feat: add workspace management features including member invitations and role updates

- Implemented API endpoints for managing workspace members (GET, POST, PATCH, DELETE).
- Added workspace creation and retrieval functionalities.
- Enhanced project model to associate with workspaces.
- Updated project member roles and access control logic.
- Created sign-out page and updated authentication flow.
- Modified header to include navigation to workspaces.
- Updated Prisma schema to include workspace and member models.
- Seed script updated to create demo workspaces and associated members.

app/api/projects/[projectId]/members/[memberId]/route.ts

@@ -0,0 +1,109 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { auth } from '@/lib/auth';
+import { ProjectMemberRole } from '@prisma/client';
+
+type RouteParams = { params: Promise<{ projectId: string; memberId: string }> };
+
+// PATCH /api/projects/[projectId]/members/[memberId] - Update member role
+export async function PATCH(request: NextRequest, { params }: RouteParams) {
+    try {
+        const session = await auth();
+        const { projectId, memberId } = await params;
+
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        const project = await db.project.findUnique({
+            where: { id: projectId },
+            include: { members: { where: { userId: session.user.id } } },
+        });
+
+        if (!project) {
+            return NextResponse.json({ error: 'Project not found' }, { status: 404 });
+        }
+
+        const isOwner = project.ownerId === session.user.id;
+        const isAdmin = project.members[0]?.role === ProjectMemberRole.ADMIN;
+
+        if (!isOwner && !isAdmin) {
+            return NextResponse.json({ error: 'Access denied' }, { status: 403 });
+        }
+
+        const body = await request.json();
+        const { role } = body;
+
+        const validRoles = ['ADMIN', 'COMMENTATOR'];
+        if (!validRoles.includes(role)) {
+            return NextResponse.json(
+                { error: 'Invalid role. Must be ADMIN or COMMENTATOR.' },
+                { status: 400 }
+            );
+        }
+
+        const member = await db.projectMember.update({
+            where: { id: memberId },
+            data: { role: role as ProjectMemberRole },
+            include: {
+                user: { select: { id: true, name: true, image: true } },
+            },
+        });
+
+        return NextResponse.json(member);
+    } catch (error) {
+        console.error('Error updating member role:', error);
+        return NextResponse.json(
+            { error: 'Failed to update member role' },
+            { status: 500 }
+        );
+    }
+}
+
+// DELETE /api/projects/[projectId]/members/[memberId] - Remove member
+export async function DELETE(request: NextRequest, { params }: RouteParams) {
+    try {
+        const session = await auth();
+        const { projectId, memberId } = await params;
+
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        const project = await db.project.findUnique({
+            where: { id: projectId },
+            include: { members: { where: { userId: session.user.id } } },
+        });
+
+        if (!project) {
+            return NextResponse.json({ error: 'Project not found' }, { status: 404 });
+        }
+
+        const isOwner = project.ownerId === session.user.id;
+        const isAdmin = project.members[0]?.role === ProjectMemberRole.ADMIN;
+
+        const memberToRemove = await db.projectMember.findUnique({
+            where: { id: memberId },
+        });
+
+        if (!memberToRemove) {
+            return NextResponse.json({ error: 'Member not found' }, { status: 404 });
+        }
+
+        const isSelf = memberToRemove.userId === session.user.id;
+
+        if (!isOwner && !isAdmin && !isSelf) {
+            return NextResponse.json({ error: 'Access denied' }, { status: 403 });
+        }
+
+        await db.projectMember.delete({ where: { id: memberId } });
+
+        return NextResponse.json({ success: true, message: 'Member removed' });
+    } catch (error) {
+        console.error('Error removing member:', error);
+        return NextResponse.json(
+            { error: 'Failed to remove member' },
+            { status: 500 }
+        );
+    }
+}

