Reparaturplan Fixes: Widget workspace_id check, total bug, context is_visible, permissions, fallbacks

Backend:
- Widget total: 0 bug fixed (now returns len(widgets))
- Widget update/delete: now verifies workspace_id + tenant_id (was only tenant_id)
- Workspace context: returns all modules with is_visible flag (was only visible modules)
- is_workspace_manager() removed (Plan 4.2: no manager checks)
- seed_default_workspace: removed hardcoded modules (Plan 4.7: no hardcoded tiles)
- Workspace permissions registered in CORE_PERMISSIONS (Plan 2.3)

Frontend:
- Permission fallback removed: Sidebar/TopBar show nothing while loading (Plan 2.4)
- workspaceStore isModuleVisible: fail-closed when isSystemAdmin undefined
- WorkspaceManager: AVAILABLE_MODULES replaced with dynamic core+plugin items (Plan 4.4)

Tests:
- 17 backend tests (removed is_workspace_manager test, adapted widget/context tests)
- 13 frontend tests (added undefined-isSystemAdmin test, adapted visibility tests)

app/core/permission_registry.py

@@ -59,6 +59,12 @@ CORE_PERMISSIONS: list[dict[str, str]] = [
     {"key": "currencies:write", "label": "Currencies: Write", "category": "core", "module": "currencies"},
     {"key": "import_export:read", "label": "Import/Export: Read", "category": "core", "module": "import_export"},
     {"key": "import_export:write", "label": "Import/Export: Write", "category": "core", "module": "import_export"},
+    {"key": "workspaces:read", "label": "Workspaces: Read", "category": "core", "module": "workspaces"},
+    {"key": "workspaces:create", "label": "Workspaces: Create", "category": "core", "module": "workspaces"},
+    {"key": "workspaces:update", "label": "Workspaces: Update", "category": "core", "module": "workspaces"},
+    {"key": "workspaces:delete", "label": "Workspaces: Delete", "category": "core", "module": "workspaces"},
+    {"key": "workspaces:assign_users", "label": "Workspaces: Assign Users", "category": "core", "module": "workspaces"},
+    {"key": "workspaces:configure_modules", "label": "Workspaces: Configure Modules", "category": "core", "module": "workspaces"},
     {"key": "system:admin", "label": "System: Admin (cross-tenant)", "category": "system", "module": "system"},
 ]
 

app/routes/workspaces.py

@@ -284,7 +284,8 @@ async def list_widgets(
         wid = uuid.UUID(workspace_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid workspace_id", "code": "invalid_id"})
-    return {"items": await workspace_service.get_widgets(db, tenant_id, wid), "total": 0}
+    widgets = await workspace_service.get_widgets(db, tenant_id, wid)
+    return {"items": widgets, "total": len(widgets)}
 
 
 @router.post("/{workspace_id}/widgets", status_code=status.HTTP_201_CREATED)
@@ -317,11 +318,12 @@ async def update_widget(
     """Update a widget."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     try:
+        ws_id = uuid.UUID(workspace_id)
         wid = uuid.UUID(widget_id)
     except ValueError:
-        raise HTTPException(400, detail={"detail": "Invalid widget_id", "code": "invalid_id"})
+        raise HTTPException(400, detail={"detail": "Invalid ID", "code": "invalid_id"})
     result = await workspace_service.update_widget(
-        db, tenant_id, wid,
+        db, tenant_id, ws_id, wid,
         body.position_x, body.position_y, body.width, body.height, body.config,
     )
     if result is None:
@@ -339,10 +341,11 @@ async def delete_widget(
     """Delete a widget."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     try:
+        ws_id = uuid.UUID(workspace_id)
         wid = uuid.UUID(widget_id)
     except ValueError:
-        raise HTTPException(400, detail={"detail": "Invalid widget_id", "code": "invalid_id"})
-    deleted = await workspace_service.delete_widget(db, tenant_id, wid)
+        raise HTTPException(400, detail={"detail": "Invalid ID", "code": "invalid_id"})
+    deleted = await workspace_service.delete_widget(db, tenant_id, ws_id, wid)
     if not deleted:
         raise HTTPException(404, detail={"detail": "Widget not found", "code": "not_found"})
 

app/services/workspace_service.py

@@ -382,11 +382,10 @@ async def get_workspace_context(
     if wu is None:
         return None  # User not assigned — caller can check is_system_admin
     
