From 76966f7023d9e03aa46b311fa333e6a47448181c Mon Sep 17 00:00:00 2001
From: sabulous <sabri.sahin@seqera.io>
Date: Wed, 22 Jul 2026 11:12:29 +0200
Subject: [PATCH 1/5] feat(studios): add --allow-user to studios
 add/add-as-new/start and show allowed users in view

---
 .../cli/commands/studios/AddAsNewCmd.java     |  4 ++
 .../tower/cli/commands/studios/AddCmd.java    |  4 ++
 .../tower/cli/commands/studios/StartCmd.java  |  4 ++
 .../cli/responses/studios/StudiosView.java    |  2 +
 .../tower/cli/studios/StudiosCmdTest.java     | 61 +++++++++++++++++++
 5 files changed, 75 insertions(+)

diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java
index a8bd06fc6..f1e401eb2 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java
@@ -66,6 +66,9 @@ public class AddAsNewCmd extends AbstractStudiosCmd{
     @CommandLine.Option(names = {"--private"}, description = "Create a private studio that only you can access or manage (default: false)", defaultValue = "false")
     public Boolean isPrivate;
 
+    @CommandLine.Option(names = {"--allow-user"}, description = "ID of a user, besides the creator, allowed to connect to and start this studio when it is private.")
+    public List<Long> allowedUserIds;
+
     @CommandLine.Option(names = {"--labels"}, description = "Comma-separated list of labels", split = ",", converter = Label.StudioResourceLabelsConverter.class)
     public List<Label> labels;
 
@@ -99,6 +102,7 @@ DataStudioCreateRequest prepareRequest(DataStudioDto parentDataStudio, String pa
         }
         request.setLabelIds(getLabelIds(labels, wspId));
         request.setIsPrivate(isPrivate);
+        request.setAllowedUserIds(allowedUserIds);
         if (parentCheckpointId == null) {
             DataStudioListCheckpointsResponse response = studiosApi().listDataStudioCheckpoints(parentDataStudio.getSessionId(), parentDataStudio.getWorkspaceId(), null, 1, null);
             if (!response.getCheckpoints().isEmpty()) {
diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java
index 9729c8317..c790b56ac 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java
@@ -82,6 +82,9 @@ public class AddCmd extends AbstractStudiosCmd{
     @CommandLine.Option(names = {"--ssh"}, description = "Enable SSH connectivity to the studio (default: false).")
     public Boolean ssh;
 
+    @CommandLine.Option(names = {"--allow-user"}, description = "ID of a user, besides the creator, allowed to connect to and start this studio when it is private.")
+    public List<Long> allowedUserIds;
+
     @CommandLine.Option(names = {"--labels"}, description = "Comma-separated list of labels", split = ",", converter = Label.StudioResourceLabelsConverter.class)
     public List<Label> labels;
 
@@ -131,6 +134,7 @@ DataStudioCreateRequest prepareRequest(Long wspId) throws ApiException {
         if (description != null && !description.isEmpty()) {request.description(description);}
         request.setLabelIds(getLabelIds(labels, wspId));
         request.setIsPrivate(isPrivate);
+        request.setAllowedUserIds(allowedUserIds);
         if (spot != null) {
             request.setSpot(spot);
         }
diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java
index dcc2bb3ee..578facb5c 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java
@@ -64,6 +64,9 @@ public class StartCmd extends AbstractStudiosCmd {
     @CommandLine.Option(names = {"--ssh"}, description = "Optional override to enable SSH connectivity to the studio.")
     public Boolean ssh;
 
