Scope link-sharing settings to the window's team

Replace the ambient `is_anyone_with_link_sharing_enabled` /
`is_direct_link_sharing_enabled` reads with getters that take a
`TeamScope`, resolving each window's own team policy instead of the
current workspace's arbitrarily-chosen `teams[0]` effective settings.

The sharing dialog resolves a `TeamContext` from its own view handle,
freshly on every read, and re-checks the policy before sending
invitations and before applying link permissions, so a dialog left open
while its window moves to a restricting team cannot act on the policy it
opened with.

Author: warp-agent-staging[bot]

app/src/drive/sharing/dialog/mod.rs

@@ -60,7 +60,7 @@ use crate::word_block_editor::{
     WordBlockStyles,
 };
 use crate::workspace::{ToastStack, WorkspaceAction};
-use crate::workspaces::user_workspaces::UserWorkspaces;
+use crate::workspaces::user_workspaces::{TeamContext, UserWorkspaces};
 use crate::{TelemetryEvent, send_telemetry_from_ctx};
 
 mod inheritance;
@@ -475,12 +475,29 @@ impl SharingDialog {
         self.target.is_some() && self.access_level(app).can_edit_access()
     }
 
+    /// The team this dialog's window is sharing as, resolved afresh on every read so a window
+    /// that moves to another team is never governed by the team it opened with.
+    ///
+    /// `None` when the dialog's window cannot be located, which for a live dialog means its
+    /// window is gone: `RootView::new` registers every window as it is created.
+    fn team_scope<'a>(&self, app: &'a AppContext) -> Option<TeamContext<'a>> {
+        UserWorkspaces::as_ref(app).team_context(&self.self_handle, app)
+    }
+
+    /// Whether this window's team permits sharing the target with anyone who holds its link.
+    /// A window whose team cannot be resolved denies: offering a sharing channel whose
+    /// governing policy is unknown is the unsafe direction to guess in.
     fn can_anyone_with_link_share(&self, app: &AppContext) -> bool {
-        UserWorkspaces::as_ref(app).is_anyone_with_link_sharing_enabled()
+        self.team_scope(app).is_some_and(|scope| {
+            UserWorkspaces::as_ref(app).is_anyone_with_link_sharing_enabled(&scope)
+        })
     }
 
+    /// Whether this window's team permits sharing the target directly with named people. See
+    /// [`Self::can_anyone_with_link_share`] for why an unresolvable team denies.
     fn can_direct_link_share(&self, app: &AppContext) -> bool {
-        UserWorkspaces::as_ref(app).is_direct_link_sharing_enabled()
+        self.team_scope(app)
+            .is_some_and(|scope| UserWorkspaces::as_ref(app).is_direct_link_sharing_enabled(&scope))
     }
 
     /// The editability state of the object.
@@ -1615,6 +1632,13 @@ impl SharingDialog {
 
     /// Send all pending email invitations.
     fn send_invitations(&mut self, ctx: &mut ViewContext<Self>) {
+        // Re-read the policy instead of trusting the render that put the form on screen: an
+        // open dialog whose window moved to a team that forbids direct sharing must not send
+        // the invitations that team now disallows.
+        if !self.can_direct_link_share(ctx) {
+            return;
+        }
+
         let form_state = self.invite_form_state(ctx);
         if !form_state.is_valid() {
             return;
@@ -2930,6 +2954,13 @@ impl TypedActionView for SharingDialog {
             }
             SharingDialogAction::SetLinkPermissions(access_level) => {
                 self.set_open_menu(OpenMenuState::None, ctx);
+                // The menu's items were built when it opened. Re-read the policy so a window
+                // that has since moved to a team forbidding link sharing cannot act on the
+                // permission it was offered under the old one.
+                if !self.can_anyone_with_link_share(ctx) {
+                    ctx.notify();
+                    return;
+                }
                 if let Some(ShareableObject::WarpDriveObject(id)) = self.target.as_ref() {
                     UpdateManager::handle(ctx).update(ctx, move |update_manager, ctx| {
                         update_manager.set_object_link_permissions(*id, *access_level, ctx);

