Address review: allow revocation, cover the guards, redraw on team change

- `SetLinkPermissions` only guards grants. `None` revokes link access, and
  blocking it left a user unable to tighten an over-shared object in exactly
  the race the guard exists for.
- Cover the guards themselves. `UpdateManager` marks an object as having a
  pending permissions change synchronously, before it issues any request, so
  the new tests can assert whether a dispatch reached the target.
- Subscribe to `UserWorkspaces`: nothing else re-rendered the dialog on a team
  change, so the invite form and link row stayed on screen under the old
  team's policy while the guards refused to act on them.
- Rename the unresolvable-window test, which named the teamless case but tests
  a window `UserWorkspaces` never saw, and correct the two docs that said an
  unresolved team denies when only an unresolvable window does.

Author: warp-agent-staging[bot]

app/src/drive/sharing/dialog/mod.rs

@@ -60,7 +60,7 @@ use crate::word_block_editor::{
     WordBlockStyles,
 };
 use crate::workspace::{ToastStack, WorkspaceAction};
-use crate::workspaces::user_workspaces::{TeamContext, UserWorkspaces};
+use crate::workspaces::user_workspaces::{TeamContext, UserWorkspaces, UserWorkspacesEvent};
 use crate::{TelemetryEvent, send_telemetry_from_ctx};
 
 mod inheritance;
@@ -262,6 +262,10 @@ impl SharingDialog {
             },
         );
 
+        ctx.subscribe_to_model(&UserWorkspaces::handle(ctx), |me, _, event, ctx| {
+            me.handle_user_workspaces_event(event, ctx);
+        });
+
         let invite_form = EmailInviteForm {
             email_editor: ctx.add_typed_action_view(|ctx| {
                 let mut view = WordBlockEditorView::new(
@@ -302,6 +306,26 @@ impl SharingDialog {
         }
     }
 
+    /// The link-sharing controls are drawn from this window's team policy, so a team change has
+    /// to redraw: the invite form and the link-sharing row appear and disappear with it, and a
+    /// control left on screen under the old team's policy is one the action guards now refuse.
+    fn handle_user_workspaces_event(
+        &mut self,
+        event: &UserWorkspacesEvent,
+        ctx: &mut ViewContext<Self>,
+    ) {
+        let changes_this_windows_policy = match event {
+            UserWorkspacesEvent::TeamsChanged => true,
+            UserWorkspacesEvent::WindowTeamChanged { window_id } => *window_id == ctx.window_id(),
+            // Everything else this model emits is workspace administration, which does not
+            // change which team this window shares as.
+            _ => false,
+        };
+        if changes_this_windows_policy {
+            ctx.notify();
+        }
+    }
+
     fn handle_update_manager_event(
         &mut self,
         event: &UpdateManagerEvent,
@@ -478,23 +502,27 @@ impl SharingDialog {
     /// The team this dialog's window is sharing as, resolved afresh on every read so a window
     /// that moves to another team is never governed by the team it opened with.
     ///
-    /// `None` when the dialog's window cannot be located, which for a live dialog means its
-    /// window is gone: `RootView::new` registers every window as it is created.
+    /// `None` only when no scope can be resolved at all: this view is no longer in a window,
+    /// its window was never registered with `UserWorkspaces`, or its window names a team that
+    /// has since left the current workspace. A window that simply *has* no team is a different
+    /// thing — it resolves a scope, whose `team_uid()` is then `None`.
     fn team_scope<'a>(&self, app: &'a AppContext) -> Option<TeamContext<'a>> {
         UserWorkspaces::as_ref(app).team_context(&self.self_handle, app)
     }
 
     /// Whether this window's team permits sharing the target with anyone who holds its link.
-    /// A window whose team cannot be resolved denies: offering a sharing channel whose
-    /// governing policy is unknown is the unsafe direction to guess in.
+    ///
+    /// A window with no team permits it, per `TeamScope`'s contract. Only a window with no
+    /// resolvable scope denies, because offering a sharing channel when we cannot say which
+    /// policy governs it is the unsafe direction to guess in.
     fn can_anyone_with_link_share(&self, app: &AppContext) -> bool {
         self.team_scope(app).is_some_and(|scope| {
             UserWorkspaces::as_ref(app).is_anyone_with_link_sharing_enabled(&scope)
         })
     }
 
     /// Whether this window's team permits sharing the target directly with named people. See
-    /// [`Self::can_anyone_with_link_share`] for why an unresolvable team denies.
+    /// [`Self::can_anyone_with_link_share`] for what an unresolvable scope means.
     fn can_direct_link_share(&self, app: &AppContext) -> bool {
         self.team_scope(app)
             .is_some_and(|scope| UserWorkspaces::as_ref(app).is_direct_link_sharing_enabled(&scope))
@@ -1634,8 +1662,10 @@ impl SharingDialog {
     fn send_invitations(&mut self, ctx: &mut ViewContext<Self>) {
         // Re-read the policy instead of trusting the render that put the form on screen: an
         // open dialog whose window moved to a team that forbids direct sharing must not send
-        // the invitations that team now disallows.
+        // the invitations that team now disallows. Redraw on the way out so the form the user
+        // just submitted disappears rather than sitting there as a dead control.
         if !self.can_direct_link_share(ctx) {
+            ctx.notify();
             return;
         }
 
