Add admin invites and user workspace management tools.

Implement invite-token registration with optional email delivery, add admin UI actions for creating invites and opening user workspaces, and support superuser workspace override while preserving per-user code isolation with shared read-only lib.

Made-with: Cursor

src/editor_app/deps.py

@@ -1,12 +1,15 @@
 from __future__ import annotations
 
 import os
+import re
+from pathlib import Path
 
-from fastapi import Cookie, Depends, Header, HTTPException
+from fastapi import Cookie, Depends, Header, HTTPException, Query
 from sqlalchemy.orm import Session
 
 from editor_app.db.session import get_db
 from editor_app.db.models import User
+from editor_app import config
 from editor_app.services import accounts
 
 
@@ -61,3 +64,33 @@ async def require_superuser(
     if not user.is_superuser:
         raise HTTPException(status_code=403, detail="Superuser required")
     return user
+
+
+def _safe_workspace_leaf(user: User) -> str:
+    base = re.sub(r"[^a-zA-Z0-9._-]+", "-", user.username).strip("-").lower() or "user"
+    return f"{base}-{user.id}"
+
+
+def _seed_user_workspace(user_root: Path) -> None:
+    (user_root / "code").mkdir(parents=True, exist_ok=True)
+
+
+async def get_workspace_root(
+    user: User | None = Depends(get_current_user_optional),
+    workspace_user_id: int | None = Query(default=None),
+    db: Session = Depends(get_db),
+) -> Path:
+    root = config.WORKSPACE_ROOT.resolve()
+    if not accounts.auth_enabled() or user is None:
+        return root
+    target_user = user
+    if workspace_user_id is not None:
+        if not user.is_superuser:
+            raise HTTPException(status_code=403, detail="Superuser required for workspace override")
+        lookup = accounts.get_user_by_id(db, int(workspace_user_id))
+        if lookup is None:
+            raise HTTPException(status_code=404, detail="Workspace user not found")
+        target_user = lookup
+    user_root = root / "users" / _safe_workspace_leaf(target_user)
+    _seed_user_workspace(user_root)
+    return user_root