Control Center V2 (5/6): public workspace management

[Paul Lizer (paullizer)]

Summary

• Production-ready Public Workspaces list: parameterized query-level search/status/owner filters, sorting/pagination, bounded cross-page selection, partial-failure bulk status actions, and injection-safe filtered CSV export. Five V2 APIs require Control Center admin; dashboard readers are denied.
• Shared Groups drawer supports public metrics/status history, supported members/CSV, native retention, ownership/destructive approval submissions, activity/export, and Users/Activity Logs links. Native Owner/Admin permissions and existing public approval dispatch remain authoritative.
• Depends on Control Center V2 (4/6): group management #1692; Control Center V2 (6/6): activity logs #1693 depends on this PR. Normally merged reviewed Groups 38a7582c01100585076cfd76e7b7a1c577398f7f (including integration f1c3ddab0). Integration base is used because Groups head branch is fork-only; this carries reviewed Users/Groups until Control Center V2 (4/6): group management #1692 lands. No rebase/amend/force-push.
• Latest head 89114a2076b313126c61ddf51153778e8e45f13d, current version 0.261.285. Isolated Phase 6 commit 4c99eeeeb was backported as ee6f9ab8c: all five public workspace validation catches return fixed safe messages with HTTP 400 preserved; shared sensitive-exception regressions and unused-import cleanup included. No Phase 6 implementation pulled in.

Linked issue

No standalone Phase 5 issue supplied. Dependency #1692; downstream #1693. No issue-closing claim.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Current 0.261.285; feature implementation history remains 0.261.283, parent reconciliation .284, public validation safety .285. No deployer changes.

Testing / validation

Ignored local .venv uses repository-compatible Flask 3.1.3 to avoid host Flask2/Werkzeug3 mismatch. Root commands unless noted.

Latest safe-response backport: 127 passed (43 warnings)

.\.venv\Scripts\python.exe -m pytest functional_tests\test_control_center_safe_exception_responses.py functional_tests\test_v2_control_center_public_workspaces.py functional_tests\test_v2_control_center_groups.py functional_tests\test_v2_control_center_users.py functional_tests\test_control_center_public_writers.py -q --tb=short --disable-warnings

Post-Groups-merge integrated suite: 256 passed (67 warnings) (before isolated error-message-only backport)

.\.venv\Scripts\python.exe -m pytest functional_tests\test_v2_control_center_public_workspaces.py functional_tests\test_v2_control_center_groups.py functional_tests\test_v2_control_center_users.py functional_tests\test_v2_control_center_foundation.py functional_tests\test_v2_control_center_dashboard.py functional_tests\test_v2_api_security.py functional_tests\test_control_center_public_writers.py functional_tests\test_control_center_safe_exception_responses.py functional_tests\route_tests\test_route_blueprint_policy_inventory.py functional_tests\route_tests\test_route_unauthenticated_policy_contract.py functional_tests\route_tests\test_route_policy_test_coverage.py functional_tests\test_v2_ui_local_assets.py functional_tests\test_public_membership_apis.py functional_tests\test_public_workspace_membership_writer_safety.py -q --tb=short --disable-warnings

Post-merge typecheck/build passed; existing large-bundle warning. No UI code changed in backport.

cd application\v2_ui; npm run typecheck && npm run build

18 built-local-UI browser tests passed (post-Groups merge; APIs intercepted; not rerun for message-only backport).

.\.venv\Scripts\python.exe -m pytest ui_tests\test_v2_control_center_public_workspaces.py ui_tests\test_v2_control_center_groups.py ui_tests\test_v2_control_center_users.py -q --tb=short --disable-warnings

Standalone route-policy scripts: 12/12, 7/7, 3/3 passed; routes/decorators unchanged by backport.

.\.venv\Scripts\python.exe functional_tests\route_tests\test_route_blueprint_policy_inventory.py
.\.venv\Scripts\python.exe functional_tests\route_tests\test_route_unauthenticated_policy_contract.py
.\.venv\Scripts\python.exe functional_tests\route_tests\test_route_policy_test_coverage.py

Inventory regenerated after Groups merge; coverage 7/7 and quality 6/6 passed again after backport.

python .\scripts\build_docs_inventory.py
python .\functional_tests\test_docs_app_surface_coverage.py
python .\functional_tests\test_docs_site_quality.py

Latest backport XSS/BAC checks: passed, one changed route file each; whitespace passed.

python .\scripts\check_xss_sinks.py --base-sha 3731cdda8 application\single_app\route_backend_control_center.py
python .\scripts\check_broken_access_control.py --base-sha 3731cdda8 application\single_app\route_backend_control_center.py
git diff --check

Full Phase 5 post-merge guardrails: XSS4/BAC2 passed.

python .\scripts\check_xss_sinks.py --base-sha 38a7582c01100585076cfd76e7b7a1c577398f7f application\v2_ui\src\components\controlCenter\PublicWorkspacesSection.tsx application\v2_ui\src\components\controlCenter\GroupDetailDrawer.tsx application\v2_ui\src\components\controlCenter\ControlCenterPrimitives.tsx application\single_app\route_backend_control_center.py
python .\scripts\check_broken_access_control.py --base-sha 38a7582c01100585076cfd76e7b7a1c577398f7f application\single_app\route_backend_control_center.py application\single_app\functions_control_center_public_workspaces.py

Implementation-phase Impeccable detector returned no findings. No live Azure tenant/Cosmos validation. Known unrelated rail-collapse/legacy management-pagination failures untouched.

Limitations: live OFFSET pages can shift during writes; equal recorded sort values lack guaranteed secondary ordering. List metrics are recorded snapshots with freshness; legacy refresh may not record tokens. Established public retention API cannot reset custom values to inherited default. Activity/export uses recent20 allowlisted records. Existing public destructive routes submit correctly scoped approvals; the pre-existing executor can continue after individual document-cleanup failures. No direct classic bulk document deletion or approval queue added.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Updated V2_CONTROL_CENTER feature documentation, guide, release notes, and V2_CONTROL_CENTER_VALIDATION_ERRORS_FIX with current/implementation versions, exact supported workflows and limitations. Inventory unchanged after regeneration.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No new settings disclosure path. Inputs are bounded/parameterized; bulk cap500, export cap10,000. Native public permissions remain enforced. All fourteen Users/Groups/Public Workspace validation catches are covered by sensitive-exception response regressions.