Gate workspace features by plan capability

[ComputelessComputer]

Summary:

• resolve workspace-scoped Team and Enterprise capabilities from Stripe entitlements
• enforce capabilities across privileged sharing and workspace RPCs
• gate desktop settings and enterprise capture by capability

Tests:

• pnpm exec supabase test db
• pnpm -F desktop test
• pnpm -r typecheck
• pnpm fmt:check
• pnpm -F desktop i18n:check
• pnpm exec oxlint --quiet --format=github apps/desktop/src/

---

Note

High Risk
Changes authorization across many security-definer RPCs, sharing flows, and SSO/SCIM enforcement; misconfiguration could block paid customers or leave features exposed.

Overview
Introduces workspace-scoped plan capabilities resolved from the workspace’s own Stripe entitlements (hyprnote_team / hyprnote_enterprise), so personal Pro no longer unlocks another workspace’s paid controls.

The backend adds get_workspace_access and capability helpers, then enforces named capabilities on management RPCs (members, policies, logo, subdomain, usage, SSO/SCIM/retention) and on shared-note actions via require_workspace_or_pro_capability for shared workspaces.

The desktop app loads access through getWorkspaceAccess and uses it in Team settings to show or hide admin UI (including Enterprise-only policy fields) and in enterprise capture sync to poll only workspaces with enterprise.capture.

^{Reviewed by Cursor Bugbot for commit a55994b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[netlify]

✅ Deploy Preview for anarlog ready!

Name	Link
🔨 Latest commit	a55994b
🔍 Latest deploy log	https://app.netlify.com/projects/anarlog/deploys/6a963381c557f5000835e2a6
😎 Deploy Preview	https://deploy-preview-7215--anarlog.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.