[camielvs]

Description

The first of three foundation PRs for workspace secrets under team impersonation. Inside a project whose workspace maps to a team, secrets are managed and runs are submitted as that team: the backend's impersonation header is added to those specific requests only, never globally. This PR decides which team, if any, a set of projects acts as. Nothing here sends the header or changes a screen yet.

• getTeamImpersonationHeaderName reads the header name the host page injects as window.__TANGLE_TEAM_IMPERSONATION__. With none configured, as in a default deployment, every team lookup resolves to none and the app behaves exactly as today. It also refuses a name that isn't a valid header, or one the app's own requests already send, such as Authorization, which the team header would overwrite.
• teamRequestHeaders(teamId) is the one place the header is built. It returns {} without a configured header name or a team id.
• resolveTeamId is the one place that knows a workspace names its team through data.teamId, the interim contract until the backend has a field for it.
• readTeamMemberships is the one place that knows the teams map on GET /api/users/me. That map is fetched without the header; with it, the response describes the team and carries no teams. fetchTeamMemberships is its own lookup rather than the shared user query, which turns a failed request into an anonymous user for 30 minutes, so a failed lookup reports an error instead of "not a member".
• fetchTeamIdentity asks /api/users/me with the header. A team only counts as active when the backend answers as that team. That's because a nobody role passes impersonation with no access, and a backend that doesn't read the configured header still lists teams but answers as the user. canWrite comes from the permissions the backend returns rather than from role names.
• resolveTeam turns the lookups into one outcome, and useTeamForProjects gathers them. The outcome is one of none, resolving, active, not-member, unavailable, conflict (projects on different teams) or error.

Related Issue and Pull requests

• Followed by feat(secrets): scope secret storage to a team #2928 (team-scoped secret storage) and feat(runs): submit and manage runs as a team #2929 (run methods that act as a team).
• Supersedes the data-layer half of feat(projects): manage workspace secrets from a Tangent project #2886. That PR will be closed once its UI parts are extracted into the follow-up UI PRs.

Type of Change

• New feature

Line Breakdown

Category	Added	Removed
Production code	393	0
Tests	653	0
Config / CI / tooling	1	0
Total	1047	0

Checklist

• I have tested this does not break current pipelines / runs functionality
• I have tested the changes on staging

Screenshots (if applicable)

None. There's no UI change.

Test Instructions

pnpm vitest run src/config/teamImpersonation.test.ts src/services/teams

pnpm validate (format, lint, typecheck, knip) passes. No screen calls these hooks yet, so there's nothing to click through.

Additional Comments

• src/services/teams is added to react-compiler.config.js.
• useTeamForProjects reads projects and workspaces through the existing ProjectsQueryKeys / WorkspacesQueryKeys caches and treats a deleted project as absent rather than as an error.

🤖 Generated with Claude Code

[github-actions]

🎩 Preview

A preview build has been created at: cvs/team-context/2fe4639

[morgan-wowk]

Partial review. Left one blocking comment for now.

We will migrate later.