Feat/workspaces

[Entropy-rgb]

User description

Description

Related Issue

Type of Change

• Bug fix
• New feature
• Documentation update
• Refactor / performance improvement
• Dependency update
• CI / infrastructure change

How Has This Been Tested?

• Backend tests (pytest)
• Frontend tests (if applicable)
• Manual testing (describe below)

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have added tests that prove my fix or feature works
• All existing tests pass
• I have updated documentation if needed

Summary by CodeRabbit

• New Features
  • Multi-workspace experience: workspace setup, invitations & membership, role-based permissions (RBAC), ownership transfer, and workspace activity logs (CSV export + retention cleanup).
  • Saved queries and dashboards with editable panels and chart-aware visualization (including streaming chart events).
  • Account settings: profile editing and email re-verification on email changes.
• Improvements
  • Queries, knowledge/catalog, conversations, and history are now scoped to the active workspace (and selected database), with re-run SQL and “Save to Dashboard”.
  • Connection aliasing and improved reconnect behavior, plus enhanced chart support across SQL execution.
• Documentation
  • Updated setup/security guidance, including required recent-connection encryption key and activity cleanup configuration.

---

CodeAnt-AI Description

Add multi-workspace support with workspace settings, permissions, dashboards, and scoped databases

What Changed

• Users can now create, switch between, invite others to, leave, transfer, and delete workspaces
• Workspace owners can set invite defaults, invite expiry, activity retention, and custom role permissions
• Query, conversation, catalog, history, and connection actions now stay tied to the selected workspace and database
• Dashboards and saved queries are now available per workspace, with chart output support in query results
• Activity logs can be viewed, filtered, exported, and automatically cleaned up by retention rules

Impact

✅ Safer workspace sharing
✅ Fewer cross-database mix-ups
✅ Clearer dashboard and query history per workspace

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR migrates BoloDB's data model and API surface from per-user scoping to multi-tenant workspace scoping, adding workspace membership, roles, and permissions; adds SQL result chart metadata, saved queries, and dashboards; consolidates ORM models and Alembic migrations; refactors activity logging and connection encryption; and updates the frontend for workspaces, dashboards, and charts.

Changes

Workspace platform

Layer / File(s)	Summary
Schema and ORM foundations backend/app/models/*, backend/alembic/versions/*, backend/alembic/env.py	Consolidated SQLAlchemy models (users, workspaces, catalog, conversations, auth tokens, activity, dashboards, saved queries, workspace settings) and matching Alembic migrations with an advisory-lock guard replace prior per-user schema/migrations.
Workspace authorization and lifecycle backend/app/dependencies.py, backend/app/permissions.py, backend/app/controllers/workspaces.py, backend/app/routes/workspaces.py, backend/app/services/email.py, tests/test_workspace_*, tests/test_invite_codes.py, tests/test_m2_permissions_adversarial.py, tests/test_phase4_e2e_suite.py, tests/test_permissions_and_workspace_settings.py	Adds get_current_workspace, require_role, require_permission, a role-permission registry, and full workspace/member/invite lifecycle controllers and routes, with invite codes/emails and extensive test coverage.
Workspace-scoped backend data flow backend/app/database.py, backend/app/pgdatabase/*, backend/app/controllers/{catalog,conversations,onboard,database,query,system}.py, backend/app/routes/{catalog,connections,conversations,database,history,onboard,query,system}.py	Reworks connection management, knowledge/catalog/conversation/history persistence, and query/system controllers and routes to key off workspace_id/db_id instead of user_id.
Charts, saved queries, and dashboards backend/app/llm.py, backend/app/repair.py, backend/app/controllers/dashboards.py, backend/app/pgdatabase/{dashboards,saved_queries}.py, backend/app/routes/{dashboards,saved_queries}.py, frontend/src/lib/components/{ChartPanel,DashboardEditor,SaveQueryDialog,AnswerCard,charts/*}.svelte, frontend/src/routes/dashboards/*	Adds chart-spec generation/parsing to SQL responses, saved-query and dashboard persistence/execution, and new frontend dashboard/chart editing and viewing UI.
Activity maintenance and profile APIs backend/app/controllers/activity.py, backend/app/logbook.py, backend/app/server.py, backend/app/controllers/auth.py, backend/app/routes/auth.py, frontend/src/lib/components/ActivityLog.svelte, frontend/src/routes/profile/+page.svelte	Adds workspace activity logging/retention/export with a background cleanup loop, simplifies session logging, and adds profile update endpoints/UI.
Frontend workspace experience frontend/src/lib/appState.svelte.ts, frontend/src/lib/api.ts, frontend/src/lib/components/{Sidebar,AppShell,ConnectScreen,DataCatalog,SettingsTab,InviteBell,Navbar,AskScreen}.svelte, frontend/src/routes/workspaces/*	Adds multi-workspace state, invite notifications, workspace-aware navigation/connection/catalog screens, and workspace setup/settings pages.
Validation and runtime packaging tests/test_* (controllers/config/encryption/sample data), docker-compose*.yml, */DOCKERFILE*, nginx/*, .env.example, README.md, backend/sample_data.py, backend/sample_db/*	Updates test suites for the workspace-scoped contracts, reworks connection encryption to require an env key, replaces the sample database with a webshop dataset, and updates Docker/nginx runtime configuration.

