safe-global / safe-client-gateway / 36992672606

90%

push

github

feat(entitlements): return entitlements for all the caller's workspaces (#3534)

Adds `GET /v1/spaces/entitlements`, which returns the entitlements of every workspace the caller is an `ACTIVE` member of in one request, keyed by workspace UUID. Each value is exactly what `GET /v1/spaces/:spaceId/entitlements` returns for that workspace. Workspaces the caller is only invited to are left out, and a caller in no workspace gets `{}`. This is the entitlements counterpart of `GET /v1/spaces/safes`.

Authorization (R-024): there is no `assertMember`, because there is no single workspace to check. The route is behind `AuthGuard`, the caller's id comes from the verified JWT, and the membership query (`user: Equal(userId)`, `status: 'ACTIVE'`) is what limits the result to the caller's own workspaces. The service and controller tests cover a pending invite and another user's workspace being excluded.

Reads are batched: one membership query, then features, active subscriptions, usage counters and Safe seat counts are each read once for every workspace. The query count stays the same however many workspaces the caller has. The response is not paginated, matching `GET /v1/spaces/safes`.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

4575 of 5369 branches covered (85.21%)

Branch coverage included in aggregate %.

70 of 71 new or added lines in 4 files covered. (98.59%)

11656 of 12770 relevant lines covered (91.28%)

508.88 hits per line