app/api/projects/[projectId]/members/route.ts

@@ -0,0 +1,153 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { auth } from '@/lib/auth';
+import { ProjectMemberRole } from '@prisma/client';
+
+type RouteParams = { params: Promise<{ projectId: string }> };
+
+// GET /api/projects/[projectId]/members - List members
+export async function GET(request: NextRequest, { params }: RouteParams) {
+    try {
+        const session = await auth();
+        const { projectId } = await params;
+
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        const project = await db.project.findUnique({
+            where: { id: projectId },
+            include: {
+                members: { where: { userId: session.user.id } },
+            },
+        });
+
+        if (!project) {
+            return NextResponse.json({ error: 'Project not found' }, { status: 404 });
+        }
+
+        const isOwner = project.ownerId === session.user.id;
+        const isMember = project.members.length > 0;
+
+        if (!isOwner && !isMember) {
+            return NextResponse.json({ error: 'Access denied' }, { status: 403 });
+        }
+
+        const members = await db.projectMember.findMany({
+            where: { projectId },
+            include: {
+                user: { select: { id: true, name: true, image: true } },
+            },
+            orderBy: { createdAt: 'asc' },
+        });
+
+        const owner = await db.user.findUnique({
+            where: { id: project.ownerId },
+            select: { id: true, name: true, image: true },
+        });
+
+        return NextResponse.json({ members, owner });
+    } catch (error) {
+        console.error('Error fetching project members:', error);
+        return NextResponse.json(
+            { error: 'Failed to fetch members' },
+            { status: 500 }
+        );
+    }
+}
+
+// POST /api/projects/[projectId]/members - Invite a member
+export async function POST(request: NextRequest, { params }: RouteParams) {
+    try {
+        const session = await auth();
+        const { projectId } = await params;
+
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        // Check if user is owner or admin
+        const project = await db.project.findUnique({
+            where: { id: projectId },
+            include: { members: { where: { userId: session.user.id } } },
+        });
+
+        if (!project) {
+            return NextResponse.json({ error: 'Project not found' }, { status: 404 });
+        }
+
+        const isOwner = project.ownerId === session.user.id;
+        const isAdmin = project.members[0]?.role === ProjectMemberRole.ADMIN;
+
+        if (!isOwner && !isAdmin) {
+            return NextResponse.json(
+                { error: 'Only project owners and admins can invite members' },
+                { status: 403 }
+            );
+        }
+
+        const body = await request.json();
+        const { email, role } = body;
+
+        if (!email || typeof email !== 'string') {
+            return NextResponse.json(
+                { error: 'Email is required' },
+                { status: 400 }
+            );
+        }
+
+        // Validate role
+        const validRoles = ['ADMIN', 'COMMENTATOR'];
+        const memberRole = validRoles.includes(role) ? role : 'COMMENTATOR';
+
+        // Find user by email
+        const userToInvite = await db.user.findUnique({
+            where: { email: email.toLowerCase().trim() },
+        });
+
+        if (!userToInvite) {
+            return NextResponse.json(
+                { message: 'If the user exists, an invitation has been sent.' },
+                { status: 200 }
+            );
+        }
+
+        if (userToInvite.id === project.ownerId) {
+            return NextResponse.json(
+                { error: 'Cannot invite the project owner as a member' },
+                { status: 400 }
+            );
+        }
+
+        // Check if already a member
+        const existingMember = await db.projectMember.findUnique({
+            where: { projectId_userId: { projectId, userId: userToInvite.id } },
+        });
+
+        if (existingMember) {
+            return NextResponse.json(
+                { error: 'User is already a member of this project' },
+                { status: 409 }
+            );
+        }
+
+        const member = await db.projectMember.create({
+            data: {
+                projectId,
+                userId: userToInvite.id,
+                role: memberRole as ProjectMemberRole,
+            },
+            include: {
+                user: { select: { id: true, name: true, image: true } },
+            },
+        });
+
+        return NextResponse.json(member, { status: 201 });
+    } catch (error) {
+        console.error('Error inviting project member:', error);
+        return NextResponse.json(
+            { error: 'Failed to invite member' },
+            { status: 500 }
+        );
+    }
+}

app/api/projects/[projectId]/route.ts

@@ -18,13 +18,29 @@ async function checkProjectAccess(projectId: string, userId: string) {
 
     const isOwner = project.ownerId === userId;
     const membership = project.members[0];
-    const role = isOwner ? 'OWNER' : membership?.role || null;
+    let role: string | null = isOwner ? 'OWNER' : membership?.role || null;
+
+    // Check workspace-level access if not already authorized
+    if (!isOwner && !membership) {
+        const wsMember = await db.workspaceMember.findUnique({
+            where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
+        });
+        const wsOwner = await db.workspace.findUnique({
+            where: { id: project.workspaceId },
+            select: { ownerId: true },
+        });
+        if (wsOwner?.ownerId === userId) {
+            role = 'OWNER';
+        } else if (wsMember) {
+            role = wsMember.role; // ADMIN or COMMENTATOR from workspace
+        }
+    }
 
     return {
         project,
         role,
-        canEdit: isOwner || role === ProjectMemberRole.ADMIN || role === ProjectMemberRole.EDITOR,
-        canDelete: isOwner,
+        canEdit: isOwner || role === 'OWNER' || role === ProjectMemberRole.ADMIN,
+        canDelete: isOwner || role === 'OWNER',
     };
 }
 
