feat: add workspace access and global filtering

api/v1/api.yaml

@@ -772,6 +772,7 @@ paths:
         - $ref: "#/components/parameters/Page"
         - $ref: "#/components/parameters/PerPage"
         - $ref: "#/components/parameters/RemoteNode"
+        - $ref: "#/components/parameters/Workspace"
         - name: "name"
           in: "query"
           required: false
@@ -1654,7 +1655,6 @@ paths:
       parameters:
         - $ref: "#/components/parameters/DAGFileName"
         - $ref: "#/components/parameters/RemoteNode"
-        - $ref: "#/components/parameters/Workspace"
         - name: "q"
           in: "query"
           required: true
@@ -1667,6 +1667,7 @@ paths:
           schema:
             type: "string"
           description: "Filter DAG matches by labels (comma-separated). Returns matches only when the DAG has ALL specified labels."
+        - $ref: "#/components/parameters/Workspace"
         - $ref: "#/components/parameters/SearchCursor"
         - $ref: "#/components/parameters/SearchMatchLimit"
       responses:
@@ -1754,6 +1755,7 @@ paths:
         - "dags"
       parameters:
         - $ref: "#/components/parameters/RemoteNode"
+        - $ref: "#/components/parameters/Workspace"
       responses:
         "200":
           description: "A successful response"
@@ -1778,6 +1780,7 @@ paths:
         - "dags"
       parameters:
         - $ref: "#/components/parameters/RemoteNode"
+        - $ref: "#/components/parameters/Workspace"
       responses:
         "200":
           description: "A successful response"
@@ -1807,6 +1810,7 @@ paths:
         - $ref: "#/components/parameters/DAGRunListLimit"
         - $ref: "#/components/parameters/DAGRunListCursor"
         - $ref: "#/components/parameters/RemoteNode"
+        - $ref: "#/components/parameters/Workspace"
         - name: "name"
           in: "query"
           required: false
@@ -2016,6 +2020,7 @@ paths:
         - $ref: "#/components/parameters/DAGRunListLimit"
         - $ref: "#/components/parameters/DAGRunListCursor"
         - $ref: "#/components/parameters/RemoteNode"
+        - $ref: "#/components/parameters/Workspace"
       responses:
         "200":
           description: "A successful response"
@@ -6977,10 +6982,12 @@ components:
     Workspace:
       name: workspace
       in: query
-      description: selected workspace scope
+      description: "Workspace selector. For list and search APIs, use all, default, or a workspace name. Omitted means all. For document target APIs, use default or a workspace name; omitted means default."
       required: false
       schema:
         type: string
+        minLength: 1
+        maxLength: 64
         pattern: "^[A-Za-z0-9_-]+$"
 
     SearchCursor:
@@ -7974,6 +7981,9 @@ components:
         name:
           type: string
           description: "Logical name of the DAG"
+        workspace:
+          type: string
+          description: "Workspace label value for the DAG. Omitted for default DAGs and invalid workspace labels."
         schedule:
           type: array
           description: "List of scheduling expressions defining when DAG-runs should be created from this DAG"
@@ -8489,6 +8499,9 @@ components:
           $ref: "#/components/schemas/DAGRunId"
         name:
           $ref: "#/components/schemas/DAGName"
+        workspace:
+          type: string
+          description: "Workspace label value for the DAG-run. Omitted for default DAG-runs and invalid workspace labels."
         status:
           $ref: "#/components/schemas/Status"
         statusLabel:
@@ -9007,6 +9020,9 @@ components:
         name:
           type: string
           description: "Display label for the DAG result; file-backed search currently mirrors fileName"
+        workspace:
+          type: string
+          description: "Workspace label value for the matching DAG. Omitted for default DAGs and invalid workspace labels."
         hasMoreMatches:
           type: boolean
           description: "Whether additional snippets are available beyond the preview"
@@ -9048,6 +9064,9 @@ components:
           type: string
         title:
           type: string
+        workspace:
+          type: string
+          description: "Workspace that owns this document. Omitted for default documents."
         hasMoreMatches:
           type: boolean
           description: "Whether additional snippets are available beyond the preview"
@@ -9504,6 +9523,41 @@ components:
         - operator
         - viewer
 
