# TASK IMPLEMENTATION — S3-003

## WorkspaceMiddleware (Tenant Isolation)

You are implementing exactly one Sprint 3 task for the INVEETAIRE project.

Current project status:

* Sprint 0 ✅ Complete
* Sprint 1 ✅ Complete
* Sprint 2 ✅ Complete
* Database Foundation ✅ Complete
* S3-002 Security Hardening ✅ Complete

Your task is ONLY to implement the WorkspaceMiddleware.

Do not begin WS-001 or any later Sprint 3 task.

---

# Mandatory Reading

Read before implementation:

* AI.md v1.1
* WORKFLOW.md
* SPRINT3_PLANNING.md
* SPRINT3_EXECUTION_GUIDE.md
* Implementation Memory for S3-002

If any documentation conflict is discovered:

STOP.

Report the conflict.

Wait for approval.

---

# Objective

Implement:

App\Middleware\WorkspaceMiddleware

Purpose:

Enforce Workspace boundary validation for authenticated Couple and Crew requests.

The middleware is responsible ONLY for validation.

It must never:

* provision workspaces
* evaluate phases
* modify workspace data
* execute business logic
* write configuration
* perform checklist evaluation

---

# Scope

Create:

app/middleware/WorkspaceMiddleware.php

Modify only:

routes/couple.php

routes/crew.php

No other files are allowed to be modified.

---

# Functional Requirements

The middleware shall:

1.

Implement MiddlewareInterface.

2.

Remain completely stateless.

3.

Intercept Couple and Crew requests.

4.

Read workspace_snapshot from the authenticated session.

5.

For Couple and Crew:

* verify workspace exists
* verify workspace is active
* verify workspace is not purged
* verify authenticated user belongs to the workspace

6.

For Super Admin:

* bypass Workspace validation only for approved global administration pages
* if operating under an approved Support Session, validate the adopted workspace context
* do not assume unrestricted workspace access outside approved administrative workflows

7.

On validation failure:

Immediately stop execution.

Return:

ErrorHandler::renderForbidden()

Never redirect.

Never continue execution.

---

# Workspace Rules

Every workspace lookup must use parameterized PDO queries.

Never concatenate SQL.

Every workspace-scoped query must include:

WHERE workspace_id = :workspace_id

Never allow cross-workspace access.

---

# Constraints

Do NOT:

* create Workspace module
* create WorkspaceService
* create WorkspaceController
* create WorkspaceModel
* modify Auth module
* modify app/core/*
* modify Router
* modify BaseController
* modify MiddlewarePipeline
* modify database
* modify documentation
* perform git operations

---

# Verification

Before finishing:

* Run php -l on every modified PHP file.
* Verify middleware is stateless.
* Verify Couple validation.
* Verify Crew validation.
* Verify Super Admin bypass logic.
* Verify workspace isolation.
* Verify 403 response on validation failure.
* Verify only approved files were changed.

---

# Acceptance Criteria

* WorkspaceMiddleware implements MiddlewareInterface.
* Couple and Crew routes are protected.
* No cross-workspace access is possible.
* Workspace validation is read-only.
* Middleware performs no provisioning.
* Middleware performs no phase evaluation.
* Middleware performs no checklist evaluation.
* Middleware remains stateless.
* PHP syntax validation passes.
* Scope boundaries are respected.

---

# Output Report

Provide:

1. Files created.
2. Files modified.
3. Middleware workflow summary.
4. Validation logic summary.
5. Security verification.
6. Acceptance criteria checklist.
7. PHP syntax results.
8. Confirmation that no other Sprint 3 task was started.

Stop after the implementation report.

Wait for Human Approval.