Estimated code review effort: 5 (Critical) | ~150 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant WorkspaceDependency
  participant Route
  participant Controller
  participant DatabaseManager
  Client->>WorkspaceDependency: Send JWT and workspace headers
  WorkspaceDependency->>DatabaseManager: Verify workspace membership and role
  WorkspaceDependency-->>Route: Return workspace_id, role, and db_id
  Route->>Controller: Invoke workspace-scoped operation
  Controller->>DatabaseManager: Read or write workspace-owned state
  DatabaseManager-->>Controller: Return operation result
  Controller-->>Route: Return response
  Route-->>Client: Return API response

Loading

sequenceDiagram
  participant DashboardPage
  participant DashboardRoute
  participant DashboardController
  participant DatabaseHelpers
  participant DatabaseManager
  DashboardPage->>DashboardRoute: Request dashboard data
  DashboardRoute->>DashboardController: Execute dashboard queries
  DashboardController->>DatabaseHelpers: Load dashboard panels and saved queries
  DashboardController->>DatabaseManager: Execute saved-query SQL
  DatabaseManager-->>DashboardController: Return rows and columns
  DashboardController-->>DashboardRoute: Return normalized panel results
  DashboardRoute-->>DashboardPage: Render dashboard panels

Loading

Possibly related PRs

• BoloDB/bolodb#253: Both PRs change the same knowledge/catalog persistence stack, refactoring the tour-completion/knowledge tables and models/controllers between user-scoped and workspace-scoped identifiers.
• BoloDB/bolodb#257: Both PRs touch the knowledge-base/knowledge-service integration and its controller call surfaces (catalog/onboard/query flows), which this PR further refactors from (user_id, db_id) to (workspace_id, db_id).
• BoloDB/bolodb#263: Both PRs modify the same core run_query/run_query_stream functions in backend/app/controllers/query.py, adding workspace/db scoping and chart support here versus error-event streaming there.

Suggested reviewers: haahit

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 21.46% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title is too generic to describe the main change beyond a vague feature/workspaces label.	Use a specific title that names the primary change, e.g. "Add multi-workspace support" or "Introduce workspace-scoped permissions and data".

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch Feat/workspaces

---

_{Comment @coderabbitai help to get the list of available commands.}

[Entropy-rgb]

I think this is ready to merge now, please express your thoughts on this @HAAHIT @coderabbitai @greptileai @CodeAnt-AI @strix-security. Please let me know if i shall merge this. Thank You

[strix-security]

Strix flagged 4 new security findings below. See the pinned summary comment for the full PR status.

[greptile-apps]

Too many files changed for review. (179 files found, 100 file limit)

Bypass the limit by tagging @greptile-apps to review.

[Entropy-rgb]

I think this is now finally ready to merge after the very last validation loop @HAAHIT @greptileai @coderabbitai @CodeAnt-AI @strix-security

[Entropy-rgb]

@strix-security can u please run checks on the latest commits

[Entropy-rgb]

The implementation is now complete with docs !