feat(dashboard-api): project upsert, member sync and user purge

[ben-fornefeld]

Leaves 501 for every /v1/management operation except project deletion. Completes the cluster-side half of the contract belt's workspace-api calls (EN-1740, EN-1741, EN-1743).

What lands

Route	Behaviour
PUT /projects/{id}	Creates from a caller-supplied UUID on the default tier, or reconciles. 201 vs 200
PUT·DELETE /projects/{id}/members/{userId}	One shared implementation
POST /projects/{id}/members/batch	Same implementation, both directions in one transaction
DELETE /users/{id}	Memberships and access tokens; public.users survives

Contract changes

email is now required. The caller synchronizes every property in the upsert body and sends all of them on every push, so a reconcile is a complete statement of the project rather than a patch. Runtime-breaking for a caller that omits it.

project_type is gone. This side has no column for it and no opinion about the caller's plan vocabulary — the tier is assigned once at creation from a local default, and the limits that matter arrive absolute through upsertProjectLimits. Nothing sets additionalProperties: false, so a caller still sending the field has it ignored rather than rejected; the break is at their next codegen, not at runtime.

The handler branches on whether the project exists rather than on an insert failing, which is what makes "a create assigns the tier, a reconcile never touches it" visible in the code.

Why membership writes moved out of the handlers

Auth caches a copy of the team per member under <userID>-<teamID>, and InvalidateTeamCache discovers those keys by reading users_teams — so a member already removed is one it structurally cannot see. Writing and evicting from separate call sites leaves a revoked member authenticating until the entry expires.

internal/management makes that unrepresentable: the write and its evictions are one call. Three routes converge on it, so the per-member and batch paths cannot answer differently for the same desired state.

Two consequences worth flagging:

• Eviction covers every user the request named, not the rows that moved. A crash before the eviction leaves a stale entry only a retry clears, and that retry finds the work already done — keying off what the statement touched would make the recovery path a no-op.
• Membership changes evict pair keys only. Sweeping the team-wide entries too would evict every API key on the project for a change none of them observe.

Review caught the inverse of the first point in PurgeUser, fixed in 17128ae: it read the user's teams, then ran an unconditional delete, then evicted for the earlier read. Under READ COMMITTED those are separate statement snapshots. It is now DELETE ... RETURNING team_id, so the evicted set is the deleted set by construction.

Project deletion stays 501

envs, snapshots and volumes reference teams with ON DELETE NO ACTION and template deletion only stamps deleted_at, so any project that ever built one pins its team row. Releasing it needs the api service's orchestrator connections, which this process does not have.

Reason and the three ways out are recorded in the handler, with a test pinning the 501. Belt drops its caller separately.

Notes

• ADMIN_AUTH_PROVIDER_CONFIG is still absent from iac/provider-gcp/dashboard-api.tf, so these routes answer 401 in production until EN-2007.
• Cross-service ordering gaps found during review are tracked in EN-2012 rather than fixed here — they need workspace-api live to observe, and several want a decision rather than a fix.
• internal/management handles project, handlers handle team — the contract's word meeting the cluster's, translated at the call site.

[linear-code]

EN-1740

[cursor]

PR Summary

Medium Risk
Changes membership and auth cache behavior and tightens the management API contract (required email); incorrect eviction or slug conflict handling could affect access until cache TTL, but logic is transactional and tested.

Overview
Implements the cluster-side /v1/management contract for workspace residency: project upsert (create/reconcile teams by caller UUID, default tier on create only, required email, project_type removed), member sync (single, delete, and batch with contradiction checks) via internal/management with post-commit auth cache evictions, and user purge (memberships and access tokens; users row kept). Auth invalidates team/member cache entries with detached, bounded contexts so client disconnect does not skip eviction. Project delete stays 501 with documented rationale. OpenAPI and architecture docs updated; broad handler and integration tests added.

^{Reviewed by Cursor Bugbot for commit bf5b488. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
3647	1	3646	7

View the top 1 failed test(s) by shortest run time

github.com/e2b-dev/infra/tests/integration/internal/tests/api/metrics::TestSandboxMetrics

Stack Traces | 31.6s run time

=== RUN   TestSandboxMetrics
=== PAUSE TestSandboxMetrics
=== CONT  TestSandboxMetrics
    sandbox_metrics_test.go:26: 
        	Error Trace:	.../api/metrics/sandbox_metrics_test.go:26
        	Error:      	Condition never satisfied
        	Test:       	TestSandboxMetrics
        	Messages:   	sandbox metrics not available in time
    sandbox_metrics_test.go:28: 
        	Error Trace:	.../api/metrics/sandbox_metrics_test.go:28
        	            				.../hostedtoolcache/go/1.26.5.../src/runtime/asm_amd64.s:1771
        	Error:      	Received unexpected error:
        	            	Get "http://localhost:.../sandboxes/ilmxvtku798axjsejcrey/metrics": context canceled
        	Test:       	TestSandboxMetrics
--- FAIL: TestSandboxMetrics (31.61s)

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bb2b0667b6

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e498f2e. Configure here.}