ФУНКЦИИ - МЕЖПРОЕКТНАЯ КОММУНИКАЦИЯ: guest-доступ Operational Core

server/dev-server.mjs

@@ -1449,6 +1449,16 @@ app.post("/api/admin/access/user-service", requireLauncherAdmin, asyncRoute(asyn
     return;
   }
 
+  const snapshot = controlPlaneStore.getSnapshot(req.nodedcSession.user);
+  if (isPublicTaskManagerGuestServiceAssignment(snapshot.data, req.body)) {
+    res.status(400).json({
+      ok: false,
+      error: "task_manager_public_guest_not_assignable",
+      message: "Workspace Guest выдаётся только через настройки Operational Core.",
+    });
+    return;
+  }
+
   const result = await controlPlaneStore.setUserServiceAccess(req.body, req.nodedcSession.user);
   const syncResult = await syncUsersToAuthentik(result.data, [req.body?.userId], req.nodedcSession.user);
   publishControlPlaneEvent("admin.access.user-service.updated", syncResult.userIds);
@@ -2181,6 +2191,24 @@ function normalizeTaskManagerRole(value) {
   return value === "guest" || value === "admin" || value === "member" ? value : null;
 }
 
+function isPublicTaskManagerGuestServiceAssignment(data, payload) {
+  if (payload?.value !== "viewer") return false;
+
+  const service = data.services.find((candidate) => candidate.id === payload?.serviceId);
+  if (!service || !isTaskManagerService(service)) return false;
+
+  return data.memberships.some(
+    (membership) =>
+      membership.userId === payload?.userId &&
+      membership.clientId === publicPoolClientId &&
+      membership.status === "active"
+  );
+}
+
+function isTaskManagerService(service) {
+  return service?.slug === "task-manager" || service?.authentikApplicationSlug === "task-manager";
+}
+
 function resolveTaskManagerRoleForMembership(role) {
   return role === "client_owner" || role === "client_admin" ? "admin" : "member";
 }