Add workspaces, conversation sessions, app-managed computers and pictures

- Rail: Add icon with stacked form modals (bot, workspace, computer),
  coordinator, recent bots with "See all bots", Workspaces section, and
  a workspace mode listing only its crew
- Workspaces: page for context, bots (per-workspace instructions and
  memory), computers (default, link, unlink), models and delete;
  conversations scoped per bot per workspace
- Sessions: conversations split into searchable, reopenable sessions
  with carry-over summaries; sessions and new-session header icons
- Computers: created and provisioned over the docker socket, home dir
  kept at DATA_DIR/computers/<id> after delete; super admins only
- Models: workspace settings win over a bot's own, then the defaults
- Pictures for bots and workspaces; bots editable from the header
- Coordinator tools: update_workspace, set_bot_workspace_instructions

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/pages/api/admin/bots/create-bot.ts

@@ -0,0 +1,61 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import createBot from "@/src/functions/backend/db/bots/create-bot";
+import addBotToWorkspace from "@/src/functions/backend/db/workspaces/add-bot-to-workspace";
+import grabUserWorkspace from "@/src/functions/backend/db/workspaces/grab-user-workspace";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { CreateBotRequestSchema } from "@/src/schemas/bot-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Adds a worker bot to the session user's crew, and to one of their
+ * workspaces when one is given. Returns the bot's id.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<{ bot_id: number }>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { name, role, hue, system_prompt, workspace_id } = parseWithSchema({ schema: CreateBotRequestSchema, data: body });
+
+        if (workspace_id && !(await grabUserWorkspace({ workspace_id, user_id: user.id }))?.id) {
+            throw new AppError(`Workspace not found.`);
+        }
+
+        const bot_id = await createBot({ user_id: user.id, name, role, hue, system_prompt });
+
+        if (workspace_id) {
+            await addBotToWorkspace({ user_id: user.id, workspace_id, bot_id });
+        }
+
+        await logEvent({
+            title: "Bot added",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} added the bot ${name}.`,
+            metadata: { bot_id, workspace_id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return { success: true, msg: `${name} is on the crew.`, singleRes: { bot_id } };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/bots/list-sessions.ts

@@ -0,0 +1,51 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabBotSessions from "@/src/functions/backend/db/bot-sessions/grab-bot-sessions";
+import grabUserConversation from "@/src/functions/backend/db/bot-sessions/grab-user-conversation";
+import { ListBotSessionsRequestSchema } from "@/src/schemas/bot-schema";
+import type { BotSessionListItem } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * The sessions of one of the session user's conversations, latest first,
+ * searched by title, summary or message text.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<BotSessionListItem>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        const { bot_id, workspace_id, query, page } = parseWithSchema({
+            schema: ListBotSessionsRequestSchema,
+            data: body,
+        });
+
+        const conversation = await grabUserConversation({ user_id: user.id, bot_id, workspace_id });
+
+        return {
+            success: true,
+            payload: await grabBotSessions({
+                bot_id: conversation.bot.id,
+                workspace_id: conversation.workspace_id,
+                query,
+                page,
+            }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/bots/mark-read.ts

@@ -1,6 +1,6 @@
 import userAuth from "@/src/functions/backend/auth/user-auth";
-import markBotRead from "@/src/functions/backend/db/bots/mark-bot-read";
-import { BotIdRequestSchema } from "@/src/schemas/bot-schema";
+import markBotSessionRead from "@/src/functions/backend/db/bot-sessions/mark-bot-session-read";
+import { BotSessionIdRequestSchema } from "@/src/schemas/bot-schema";
 import AppError from "@/src/utils/app-error";
 import parseWithSchema from "@/src/utils/parse-with-schema";
 import safeErrorMessage from "@/src/utils/safe-error-message";
@@ -10,8 +10,8 @@ import type {
 } from "@moduletrace/bunext/types";
 
 /**
- * Clears a bot's unread flag when a message arrives in the conversation
- * the user has open. Only the session user's own bots.
+ * Clears a session's unread flag when a message arrives in the
+ * conversation the user has open. Only the session user's own bots.
  */
 export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
     req,
@@ -28,9 +28,9 @@ export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
             return { success: false, msg: `Unauthorized`, logoutUser: true };
         }
 