@@ -2956,8 +2986,10 @@ impl TypedActionView for SharingDialog {
                 self.set_open_menu(OpenMenuState::None, ctx);
                 // The menu's items were built when it opened. Re-read the policy so a window
                 // that has since moved to a team forbidding link sharing cannot act on the
-                // permission it was offered under the old one.
-                if !self.can_anyone_with_link_share(ctx) {
+                // permission it was offered under the old one. Only granting is blocked:
+                // `None` revokes link access, and a user tightening an over-shared object must
+                // not be turned away by the very policy that wants it tightened.
+                if access_level.is_some() && !self.can_anyone_with_link_share(ctx) {
                     ctx.notify();
                     return;
                 }

app/src/drive/sharing/dialog/mod_tests.rs

@@ -1,16 +1,22 @@
 use chrono::Local;
 use session_sharing_protocol::common::SessionId;
-use warpui::{App, SingletonEntity, ViewHandle};
-
-use super::{SharingDialog, SharingDialogMode};
-use crate::drive::sharing::ShareableObject;
+use warpui::{App, SingletonEntity, TypedActionView, ViewHandle};
+
+use super::{SharingDialog, SharingDialogAction, SharingDialogMode};
+use crate::auth::UserUid;
+use crate::cloud_object::model::persistence::CloudModel;
+use crate::cloud_object::{CloudObject, Owner};
+use crate::drive::sharing::{ShareableObject, SharingAccessLevel};
+use crate::server::ids::{ClientId, ServerId, SyncId};
 use crate::terminal::TerminalView;
 use crate::terminal::shared_session::manager::Manager;
 use crate::terminal::shared_session::{SharedSessionSource, SharedSessionStatus};
 use crate::test_util::add_window_with_terminal;
 use crate::test_util::terminal::{
     add_window_with_id_and_terminal, initialize_app_for_terminal_view,
 };
+use crate::workflows::workflow::Workflow;
+use crate::workflows::{CloudWorkflow, CloudWorkflowModel};
 use crate::workspaces::team::{Team, TeamVisibility};
 use crate::workspaces::user_workspaces::UserWorkspaces;
 use crate::workspaces::workspace::{
@@ -310,24 +316,139 @@ fn link_sharing_gates_follow_a_window_onto_its_new_team() {
     });
 }
 
+/// Distinct from a window that has no team, which resolves a scope and is *permitted* to share.
+/// A window `UserWorkspaces` has never seen resolves no scope at all, and there is then no
+/// policy to consult.
 #[test]
-fn link_sharing_gates_deny_when_the_dialogs_window_has_no_team() {
+fn link_sharing_gates_deny_when_the_dialogs_window_cannot_be_resolved() {
     App::test((), |mut app| async move {
         initialize_app_for_terminal_view(&mut app);
 
         let (window_id, _terminal) = add_window_with_id_and_terminal(&mut app, None);
         install_workspace_with_teams(&mut app, vec![team_with_link_sharing(123, "team", true)]);
 
-        // Deliberately left unregistered: no window team can be resolved for this dialog.
+        // Deliberately never registered: `add_window_with_id_and_terminal` roots the window in
+        // a `TerminalView`, so nothing calls `UserWorkspaces::register_window` for it.
         let dialog = app.add_typed_action_view(window_id, |ctx| SharingDialog::new(None, ctx));
 
