WorkspaceAccessService.java

package com.taxonomy.workspace.service;

import com.taxonomy.workspace.repository.UserWorkspaceRepository;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

/**
 * Resolves whether workspace metadata may be disclosed to an authenticated
 * principal. The lookup deliberately returns only a scalar count so callers
 * cannot accidentally expose or materialize a foreign workspace after an
 * authorization decision.
 */
@Service
public class WorkspaceAccessService {

    private final UserWorkspaceRepository workspaceRepository;

    public WorkspaceAccessService(UserWorkspaceRepository workspaceRepository) {
        this.workspaceRepository = workspaceRepository;
    }

    @Transactional(readOnly = true)
    public boolean canReadWorkspaceMetadata(String workspaceId, String username) {
        if (workspaceId == null || workspaceId.isBlank()
                || username == null || username.isBlank()) {
            return false;
        }
        return workspaceRepository.countVisibleWorkspaceMetadata(
                workspaceId.strip(), username.strip()) > 0L;
    }

    @Transactional(readOnly = true)
    public boolean canUsePrivateWorkspace(RepositoryContext context) {
        return context != null && context.scope() == RepositoryScope.WORKSPACE
                && workspaceRepository.countOwnedPrivateWorkspace(context.workspaceId(), context.username(), context.repositoryId()) == 1;
    }
}