-        const { bot_id } = parseWithSchema({ schema: BotIdRequestSchema, data: body });
+        const { session_id } = parseWithSchema({ schema: BotSessionIdRequestSchema, data: body });
 
-        await markBotRead({ bot_id, user_id: user.id });
+        await markBotSessionRead({ session_id, user_id: user.id });
 
         return { success: true };
     } catch (error: unknown) {

src/pages/api/admin/bots/new-session.ts

@@ -0,0 +1,54 @@
+import type { BUN_SQLITE_COBBLE_BOT_SESSIONS } from "@/db/types/db";
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabUserConversation from "@/src/functions/backend/db/bot-sessions/grab-user-conversation";
+import startBotSession from "@/src/functions/backend/db/bot-sessions/start-bot-session";
+import { BotConversationRequestSchema } from "@/src/schemas/bot-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Closes the active session of one of the session user's conversations and
+ * starts the next one, which carries on from it.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<BUN_SQLITE_COBBLE_BOT_SESSIONS>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { bot_id, workspace_id } = parseWithSchema({
+            schema: BotConversationRequestSchema,
+            data: body,
+        });
+
+        const conversation = await grabUserConversation({ user_id: user.id, bot_id, workspace_id });
+
+        return {
+            success: true,
+            singleRes: await startBotSession({
+                bot_id: conversation.bot.id,
+                workspace_id: conversation.workspace_id,
+            }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/bots/reopen-session.ts

@@ -0,0 +1,48 @@
+import type { BUN_SQLITE_COBBLE_BOT_SESSIONS } from "@/db/types/db";
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import reopenBotSession from "@/src/functions/backend/db/bot-sessions/reopen-bot-session";
+import { BotSessionIdRequestSchema } from "@/src/schemas/bot-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Makes a closed session of one of the session user's conversations the
+ * active one again, so the bot carries on from where it left off.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<BUN_SQLITE_COBBLE_BOT_SESSIONS>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { session_id } = parseWithSchema({
+            schema: BotSessionIdRequestSchema,
+            data: body,
+        });
+
+        return {
+            success: true,
+            singleRes: await reopenBotSession({ session_id, user_id: user.id }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/bots/send-message.ts

@@ -1,5 +1,6 @@
 import userAuth from "@/src/functions/backend/auth/user-auth";
-import grabUserBot from "@/src/functions/backend/db/bots/grab-user-bot";
+import grabUserConversation from "@/src/functions/backend/db/bot-sessions/grab-user-conversation";
+import ensureBotSession from "@/src/functions/backend/db/bot-sessions/ensure-bot-session";
 import insertUserMessage from "@/src/functions/backend/db/bots/insert-user-message";
 import grabAttachableMedia from "@/src/functions/backend/db/bots/grab-attachable-media";
 import enqueueBotReply from "@/src/functions/backend/db/bots-queue/enqueue-bot-reply";
@@ -16,10 +17,12 @@ import type {
 } from "@moduletrace/bunext/types";
 
 /**
- * Posts a message from the session user to one of their own bots and
- * queues the bot's reply, which arrives over the WebSocket. The message
- * also goes to the user's other open tabs. Files are uploaded first
- * (`upload-attachment`) and sent as `media_ids`.
+ * Posts a message from the session user to one of their own bots, in its
+ * own chat or in a workspace it's in, and queues the bot's reply, which
+ * arrives over the WebSocket. The message goes in the conversation's
+ * active session (the next one when it's full) and also to the user's
+ * other open tabs. Files are uploaded first (`upload-attachment`) and
+ * sent as `media_ids`.
  */
 export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
     req,
@@ -44,23 +47,33 @@ export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
             throw new AppError(`This user can only read records.`);
         }
 
-        const { bot_id, text, media_ids } = parseWithSchema({
+        const { bot_id, workspace_id, text, media_ids } = parseWithSchema({
             schema: SendBotMessageRequestSchema,
             data: body,
         });
 