-    # Get visible modules
+    # Get all modules (including hidden) — frontend needs is_visible flag
     mod_q = select(WorkspaceModule).where(
         WorkspaceModule.workspace_id == workspace_id,
         WorkspaceModule.tenant_id == tenant_id,
-        WorkspaceModule.is_visible == True,  # noqa: E712
     ).order_by(WorkspaceModule.menu_order)
     mod_result = await db.execute(mod_q)
     modules = mod_result.scalars().all()
@@ -407,6 +406,7 @@ async def get_workspace_context(
         "modules": [
             {
                 "module_key": m.module_key,
+                "is_visible": m.is_visible,
                 "menu_order": m.menu_order,
                 "config": m.config or {},
             }
@@ -485,15 +485,16 @@ async def create_widget(
 
 
 async def update_widget(
-    db: AsyncSession, tenant_id: uuid.UUID, widget_id: uuid.UUID,
+    db: AsyncSession, tenant_id: uuid.UUID, workspace_id: uuid.UUID, widget_id: uuid.UUID,
     position_x: int | None = None, position_y: int | None = None,
     width: int | None = None, height: int | None = None,
     config: dict | None = None,
 ) -> dict[str, Any] | None:
-    """Update a widget."""
+    """Update a widget. Verifies workspace_id and tenant_id."""
     q = select(WorkspaceWidget).where(
         WorkspaceWidget.id == widget_id,
         WorkspaceWidget.tenant_id == tenant_id,
+        WorkspaceWidget.workspace_id == workspace_id,
     )
     result = await db.execute(q)
     w = result.scalar_one_or_none()
@@ -524,12 +525,13 @@ async def update_widget(
 
 
 async def delete_widget(
-    db: AsyncSession, tenant_id: uuid.UUID, widget_id: uuid.UUID
+    db: AsyncSession, tenant_id: uuid.UUID, workspace_id: uuid.UUID, widget_id: uuid.UUID
 ) -> bool:
-    """Delete a widget."""
+    """Delete a widget. Verifies workspace_id and tenant_id."""
     q = select(WorkspaceWidget).where(
         WorkspaceWidget.id == widget_id,
         WorkspaceWidget.tenant_id == tenant_id,
+        WorkspaceWidget.workspace_id == workspace_id,
     )
     result = await db.execute(q)
     w = result.scalar_one_or_none()
@@ -540,22 +542,6 @@ async def delete_widget(
     return True
 
 
-# ─── Manager Role Check ───────────────────────────────────────
-
-async def is_workspace_manager(
-    db: AsyncSession, tenant_id: uuid.UUID, workspace_id: uuid.UUID, user_id: uuid.UUID
-) -> bool:
-    """Check if a user is a manager of a workspace (or system admin)."""
-    q = select(WorkspaceUser).where(
-        WorkspaceUser.workspace_id == workspace_id,
-        WorkspaceUser.user_id == user_id,
-        WorkspaceUser.tenant_id == tenant_id,
-        WorkspaceUser.role == "manager",
-    )
-    result = await db.execute(q)
-    return result.scalar_one_or_none() is not None
-
-
 # ─── Cross-Tenant Validation ──────────────────────────────────
 
 async def verify_user_same_tenant(
@@ -606,29 +592,15 @@ async def seed_default_workspace(
         tenant_id=tenant_id,
         workspace_id=ws.id,
         user_id=user_id,
-        role="manager",
+        role="member",
         is_default=True,
         assigned_by=user_id,
     )
     db.add(wu)
 
-    # Add all standard modules visible by default
-    standard_modules = [
-        ("dashboard", 0), ("contacts", 10), ("calendar", 20),
-        ("mail", 30), ("tasks", 40), ("dms", 50),
-        ("kommunikation", 60), ("reports", 70), ("automation", 80),
-        ("tags", 90), ("settings", 100), ("audit", 110),
-    ]
-    for key, order in standard_modules:
-        wm = WorkspaceModule(
-            tenant_id=tenant_id,
-            workspace_id=ws.id,
-            module_key=key,
-            is_visible=True,
-            menu_order=order,
-            config={},
-        )
-        db.add(wm)
+    # No hardcoded modules — workspace starts empty.
+    # Modules are configured by the admin via the workspace settings UI.
+    # If no modules are configured, all active+permitted modules remain visible (backward compatible).
 