app/src/drive/sharing/dialog/mod_tests.rs

@@ -8,7 +8,14 @@ use crate::terminal::TerminalView;
 use crate::terminal::shared_session::manager::Manager;
 use crate::terminal::shared_session::{SharedSessionSource, SharedSessionStatus};
 use crate::test_util::add_window_with_terminal;
-use crate::test_util::terminal::initialize_app_for_terminal_view;
+use crate::test_util::terminal::{
+    add_window_with_id_and_terminal, initialize_app_for_terminal_view,
+};
+use crate::workspaces::team::{Team, TeamVisibility};
+use crate::workspaces::user_workspaces::UserWorkspaces;
+use crate::workspaces::workspace::{
+    EnforceableSetting, TeamLinkSharingSettings, TeamSettings, Workspace,
+};
 
 fn set_shared_session_status(
     terminal: &ViewHandle<TerminalView>,
@@ -157,3 +164,170 @@ fn session_qr_code_requires_status_eligible_matching_session_id() {
         assert_session_link_state(&terminal, &dialog, Some(second_session_id), &app);
     });
 }
+
+/// A team whose admins either permit or forbid both link-sharing channels.
+fn team_with_link_sharing(uid: i64, name: &str, permitted: bool) -> Team {
+    let permission = EnforceableSetting {
+        value: permitted,
+        is_enforced_by_workspace: false,
+    };
+    Team {
+        uid: uid.into(),
+        name: name.to_string(),
+        color: None,
+        invite_link: None,
+        members: vec![],
+        pending_email_invites: vec![],
+        invite_link_domain_restrictions: vec![],
+        billing_metadata: Default::default(),
+        stripe_customer_id: None,
+        settings: TeamSettings {
+            link_sharing: TeamLinkSharingSettings {
+                anyone_with_link_sharing_enabled: permission.clone(),
+                direct_link_sharing_enabled: permission,
+            },
+            ..Default::default()
+        },
+        is_eligible_for_discovery: false,
+        has_billing_history: false,
+        visibility: TeamVisibility::Open,
+    }
+}
+
+/// Replaces the user's workspaces with one holding `teams` and selects it, the way a
+/// workspaces-metadata refresh does. Windows already assigned to a team that `teams` no longer
+/// contains reconcile onto the first remaining one.
+fn install_workspace_with_teams(app: &mut App, teams: Vec<Team>) {
+    let workspace = Workspace {
+        uid: "workspace_uid123456789".to_string().into(),
+        name: "test".to_string(),
+        stripe_customer_id: None,
+        teams,
+        billing_metadata: Default::default(),
+        bonus_grants_purchased_this_month: Default::default(),
+        billing_cycle_usage: None,
+        has_billing_history: false,
+        settings: Default::default(),
+        invite_link_domain_restrictions: vec![],
+        pending_email_invites: vec![],
+        is_eligible_for_discovery: false,
+        members: vec![],
+        total_requests_used_since_last_refresh: 0,
+    };
+    let workspace_uid = workspace.uid;
+
+    let user_workspaces = UserWorkspaces::handle(&*app);
+    user_workspaces.update(app, |user_workspaces, ctx| {
+        user_workspaces.update_workspaces(vec![workspace], ctx);
+        user_workspaces.set_current_workspace_uid(workspace_uid, ctx);
+    });
+}
+
+#[test]
+fn link_sharing_gates_resolve_each_windows_own_team() {
+    App::test((), |mut app| async move {
+        initialize_app_for_terminal_view(&mut app);
+
+        let (permitted_window, _permitted_terminal) =
+            add_window_with_id_and_terminal(&mut app, None);
+        let (forbidden_window, _forbidden_terminal) =
+            add_window_with_id_and_terminal(&mut app, None);
+
+        let permitted_team = team_with_link_sharing(123, "permits-sharing", true);
+        let forbidden_team = team_with_link_sharing(456, "forbids-sharing", false);
+        install_workspace_with_teams(
+            &mut app,
+            vec![permitted_team.clone(), forbidden_team.clone()],
+        );
+
+        let user_workspaces = UserWorkspaces::handle(&app);
+        user_workspaces.update(&mut app, |user_workspaces, ctx| {
+            user_workspaces.set_team_for_window(permitted_window, permitted_team.uid, ctx);
+            user_workspaces.set_team_for_window(forbidden_window, forbidden_team.uid, ctx);
+        });
+
+        let permitted_dialog =
+            app.add_typed_action_view(permitted_window, |ctx| SharingDialog::new(None, ctx));
+        let forbidden_dialog =
+            app.add_typed_action_view(forbidden_window, |ctx| SharingDialog::new(None, ctx));
+
+        permitted_dialog.read(&app, |dialog, ctx| {
+            assert!(dialog.can_anyone_with_link_share(ctx));
+            assert!(dialog.can_direct_link_share(ctx));
+        });
+        forbidden_dialog.read(&app, |dialog, ctx| {
+            assert!(
+                !dialog.can_anyone_with_link_share(ctx),
+                "a dialog in a window on a forbidding team must not inherit the other window's \
+                 permission"
+            );
+            assert!(!dialog.can_direct_link_share(ctx));
+        });
+    });
+}
+
+/// The dialog re-reads these gates when it renders and again before it acts, in
+/// `send_invitations` and in the `SetLinkPermissions` handler. Resolving them from the window
+/// rather than caching them at open is what stops an already-open dialog from sharing under
+/// the policy it opened with after its window has moved to a team that forbids sharing.
+#[test]
+fn link_sharing_gates_follow_a_window_onto_its_new_team() {
+    App::test((), |mut app| async move {
+        initialize_app_for_terminal_view(&mut app);
+
+        let (window_id, _terminal) = add_window_with_id_and_terminal(&mut app, None);
+
+        let permitted_team = team_with_link_sharing(123, "permits-sharing", true);
+        let forbidden_team = team_with_link_sharing(456, "forbids-sharing", false);
+        install_workspace_with_teams(
+            &mut app,
+            vec![permitted_team.clone(), forbidden_team.clone()],
+        );
+
+        let user_workspaces = UserWorkspaces::handle(&app);
+        user_workspaces.update(&mut app, |user_workspaces, ctx| {
+            user_workspaces.set_team_for_window(window_id, permitted_team.uid, ctx);
+        });
+
+        let dialog = app.add_typed_action_view(window_id, |ctx| SharingDialog::new(None, ctx));
+        dialog.read(&app, |dialog, ctx| {
+            assert!(dialog.can_anyone_with_link_share(ctx));
+            assert!(dialog.can_direct_link_share(ctx));
+        });
+
+        // The permitting team leaves the workspace, so the window reconciles onto the
+        // forbidding one while the dialog is still open.
+        install_workspace_with_teams(&mut app, vec![forbidden_team]);
+
+        dialog.read(&app, |dialog, ctx| {
+            assert!(
+                !dialog.can_anyone_with_link_share(ctx),
+                "an open dialog must lose link sharing when its window moves to a team that \
+                 forbids it"
+            );
+            assert!(!dialog.can_direct_link_share(ctx));
+        });
+    });
+}
+
+#[test]
+fn link_sharing_gates_deny_when_the_dialogs_window_has_no_team() {
+    App::test((), |mut app| async move {
+        initialize_app_for_terminal_view(&mut app);
+
+        let (window_id, _terminal) = add_window_with_id_and_terminal(&mut app, None);
+        install_workspace_with_teams(&mut app, vec![team_with_link_sharing(123, "team", true)]);
+
+        // Deliberately left unregistered: no window team can be resolved for this dialog.
+        let dialog = app.add_typed_action_view(window_id, |ctx| SharingDialog::new(None, ctx));
+
+        dialog.read(&app, |dialog, ctx| {
+            assert!(
+                !dialog.can_anyone_with_link_share(ctx),
+                "a dialog whose window team cannot be resolved must not offer a sharing channel \
+                 governed by an unknown policy"
+            );
+            assert!(!dialog.can_direct_link_share(ctx));
+        });
+    });
+}