-        const bot = await grabUserBot({ bot_id, user_id: user.id });
-
-        if (!bot?.id) {
-            throw new AppError(`Bot not found`);
-        }
+        const conversation = await grabUserConversation({ user_id: user.id, bot_id, workspace_id });
+        const bot = conversation.bot;
 
         const media = await grabAttachableMedia({ user_id: Number(user.id), media_ids });
-        const message = await insertUserMessage({ bot_id: bot.id, text, media });
+        const session = await ensureBotSession({
+            bot_id: bot.id,
+            workspace_id: conversation.workspace_id,
+            rollover: true,
+        });
+
+        const message = await insertUserMessage({
+            bot_id: bot.id,
+            session_id: Number(session.id),
+            workspace_id: conversation.workspace_id,
+            text,
+            media,
+        });
 
         await enqueueBotReply({
             user_id: user.id,
             bot_id: bot.id,
+            session_id: Number(session.id),
             message_id: message.id || 0,
         });
 

src/pages/api/admin/bots/set-computer.ts

@@ -2,6 +2,8 @@ import type { BUN_SQLITE_COBBLE_COMPUTERS } from "@/db/types/db";
 import userAuth from "@/src/functions/backend/auth/user-auth";
 import pushBotNotice from "@/src/bots-queue/push-bot-notice";
 import setBotComputer from "@/src/functions/backend/db/computers/set-bot-computer";
+import grabUserConversation from "@/src/functions/backend/db/bot-sessions/grab-user-conversation";
+import setWorkspaceComputer from "@/src/functions/backend/db/workspaces/set-workspace-computer";
 import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
 import { SetBotComputerRequestSchema } from "@/src/schemas/bot-schema";
 import AppError from "@/src/utils/app-error";
@@ -14,9 +16,9 @@ import type {
 } from "@moduletrace/bunext/types";
 
 /**
- * Switches the computer one of the session user's bots works on, and
- * tells the user's other tabs. Returns the bot's computers, the new one
- * first.
+ * Switches the computer one of the session user's bots works on (in a
+ * workspace, the workspace's default computer), and tells the user's
+ * other tabs. Returns the bot's computers there, the new one first.
  */
 export const handler: BunextAPIRouteHandler<
     APIResponseObject<BUN_SQLITE_COBBLE_COMPUTERS>
@@ -36,16 +38,21 @@ export const handler: BunextAPIRouteHandler<
             throw new AppError(`This user can only read records.`);
         }
 
-        const { bot_id, computer_id } = parseWithSchema({
+        const { bot_id, computer_id, workspace_id } = parseWithSchema({
             schema: SetBotComputerRequestSchema,
             data: body,
         });
 
-        const { bot, computer, computers } = await setBotComputer({
-            bot_id,
-            computer_id,
-            user_id: user.id,
-        });
+        const { bot, computer, computers } = workspace_id
+            ? {
+                  bot: (await grabUserConversation({ user_id: user.id, bot_id, workspace_id })).bot,
+                  ...(await setWorkspaceComputer({ user_id: user.id, workspace_id, computer_id })),
+              }
+            : await setBotComputer({
+                  bot_id,
+                  computer_id,
+                  user_id: user.id,
+              });
 
         await pushBotNotice({
             bot_id: bot.id || 0,
@@ -61,14 +68,18 @@ export const handler: BunextAPIRouteHandler<
             title: "Bot computer switched",
             category: "system",
             user_id: user.id,
-            plain_text: `User #${user.id} switched ${bot.name} to ${computer.name || `computer #${computer.id}`}.`,
-            metadata: { bot_id: bot.id, computer_id: computer.id },
+            plain_text: workspace_id
+                ? `User #${user.id} made ${computer.name || `computer #${computer.id}`} the default of workspace #${workspace_id}.`
+                : `User #${user.id} switched ${bot.name} to ${computer.name || `computer #${computer.id}`}.`,
+            metadata: { bot_id: bot.id, computer_id: computer.id, workspace_id },
             ip_address: grabRequestIP(req),
         });
 