+    @CommandLine.Option(names = {"--allow-user"}, description = "Override the users, besides the creator, allowed to connect to and start this studio when it is private. Replaces the existing list; omit to leave it unchanged. Repeatable; currently limited to a single user. Only the studio creator may change it.")
+    public List<Long> allowedUserIds;
+
     @Override
     protected Response exec() throws ApiException {
         Long wspId = workspaceId(workspace.workspace);
@@ -115,6 +118,7 @@ private DataStudioStartRequest getStartRequestWithOverridesApplied(DataStudioDto
         request.setConfiguration(newConfig);
         request.setDescription(appliedDescription);
         request.setLabelIds(getLabelIds(labels, studioDto.getWorkspaceId()));
+        request.setAllowedUserIds(allowedUserIds);
         if (spot != null) {
             request.setSpot(spot);
         }
diff --git a/src/main/java/io/seqera/tower/cli/responses/studios/StudiosView.java b/src/main/java/io/seqera/tower/cli/responses/studios/StudiosView.java
index 9f62bd9aa..5a7eca78b 100644
--- a/src/main/java/io/seqera/tower/cli/responses/studios/StudiosView.java
+++ b/src/main/java/io/seqera/tower/cli/responses/studios/StudiosView.java
@@ -58,6 +58,8 @@ public void toString(PrintWriter out){
         table.addRow("Description", formatDescription(studio.getDescription(), 100));
         table.addRow("Created on", formatTime(studio.getDateCreated()));
         table.addRow("Created by", studioUser == null ? "NA" : String.format("%s | %s",studioUser.getUserName(), studioUser.getEmail()));
+        table.addRow("Allowed users", studio.getAllowedUsers() == null || studio.getAllowedUsers().isEmpty() ? "NA" : studio.getAllowedUsers()
+                .stream().map(u -> String.format("%s | %s", u.getUserName(), u.getEmail())).collect(java.util.stream.Collectors.joining(", ")));
         table.addRow("Template", studio.getTemplate() == null ? "NA" : studio.getTemplate().getRepository());
         table.addRow("Mounted data", studio.getMountedDataLinks() == null ? "NA" : studio.getMountedDataLinks()
                 .stream().map(DataLinkDto::getResourceRef).collect(java.util.stream.Collectors.joining(", ")));
diff --git a/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java b/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java
index d631b21f4..a94d6b1f1 100644
--- a/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java
+++ b/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java
@@ -48,6 +48,7 @@
 import java.util.List;
 
 import org.mockserver.client.MockServerClient;
+import org.mockserver.matchers.MatchType;
 import org.mockserver.model.MediaType;
 import org.mockserver.verify.VerificationTimes;
 
@@ -1310,6 +1311,66 @@ void testAddWithNonDefaultConfig(OutputType format, MockServerClient mock){
                 "http://localhost:"+mock.getPort()+"/orgs/organization1/workspaces/workspace1", false));
     }
 
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testAddPrivateWithAllowedUser(OutputType format, MockServerClient mock){
+        mock.when(
+                request().withMethod("GET").withPath("/user-info"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("user")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/user/1264/workspaces"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("workspaces/workspaces_list")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/studios/templates")
+                        .withQueryStringParameter("workspaceId", "75887156211589")
+                        .withQueryStringParameter("max", "20"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_templates_response")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/compute-envs")
+                        .withQueryStringParameter("status", "AVAILABLE")
+                        .withQueryStringParameter("workspaceId", "75887156211589"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody("{\"computeEnvs\":[{\"id\":\"vYOK4vn7spw7bHHWBDXZ2\",\"name\":\"demo\",\"platform\":\"aws-batch\",\"status\":\"AVAILABLE\",\"message\":null,\"lastUsed\":null,\"primary\":true,\"workspaceName\":null,\"visibility\":null}]}").withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/compute-envs/vYOK4vn7spw7bHHWBDXZ2"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("compute_env_demo")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        // Assert only the allow-list fields are sent; the rest of the create body is covered by other tests.
+        mock.when(
+                request().withMethod("POST").withPath("/studios")
+                        .withQueryStringParameter("workspaceId", "75887156211589")
+                        .withQueryStringParameter("autostart", "false")
+                        .withBody(json("""
+                           {
+                             "isPrivate": true,
+                             "allowedUserIds": [21]
+                           }
+                           """, MatchType.ONLY_MATCHING_FIELDS))
+                , exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_created_response")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        ExecOut out = exec(format, mock, "studios", "add", "-n", "studio-a66d", "-w", "75887156211589", "-t" ,"cr.seqera.io/public/data-studio-vscode:1.93.1-snapshot", "-c", "demo",
+        "--private", "--allow-user", "21");
+
+        assertOutput(format, out, new StudiosCreated("3e8370e7",75887156211589L, "[organization1 / workspace1]",
+                "http://localhost:"+mock.getPort()+"/orgs/organization1/workspaces/workspace1", false));
+    }
+
     @ParameterizedTest
     @EnumSource(OutputType.class)
     void testAddWithNonExistentLabel(OutputType format, MockServerClient mock){