         dialog.read(&app, |dialog, ctx| {
             assert!(
                 !dialog.can_anyone_with_link_share(ctx),
-                "a dialog whose window team cannot be resolved must not offer a sharing channel \
-                 governed by an unknown policy"
+                "a dialog with no resolvable scope must not offer a sharing channel governed by \
+                 an unknown policy"
             );
             assert!(!dialog.can_direct_link_share(ctx));
         });
     });
 }
+
+/// Puts a Warp Drive object in the cloud model under a server id, so the sharing dialog can
+/// target it and `UpdateManager` can find it.
+fn add_shareable_object(app: &mut App) -> ServerId {
+    let object_uid: ServerId = 789.into();
+    let mut object = CloudWorkflow::new_local(
+        CloudWorkflowModel {
+            data: Workflow::new("shared workflow", "echo shared"),
+        },
+        Owner::User {
+            user_uid: UserUid::new("owner"),
+        },
+        None,
+        ClientId::default(),
+    );
+    object.id = SyncId::ServerId(object_uid);
+
+    let cloud_model = CloudModel::handle(&*app);
+    cloud_model.update(app, |cloud_model, _| {
+        cloud_model.add_object(object.id, object);
+    });
+    object_uid
+}
+
+/// Whether a permissions change reached the object. `UpdateManager` marks the object
+/// synchronously, before it issues any request, so a dispatch the dialog refused leaves this
+/// clear.
+fn permissions_change_reached_object(app: &App, object_uid: ServerId) -> bool {
+    app.read(|ctx| {
+        CloudModel::as_ref(ctx)
+            .get_by_uid(&object_uid.uid())
+            .expect("the targeted object should be in the cloud model")
+            .metadata()
+            .pending_changes_statuses
+            .has_pending_permissions_change
+    })
+}
+
+fn set_link_permissions(
+    dialog: &ViewHandle<SharingDialog>,
+    access_level: Option<SharingAccessLevel>,
+    app: &mut App,
+) {
+    dialog.update(app, |dialog, ctx| {
+        dialog.handle_action(&SharingDialogAction::SetLinkPermissions(access_level), ctx);
+    });
+}
+
+/// The link-sharing menu builds its items once, when it opens, so acting on one has to re-read
+/// the policy. Deleting the guard in the `SetLinkPermissions` handler must fail this test.
+#[test]
+fn set_link_permissions_refuses_to_grant_under_a_forbidding_team() {
+    App::test((), |mut app| async move {
+        initialize_app_for_terminal_view(&mut app);
+
+        let (window_id, _terminal) = add_window_with_id_and_terminal(&mut app, None);
+        let forbidden_team = team_with_link_sharing(456, "forbids-sharing", false);
+        install_workspace_with_teams(&mut app, vec![forbidden_team.clone()]);
+
+        let user_workspaces = UserWorkspaces::handle(&app);
+        user_workspaces.update(&mut app, |user_workspaces, ctx| {
+            user_workspaces.set_team_for_window(window_id, forbidden_team.uid, ctx);
+        });
+
+        let object_uid = add_shareable_object(&mut app);
+        let dialog = app.add_typed_action_view(window_id, |ctx| {
+            SharingDialog::new(Some(ShareableObject::WarpDriveObject(object_uid)), ctx)
+        });
+
+        set_link_permissions(&dialog, Some(SharingAccessLevel::View), &mut app);
+        assert!(
+            !permissions_change_reached_object(&app, object_uid),
+            "granting link access under a team that forbids it must not reach the object"
+        );
+
+        // Revoking is how a user tightens an over-shared object, so the guard must let it
+        // through: the forbidding policy is the reason to allow this, not to block it.
+        set_link_permissions(&dialog, None, &mut app);
+        assert!(
+            permissions_change_reached_object(&app, object_uid),
+            "revoking link access must go through even under a team that forbids granting it"
+        );
+    });
+}
+
+#[test]
+fn set_link_permissions_grants_under_a_permitting_team() {
+    App::test((), |mut app| async move {
+        initialize_app_for_terminal_view(&mut app);
+
+        let (window_id, _terminal) = add_window_with_id_and_terminal(&mut app, None);
+        let permitted_team = team_with_link_sharing(123, "permits-sharing", true);
+        install_workspace_with_teams(&mut app, vec![permitted_team.clone()]);
+
+        let user_workspaces = UserWorkspaces::handle(&app);
+        user_workspaces.update(&mut app, |user_workspaces, ctx| {
+            user_workspaces.set_team_for_window(window_id, permitted_team.uid, ctx);
+        });
+
+        let object_uid = add_shareable_object(&mut app);
+        let dialog = app.add_typed_action_view(window_id, |ctx| {
+            SharingDialog::new(Some(ShareableObject::WarpDriveObject(object_uid)), ctx)
+        });
+
+        set_link_permissions(&dialog, Some(SharingAccessLevel::View), &mut app);
+        assert!(
+            permissions_change_reached_object(&app, object_uid),
+            "the guard must let a grant through when the window's team permits link sharing"
+        );
+    });
+}

app/src/workspaces/user_workspaces.rs

@@ -1950,6 +1950,10 @@ impl UserWorkspaces {
             };
         }
 
+        // No window reaches this today: one is only registered teamless while the user has no
+        // teams, and `reconcile_window_team_assignments` moves it onto a team the moment any
+        // appear. It stops being dead the first time a caller reads a
+        // [`TeamContextForOperation`] captured before its window had a team.
         if self.has_teams() {
             return LinkSharingSettings::UNRESTRICTED;
         }

app/src/workspaces/workspace.rs

@@ -979,9 +979,8 @@ pub struct LinkSharingSettings {
 
 impl LinkSharingSettings {
     /// The policy in force when neither a team nor a workspace governs link sharing: both
-    /// channels are permitted. Distinct from `Default`, whose all-`false` shape is the
-    /// starting point for decoding a policy that *is* governed.
-    pub const UNRESTRICTED: Self = Self {
+    /// channels are permitted. Deliberately not `Default`, which is all-`false`.
+    pub(crate) const UNRESTRICTED: Self = Self {
         anyone_with_link_sharing_enabled: true,
         direct_link_sharing_enabled: true,
     };