     await db.flush()
     return _workspace_to_dict(ws, user_count=1)

frontend/src/components/layout/Sidebar.tsx

@@ -70,8 +70,8 @@ export function Sidebar() {
   // Use hasPermission directly — permissions are loaded via useUserPermissions hook
   const canAccess = (perm?: string): boolean => {
     if (!perm) return true;
-    // While permissions are loading (undefined), show everything; backend 403 catches errors
-    if (!user?.permissions && user?.is_system_admin === undefined) return true;
+    // While permissions are loading (undefined), show nothing for protected items
+    if (!user?.permissions && user?.is_system_admin === undefined) return false;
     return hasPermission(perm);
   };
 

frontend/src/components/layout/TopBar.tsx

@@ -25,7 +25,7 @@ export function TopBar() {
   const { hasPermission } = usePermission();
   // While permissions are loading (undefined), show everything; backend 403 catches errors
   const canAccess = (perm: string): boolean => {
-    if (!user?.permissions && user?.is_system_admin === undefined) return true;
+    if (!user?.permissions && user?.is_system_admin === undefined) return false;
     return hasPermission(perm);
   };
   const restoreWindow = useWindowStore((s) => s.restoreWindow);

frontend/src/components/settings/WorkspaceManager.tsx

@@ -1,21 +1,13 @@
-import { useState } from 'react';
+import { useState, useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
 import { useWorkspaces, useCreateWorkspace, useUpdateWorkspace, useDeleteWorkspace, useSetWorkspaceModules, useAssignWorkspaceUser, useRemoveWorkspaceUser, type Workspace, type WorkspaceModule } from '@/api/hooks/workspaces';
+import { usePluginStore } from '@/store/pluginStore';
 import { LayoutGrid, Plus, Trash2, Edit, Users, Save, X, Check } from 'lucide-react';
 
-const AVAILABLE_MODULES = [
-  { key: 'contacts', label: 'Kontakte' },
-  { key: 'calendar', label: 'Kalender' },
-  { key: 'mail', label: 'E-Mail' },
-  { key: 'tasks', label: 'Aufgaben' },
-  { key: 'dms', label: 'Dokumente' },
-  { key: 'kommunikation', label: 'Kommunikation' },
-  { key: 'reports', label: 'Reports' },
-  { key: 'automation', label: 'Automation' },
-  { key: 'tags', label: 'Tags' },
+// Static core menu items — same as Sidebar.tsx
+const CORE_MENU_ITEMS = [
   { key: 'dashboard', label: 'Dashboard' },
-  { key: 'settings', label: 'Einstellungen' },
-  { key: 'audit', label: 'Audit-Log' },
+  { key: 'contacts', label: 'Kontakte' },
 ];
 
 export function WorkspaceManager() {
@@ -25,6 +17,24 @@ export function WorkspaceManager() {
   const updateWs = useUpdateWorkspace();
   const deleteWs = useDeleteWorkspace();
   const setModules = useSetWorkspaceModules();
+  const manifests = usePluginStore(s => s.manifests);
+
+  // Dynamically build available modules from core menu items + plugin manifests
+  const availableModules = useMemo(() => {
+    const pluginItems = manifests
+      .flatMap(m => m.menu_items || [])
+      .map(item => ({
+        key: item.path.replace(/^\//, '').split('/')[0],
+        label: item.label || item.label_key,
+      }));
+    // Merge core + plugin, deduplicate by key
+    const seen = new Set<string>();
+    return [...CORE_MENU_ITEMS, ...pluginItems].filter(m => {
+      if (seen.has(m.key)) return false;
+      seen.add(m.key);
+      return true;
+    });
+  }, [manifests]);
 
   const [showCreate, setShowCreate] = useState(false);
   const [editingId, setEditingId] = useState<string | null>(null);
@@ -59,7 +69,7 @@ export function WorkspaceManager() {
   const openModuleEditor = (ws: Workspace) => {
     setModuleWsId(ws.id);
     const existing = ws.modules || [];
-    setModuleConfig(AVAILABLE_MODULES.map(m => {
+    setModuleConfig(availableModules.map(m => {
       const existingMod = existing.find(e => e.module_key === m.key);
       return {
         module_key: m.key,
@@ -144,7 +154,7 @@ export function WorkspaceManager() {
           </div>
           <div className="grid grid-cols-2 md:grid-cols-3 gap-2">
             {moduleConfig.map(m => {
-              const mod = AVAILABLE_MODULES.find(a => a.key === m.module_key);
+              const mod = availableModules.find(a => a.key === m.module_key);
               return (
                 <label key={m.module_key} className="flex items-center gap-2 p-2 border border-gray-200 dark:border-gray-700 rounded-md cursor-pointer hover:bg-gray-50 dark:hover:bg-gray-800">
                   <input

frontend/src/store/__tests__/workspaceStore.test.ts

@@ -57,7 +57,11 @@ describe('workspaceStore', () => {
   });
 
   it('isModuleVisible returns true when no workspace context (backward compatible)', () => {
-    expect(useWorkspaceStore.getState().isModuleVisible('contacts')).toBe(true);
+    expect(useWorkspaceStore.getState().isModuleVisible('contacts', false)).toBe(true);
+  });
+
+  it('isModuleVisible returns false when isSystemAdmin is undefined (loading)', () => {
+    expect(useWorkspaceStore.getState().isModuleVisible('contacts', undefined)).toBe(false);
   });
 
   it('isModuleVisible returns true for system admin', () => {
@@ -75,7 +79,7 @@ describe('workspaceStore', () => {
       modules: [{ module_key: 'contacts', menu_order: 0, config: {} }],
       widgets: [],
     });
-    expect(useWorkspaceStore.getState().isModuleVisible('mail')).toBe(false);
+    expect(useWorkspaceStore.getState().isModuleVisible('mail', false)).toBe(false);
   });
 
   it('isModuleVisible returns true for module in workspace', () => {
@@ -87,8 +91,8 @@ describe('workspaceStore', () => {
       ],
       widgets: [],
     });
-    expect(useWorkspaceStore.getState().isModuleVisible('contacts')).toBe(true);
-    expect(useWorkspaceStore.getState().isModuleVisible('calendar')).toBe(true);
+    expect(useWorkspaceStore.getState().isModuleVisible('contacts', false)).toBe(true);
+    expect(useWorkspaceStore.getState().isModuleVisible('calendar', false)).toBe(true);
   });
 
   it('visibleModuleKeys returns set of visible module keys', () => {

frontend/src/store/workspaceStore.ts

@@ -92,6 +92,8 @@ export const useWorkspaceStore = create<WorkspaceStoreState>()(
       isModuleVisible: (moduleKey: string, isSystemAdmin?: boolean) => {
         // System admins see all modules regardless of workspace
         if (isSystemAdmin) return true;
+        // While permissions are loading, show nothing (fail-closed)
+        if (isSystemAdmin === undefined) return false;
         // If no workspace context, show all (backward compatible)
         const ctx = get().context;
         if (!ctx?.workspace_id || !ctx?.modules?.length) return true;

tests/test_workspaces.py

@@ -239,7 +239,9 @@ async def test_hidden_module_not_in_context(db_session: AsyncSession):
     assert ctx is not None
     module_keys = [m["module_key"] for m in ctx["modules"]]
     assert "contacts" in module_keys
-    assert "mail" not in module_keys  # Hidden module not in context
+    mail_modules = [m for m in ctx["modules"] if m["module_key"] == "mail"]
+    assert len(mail_modules) == 1
+    assert mail_modules[0]["is_visible"] == False
 
 
 # ─── Widget CRUD ──────────────────────────────────────────────
@@ -313,7 +315,7 @@ async def test_update_widget(db_session: AsyncSession):
     )
     widget_id = uuid.UUID(widget["id"])
     result = await workspace_service.update_widget(
-        db_session, seed["tenant"].id, widget_id,
+        db_session, seed["tenant"].id, ws_id, widget_id,
         position_x=2, position_y=3, width=4, height=2,
     )
     assert result is not None
@@ -335,7 +337,7 @@ async def test_delete_widget(db_session: AsyncSession):
         db_session, seed["tenant"].id, ws_id, widget_key="test_widget",
     )
     widget_id = uuid.UUID(widget["id"])
-    deleted = await workspace_service.delete_widget(db_session, seed["tenant"].id, widget_id)
+    deleted = await workspace_service.delete_widget(db_session, seed["tenant"].id, ws_id, widget_id)
     assert deleted is True
     result = await workspace_service.get_widgets(db_session, seed["tenant"].id, ws_id)
     assert len(result) == 0
@@ -417,216 +419,3 @@ async def test_cross_tenant_user_assignment_blocked(db_session: AsyncSession):
     assert result is True
 