From 7845de87e9d065781fe01a845d3136a89fdc14ea Mon Sep 17 00:00:00 2001
From: sabulous <sabri.sahin@seqera.io>
Date: Wed, 22 Jul 2026 11:47:25 +0200
Subject: [PATCH 2/5] fix(studios): fetch full studio detail when looking up by
 name

---
 .../commands/studios/AbstractStudiosCmd.java  |  11 +-
 .../tower/cli/studios/StudiosCmdTest.java     | 110 ++++++++++++++++++
 ...dios_view_response_with_allowed_users.json |  72 ++++++++++++
 3 files changed, 186 insertions(+), 7 deletions(-)
 create mode 100644 src/test/resources/runcmd/studios/studios_view_response_with_allowed_users.json

diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java
index 37e42fcc9..f45d21019 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java
@@ -46,19 +46,16 @@ public class AbstractStudiosCmd extends AbstractApiCmd {
     protected String getSessionId(StudioRefOptions studioRefOptions, Long wspId) throws ApiException {
         return studioRefOptions.studio.sessionId != null
                 ? studioRefOptions.studio.sessionId
-                : fetchStudio(studioRefOptions, wspId).getSessionId();
+                : getStudioByName(wspId, studioRefOptions.studio.studioName).getSessionId();
     }
 
     protected DataStudioDto fetchStudio(StudioRefOptions studioRefOptions, Long wspId) throws ApiException {
-        DataStudioDto studio;
-
         if (studioRefOptions.studio.sessionId != null) {
-            studio = getStudioById(wspId, studioRefOptions.studio.sessionId);
-        } else {
-            studio = getStudioByName(wspId, studioRefOptions.studio.studioName);
+            return getStudioById(wspId, studioRefOptions.studio.sessionId);
         }
 
-        return studio;
+        String sessionId = getStudioByName(wspId, studioRefOptions.studio.studioName).getSessionId();
+        return getStudioById(wspId, sessionId);
     }
 
     protected String getParentStudioSessionId(ParentStudioRefOptions parentStudioRefOptions, Long wspId) throws ApiException {
diff --git a/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java b/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java
index a94d6b1f1..e1e3519b8 100644
--- a/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java
+++ b/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java
@@ -156,6 +156,116 @@ void testView(OutputType format, MockServerClient mock) throws JsonProcessingExc
                 }""", DataStudioDto.class), "[organization1 / workspace1]" ));
     }
 
