feat: complete catalog sensitivity enhancements

backend/src/routes/workspaces.ts

@@ -16,23 +16,33 @@ import {
   type WorkspaceDescriptor,
 } from "../workspaces/schema.js";
 import type { RuntimeBindings } from "../workspaces/runtime-renderer.js";
-import type { ConnectorDiagnostics } from "../workspaces/diagnostics.js";
+import type {
+  ConnectorDiagnostics,
+  Diagnostic,
+  WorkspaceDiagnosticOptions,
+} from "../workspaces/diagnostics.js";
 import { isPrincipalContext, requirePermission } from "../auth/authorization.js";
 import type { AuthDiagnoser } from "../auth/diagnostics.js";
 import { decodeAuthDiagnostics, type AuthDiagnostics } from "../auth/group-catalog.js";
+import type { WorkspaceDatabase } from "../catalog/types.js";
 
 export type WorkspaceDiagnoser = (
   workspace: WorkspaceDescriptor,
   bindings: RuntimeBindings,
-  options: { writeProbe: boolean },
+  options: WorkspaceDiagnosticOptions,
 ) => Promise<ConnectorDiagnostics>;
 
+export type WorkspaceDatabaseTester = (
+  workspaceId: string,
+) => Promise<WorkspaceDatabase | undefined>;
+
 interface WorkspaceRoutesDeps {
   registry: WorkspaceRegistry;
   config: WorkspaceRegistryConfig;
   diagnose: WorkspaceDiagnoser;
   authDiagnoser: AuthDiagnoser;
   secretStore: WorkspaceSecretStore;
+  testDatabaseConnection: WorkspaceDatabaseTester;
 }
 
 const workspaceId = z.string().regex(/^[a-z][a-z0-9-]{2,62}$/);
@@ -56,6 +66,20 @@ const SAFE_MESSAGES = {
   semantic_index_incompatible: "Semantic index is incompatible with this workspace.",
 } as const;
 
+const catalogConnectionUnavailable = (): Diagnostic => ({
+  level: "error",
+  code: "connector_unavailable",
+  field: "dwh",
+  message: "The configured database could not be reached or authenticated.",
+});
+
+const catalogConnectionMissing = (): Diagnostic => ({
+  level: "error",
+  code: "binding_missing",
+  field: "dwh",
+  message: "Configure this workspace in Database Management before testing connections.",
+});
+
 function authenticationReport(value: unknown): AuthDiagnostics {
   const report = decodeAuthDiagnostics(value);
   if (!report) throw new Error("invalid authentication diagnostic report");
@@ -238,14 +262,33 @@ export function workspaceRoutes(app: FastifyInstance, deps: WorkspaceRoutesDeps)
         deps.secretStore,
       );
       try {
-        const [workspaceDiagnostics, inspectedAuthentication] = await Promise.all([
-          deps.diagnose(operational, lease.bindings, { writeProbe: false }),
+        const [workspaceDiagnostics, testedDatabase, inspectedAuthentication] = await Promise.all([
+          deps.diagnose(operational, lease.bindings, {
+            writeProbe: false,
+            skipDwh: true,
+          }),
+          deps.testDatabaseConnection(id),
           deps.authDiagnoser.inspect({ live: true }),
         ]);
         const authentication = authenticationReport(inspectedAuthentication);
+        const catalogConnectionReady = testedDatabase?.connectionStatus === "reachable";
+        const catalogConnectionDiagnostic = !testedDatabase
+          ? catalogConnectionMissing()
+          : catalogConnectionReady
+            ? undefined
+            : catalogConnectionUnavailable();
+        const diagnostics = catalogConnectionDiagnostic
+          ? [
+            ...workspaceDiagnostics.diagnostics.filter(({ code }) => code !== "binding_ok"),
+            catalogConnectionDiagnostic,
+          ]
+          : workspaceDiagnostics.diagnostics;
         return {
           ...workspaceDiagnostics,
-          activatable: workspaceDiagnostics.activatable && authentication.ready,
+          activatable: workspaceDiagnostics.activatable
+            && catalogConnectionReady
+            && authentication.ready,
+          diagnostics,
           authentication,
         };
       } finally {