         return {
             success: true,
-            msg: `${bot.name} is on ${computer.name || "that computer"} now.`,
+            msg: workspace_id
+                ? `${computer.name || "That computer"} is the workspace's default computer now.`
+                : `${bot.name} is on ${computer.name || "that computer"} now.`,
             payload: computers,
         };
     } catch (error: unknown) {

src/pages/api/admin/bots/update-bot.ts

@@ -0,0 +1,55 @@
+import type { BUN_SQLITE_COBBLE_BOTS } from "@/db/types/db";
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import updateBot from "@/src/functions/backend/db/bots/update-bot";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { UpdateBotRequestSchema } from "@/src/schemas/bot-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Saves one of the session user's bots (name, job, hue, instructions).
+ * Returns the bot.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<BUN_SQLITE_COBBLE_BOTS>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { bot_id, name, role, hue, system_prompt } = parseWithSchema({
+            schema: UpdateBotRequestSchema,
+            data: body,
+        });
+
+        const bot = await updateBot({ user_id: user.id, bot_id, name, role, hue, system_prompt });
+
+        await logEvent({
+            title: "Bot changed",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} changed the bot ${bot.name}.`,
+            metadata: { bot_id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return { success: true, msg: `Saved.`, singleRes: bot };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/computers/create-computer.ts

@@ -0,0 +1,74 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import createComputer from "@/src/functions/backend/db/computers/create-computer";
+import grabUserComputers from "@/src/functions/backend/db/computers/grab-user-computers";
+import addComputerToWorkspace from "@/src/functions/backend/db/workspaces/add-computer-to-workspace";
+import grabUserWorkspace from "@/src/functions/backend/db/workspaces/grab-user-workspace";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import type { ComputerWithStatus } from "@/src/types";
+import { CreateComputerRequestSchema } from "@/src/schemas/computer-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import isPassThroughUser from "@/src/utils/rbac/is-pass-through-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Creates a computer for the session user (super admins only: each one
+ * is a container on this host), and links it to one of their workspaces
+ * when one is given. The container is set up in the background; its
+ * state arrives as `server:computer-updated`. Returns the computer.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<ComputerWithStatus>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        if (!isPassThroughUser({ user_types })) {
+            throw new AppError(`Only a super admin can do that.`);
+        }
+
+        const { name, description, workspace_id } = parseWithSchema({ schema: CreateComputerRequestSchema, data: body });
+
+        if (workspace_id && !(await grabUserWorkspace({ workspace_id, user_id: user.id }))?.id) {
+            throw new AppError(`Workspace not found.`);
+        }
+
+        const { computer_id } = await createComputer({ user_id: user.id, name, description });
+
+        if (workspace_id) {
+            await addComputerToWorkspace({ user_id: user.id, workspace_id, computer_id });
+        }
+
+        await logEvent({
+            title: "Computer created",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} created the computer ${name}.`,
+            metadata: { computer_id, workspace_id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return {
+            success: true,
+            msg: `${name} is being set up. It can take a few minutes the first time.`,
+            singleRes: (await grabUserComputers({ computer_id }))[0],
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/computers/delete-computer.ts

@@ -0,0 +1,60 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import deleteComputer from "@/src/functions/backend/db/computers/delete-computer";
+import grabComputerDataDir from "@/src/functions/backend/db/computers/grab-computer-data-dir";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { ComputerIdRequestSchema } from "@/src/schemas/computer-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import isPassThroughUser from "@/src/utils/rbac/is-pass-through-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Deletes one of the session user's computers and its container (super
+ * admins only). Its home directory stays on disk.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        if (!isPassThroughUser({ user_types })) {
+            throw new AppError(`Only a super admin can do that.`);
+        }
+
+        const { computer_id } = parseWithSchema({ schema: ComputerIdRequestSchema, data: body });
+
+        const computer = await deleteComputer({ user_id: user.id, computer_id });
+
+        await logEvent({
+            title: "Computer deleted",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} deleted the computer ${computer.name}.`,
+            metadata: { computer_id, data_dir: grabComputerDataDir({ computer_id }) },
+            ip_address: grabRequestIP(req),
+        });
+
+        return {
+            success: true,
+            msg: `${computer.name || "The computer"} is deleted. Its files are kept.`,
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/computers/retry-computer.ts

@@ -0,0 +1,65 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabUserComputer from "@/src/functions/backend/db/computers/grab-user-computer";
+import grabUserComputers from "@/src/functions/backend/db/computers/grab-user-computers";
+import provisionComputer from "@/src/functions/backend/db/computers/provision-computer";
+import type { ComputerWithStatus } from "@/src/types";
+import { ComputerIdRequestSchema } from "@/src/schemas/computer-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import isPassThroughUser from "@/src/utils/rbac/is-pass-through-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Sets up a computer's container again after it failed (super admins
+ * only), in the background. Returns the computer, `creating`.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<ComputerWithStatus>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        if (!isPassThroughUser({ user_types })) {
+            throw new AppError(`Only a super admin can do that.`);
+        }
+
+        const { computer_id } = parseWithSchema({ schema: ComputerIdRequestSchema, data: body });
+
+        const computer = await grabUserComputer({ computer_id, user_id: user.id });
+
+        if (!computer?.id) {
+            throw new AppError(`Computer not found.`);
+        }
+
+        const current = (await grabUserComputers({ computer_id: computer.id }))[0];
+
+        if (current?.status == "creating") {
+            throw new AppError(`${computer.name || "The computer"} is already being set up.`);
+        }
+
+        provisionComputer({ computer_id: Number(computer.id) });
+
+        return {
+            success: true,
+            msg: `Setting ${computer.name || "the computer"} up again.`,
+            singleRes: { ...current, status: "creating", error: null },
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/set-profile-image.ts

@@ -0,0 +1,48 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import setProfileImage from "@/src/functions/backend/db/profile-images/set-profile-image";
+import { SetProfileImageRequestSchema } from "@/src/schemas/profile-image-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Sets or removes the picture of one of the session user's bots or
+ * workspaces. Returns the new `image_media_id` (null once removed).
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<{ image_media_id: number | null }>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { target, id, data_url } = parseWithSchema({
+            schema: SetProfileImageRequestSchema,
+            data: body,
+        });
+
+        return {
+            success: true,
+            msg: data_url ? `Picture saved.` : `Picture removed.`,
+            singleRes: await setProfileImage({ user_id: user.id, target, id, data_url }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/workspaces/add-bot.ts

@@ -0,0 +1,46 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import addBotToWorkspace from "@/src/functions/backend/db/workspaces/add-bot-to-workspace";
+import grabWorkspaceBots from "@/src/functions/backend/db/workspaces/grab-workspace-bots";
+import type { WorkspaceBot } from "@/src/types";
+import { WorkspaceBotRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Puts one of the session user's bots in one of their workspaces. Returns
+ * the workspace's crew.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<WorkspaceBot>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, bot_id } = parseWithSchema({ schema: WorkspaceBotRequestSchema, data: body });
+
+        await addBotToWorkspace({ user_id: user.id, workspace_id, bot_id });
+
+        return {
+            success: true,
+            payload: await grabWorkspaceBots({ user_id: user.id, workspace_id }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/workspaces/add-computer.ts

@@ -0,0 +1,43 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import addComputerToWorkspace from "@/src/functions/backend/db/workspaces/add-computer-to-workspace";
+import grabWorkspaceComputers from "@/src/functions/backend/db/workspaces/grab-workspace-computers";
+import type { ComputerWithStatus } from "@/src/types";
+import { WorkspaceComputerRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Links one of the session user's computers to one of their workspaces
+ * (the first becomes its default). Returns the workspace's computers.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<ComputerWithStatus>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, computer_id } = parseWithSchema({ schema: WorkspaceComputerRequestSchema, data: body });
+
+        await addComputerToWorkspace({ user_id: user.id, workspace_id, computer_id });
+
+        return { success: true, payload: await grabWorkspaceComputers({ workspace_id }) };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/workspaces/create-workspace.ts

@@ -0,0 +1,52 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import createWorkspace from "@/src/functions/backend/db/workspaces/create-workspace";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { CreateWorkspaceRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Creates a workspace for the session user. Returns its id.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<{ workspace_id: number }>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { name, description, system_prompt } = parseWithSchema({ schema: CreateWorkspaceRequestSchema, data: body });
+
+        const workspace_id = Number(
+            await createWorkspace({ user_id: user.id, name, description, system_prompt }),
+        );
+
+        await logEvent({
+            title: "Workspace created",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} created the workspace ${name}.`,
+            metadata: { workspace_id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return { success: true, msg: `${name} is ready.`, singleRes: { workspace_id } };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/workspaces/delete-workspace.ts

@@ -0,0 +1,51 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import deleteWorkspace from "@/src/functions/backend/db/workspaces/delete-workspace";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { WorkspaceIdRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Deletes one of the session user's workspaces with its conversations.
+ * Its bots and computers stay.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id } = parseWithSchema({ schema: WorkspaceIdRequestSchema, data: body });
+
+        const workspace = await deleteWorkspace({ user_id: user.id, workspace_id });
+
+        await logEvent({
+            title: "Workspace deleted",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} deleted the workspace ${workspace.name}.`,
+            metadata: { workspace_id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return { success: true, msg: `${workspace.name || "The workspace"} is deleted.` };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/workspaces/remove-bot.ts

@@ -0,0 +1,47 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import removeBotFromWorkspace from "@/src/functions/backend/db/workspaces/remove-bot-from-workspace";
+import grabWorkspaceBots from "@/src/functions/backend/db/workspaces/grab-workspace-bots";
+import type { WorkspaceBot } from "@/src/types";
+import { WorkspaceBotRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Takes a bot out of one of the session user's workspaces. Its
+ * conversation there is kept, for if it's put back. Returns the
+ * workspace's crew.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<WorkspaceBot>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, bot_id } = parseWithSchema({ schema: WorkspaceBotRequestSchema, data: body });
+
+        await removeBotFromWorkspace({ user_id: user.id, workspace_id, bot_id });
+
+        return {
+            success: true,
+            payload: await grabWorkspaceBots({ user_id: user.id, workspace_id }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/workspaces/remove-computer.ts

@@ -0,0 +1,43 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import removeComputerFromWorkspace from "@/src/functions/backend/db/workspaces/remove-computer-from-workspace";
+import grabWorkspaceComputers from "@/src/functions/backend/db/workspaces/grab-workspace-computers";
+import type { ComputerWithStatus } from "@/src/types";
+import { WorkspaceComputerRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Unlinks a computer from one of the session user's workspaces; the
+ * computer stays. Returns the workspace's computers.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<ComputerWithStatus>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, computer_id } = parseWithSchema({ schema: WorkspaceComputerRequestSchema, data: body });
+
+        await removeComputerFromWorkspace({ user_id: user.id, workspace_id, computer_id });
+
+        return { success: true, payload: await grabWorkspaceComputers({ workspace_id }) };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/workspaces/save-harness-settings.ts