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testViewByName(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        mock.when(
+                request().withMethod("GET").withPath("/user-info"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("user")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/user/1264/workspaces"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("workspaces/workspaces_list")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        // the name is resolved to a session id via the list endpoint...
+        mock.when(
+                request().withMethod("GET").withPath("/studios").withQueryStringParameter("workspaceId", "75887156211589"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_list_response")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        // ...then the full detail (including allowedUsers) is fetched by that id, since the list DTO is partial
+        mock.when(
+                request().withMethod("GET").withPath("/studios/3e8370e7").withQueryStringParameter("workspaceId", "75887156211589"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_view_response_with_allowed_users")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        ExecOut out = exec(format, mock, "studios", "view", "-w", "75887156211589", "-n", "studio-a66d");
+
+        assertOutput(format, out, new StudiosView(parseJson("""
+                {
+                  "sessionId": "3e8370e7",
+                  "workspaceId": 75887156211589,
+                  "user": {
+                    "id": 2345,
+                    "userName": "John Doe",
+                    "email": "john@seqera.io",
+                    "avatar": null
+                  },
+                  "allowedUsers": [
+                    {
+                      "id": 21,
+                      "userName": "nonowner",
+                      "email": "nonowner@seqera.io",
+                      "avatar": null
+                    }
+                  ],
+                  "name": "studio-a66d",
+                  "description": "my first studio",
+                  "studioUrl": "https://a3e8370e7.dev-tower.com",
+                  "computeEnv": {
+                    "id": "3xkkzYH2nbD3nZjrzKm0oR",
+                    "name": "ce1",
+                    "platform": "aws-batch",
+                    "region": "us-east-2"
+                  },
+                  "template": {
+                    "repository": "cr.seqera.io/public/data-studio-vscode:1.93.1-snapshot",
+                    "icon": "vscode"
+                  },
+                  "configuration": {
+                    "gpu": 0,
+                    "cpu": 2,
+                    "memory": 8192,
+                    "mountData": [
+                      "v1-user-1ccf131810375d303bf0402dd8423433"
+                    ],
+                    "condaEnvironment":null
+                  },
+                  "dateCreated": "2024-12-19T06:49:24.893122+01:00",
+                  "lastUpdated": "2024-12-19T06:52:50.686822+01:00",
+                  "statusInfo": {
+                    "status": "running",
+                    "message": "",
+                    "lastUpdate": "2024-12-19T05:52:41.823Z"
+                  },
+                  "waveBuildUrl": null,
+                  "baseImage": "cr.seqera.io/public/data-studio-jupyter:4.2.5-snapshot",
+                  "isPrivate": true,
+                  "mountedDataLinks": [
+                    {
+                      "id": "v1-user-1ccf131810375d303bf0402dd8423433",
+                      "name": "aaa-my-bucket",
+                      "resourceRef": "s3://aaa-my-bucket",
+                      "type": "bucket",
+                      "provider": "aws",
+                      "region": "us-east-2"
+                    }
+                  ],
+                  "progress": [
+                    {
+                      "status": "succeeded",
+                      "message": "Provisioning compute resources",
+                      "warnings": null
+                    },
+                    {
+                      "status": "succeeded",
+                      "message": "Mounting checkpoints",
+                      "warnings": null
+                    }
+                  ]
+                }""", DataStudioDto.class), "[organization1 / workspace1]" ));
+
+        // proves the fetch-then-describe path: name resolved via list, full detail fetched by id
+        mock.verify(request().withMethod("GET").withPath("/studios").withQueryStringParameter("workspaceId", "75887156211589"), VerificationTimes.exactly(1));
+        mock.verify(request().withMethod("GET").withPath("/studios/3e8370e7").withQueryStringParameter("workspaceId", "75887156211589"), VerificationTimes.exactly(1));
+    }
+
     @Test
     void testViewForbidden(MockServerClient mock) {
         mock.when(
diff --git a/src/test/resources/runcmd/studios/studios_view_response_with_allowed_users.json b/src/test/resources/runcmd/studios/studios_view_response_with_allowed_users.json
new file mode 100644
index 000000000..84d5a92e0
--- /dev/null
+++ b/src/test/resources/runcmd/studios/studios_view_response_with_allowed_users.json
@@ -0,0 +1,72 @@
+{
+  "sessionId": "3e8370e7",
+  "workspaceId": 75887156211589,
+  "user": {
+    "id": 2345,
+    "userName": "John Doe",
+    "email": "john@seqera.io",
+    "avatar": null
+  },
+  "allowedUsers": [
+    {
+      "id": 21,
+      "userName": "nonowner",
+      "email": "nonowner@seqera.io",
+      "avatar": null
+    }
+  ],
+  "name": "studio-a66d",
+  "description": "my first studio",
+  "studioUrl": "https://a3e8370e7.dev-tower.com",
+  "computeEnv": {
+    "id": "3xkkzYH2nbD3nZjrzKm0oR",
+    "name": "ce1",
+    "platform": "aws-batch",
+    "region": "us-east-2"
+  },
+  "template": {
+    "repository": "cr.seqera.io/public/data-studio-vscode:1.93.1-snapshot",
+    "icon": "vscode"
+  },
+  "configuration": {
+    "gpu": 0,
+    "cpu": 2,
+    "memory": 8192,
+    "mountData": [
+      "v1-user-1ccf131810375d303bf0402dd8423433"
+    ],
+    "condaEnvironment":null
+  },
+  "dateCreated": "2024-12-19T06:49:24.893122+01:00",
+  "lastUpdated": "2024-12-19T06:52:50.686822+01:00",
+  "statusInfo": {
+    "status": "running",
+    "message": "",
+    "lastUpdate": "2024-12-19T05:52:41.823Z"
+  },
+  "waveBuildUrl": null,
+  "baseImage": "cr.seqera.io/public/data-studio-jupyter:4.2.5-snapshot",
+  "isPrivate": true,
+  "mountedDataLinks": [
+    {
+      "id": "v1-user-1ccf131810375d303bf0402dd8423433",
+      "name": "aaa-my-bucket",
+      "resourceRef": "s3://aaa-my-bucket",
+      "type": "bucket",
+      "provider": "aws",
+      "region": "us-east-2"
+    }
+  ],
+  "progress": [
+    {
+      "status": "succeeded",
+      "message": "Provisioning compute resources",
+      "warnings": null
+    },
+    {
+      "status": "succeeded",
+      "message": "Mounting checkpoints",
+      "warnings": null
+    }
+  ]
+}