@@ -66,7 +82,25 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
         const isOwner = session?.user?.id === project.ownerId;
         const isMember = project.members.some(m => m.userId === session?.user?.id);
 
-        if (!isPublic && !isOwner && !isMember) {
+        // Check workspace membership
+        let isWorkspaceMember = false;
+        if (!isPublic && !isOwner && !isMember && session?.user?.id) {
+            const wsMember = await db.workspaceMember.findUnique({
+                where: {
+                    workspaceId_userId: {
+                        workspaceId: project.workspaceId,
+                        userId: session.user.id,
+                    },
+                },
+            });
+            const wsOwner = await db.workspace.findUnique({
+                where: { id: project.workspaceId },
+                select: { ownerId: true },
+            });
+            isWorkspaceMember = !!wsMember || wsOwner?.ownerId === session.user.id;
+        }
+
+        if (!isPublic && !isOwner && !isMember && !isWorkspaceMember) {
             return NextResponse.json({ error: 'Access denied' }, { status: 403 });
         }
 

app/api/projects/[projectId]/videos/[videoId]/route.ts

@@ -86,8 +86,7 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
         const isOwner = video.project.ownerId === session.user.id;
         const membership = video.project.members[0];
         const canEdit = isOwner ||
-            membership?.role === ProjectMemberRole.ADMIN ||
-            membership?.role === ProjectMemberRole.EDITOR;
+            membership?.role === ProjectMemberRole.ADMIN;
 
         if (!canEdit) {
             return NextResponse.json({ error: 'Access denied' }, { status: 403 });

app/api/projects/[projectId]/videos/[videoId]/versions/route.ts

@@ -76,8 +76,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
         const isOwner = video.project.ownerId === session.user.id;
         const membership = video.project.members[0];
         const canEdit = isOwner ||
-            membership?.role === ProjectMemberRole.ADMIN ||
-            membership?.role === ProjectMemberRole.EDITOR;
+            membership?.role === ProjectMemberRole.ADMIN;
 
         if (!canEdit) {
             return NextResponse.json({ error: 'Access denied' }, { status: 403 });

app/api/projects/[projectId]/videos/route.ts

@@ -64,7 +64,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         }
 
-        // Check project access (must be owner, admin, or editor)
+        // Check project access (must be owner or admin)
         const project = await db.project.findUnique({
             where: { id: projectId },
             include: { members: { where: { userId: session.user.id } } },
@@ -77,8 +77,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
         const isOwner = project.ownerId === session.user.id;
         const membership = project.members[0];
         const canEdit = isOwner ||
-            membership?.role === ProjectMemberRole.ADMIN ||
-            membership?.role === ProjectMemberRole.EDITOR;
+            membership?.role === ProjectMemberRole.ADMIN;
 
         if (!canEdit) {
             return NextResponse.json({ error: 'Access denied' }, { status: 403 });

app/api/projects/route.ts

@@ -15,17 +15,32 @@ export async function GET(request: NextRequest) {
         const { searchParams } = new URL(request.url);
         const page = parseInt(searchParams.get('page') || '1');
         const limit = parseInt(searchParams.get('limit') || '10');
+        const workspaceId = searchParams.get('workspaceId');
         const skip = (page - 1) * limit;
 
