{"record":{"id":"86b51ed6a046e3be","repo":"nexu-io/open-design","slug":"design-system-backing-project-belongs-to-another-w","errorCode":null,"errorMessage":"design system backing project belongs to another workspace","messagePattern":"design system backing project belongs to another workspace","errorType":"exception","errorClass":"Error","httpStatus":500,"severity":"error","filePath":"apps/daemon/src/design-systems/team-project-share.ts","lineNumber":102,"sourceCode":" * and each remote-project/local-projection pair compensates itself before\n * rejecting.\n */\nexport function createDesignSystemBackingProjectPreparer(\n  options: CreateDesignSystemBackingProjectPreparerOptions,\n): CreateLinkedProjectTeamResourceShareServiceOptions['prepare'] {\n  return async (resourceId, scope) => {\n    let projectId = (await options.resolveProjectId(resourceId, scope))?.trim() ?? '';\n    if ((!projectId || !options.projectExists(projectId)) && options.ensureProjectId) {\n      projectId = (await options.ensureProjectId(resourceId, scope))?.trim() ?? '';\n    }\n    if (!projectId || !options.projectExists(projectId)) {\n      throw new Error('design system backing project is unavailable');\n    }\n    const workspaceId = scope.principal.teamId;\n    const memberId = scope.principal.memberId;\n    const binding = options.getProjectBinding(projectId);\n    if (binding?.workspaceId && binding.workspaceId !== workspaceId) {\n      throw new Error('design system backing project belongs to another workspace');\n    }\n    if (binding?.createdByWorkspaceMemberId !== memberId) {\n      throw new TeamResourceShareForbiddenError();\n    }\n    options.onPrepared?.({ resourceId, projectId, scope });\n    return {\n      projectId,\n      transition: async (visibility) => {\n        if (visibility === 'team') {\n          const published = await options.publishProject(projectId, scope);\n          if (published.version == null) {\n            throw new Error('design system backing project publish failed');\n          }\n          try {\n            await options.persistVisibility({ projectId, scope, visibility });\n          } catch (error) {\n            try {\n              await options.unpublishProject(projectId, scope);","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/nexu-io/open-design/blob/5be4028344c2eb4c667c5a97bda8f750c5597ef7/apps/daemon/src/design-systems/team-project-share.ts#L84-L120","documentation":"Thrown by the design-system backing project preparer when the resolved project's binding carries a `workspaceId` that is set and differs from the requesting principal's `teamId`. This is the cross-workspace contamination guard: a backing project bound under one workspace cannot be moved by a share request originating from another workspace.","triggerScenarios":"A share/unshare request whose `scope.principal.teamId` is workspace B, but the backing project binding's `workspaceId` is workspace A (a different, non-empty value).","commonSituations":"A design system was originally shared under workspace A and is now being operated on from workspace B due to a stale client, a workspace switch, or a binding row that was not migrated. Manual database edits that changed a binding's workspace. A resource id collision resolving to the wrong project.","solutions":["Confirm the requesting user is acting in the same workspace that owns the backing project binding.","If the binding workspace is stale due to a migration, correct the binding row so `workspaceId` matches the owning workspace.","Do not attempt to cross-share a project from another workspace; re-create the design system resource under the correct workspace instead."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before sharing, confirm workspace ownership:\nconst binding = getProjectBinding(projectId);\nif (binding?.workspaceId && binding.workspaceId !== scope.principal.teamId) {\n  throw new Error('refusing cross-workspace share');\n}\nawait share(resourceId, scope);","typeGuard":null,"tryCatchPattern":"try {\n  await linkedShare.share(resourceId, scope);\n} catch (err) {\n  if (err instanceof Error && /belongs to another workspace/.test(err.message)) {\n    // re-create the design system under the correct workspace\n  }\n  throw err;\n}","preventionTips":["Bind backing projects to a workspace at creation time and never mutate the binding workspace manually.","Ensure session principal's teamId reflects the workspace the user intends to act in.","Reject cross-workspace share attempts in the UI before they reach the preparer."],"tags":["team","design-system","workspace","share","authorization","data-integrity"],"backgroundTag":null,"analyzedSha":"5be4028344c2eb4c667c5a97bda8f750c5597ef7","analyzedAt":"2026-08-12T12:03:58.812Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}