feat(spaces): app-owned SpacesAPI + /me capability (#216 API) #223

Merged

Cordy merged 5 commits from feat-appspaces-api into main

2026-08-13 16:57:10 +00:00

Cordy commented

2026-08-13 16:56:10 +00:00

Owner

API half of #216. Makes create-space and member management actually work without an IdP client, and gives the UI a capability signal to feature-detect against.

SpacesAPI now dispatches on its backend: Mgr (IdP power mode) or Members *spacestore.Store (app-owned, default). Same routes; create, listMembers, setMember, removeMember, and owner resolution each branch to the configured store. App-owned member JSON is {user, role} — identical shape to the IdP path, so the frontend is unaffected.
main.go: wires the app-owned SpacesAPI (Members: spaceStore) whenever the IdP power mode is off — so apiH.Spaces is non-nil on every instance now (fixes the silent 404 root cause of #209/#210 on the backend side).
GET /me reports "spaces": {"create": …, "manageMembers": …} (true when the spaces API is wired), for the frontend feature-detect (#216 frontend, next).

New spaces_appowned_test.go: httptest coverage of create, set/list/remove members, owner-not-removable (400), non-owner-denied (403), duplicate (409), unknown-space (404).

Frontend feature-detect + error-surfacing follows as the second PR under #216.

API half of #216. Makes create-space and member management actually work without an IdP client, and gives the UI a capability signal to feature-detect against. - **`SpacesAPI` now dispatches on its backend**: `Mgr` (IdP power mode) or `Members *spacestore.Store` (app-owned, default). Same routes; `create`, `listMembers`, `setMember`, `removeMember`, and owner resolution each branch to the configured store. App-owned member JSON is `{user, role}` — identical shape to the IdP path, so the frontend is unaffected. - **`main.go`**: wires the app-owned `SpacesAPI` (`Members: spaceStore`) whenever the IdP power mode is off — so `apiH.Spaces` is non-nil on every instance now (fixes the silent 404 root cause of #209/#210 on the backend side). - **`GET /me`** reports `"spaces": {"create": …, "manageMembers": …}` (true when the spaces API is wired), for the frontend feature-detect (#216 frontend, next). New `spaces_appowned_test.go`: httptest coverage of create, set/list/remove members, owner-not-removable (400), non-owner-denied (403), duplicate (409), unknown-space (404). Frontend feature-detect + error-surfacing follows as the second PR under #216.

Cordy added 5 commits

2026-08-13 16:56:11 +00:00