 
-# ─── Manager Role Check ───────────────────────────────────────
-
-
-@pytest.mark.asyncio
-async def test_is_workspace_manager(db_session: AsyncSession):
-    """Creator is auto-assigned as manager; a regular member is not a manager."""
-    seed = await _seed_tenant_and_user(db_session)
-    created = await workspace_service.create_workspace(
-        db_session, seed["tenant"].id, seed["user"].id, name="TestWS",
-    )
-    ws_id = uuid.UUID(created["id"])
-
-    # Creator should be manager
-    is_mgr = await workspace_service.is_workspace_manager(
-        db_session, seed["tenant"].id, ws_id, seed["user"].id,
-    )
-    assert is_mgr is True
-
-    # Create a member (not manager)
-    user2 = User(
-        email="member@example.com", name="Member", password_hash="dummy",
-        is_active=True, preferences={},
-    )
-    db_session.add(user2)
-    await db_session.flush()
-    ut2 = UserTenant(user_id=user2.id, tenant_id=seed["tenant"].id, is_default=True, role="viewer")
-    db_session.add(ut2)
-    await db_session.flush()
-
-    await workspace_service.assign_user(
-        db_session, seed["tenant"].id, ws_id, user2.id, role="member",
-    )
-
-    is_mgr2 = await workspace_service.is_workspace_manager(
-        db_session, seed["tenant"].id, ws_id, user2.id,
-    )
-    assert is_mgr2 is False
-
-
-# ─── Default Workspace Seeding ────────────────────────────────
-
-
-@pytest.mark.asyncio
-async def test_seed_default_workspace(db_session: AsyncSession):
-    """seed_default_workspace creates a default workspace with all standard modules."""
-    seed = await _seed_tenant_and_user(db_session)
-    result = await workspace_service.seed_default_workspace(
-        db_session, seed["tenant"].id, seed["user"].id,
-    )
-    assert result is not None
-    assert result["name"] == "Standard"
-    assert result["is_default"] is True
-    assert result["user_count"] == 1
-
-
-@pytest.mark.asyncio
-async def test_seed_default_workspace_idempotent(db_session: AsyncSession):
-    """seed_default_workspace returns None if workspaces already exist."""
-    seed = await _seed_tenant_and_user(db_session)
-    # First call creates the default workspace
-    await workspace_service.seed_default_workspace(
-        db_session, seed["tenant"].id, seed["user"].id,
-    )
-    # Second call should return None (already has workspaces)
-    result = await workspace_service.seed_default_workspace(
-        db_session, seed["tenant"].id, seed["user"].id,
-    )
-    assert result is None
-
-
-# ─── Set User Default Workspace ───────────────────────────────
-
-
-@pytest.mark.asyncio
-async def test_set_user_default_workspace(db_session: AsyncSession):
-    """set_user_default_workspace sets a workspace as default and unsets others."""
-    seed = await _seed_tenant_and_user(db_session)
-    ws1 = await workspace_service.create_workspace(
-        db_session, seed["tenant"].id, seed["user"].id, name="WS1",
-    )
-    ws2 = await workspace_service.create_workspace(
-        db_session, seed["tenant"].id, seed["user"].id, name="WS2",
-    )
-    ws1_id = uuid.UUID(ws1["id"])
-    ws2_id = uuid.UUID(ws2["id"])
-
-    # Assign user to both
-    # (creator is already auto-assigned to both as manager)
-
-    # Set WS2 as default
-    await workspace_service.set_user_default_workspace(
-        db_session, seed["tenant"].id, seed["user"].id, ws2_id,
-    )
-
-    # Verify via get_my_workspaces
-    my = await workspace_service.get_my_workspaces(
-        db_session, seed["tenant"].id, seed["user"].id,
-    )
-    for item in my["items"]:
-        if item["id"] == ws2["id"]:
-            assert item["is_user_default"] is True
-        elif item["id"] == ws1["id"]:
-            assert item["is_user_default"] is False
-
-
-# ─── Workspace Context ────────────────────────────────────────
-
-
-@pytest.mark.asyncio
