feat(core): add allowGuestDemoWorkspace flag to force login (#12779)

https://github.com/user-attachments/assets/41a659c9-6def-4492-be8e-5910eb148d6f

This PR enforces login‑first access (#8716) by disabling or enabling the
guest demo workspace via Admin Server Client Page and redirecting
unauthenticated users straight to `/sign‑in`.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a configuration option to control whether guest users can create
demo workspaces.
* Updated server and client interfaces, GraphQL schema, and queries to
support the new guest demo workspace flag.

* **Bug Fixes**
* Improved sign-out behavior to redirect users appropriately based on
guest demo workspace permissions.
* Enhanced navigation flow to handle guest demo workspace access and
user authentication state.

* **Tests**
* Added tests to verify sign-out logic when guest demo workspaces are
enabled or disabled.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: liuyi <forehalo@gmail.com>
Co-authored-by: fengmk2 <fengmk2@gmail.com>

packages/backend/server/src/core/config/config.ts

@@ -4,6 +4,7 @@ import { defineModuleConfig } from '../../base';
 
 export interface ServerFlags {
   earlyAccessControl: boolean;
+  allowGuestDemoWorkspace: boolean;
 }
 
 declare global {
@@ -75,4 +76,8 @@ defineModuleConfig('flags', {
     desc: 'Only allow users with early access features to access the app',
     default: false,
   },
+  allowGuestDemoWorkspace: {
+    desc: 'Whether allow guest users to create demo workspaces.',
+    default: true,
+  },
 });

packages/backend/server/src/core/config/resolver.ts

@@ -85,6 +85,7 @@ export class ServerConfigResolver {
       baseUrl: this.url.requestBaseUrl,
       type: env.DEPLOYMENT_TYPE,
       features: this.server.features,
+      allowGuestDemoWorkspace: this.config.flags.allowGuestDemoWorkspace,
     };
   }
 

packages/backend/server/src/core/config/types.ts

@@ -38,4 +38,9 @@ export class ServerConfigType {
 
   @Field(() => [ServerFeature], { description: 'enabled server features' })
   features!: ServerFeature[];
+
+  @Field(() => Boolean, {
+    description: 'Whether allow guest users to create demo workspaces.',
+  })
+  allowGuestDemoWorkspace!: boolean;
 }

packages/backend/server/src/core/version/config.ts

@@ -5,6 +5,7 @@ export interface VersionConfig {
     enabled: boolean;
     requiredVersion: string;
   };
+  allowGuestDemoWorkspace?: boolean;
 }
 
 declare global {
@@ -28,4 +29,8 @@ defineModuleConfig('client', {
     desc: "Allowed version range of the app that allowed to access the server. Requires 'client/versionControl.enabled' to be true to take effect.",
     default: '>=0.20.0',
   },
+  allowGuestDemoWorkspace: {
+    desc: 'Allow guests to access demo workspace.',
+    default: true,
+  },
 });