fix(device-core): allow workspace reads in readonly transactions

device-plane/services/device-control-core/src/lifecycle-repository.mjs

@@ -505,7 +505,14 @@ async function transferDevice(client, actor, command) {
   };
 }
 
-export async function findProjectWithCapability(client, actor, projectId, capability) {
+export async function findProjectWithCapability(
+  client,
+  actor,
+  projectId,
+  capability,
+  { lock = true } = {},
+) {
+  const projectLockClause = lock ? "for share of p, os" : "";
   const result = await client.query(
     `select p.id, p.owner_scope_id, p.project_key, p.name, p.description,
       p.lifecycle_state, p.created_at, p.updated_at,
@@ -514,7 +521,7 @@ export async function findProjectWithCapability(client, actor, projectId, capabi
     from device_projects p
     join device_owner_scopes os on os.id = p.owner_scope_id
     where p.id = $1
-    for share of p, os`,
+    ${projectLockClause}`,
     [projectId],
   );
   const project = result.rows[0];
@@ -531,7 +538,7 @@ export async function findProjectWithCapability(client, actor, projectId, capabi
     from device_project_grants
     where project_id = $1
     order by created_at, id
-    for share`,
+    ${lock ? "for share" : ""}`,
     [projectId],
   );
   assertProjectCapability(

device-plane/services/device-control-core/src/project-query-repository.mjs

@@ -52,6 +52,7 @@ export async function getDeviceProjectWorkspace(client, actor, projectId) {
     actor,
     projectId,
     "project.read",
+    { lock: false },
   );
   const grantsResult = await client.query(
     `select id, principal_kind, principal_ref, project_role,