fix(workspace): resolve workspace items from partner presentations (issue #1267)

When a user requests a workspace item (/files/workspace-items/...) that was
generated in a Partner Chat session, resolve_published_item must search the
partner's workspace presentations in addition to the user's direct bindings.

Previously, the function only checked user bindings and raised 'The workspace
is no longer registered for this user' for partner-generated items (404 in UI).

Changes:
- resolve_published_item now searches candidate_roots (user + all visible partners)
- Gracefully handles partners without the requested workspace
- Maintains security: searches only visible_partners() that the user can access
- Backward compatible: user's direct bindings take precedence

This completes the fix for issue #1267 Partner Chat Artifact Downloads.
The outputs endpoint (commit 0d1696a) and workspace routers are already fixed;
this addresses workspace-items endpoint for partner artifacts.

Test: test_resolve_published_item_searches_partner_workspaces verifies fallback
behavior with mocked partner workspaces.

Fixes: #1267

Author: sjagadee

deeptutor/services/workspace/service.py

@@ -19,7 +19,10 @@
 
 from deeptutor.core.context import WorkspaceRuntimeContext
 from deeptutor.multi_user.context import get_current_user
+from deeptutor.multi_user.partner_access import visible_partners
+from deeptutor.multi_user.paths import get_path_service_for_scope
 from deeptutor.services.path_service import get_path_service
+from deeptutor.services.partners.scope import partner_scope
 from deeptutor.services.settings.interface_settings import atomic_update
 from deeptutor.utils.secret_files import ensure_private_directory
 
@@ -772,31 +775,74 @@ def export_once(
     def resolve_published_item(
         self, workspace_id: str, workspace_item_id: str
     ) -> tuple[Path, WorkspaceItem]:
+        """Resolve a published workspace item from the user's workspace or visible partner workspaces.
+        
+        Tries the user's direct workspace bindings first, then searches visible
+        partner workspace presentations if the item is not found (issue #1267).
+        """
         if not re.fullmatch(r"wsi_[0-9a-f]{32}", workspace_item_id):
             raise WorkspaceError("Invalid workspace item id.")
-        binding = self.binding_by_id(workspace_id)
-        root = self._presentation_root(binding)
-        for directory in (root / "items", root / "blobs"):
-            if directory.is_symlink():
-                raise WorkspaceError(
-                    "The private workspace presentation path cannot contain symbolic links."
-                )
-        manifest_path = root / "items" / f"{workspace_item_id}.json"
-        try:
-            payload = json.loads(manifest_path.read_text(encoding="utf-8"))
-            item = WorkspaceItem(**payload)
-        except (OSError, json.JSONDecodeError, TypeError) as exc:
-            raise WorkspaceError("The presented workspace item is unavailable.") from exc
-        if item.workspace_id != workspace_id or item.workspace_item_id != workspace_item_id:
-            raise WorkspaceError("The workspace item manifest is invalid.")
-        blob = (root / "blobs" / item.sha256).resolve()
+
+        candidate_roots: list[Path] = []
+        
+        # Try user's direct workspace binding first
         try:
-            blob.relative_to(root.resolve())
-        except ValueError as exc:
-            raise WorkspaceError("The workspace item path is invalid.") from exc
-        if not blob.is_file():
-            raise WorkspaceError("The presented workspace item is unavailable.")
-        return blob, item
+            binding = self.binding_by_id(workspace_id)
+            candidate_roots.append(self._presentation_root(binding))
+        except WorkspaceError:
+            pass
+
+        # Search visible partner workspace presentations if user's binding misses
+        if not candidate_roots:
+            try:
+                for partner in visible_partners():
+                    partner_id = str(partner.get("partner_id") or "").strip()
+                    if not partner_id:
+                        continue
+                    try:
+                        p_path_svc = get_path_service_for_scope(partner_scope(partner_id))
+                        p_ws_service = ContentWorkspaceService(
+                            path_service=p_path_svc,
+                            auth_scopes=self.auth_scopes,
+                        )
+                        p_binding = p_ws_service.binding_by_id(workspace_id)
+                        candidate_roots.append(p_ws_service._presentation_root(p_binding))
+                    except (WorkspaceError, Exception):
+                        # Partner doesn't have this workspace; try the next
+                        continue
+            except Exception:
+                pass
+
+        if not candidate_roots:
+            raise WorkspaceError("The workspace is no longer registered for this user.")
+
+        # Search candidate roots for the workspace item
+        for root in candidate_roots:
+            for directory in (root / "items", root / "blobs"):
+                if directory.is_symlink():
+                    raise WorkspaceError(
+                        "The private workspace presentation path cannot contain symbolic links."
+                    )
+            manifest_path = root / "items" / f"{workspace_item_id}.json"
+            if not manifest_path.is_file():
+                continue
+            try:
+                payload = json.loads(manifest_path.read_text(encoding="utf-8"))
+                item = WorkspaceItem(**payload)
+            except (OSError, json.JSONDecodeError, TypeError) as exc:
+                raise WorkspaceError("The presented workspace item is unavailable.") from exc
+            if item.workspace_id != workspace_id or item.workspace_item_id != workspace_item_id:
+                raise WorkspaceError("The workspace item manifest is invalid.")
+            blob = (root / "blobs" / item.sha256).resolve()
+            try:
+                blob.relative_to(root.resolve())
+            except ValueError as exc:
+                raise WorkspaceError("The workspace item path is invalid.") from exc
+            if not blob.is_file():
+                raise WorkspaceError("The presented workspace item is unavailable.")
+            return blob, item
+
+        raise WorkspaceError("The presented workspace item is unavailable.")
 