app/src/workspaces/user_workspaces.rs

@@ -41,8 +41,8 @@ use crate::settings::{
 #[cfg(test)]
 use crate::workspaces::workspace::{AIAutonomyPolicy, WorkspaceMember, WorkspaceSettings};
 use crate::workspaces::workspace::{
-    AiAutonomySettings, AiOverages, PurchaseAddOnCreditsPolicy, SandboxedAgentSettings,
-    UsageBasedPricingSettings,
+    AiAutonomySettings, AiOverages, LinkSharingSettings, PurchaseAddOnCreditsPolicy,
+    SandboxedAgentSettings, UsageBasedPricingSettings,
 };
 
 const STRIPE_SUBSCRIPTION_INTERVAL_PAGE_PREFIX: &str = "/upgrade";
@@ -241,9 +241,6 @@ impl TeamContextForOperation {
 /// a [`TeamContextForOperation`]. A [`WeakViewHandle`] locates a window to read from; it is
 /// not evidence that the holder is running in that window, which is what minting operation
 /// scope requires.
-// Only tests construct one today; remove this once a Group 1 migration PR resolves one from a
-// real render.
-#[allow(dead_code)]
 pub(crate) struct TeamContext<'a> {
     team_uid: Option<&'a ServerId>,
 }
@@ -463,8 +460,6 @@ impl UserWorkspaces {
     }
 
     /// Resolves `view`'s window team for one render. See [`TeamContext`].
-    // Only tests call this today; remove once a Group 1 migration PR has a real call site.
-    #[allow(dead_code)]
     pub(crate) fn team_context<'a, T: Entity>(
         &'a self,
         view: &WeakViewHandle<T>,
@@ -479,6 +474,19 @@ impl UserWorkspaces {
         Some(TeamContext { team_uid })
     }
 
+    /// Reads a `TeamScope`'s team, whether captured (a [`TeamContextForOperation`]) or freshly
+    /// resolved (a [`TeamContext`]). Returns `None` once that team is gone from the current
+    /// workspace, e.g. after the user leaves it, or when `scope` carries no team.
+    ///
+    /// Private on purpose: a scope resolves to a *setting*, through one of the getters below,
+    /// never to a `Team` a caller could carry somewhere the scope never reached. A call site
+    /// that wants a `Team` from a scope wants a new getter instead.
+    fn team_from_scope<S: TeamScope + ?Sized>(&self, scope: &S) -> Option<&Team> {
+        scope
+            .team_uid()
+            .and_then(|team_uid| self.team_from_uid(team_uid))
+    }
+
     /// Returns the windows whose team assignment changed.
     #[must_use]
     fn reconcile_window_team_assignments(&mut self) -> Vec<WindowId> {
@@ -1922,26 +1930,45 @@ impl UserWorkspaces {
             .unwrap_or_default()
     }
 
-    pub fn is_anyone_with_link_sharing_enabled(&self) -> bool {
-        self.current_workspace()
-            .map(|workspace| {
-                workspace
-                    .settings
-                    .link_sharing_settings
+    /// The link-sharing policy that governs `scope`.
+    ///
+    /// A scope that resolves to a team reads that team's effective policy, so two windows on
+    /// different teams disagree exactly as their admins configured them.
+    ///
+    /// A scope with no team is not on a team, and no team's policy may stand in for that.
+    /// [`Self::current_workspace`]'s settings are only genuine workspace-level data while the
+    /// workspace has no teams; once it has any, the server resolved them for one arbitrarily
+    /// chosen team, so a teamless scope gets [`LinkSharingSettings::UNRESTRICTED`] instead.
+    fn link_sharing_settings(&self, scope: &impl TeamScope) -> LinkSharingSettings {
+        if let Some(team) = self.team_from_scope(scope) {
+            let link_sharing = &team.settings.link_sharing;
+            return LinkSharingSettings {
+                anyone_with_link_sharing_enabled: link_sharing
                     .anyone_with_link_sharing_enabled
-            })
-            .unwrap_or(true)
-    }
+                    .value,
+                direct_link_sharing_enabled: link_sharing.direct_link_sharing_enabled.value,
+            };
+        }
+
+        if self.has_teams() {
+            return LinkSharingSettings::UNRESTRICTED;
+        }
 
-    pub fn is_direct_link_sharing_enabled(&self) -> bool {
         self.current_workspace()
-            .map(|workspace| {
-                workspace
-                    .settings
-                    .link_sharing_settings
-                    .direct_link_sharing_enabled
-            })
-            .unwrap_or(true)
+            .map(|workspace| workspace.settings.link_sharing_settings.clone())
+            .unwrap_or(LinkSharingSettings::UNRESTRICTED)
+    }
+
+    /// Whether `scope` may share an object with anyone who holds its link.
+    pub(crate) fn is_anyone_with_link_sharing_enabled(&self, scope: &impl TeamScope) -> bool {
+        self.link_sharing_settings(scope)
+            .anyone_with_link_sharing_enabled
+    }
+
+    /// Whether `scope` may share an object directly with named people.
+    pub(crate) fn is_direct_link_sharing_enabled(&self, scope: &impl TeamScope) -> bool {
+        self.link_sharing_settings(scope)
+            .direct_link_sharing_enabled
     }
 
     /// Whether invite links are enabled for the current workspace. This is a