-async def test_workspace_context_includes_modules_and_widgets(db_session: AsyncSession):
-    """get_workspace_context returns both modules and widgets."""
-    seed = await _seed_tenant_and_user(db_session)
-    created = await workspace_service.create_workspace(
-        db_session, seed["tenant"].id, seed["user"].id, name="TestWS",
-    )
-    ws_id = uuid.UUID(created["id"])
-
-    # Set modules
-    await workspace_service.set_workspace_modules(
-        db_session, seed["tenant"].id, ws_id,
-        [{"module_key": "contacts", "is_visible": True, "menu_order": 10, "config": {}}],
-    )
-
-    # Create widget
-    await workspace_service.create_widget(
-        db_session, seed["tenant"].id, ws_id, widget_key="recent_contacts",
-    )
-
-    ctx = await workspace_service.get_workspace_context(
-        db_session, seed["tenant"].id, seed["user"].id, ws_id,
-    )
-    assert ctx is not None
-    assert len(ctx["modules"]) == 1
-    assert ctx["modules"][0]["module_key"] == "contacts"
-    assert len(ctx["widgets"]) == 1
-    assert ctx["widgets"][0]["widget_key"] == "recent_contacts"
-
-
-@pytest.mark.asyncio
-async def test_workspace_context_unassigned_user(db_session: AsyncSession):
-    """get_workspace_context returns None for an unassigned user."""
-    seed = await _seed_tenant_and_user(db_session)
-    created = await workspace_service.create_workspace(
-        db_session, seed["tenant"].id, seed["user"].id, name="TestWS",
-    )
-    ws_id = uuid.UUID(created["id"])
-
-    # Create a second user NOT assigned to the workspace
-    user2 = User(
-        email="unassigned@example.com", name="Unassigned", password_hash="dummy",
-        is_active=True, preferences={},
-    )
-    db_session.add(user2)
-    await db_session.flush()
-    ut2 = UserTenant(user_id=user2.id, tenant_id=seed["tenant"].id, is_default=True, role="viewer")
-    db_session.add(ut2)
-    await db_session.flush()
-
-    ctx = await workspace_service.get_workspace_context(
-        db_session, seed["tenant"].id, user2.id, ws_id,
-    )
-    assert ctx is None  # User not assigned
-
-
-# ─── Cross-Tenant Isolation ───────────────────────────────────
-
-
-@pytest.mark.asyncio
-async def test_cross_tenant_workspace_isolation(db_session: AsyncSession):
-    """A workspace from tenant A cannot be accessed by tenant B."""
-    seed_a = await _seed_tenant_and_user(db_session)
-    seed_b = await _seed_second_tenant_and_user(db_session)
-
-    created = await workspace_service.create_workspace(
-        db_session, seed_a["tenant"].id, seed_a["user"].id, name="TenantA_WS",
-    )
-    ws_id = uuid.UUID(created["id"])
-
-    # Tenant B should not see tenant A's workspace
-    result = await workspace_service.get_workspace(
-        db_session, seed_b["tenant"].id, ws_id,
-    )
-    assert result is None  # Not found in tenant B
-
-
-@pytest.mark.asyncio
-async def test_get_my_workspaces_only_assigned(db_session: AsyncSession):
-    """get_my_workspaces returns only workspaces the user is assigned to."""
-    seed = await _seed_tenant_and_user(db_session)
-    ws1 = await workspace_service.create_workspace(
-        db_session, seed["tenant"].id, seed["user"].id, name="AssignedWS",
-    )
-    ws2 = await workspace_service.create_workspace(
-        db_session, seed["tenant"].id, seed["user"].id, name="AlsoAssignedWS",
-    )
-
-    # Create a third workspace without assigning the user
-    ws3 = Workspace(
-        tenant_id=seed["tenant"].id,
-        name="UnassignedWS",
-        is_active=True,
-        created_by=seed["user"].id,
-    )
-    db_session.add(ws3)
-    await db_session.flush()
-
-    my = await workspace_service.get_my_workspaces(
-        db_session, seed["tenant"].id, seed["user"].id,
-    )
-    names = [w["name"] for w in my["items"]]
-    assert "AssignedWS" in names
-    assert "AlsoAssignedWS" in names
-    assert "UnassignedWS" not in names  # User not assigned