From 463f37d5042d2a02c38f4fa99b6024bf0c24a29e Mon Sep 17 00:00:00 2001
From: sabulous <sabri.sahin@seqera.io>
Date: Wed, 22 Jul 2026 15:11:40 +0200
Subject: [PATCH 3/5] build: bump tower-java-sdk to 1.190.0

---
 gradle/libs.versions.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index f25cf1290..2dcbab980 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -13,7 +13,7 @@ mockserverVersion = "5.15.0"
 picocliVersion = "4.6.3"
 shadowVersion = "9.4.1"
 slf4jVersion = "2.0.17"
-towerJavaSdkVersion = "1.181.0"
+towerJavaSdkVersion = "1.190.0"
 xzVersion = "1.10"
 
 [libraries]

From 1a2ea8f0ec8e9af0b316c090933ea5bdf40a6680 Mon Sep 17 00:00:00 2001
From: sabulous <sabri.sahin@seqera.io>
Date: Fri, 24 Jul 2026 17:17:16 +0200
Subject: [PATCH 4/5] feat: accept username and email as allowed users as well
 as userids

---
 .../commands/studios/AbstractStudiosCmd.java  | 44 +++++++++++
 .../cli/commands/studios/AddAsNewCmd.java     |  6 +-
 .../tower/cli/commands/studios/AddCmd.java    |  6 +-
 .../tower/cli/commands/studios/StartCmd.java  |  6 +-
 .../tower/cli/studios/StudiosCmdTest.java     | 74 +++++++++++++++++++
 5 files changed, 127 insertions(+), 9 deletions(-)

diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java
index f45d21019..7d429bfd1 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java
@@ -16,6 +16,7 @@
 
 package io.seqera.tower.cli.commands.studios;
 