+        // Build base filter: user is owner OR a member
+        const baseFilter: Record<string, unknown> = {
+            OR: [
+                { ownerId: session.user.id },
+                { members: { some: { userId: session.user.id } } },
+                // Also include projects in workspaces where the user is a workspace member
+                ...(workspaceId ? [] : [{
+                    workspace: {
+                        members: { some: { userId: session.user.id } },
+                    },
+                }]),
+            ],
+        };
+
+        // Filter by workspace if provided
+        if (workspaceId) {
+            baseFilter.workspaceId = workspaceId;
+        }
+
         // Get projects where user is owner OR a member
         const [projects, total] = await Promise.all([
             db.project.findMany({
-                where: {
-                    OR: [
-                        { ownerId: session.user.id },
-                        { members: { some: { userId: session.user.id } } },
-                    ],
-                },
+                where: baseFilter,
                 include: {
                     owner: { select: { id: true, name: true, image: true } },
                     _count: { select: { videos: true, members: true } },
@@ -35,12 +50,7 @@ export async function GET(request: NextRequest) {
                 take: limit,
             }),
             db.project.count({
-                where: {
-                    OR: [
-                        { ownerId: session.user.id },
-                        { members: { some: { userId: session.user.id } } },
-                    ],
-                },
+                where: baseFilter,
             }),
         ]);
 
@@ -72,7 +82,7 @@ export async function POST(request: NextRequest) {
         }
 
         const body = await request.json();
-        const { name, description, visibility } = body;
+        const { name, description, visibility, workspaceId } = body;
 
         if (!name || typeof name !== 'string' || name.trim().length === 0) {
             return NextResponse.json(
@@ -81,6 +91,13 @@ export async function POST(request: NextRequest) {
             );
         }
 
+        if (!workspaceId || typeof workspaceId !== 'string') {
+            return NextResponse.json(
+                { error: 'A workspace is required. Every project must belong to a workspace.' },
+                { status: 400 }
+            );
+        }
+
         // Generate URL-friendly slug
         const baseSlug = name
             .toLowerCase()
@@ -99,6 +116,26 @@ export async function POST(request: NextRequest) {
             attempts++;
         }
 
+        // Verify user has access to the workspace
+        const workspace = await db.workspace.findUnique({
+            where: { id: workspaceId },
+            include: { members: { where: { userId: session.user.id } } },
+        });
+
+        if (!workspace) {
+            return NextResponse.json({ error: 'Workspace not found' }, { status: 404 });
+        }
+
+        const isWsOwner = workspace.ownerId === session.user.id;
+        const isWsAdmin = workspace.members[0]?.role === 'ADMIN';
+
+        if (!isWsOwner && !isWsAdmin) {
+            return NextResponse.json(
+                { error: 'Only workspace owners and admins can create projects' },
+                { status: 403 }
+            );
+        }
+
         const project = await db.project.create({
             data: {
                 name: name.trim(),
@@ -106,6 +143,7 @@ export async function POST(request: NextRequest) {
                 slug,
                 visibility: visibility || ProjectVisibility.PRIVATE,
                 ownerId: session.user.id,
+                workspaceId,
             },
             include: {
                 owner: { select: { id: true, name: true, image: true } },

app/api/workspaces/[workspaceId]/members/[memberId]/route.ts

@@ -0,0 +1,111 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { auth } from '@/lib/auth';
+import { WorkspaceMemberRole } from '@prisma/client';
+
+type RouteParams = { params: Promise<{ workspaceId: string; memberId: string }> };
+
+// PATCH /api/workspaces/[workspaceId]/members/[memberId] - Update member role
+export async function PATCH(request: NextRequest, { params }: RouteParams) {
+    try {
+        const session = await auth();
+        const { workspaceId, memberId } = await params;
+
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        // Check if user is owner or admin
+        const workspace = await db.workspace.findUnique({
+            where: { id: workspaceId },
+            include: { members: { where: { userId: session.user.id } } },
+        });
+
+        if (!workspace) {
+            return NextResponse.json({ error: 'Workspace not found' }, { status: 404 });
+        }
+
+        const isOwner = workspace.ownerId === session.user.id;
+        const isAdmin = workspace.members[0]?.role === WorkspaceMemberRole.ADMIN;
+
+        if (!isOwner && !isAdmin) {
+            return NextResponse.json({ error: 'Access denied' }, { status: 403 });
+        }
+
+        const body = await request.json();
+        const { role } = body;
+
+        const validRoles = ['ADMIN', 'COMMENTATOR'];
+        if (!validRoles.includes(role)) {
+            return NextResponse.json(
+                { error: 'Invalid role. Must be ADMIN or COMMENTATOR.' },
+                { status: 400 }
+            );
+        }
+
+        const member = await db.workspaceMember.update({
+            where: { id: memberId },
+            data: { role: role as WorkspaceMemberRole },
+            include: {
+                user: { select: { id: true, name: true, image: true } },
+            },
+        });
+
+        return NextResponse.json(member);
+    } catch (error) {
+        console.error('Error updating member role:', error);
+        return NextResponse.json(
+            { error: 'Failed to update member role' },
+            { status: 500 }
+        );
+    }
+}
+
+// DELETE /api/workspaces/[workspaceId]/members/[memberId] - Remove member
+export async function DELETE(request: NextRequest, { params }: RouteParams) {
+    try {
+        const session = await auth();
+        const { workspaceId, memberId } = await params;
+
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        const workspace = await db.workspace.findUnique({
+            where: { id: workspaceId },
+            include: { members: { where: { userId: session.user.id } } },
+        });
+
+        if (!workspace) {
+            return NextResponse.json({ error: 'Workspace not found' }, { status: 404 });
+        }
+
+        const isOwner = workspace.ownerId === session.user.id;
+        const isAdmin = workspace.members[0]?.role === WorkspaceMemberRole.ADMIN;
+
+        // Users can remove themselves, admins/owners can remove anyone
+        const memberToRemove = await db.workspaceMember.findUnique({
+            where: { id: memberId },
+        });
+
+        if (!memberToRemove) {
+            return NextResponse.json({ error: 'Member not found' }, { status: 404 });
+        }
+
+        const isSelf = memberToRemove.userId === session.user.id;
+
+        if (!isOwner && !isAdmin && !isSelf) {
+            return NextResponse.json({ error: 'Access denied' }, { status: 403 });
+        }
+
+        await db.workspaceMember.delete({ where: { id: memberId } });
+
+        return NextResponse.json({ success: true, message: 'Member removed' });
+    } catch (error) {
+        console.error('Error removing member:', error);
+        return NextResponse.json(
+            { error: 'Failed to remove member' },
+            { status: 500 }
+        );
+    }
+}

app/api/workspaces/[workspaceId]/members/route.ts

@@ -0,0 +1,154 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { auth } from '@/lib/auth';
+import { WorkspaceMemberRole } from '@prisma/client';
+
+type RouteParams = { params: Promise<{ workspaceId: string }> };
+
+// GET /api/workspaces/[workspaceId]/members - List members
+export async function GET(request: NextRequest, { params }: RouteParams) {
+    try {
+        const session = await auth();
+        const { workspaceId } = await params;
+
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        const workspace = await db.workspace.findUnique({
+            where: { id: workspaceId },
+            include: {
+                members: { where: { userId: session.user.id } },
+            },
+        });
+
+        if (!workspace) {
+            return NextResponse.json({ error: 'Workspace not found' }, { status: 404 });
+        }
+
+        const isOwner = workspace.ownerId === session.user.id;
+        const isMember = workspace.members.length > 0;
+
+        if (!isOwner && !isMember) {
+            return NextResponse.json({ error: 'Access denied' }, { status: 403 });
+        }
+
+        const members = await db.workspaceMember.findMany({
+            where: { workspaceId },
+            include: {
+                user: { select: { id: true, name: true, image: true } },
+            },
+            orderBy: { createdAt: 'asc' },
+        });
+
+        // Include the owner as well
+        const owner = await db.user.findUnique({
+            where: { id: workspace.ownerId },
+            select: { id: true, name: true, image: true },
+        });
+
+        return NextResponse.json({ members, owner });
+    } catch (error) {
+        console.error('Error fetching workspace members:', error);
+        return NextResponse.json(
+            { error: 'Failed to fetch members' },
+            { status: 500 }
+        );
+    }
+}
+
+// POST /api/workspaces/[workspaceId]/members - Invite a member
+export async function POST(request: NextRequest, { params }: RouteParams) {
+    try {
+        const session = await auth();
+        const { workspaceId } = await params;
+
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        // Check if user is owner or admin
+        const workspace = await db.workspace.findUnique({
+            where: { id: workspaceId },
+            include: { members: { where: { userId: session.user.id } } },
+        });
+
+        if (!workspace) {
+            return NextResponse.json({ error: 'Workspace not found' }, { status: 404 });
+        }
+
+        const isOwner = workspace.ownerId === session.user.id;
+        const isAdmin = workspace.members[0]?.role === WorkspaceMemberRole.ADMIN;
+
+        if (!isOwner && !isAdmin) {
+            return NextResponse.json(
+                { error: 'Only workspace owners and admins can invite members' },
+                { status: 403 }
+            );
+        }
+
+        const body = await request.json();
+        const { email, role } = body;
+
+        if (!email || typeof email !== 'string') {
+            return NextResponse.json(
+                { error: 'Email is required' },
+                { status: 400 }
+            );
+        }
+
+        // Validate role
+        const validRoles = ['ADMIN', 'COMMENTATOR'];
+        const memberRole = validRoles.includes(role) ? role : 'COMMENTATOR';
+
+        // Find user by email
+        const userToInvite = await db.user.findUnique({
+            where: { email: email.toLowerCase().trim() },
+        });
+
+        if (!userToInvite) {
+            return NextResponse.json(
+                { message: 'If the user exists, an invitation has been sent.' },
+                { status: 200 }
+            );
+        }
+
+        if (userToInvite.id === workspace.ownerId) {
+            return NextResponse.json(
+                { error: 'Cannot invite the workspace owner as a member' },
+                { status: 400 }
+            );
+        }
+
+        // Check if already a member
+        const existingMember = await db.workspaceMember.findUnique({
+            where: { workspaceId_userId: { workspaceId, userId: userToInvite.id } },
+        });
+
+        if (existingMember) {
+            return NextResponse.json(
+                { error: 'User is already a member of this workspace' },
+                { status: 409 }
+            );
+        }
+
+        const member = await db.workspaceMember.create({
+            data: {
+                workspaceId,
+                userId: userToInvite.id,
+                role: memberRole as WorkspaceMemberRole,
+            },
+            include: {
+                user: { select: { id: true, name: true, image: true } },
+            },
+        });
+
+        return NextResponse.json(member, { status: 201 });
+    } catch (error) {
+        console.error('Error inviting workspace member:', error);
+        return NextResponse.json(
+            { error: 'Failed to invite member' },
+            { status: 500 }
+        );
+    }
+}

app/api/workspaces/[workspaceId]/route.ts

@@ -0,0 +1,155 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { auth } from '@/lib/auth';
+
+type RouteParams = { params: Promise<{ workspaceId: string }> };
+
+// Helper to check workspace access
+async function checkWorkspaceAccess(workspaceId: string, userId: string) {
+    const workspace = await db.workspace.findUnique({
+        where: { id: workspaceId },
+        include: {
+            members: { where: { userId } },
+        },
+    });
+
+    if (!workspace) return { workspace: null, role: null, isOwner: false, isAdmin: false };
+
+    const isOwner = workspace.ownerId === userId;
+    const membership = workspace.members[0];
+    const role = isOwner ? 'OWNER' : membership?.role || null;
+
+    return {
+        workspace,
+        role,
+        isOwner,
+        isAdmin: isOwner || role === 'ADMIN',
+    };
+}
+
+// GET /api/workspaces/[workspaceId] - Get a single workspace
+export async function GET(request: NextRequest, { params }: RouteParams) {
+    try {
+        const session = await auth();
+        const { workspaceId } = await params;
+
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        const workspace = await db.workspace.findUnique({
+            where: { id: workspaceId },
+            include: {
+                owner: { select: { id: true, name: true, image: true } },
+                members: {
+                    include: {
+                        user: { select: { id: true, name: true, image: true } },
+                    },
+                },
+                projects: {
+                    orderBy: { updatedAt: 'desc' },
+                    include: {
+                        _count: { select: { videos: true, members: true } },
+                    },
+                },
+                _count: { select: { projects: true, members: true } },
+            },
+        });
+
+        if (!workspace) {
+            return NextResponse.json({ error: 'Workspace not found' }, { status: 404 });
+        }
+
+        // Check access
+        const isOwner = session?.user?.id === workspace.ownerId;
+        const isMember = workspace.members.some(m => m.userId === session?.user?.id);
+
+        if (!isOwner && !isMember) {
+            return NextResponse.json({ error: 'Access denied' }, { status: 403 });
+        }
+
+        return NextResponse.json(workspace);
+    } catch (error) {
+        console.error('Error fetching workspace:', error);
+        return NextResponse.json(
+            { error: 'Failed to fetch workspace' },
+            { status: 500 }
+        );
+    }
+}
+
+// PATCH /api/workspaces/[workspaceId] - Update a workspace
+export async function PATCH(request: NextRequest, { params }: RouteParams) {
+    try {
+        const session = await auth();
+        const { workspaceId } = await params;
+
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        const { isAdmin } = await checkWorkspaceAccess(workspaceId, session.user.id);
+        if (!isAdmin) {
+            return NextResponse.json({ error: 'Access denied' }, { status: 403 });
+        }
+
+        const body = await request.json();
+        const { name, description } = body;
+
+        const updateData: Record<string, unknown> = {};
+        if (name !== undefined) updateData.name = name.trim();
+        if (description !== undefined) updateData.description = description?.trim() || null;
+
+        const workspace = await db.workspace.update({
+            where: { id: workspaceId },
+            data: updateData,
+            include: {
+                owner: { select: { id: true, name: true, image: true } },
+                _count: { select: { projects: true, members: true } },
+            },
+        });
+
+        return NextResponse.json(workspace);
+    } catch (error) {
+        console.error('Error updating workspace:', error);
+        return NextResponse.json(
+            { error: 'Failed to update workspace' },
+            { status: 500 }
+        );
+    }
+}
+
+// DELETE /api/workspaces/[workspaceId] - Delete a workspace
+export async function DELETE(request: NextRequest, { params }: RouteParams) {
+    try {
+        const session = await auth();
+        const { workspaceId } = await params;
+
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        const { isOwner, workspace } = await checkWorkspaceAccess(workspaceId, session.user.id);
+
+        if (!workspace) {
+            return NextResponse.json({ error: 'Workspace not found' }, { status: 404 });
+        }
+
+        if (!isOwner) {
+            return NextResponse.json(
+                { error: 'Only the workspace owner can delete it' },
+                { status: 403 }
+            );
+        }
+
+        await db.workspace.delete({ where: { id: workspaceId } });
+
+        return NextResponse.json({ success: true, message: 'Workspace deleted' });
+    } catch (error) {
+        console.error('Error deleting workspace:', error);
+        return NextResponse.json(
+            { error: 'Failed to delete workspace' },
+            { status: 500 }
+        );
+    }
+}

app/api/workspaces/route.ts

@@ -0,0 +1,96 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { auth } from '@/lib/auth';
+
+// GET /api/workspaces - List all workspaces for the authenticated user
+export async function GET() {
+    try {
+        const session = await auth();
+
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        // Get workspaces where user is owner OR a member
+        const workspaces = await db.workspace.findMany({
+            where: {
+                OR: [
+                    { ownerId: session.user.id },
+                    { members: { some: { userId: session.user.id } } },
+                ],
+            },
+            include: {
+                owner: { select: { id: true, name: true, image: true } },
+                _count: { select: { projects: true, members: true } },
+            },
+            orderBy: { updatedAt: 'desc' },
+        });
+
+        return NextResponse.json({ workspaces });
+    } catch (error) {
+        console.error('Error fetching workspaces:', error);
+        return NextResponse.json(
+            { error: 'Failed to fetch workspaces' },
+            { status: 500 }
+        );
+    }
+}
+
+// POST /api/workspaces - Create a new workspace
+export async function POST(request: NextRequest) {
+    try {
+        const session = await auth();
+
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        const body = await request.json();
+        const { name, description } = body;
+
+        if (!name || typeof name !== 'string' || name.trim().length === 0) {
+            return NextResponse.json(
+                { error: 'Workspace name is required' },
+                { status: 400 }
+            );
+        }
+
+        // Generate slug
+        const baseSlug = name
+            .toLowerCase()
+            .trim()
+            .replace(/[^a-z0-9\s-]/g, '')
+            .replace(/\s+/g, '-')
+            .replace(/-+/g, '-');
+
+        let slug = baseSlug;
+        let attempts = 0;
+        while (attempts < 10) {
+            const existing = await db.workspace.findUnique({ where: { slug } });
+            if (!existing) break;
+            slug = `${baseSlug}-${Math.random().toString(36).substring(2, 6)}`;
+            attempts++;
+        }
+
+        const workspace = await db.workspace.create({
+            data: {
+                name: name.trim(),
+                description: description?.trim() || null,
+                slug,
+                ownerId: session.user.id,
+            },
+            include: {
+                owner: { select: { id: true, name: true, image: true } },
+                _count: { select: { projects: true, members: true } },
+            },
+        });
+
+        return NextResponse.json(workspace, { status: 201 });
+    } catch (error) {
+        console.error('Error creating workspace:', error);
+        return NextResponse.json(
+            { error: 'Failed to create workspace' },
+            { status: 500 }
+        );
+    }
+}