 
 _service = ContentWorkspaceService()

tests/services/workspace/test_content_workspace.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
-
 from pathlib import Path
+from unittest.mock import patch
+
 
 import pytest
 
@@ -151,6 +152,63 @@ def test_private_presentation_store_rejects_symlink_redirection(
     assert not any(outside.iterdir())
 
 
+def test_resolve_published_item_searches_partner_workspaces(
+    workspace_service, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Verify that resolve_published_item falls back to partner workspaces (issue #1267).
+    
+    When a workspace item is not found in the user's direct bindings, the service
+    should search visible partner workspace presentations before raising an error.
+    """
+
+
+    user_service, paths = workspace_service
+    
+    # Create item in user's workspace
+    user_binding = user_service.current_binding(ensure_output=True)
+    user_source = user_binding.root / "document.md"
+    user_source.write_text("user document", encoding="utf-8")
+    user_item = user_service.publish(user_binding, [{"path": "document.md", "title": "Doc"}])[0]
+
+    # Verify user can resolve their own item
+    blob, loaded = user_service.resolve_published_item(
+        user_item.workspace_id, user_item.workspace_item_id
+    )
+    assert blob.read_text(encoding="utf-8") == "user document"
+
+    # Create a separate partner workspace with an item
+    partner_root = tmp_path / "partner_workspace"
+    partner_root.mkdir()
+    partner_paths = PathService(workspace_root=partner_root / "runtime")
+    partner_paths.ensure_all_directories()
+
+    partner_service = ContentWorkspaceService(path_service=partner_paths)
+    partner_binding = partner_service.current_binding(ensure_output=True)
+    partner_source = partner_binding.root / "partner_doc.md"
+    partner_source.write_text("partner document", encoding="utf-8")
+    partner_item = partner_service.publish(partner_binding, [{"path": "partner_doc.md", "title": "Partner Doc"}])[0]
+
+    # Mock visible_partners to return the partner workspace
+    mock_partner = {
+        "partner_id": "test-partner-1",
+        "name": "Test Partner",
+    }
+
+    with patch("deeptutor.services.workspace.service.visible_partners") as mock_visible:
+        with patch("deeptutor.services.workspace.service.get_path_service_for_scope") as mock_get_scope:
+            # Setup mocks
+            mock_visible.return_value = [mock_partner]
+            mock_get_scope.return_value = partner_paths
+
+            # User should be able to resolve partner's item through fallback
+            blob, loaded = user_service.resolve_published_item(
+                partner_item.workspace_id, partner_item.workspace_item_id
+            )
+            assert blob.read_text(encoding="utf-8") == "partner document"
+            assert loaded.title == "Partner Doc"
+            assert loaded.workspace_item_id == partner_item.workspace_item_id
+
+
 def test_private_presentation_subdirectory_rejects_symlink_redirection(
     workspace_service, tmp_path: Path
 ) -> None: