feat(server): improve context management (#15448)

#### PR Dependency Tree


* **PR #15448** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added workspace artifact upload, browsing, removal, deduplication, and
library ownership support.
* Copilot now supports scoped document and artifact search, canvas
reading, live editor context, and frontend tools.
* Added scope and focus selectors with source-resolution receipts in
chat.
* Added embedding health, progress, synchronization, and retrieval
capabilities.
* Added BYOK policy visibility, provider restrictions, endpoint dialect
selection, and validation.
* Added delegated editor interactions and userdata document
authorization.

* **Bug Fixes**
* Improved attachment handling, cancellation, access control, retrieval
fallbacks, workspace synchronization, and configuration validation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/native/src/userdata_acl.rs

@@ -0,0 +1,46 @@
+const USERDATA_PREFIX: &str = "userdata$";
+const TABLES: [&str; 3] = ["favorite", "settings", "docIntegrationRef"];
+
+pub(crate) fn authorize(user_id: &str, workspace_id: &str, doc_id: &str) -> bool {
+  if !doc_id.starts_with(USERDATA_PREFIX) {
+    return true;
+  }
+  let mut parts = doc_id.split('$');
+  let (Some("userdata"), Some(owner_id), Some(encoded_workspace_id), Some(table), None) =
+    (parts.next(), parts.next(), parts.next(), parts.next(), parts.next())
+  else {
+    return false;
+  };
+  owner_id != "__local__" && owner_id == user_id && encoded_workspace_id == workspace_id && TABLES.contains(&table)
+}
+
+pub(crate) fn doc_id(user_id: &str, workspace_id: &str, table: &str) -> Option<String> {
+  TABLES
+    .contains(&table)
+    .then(|| format!("userdata${user_id}${workspace_id}${table}"))
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  #[test]
+  fn userdata_subject_is_owner_only_and_closed() {
+    for table in TABLES {
+      let id = doc_id("user-a", "workspace-a", table).unwrap();
+      assert!(authorize("user-a", "workspace-a", &id));
+      assert!(!authorize("user-b", "workspace-a", &id));
+      assert!(!authorize("user-a", "workspace-b", &id));
+    }
+    for id in [
+      "userdata$user-a$workspace-a$unknown",
+      "userdata$user-a$favorite",
+      "userdata$__local__$workspace-a$favorite",
+      "userdata$$workspace-a$favorite",
+      "userdata$user-a$workspace-a$favorite$extra",
+    ] {
+      assert!(!authorize("user-a", "workspace-a", id));
+    }
+    assert!(authorize("user-a", "workspace-a", "ordinary-doc"));
+  }
+}