+    WorkspaceName:
+      type: string
+      description: "Workspace name. The reserved names all and default are not allowed."
+      minLength: 1
+      maxLength: 64
+      pattern: "^[A-Za-z0-9_-]+$"
+
+    WorkspaceGrant:
+      type: object
+      description: "Role granted for a specific workspace"
+      properties:
+        workspace:
+          $ref: "#/components/schemas/WorkspaceName"
+        role:
+          $ref: "#/components/schemas/UserRole"
+      required:
+        - workspace
+        - role
+
+    WorkspaceAccess:
+      type: object
+      description: "Workspace access policy. all=true grants the top-level role in every workspace. all=false requires explicit workspace grants and a top-level viewer role."
+      properties:
+        all:
+          type: boolean
+          description: "Whether this identity can access all workspaces"
+        grants:
+          type: array
+          description: "Workspace-specific grants used when all=false"
+          items:
+            $ref: "#/components/schemas/WorkspaceGrant"
+      required:
+        - all
+        - grants
+
     SetupRequest:
       type: object
       description: "Request body for initial admin account setup"
@@ -9596,6 +9650,8 @@ components:
           minLength: 8
         role:
           $ref: "#/components/schemas/UserRole"
+        workspaceAccess:
+          $ref: "#/components/schemas/WorkspaceAccess"
       required:
         - username
         - password
@@ -9612,6 +9668,8 @@ components:
           maxLength: 64
         role:
           $ref: "#/components/schemas/UserRole"
+        workspaceAccess:
+          $ref: "#/components/schemas/WorkspaceAccess"
         isDisabled:
           type: boolean
           description: "Whether to disable the user account"
@@ -9628,6 +9686,8 @@ components:
           description: "User's username"
         role:
           $ref: "#/components/schemas/UserRole"
+        workspaceAccess:
+          $ref: "#/components/schemas/WorkspaceAccess"
         authProvider:
           type: string
           enum: [builtin, oidc]
@@ -9647,6 +9707,7 @@ components:
         - id
         - username
         - role
+        - workspaceAccess
         - createdAt
         - updatedAt
 
@@ -9685,6 +9746,8 @@ components:
           description: "Purpose description"
         role:
           $ref: "#/components/schemas/UserRole"
+        workspaceAccess:
+          $ref: "#/components/schemas/WorkspaceAccess"
         keyPrefix:
           type: string
           description: "First 8 characters for identification"
@@ -9708,6 +9771,7 @@ components:
         - id
         - name
         - role
+        - workspaceAccess
         - keyPrefix
         - createdAt
         - updatedAt
@@ -9748,6 +9812,8 @@ components:
           description: "Purpose description"
         role:
           $ref: "#/components/schemas/UserRole"
+        workspaceAccess:
+          $ref: "#/components/schemas/WorkspaceAccess"
       required:
         - name
         - role
@@ -9780,6 +9846,8 @@ components:
           description: "New description"
         role:
           $ref: "#/components/schemas/UserRole"
+        workspaceAccess:
+          $ref: "#/components/schemas/WorkspaceAccess"
 
     SuccessResponse:
       type: object
@@ -10591,6 +10659,9 @@ components:
           type: string
         title:
           type: string
+        workspace:
+          type: string
+          description: "Workspace that owns this document. Omitted for default documents."
         content:
           type: string
           description: "Full file content including YAML frontmatter"
@@ -10617,6 +10688,9 @@ components:
           type: string
         title:
           type: string
+        workspace:
+          type: string
+          description: "Workspace that owns this document. Omitted for default documents."
         modifiedAt:
           type: string
           format: date-time
@@ -10636,6 +10710,9 @@ components:
           type: string
         title:
           type: string
+        workspace:
+          type: string
+          description: "Workspace that owns this node. Omitted for default nodes."
         type:
           type: string
           enum:
@@ -10678,6 +10755,9 @@ components:
           type: string
         title:
           type: string
+        workspace:
+          type: string
+          description: "Workspace that owns this document. Omitted for default documents."
         matches:
           type: array
           items:
@@ -11372,15 +11452,15 @@ components:
         - name
       properties:
         name:
-          type: string
+          $ref: "#/components/schemas/WorkspaceName"
         description:
           type: string
 
     UpdateWorkspaceRequest:
       type: object
       properties:
         name:
-          type: string
+          $ref: "#/components/schemas/WorkspaceName"
         description:
           type: string
 
@@ -11393,7 +11473,7 @@ components:
         id:
           type: string
         name:
-          type: string
+          $ref: "#/components/schemas/WorkspaceName"
         description:
           type: string
         createdAt:

internal/agent/doc.go

@@ -66,20 +66,22 @@ const (
 
 // ListDocsOptions holds parameters for listing documents.
 type ListDocsOptions struct {
-	Page       int
-	PerPage    int
-	Sort       DocSortField
-	Order      DocSortOrder
-	PathPrefix string
+	Page             int
+	PerPage          int
+	Sort             DocSortField
+	Order            DocSortOrder
+	PathPrefix       string
+	ExcludePathRoots []string
 }
 
 // SearchDocsOptions configures a paginated document search query.
 type SearchDocsOptions struct {
-	Cursor     string
-	Limit      int
-	Query      string
-	MatchLimit int
-	PathPrefix string
+	Cursor           string
+	Limit            int
+	Query            string
+	MatchLimit       int
+	PathPrefix       string
+	ExcludePathRoots []string
 }
 
 // SearchDocMatchesOptions configures cursor-based snippet loading for one document.