+import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
@@ -26,6 +27,7 @@
 import io.seqera.tower.cli.commands.AbstractApiCmd;
 import io.seqera.tower.cli.commands.data.links.DataLinkService;
 import io.seqera.tower.cli.commands.labels.Label;
+import io.seqera.tower.cli.exceptions.MemberNotFoundException;
 import io.seqera.tower.cli.exceptions.StudioNotFoundException;
 import io.seqera.tower.model.DataStudioConfiguration;
 import io.seqera.tower.cli.commands.enums.OutputType;
@@ -35,6 +37,8 @@
 import io.seqera.tower.model.DataStudioStatusInfo;
 import io.seqera.tower.model.DataStudioTemplate;
 import io.seqera.tower.model.DataStudioTemplatesListResponse;
+import io.seqera.tower.model.ListMembersResponse;
+import io.seqera.tower.model.MemberDbDto;
 
 import static io.seqera.tower.cli.utils.ResponseHelper.waitStatus;
 import static io.seqera.tower.model.DataStudioProgressStepStatus.ERRORED;
@@ -89,6 +93,46 @@ private DataStudioDto getStudioById(Long wspId, String sessionId) throws ApiExce
         return studiosApi().describeDataStudio(sessionId, wspId);
     }
 
+    /**
+     * Resolves each {@code --allow-user} value (a numeric user ID, username, or email) to a numeric
+     * user ID. Returns {@code null} when nothing was provided, so the allow list is left untouched.
+     */
+    protected List<Long> resolveAllowedUserIds(List<String> allowUsers, Long wspId) throws ApiException {
+        if (allowUsers == null) {
+            return null;
+        }
+        List<Long> userIds = new ArrayList<>(allowUsers.size());
+        for (String value : allowUsers) {
+            userIds.add(resolveUserId(value, wspId));
+        }
+        return userIds;
+    }
+
+    private Long resolveUserId(String userToAllow, Long wspId) throws ApiException {
+        // A numeric value is treated as a user ID directly.
+        if (userToAllow != null && !userToAllow.isEmpty() && userToAllow.chars().allMatch(Character::isDigit)) {
+            return Long.parseLong(userToAllow);
+        }
+        // Resolve the username/email to a user ID. A workspace participant may be a full organization
+        // member or a collaborator (role=collaborator, which listOrganizationMembers excludes), so check
+        // both. The backend still enforces that the resolved user is a participant of the workspace.
+        Long organizationId = orgId(wspId);
+        MemberDbDto member = firstMember(orgsApi().listOrganizationMembers(organizationId, null, null, userToAllow));
+        if (member == null) {
+            member = firstMember(orgsApi().listOrganizationCollaborators(organizationId, null, null, userToAllow));
+        }
+        if (member == null || member.getUserId() == null) {
+            throw new MemberNotFoundException(organizationId, userToAllow);
+        }
+        return member.getUserId();
+    }
+
+    private static MemberDbDto firstMember(ListMembersResponse response) {
+        return response == null || response.getMembers() == null
+                ? null
+                : response.getMembers().stream().findFirst().orElse(null);
+    }
+
     protected Integer onBeforeExit(int exitCode, String sessionId, Long workspaceId, DataStudioStatus targetStatus) {
         boolean showProgress = app().output != OutputType.json;
 
diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java
index f1e401eb2..7dc7d3e36 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java
@@ -66,8 +66,8 @@ public class AddAsNewCmd extends AbstractStudiosCmd{
     @CommandLine.Option(names = {"--private"}, description = "Create a private studio that only you can access or manage (default: false)", defaultValue = "false")
     public Boolean isPrivate;
 
-    @CommandLine.Option(names = {"--allow-user"}, description = "ID of a user, besides the creator, allowed to connect to and start this studio when it is private.")
-    public List<Long> allowedUserIds;
+    @CommandLine.Option(names = {"--allow-user"}, description = "User (numeric ID, username, or email), besides the creator, allowed to connect to and start this studio when it is private. Repeatable. The platform currently accepts only one additional user; extra users are rejected by the API.")
+    public List<String> allowedUserIds;
 
