feat(auth): include authentication in workspace and tht diagnostics

backend/src/routes/workspaces.ts

@@ -16,19 +16,21 @@ import {
   type WorkspaceDescriptor,
 } from "../workspaces/schema.js";
 import type { RuntimeBindings } from "../workspaces/runtime-renderer.js";
-import type { WorkspaceDiagnostics } from "../workspaces/diagnostics.js";
+import type { ConnectorDiagnostics } from "../workspaces/diagnostics.js";
 import { isPrincipalContext, requirePermission } from "../auth/authorization.js";
+import type { AuthDiagnoser } from "../auth/diagnostics.js";
 
 export type WorkspaceDiagnoser = (
   workspace: WorkspaceDescriptor,
   bindings: RuntimeBindings,
   options: { writeProbe: boolean },
-) => Promise<WorkspaceDiagnostics>;
+) => Promise<ConnectorDiagnostics>;
 
 interface WorkspaceRoutesDeps {
   registry: WorkspaceRegistry;
   config: WorkspaceRegistryConfig;
   diagnose: WorkspaceDiagnoser;
+  authDiagnoser: AuthDiagnoser;
   secretStore: WorkspaceSecretStore;
 }
 
@@ -147,7 +149,14 @@ export function workspaceRoutes(app: FastifyInstance, deps: WorkspaceRoutesDeps)
     try {
       const { workspace } = workspacePayload.parse(request.body);
       const canonical = validateWorkspaceDescriptor(workspace);
-      return { workspace: canonical, contract: buildInstallationContract(canonical) };
+      const authentication = await deps.authDiagnoser.inspect({ live: false });
+      return {
+        workspace: canonical,
+        contract: buildInstallationContract(canonical),
+        activatable: authentication.ready,
+        diagnostics: [],
+        authentication,
+      };
     } catch (error) {
       return errorReply(reply, error);
     }
@@ -222,7 +231,15 @@ export function workspaceRoutes(app: FastifyInstance, deps: WorkspaceRoutesDeps)
         deps.secretStore,
       );
       try {
-        return await deps.diagnose(operational, lease.bindings, { writeProbe: false });
+        const [workspaceDiagnostics, authentication] = await Promise.all([
+          deps.diagnose(operational, lease.bindings, { writeProbe: false }),
+          deps.authDiagnoser.inspect({ live: true }),
+        ]);
+        return {
+          ...workspaceDiagnostics,
+          activatable: workspaceDiagnostics.activatable && authentication.ready,
+          authentication,
+        };
       } finally {
         lease.release();
       }