
     And the Custom permissions "everyone else" dropdown offers every access level
-    When I set the Custom permissions space members level to "Can view and comment"
-    Then the seeded scp0822 "custom space" members level is "Can view and comment" via the API
+    When I set the Custom permissions space members level to "Can comment"
+    Then the seeded scp0822 "custom space" members level is "Can comment" via the API
     When I open the seeded scp0822 "custom space" manage space panel
-    Then the Custom permissions card shows Space members "Can view and comment" and everyone else "Can view"
+    Then the Custom permissions card shows Space members "Can comment" and everyone else "Can view"
     When I sign in as seeded scp0822 "member"
     And I directly open the seeded scp0822 "custom page"
     Then the directly opened seeded scp0822 page is "read-only"

playwright/bdd/features/workspace/space-group-permission-resolution.feature

@@ -38,7 +38,7 @@ Feature: Seeded space group permission resolution
     When I directly open the seeded stg0822 "group page B"
     Then the directly opened seeded stg0822 page is "denied"
 
-  # The Manage Space members tab renders the group's role; its access level is verified via API.
+  # The Manage Space members tab renders the group's role and tri-state override selector.
   Scenario: Owner sees the group as a space member and the page-level group share
     Given I sign in as seeded stg0822 "owner"
     When I open the seeded stg0822 "group space A" manage space members tab
@@ -47,7 +47,7 @@ Feature: Seeded space group permission resolution
     And I open the share panel
     Then the share panel shows seeded stg0822 "group two" with "Can edit"
 
-  # Mutating: the After hook always restores group One to Member / Can view via API.
+  # Mutating: the After hook restores the exact prior role and override, including inherited null.
   Scenario: Owner-role group makes its members space owners
     Given I sign in as seeded stg0822 "owner"
     When I open the seeded stg0822 "group space A" manage space members tab
@@ -61,7 +61,7 @@ Feature: Seeded space group permission resolution
   # Live refresh: the owner mutates group membership over the API while nathan's browser
   # session stays on Page A. The server pushes a permission-changed notification and the
   # open page downgrades, then upgrades again, without any reload or navigation.
-  # Mutating: the After hook re-adds every seeded group membership via API.
+  # Mutating: the After hook restores the exact prior seeded memberships via API.
   @live-refresh
   Scenario: Removing a member from the page-share group downgrades the open page live
     Given I sign in as seeded stg0822 "nathan"
@@ -74,7 +74,7 @@ Feature: Seeded space group permission resolution
 
   # Live refresh: revoking group One's space grant must deny the open page and drop the
   # restricted Custom space from the sidebar in place; re-granting it restores both.
-  # Mutating: the After hook always restores group One to Member / Can view via API.
+  # Mutating: the After hook restores the exact prior role and override, including inherited null.
   @live-refresh
   Scenario: Removing the group from the space hides it live and restores it
     Given I sign in as seeded stg0822 "reader"
@@ -89,11 +89,11 @@ Feature: Seeded space group permission resolution
     Then the seeded stg0822 "group space A" space navigation becomes "visible" without reload
     And the open seeded stg0822 page becomes "read-only" without reload
 
-  # Custom Member principals share one collective access level; an individual group cannot carry
-  # a different level. Changing that collective level re-probes the open page in place.
-  # Mutating: the After hook restores the Custom member level to Can view via API.
+  # The baseline group explicitly inherits (access_level_override: null). Changing the
+  # collective default updates inherited assignments; explicit overrides remain independent.
+  # Mutating: the After hook restores the exact prior default and assignment via API.
   @live-refresh
-  Scenario: Changing Custom space member access updates an open page live
+  Scenario: An inherited group assignment follows Custom space member access live
     Given I sign in as seeded stg0822 "reader"
     When I directly open the seeded stg0822 "group page B"
     Then the directly opened seeded stg0822 page is "read-only"

playwright/bdd/steps/space-custom-permissions.steps.ts

@@ -820,7 +820,7 @@
   const modal = manageSpaceModal(page);
 
   await expect(modal).toBeVisible({ timeout: 15000 });
   await expect(modal.getByText('Manage Space', { exact: true })).toBeVisible({ timeout: 15000 });
   // The space access cards enable once the structured settings have loaded.
   await expect(modal.getByTestId('manage-space-visibility-option-public')).toBeEnabled({ timeout: 15000 });
 }
@@ -1328,7 +1328,7 @@
       return null;
     case 'Can view':
       return ACCESS_LEVEL_READ_ONLY;
-    case 'Can view and comment':
+    case 'Can comment':
       return ACCESS_LEVEL_READ_AND_COMMENT;
     case 'Can edit':
       return ACCESS_LEVEL_READ_AND_WRITE;
@@ -1368,7 +1368,7 @@
   const expected: Array<[string, string]> = [
     [`${triggerTestId}-option-${ACCESS_LEVEL_FULL_ACCESS}`, 'Full access'],
     [`${triggerTestId}-option-${ACCESS_LEVEL_READ_AND_WRITE}`, 'Can edit'],
-    [`${triggerTestId}-option-${ACCESS_LEVEL_READ_AND_COMMENT}`, 'Can view and comment'],
+    [`${triggerTestId}-option-${ACCESS_LEVEL_READ_AND_COMMENT}`, 'Can comment'],
     [`${triggerTestId}-option-${ACCESS_LEVEL_READ_ONLY}`, 'Can view'],
     [`${triggerTestId}-option-none`, 'No access'],
   ];