@@ -0,0 +1,91 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabBotHarnessOverview from "@/src/functions/backend/db/harness/grab-bot-harness-overview";
+import grabHarnessSetting from "@/src/functions/backend/db/harness/grab-harness-setting";
+import saveWorkspaceHarnessSetting from "@/src/functions/backend/db/harness/save-workspace-harness-setting";
+import grabUserWorkspace from "@/src/functions/backend/db/workspaces/grab-user-workspace";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { SaveWorkspaceHarnessSettingsRequestSchema } from "@/src/schemas/harness-schema";
+import type { BotHarnessOverviewPayload } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Saves which model each harness uses in one of the session user's
+ * workspaces. A workspace's models win over its bots' own, for the
+ * coordinator too.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<BotHarnessOverviewPayload>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, settings } = parseWithSchema({
+            schema: SaveWorkspaceHarnessSettingsRequestSchema,
+            data: body,
+        });
+
+        const workspace = await grabUserWorkspace({ workspace_id, user_id: user.id });
+
+        if (!workspace?.id) {
+            throw new AppError(`Workspace not found.`);
+        }
+
+        for (const setting of settings) {
+            const existing = await grabHarnessSetting({
+                harness: setting.harness,
+                workspace_id: workspace.id,
+            });
+            const { voice, ...options } = existing.source == "workspace" ? existing.options : {};
+
+            await saveWorkspaceHarnessSetting({
+                workspace_id: Number(workspace.id),
+                harness: setting.harness,
+                inherit: setting.inherit,
+                model_id: setting.model_id,
+                provider_id: setting.provider_id,
+                fallback: setting.fallback,
+                enabled: setting.enabled,
+                options: setting.voice ? { ...options, voice: setting.voice } : options,
+            });
+        }
+
+        await logEvent({
+            title: "Workspace model settings changed",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} changed ${workspace.name}'s model settings for ${settings.map((s) => s.harness).join(", ")}.`,
+            metadata: { workspace_id: workspace.id, settings },
+            ip_address: grabRequestIP(req),
+        });
+
+        return {
+            success: true,
+            msg: `Saved.`,
+            singleRes: await grabBotHarnessOverview({ workspace_id: Number(workspace.id) }),
+        };
+    } catch (error: unknown) {
+        return {
+            success: false,
+            msg: safeErrorMessage({ error }),
+        };
+    }
+};

src/pages/api/admin/workspaces/set-computer.ts

@@ -0,0 +1,50 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import setWorkspaceComputer from "@/src/functions/backend/db/workspaces/set-workspace-computer";
+import type { ComputerWithStatus } from "@/src/types";
+import { WorkspaceComputerRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Makes one of a workspace's computers its default. Returns the
+ * workspace's computers, the default first.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<ComputerWithStatus>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, computer_id } = parseWithSchema({ schema: WorkspaceComputerRequestSchema, data: body });
+
+        const { computer, computers } = await setWorkspaceComputer({
+            user_id: user.id,
+            workspace_id,
+            computer_id,
+        });
+
+        return {
+            success: true,
+            msg: `${computer.name || "That computer"} is the default now.`,
+            payload: computers,
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/workspaces/update-bot.ts

@@ -0,0 +1,47 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import updateWorkspaceBot from "@/src/functions/backend/db/workspaces/update-workspace-bot";
+import grabWorkspaceBots from "@/src/functions/backend/db/workspaces/grab-workspace-bots";
+import type { WorkspaceBot } from "@/src/types";
+import { UpdateWorkspaceBotRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Saves a bot's instructions and memory for one of the session user's
+ * workspaces. Returns the workspace's crew.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<WorkspaceBot>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, bot_id, system_prompt, memory } = parseWithSchema({ schema: UpdateWorkspaceBotRequestSchema, data: body });
+
+        await updateWorkspaceBot({ user_id: user.id, workspace_id, bot_id, system_prompt, memory });
+
+        return {
+            success: true,
+            msg: `Saved.`,
+            payload: await grabWorkspaceBots({ user_id: user.id, workspace_id }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/workspaces/update-workspace.ts

@@ -0,0 +1,56 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import updateWorkspace from "@/src/functions/backend/db/workspaces/update-workspace";
+import grabUserWorkspace from "@/src/functions/backend/db/workspaces/grab-user-workspace";
+import type { BUN_SQLITE_COBBLE_WORKSPACES } from "@/db/types/db";
+import { UpdateWorkspaceRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Saves one of the session user's workspaces: its name, description and
+ * the context every bot working there gets. Returns the workspace.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<BUN_SQLITE_COBBLE_WORKSPACES>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, name, description, system_prompt, archived } = parseWithSchema({ schema: UpdateWorkspaceRequestSchema, data: body });
+
+        await updateWorkspace({
+            user_id: user.id,
+            workspace_id,
+            data: {
+                name,
+                description,
+                system_prompt,
+                archived: archived === undefined ? undefined : archived ? 1 : 0,
+            },
+        });
+
+        return {
+            success: true,
+            msg: `Saved.`,
+            singleRes: (await grabUserWorkspace({ workspace_id, user_id: user.id })) || undefined,
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};