     @CommandLine.Option(names = {"--labels"}, description = "Comma-separated list of labels", split = ",", converter = Label.StudioResourceLabelsConverter.class)
     public List<Label> labels;
@@ -102,7 +102,7 @@ DataStudioCreateRequest prepareRequest(DataStudioDto parentDataStudio, String pa
         }
         request.setLabelIds(getLabelIds(labels, wspId));
         request.setIsPrivate(isPrivate);
-        request.setAllowedUserIds(allowedUserIds);
+        request.setAllowedUserIds(resolveAllowedUserIds(allowedUserIds, wspId));
         if (parentCheckpointId == null) {
             DataStudioListCheckpointsResponse response = studiosApi().listDataStudioCheckpoints(parentDataStudio.getSessionId(), parentDataStudio.getWorkspaceId(), null, 1, null);
             if (!response.getCheckpoints().isEmpty()) {
diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java
index c790b56ac..e2b86d615 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java
@@ -82,8 +82,8 @@ public class AddCmd extends AbstractStudiosCmd{
     @CommandLine.Option(names = {"--ssh"}, description = "Enable SSH connectivity to the studio (default: false).")
     public Boolean ssh;
 
-    @CommandLine.Option(names = {"--allow-user"}, description = "ID of a user, besides the creator, allowed to connect to and start this studio when it is private.")
-    public List<Long> allowedUserIds;
+    @CommandLine.Option(names = {"--allow-user"}, description = "User (numeric ID, username, or email), besides the creator, allowed to connect to and start this studio when it is private. Repeatable. The platform currently accepts only one additional user; extra users are rejected by the API.")
+    public List<String> allowedUserIds;
 
     @CommandLine.Option(names = {"--labels"}, description = "Comma-separated list of labels", split = ",", converter = Label.StudioResourceLabelsConverter.class)
     public List<Label> labels;
@@ -134,7 +134,7 @@ DataStudioCreateRequest prepareRequest(Long wspId) throws ApiException {
         if (description != null && !description.isEmpty()) {request.description(description);}
         request.setLabelIds(getLabelIds(labels, wspId));
         request.setIsPrivate(isPrivate);
-        request.setAllowedUserIds(allowedUserIds);
+        request.setAllowedUserIds(resolveAllowedUserIds(allowedUserIds, wspId));
         if (spot != null) {
             request.setSpot(spot);
         }
diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java
index 578facb5c..1b89aa96c 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java
@@ -64,8 +64,8 @@ public class StartCmd extends AbstractStudiosCmd {
     @CommandLine.Option(names = {"--ssh"}, description = "Optional override to enable SSH connectivity to the studio.")
     public Boolean ssh;
 
-    @CommandLine.Option(names = {"--allow-user"}, description = "Override the users, besides the creator, allowed to connect to and start this studio when it is private. Replaces the existing list; omit to leave it unchanged. Repeatable; currently limited to a single user. Only the studio creator may change it.")
-    public List<Long> allowedUserIds;
+    @CommandLine.Option(names = {"--allow-user"}, description = "Override the users (numeric ID, username, or email), besides the creator, allowed to connect to and start this studio when it is private. Replaces the existing list; omit to leave it unchanged. Repeatable. The platform currently accepts only one additional user; extra users are rejected by the API. Only the studio creator may change it.")
+    public List<String> allowedUserIds;
 
     @Override
     protected Response exec() throws ApiException {
@@ -118,7 +118,7 @@ private DataStudioStartRequest getStartRequestWithOverridesApplied(DataStudioDto
         request.setConfiguration(newConfig);
         request.setDescription(appliedDescription);
         request.setLabelIds(getLabelIds(labels, studioDto.getWorkspaceId()));
-        request.setAllowedUserIds(allowedUserIds);
+        request.setAllowedUserIds(resolveAllowedUserIds(allowedUserIds, studioDto.getWorkspaceId()));
         if (spot != null) {
             request.setSpot(spot);
         }
diff --git a/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java b/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java
index e1e3519b8..47850595c 100644
--- a/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java
+++ b/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java
@@ -1481,6 +1481,80 @@ void testAddPrivateWithAllowedUser(OutputType format, MockServerClient mock){
                 "http://localhost:"+mock.getPort()+"/orgs/organization1/workspaces/workspace1", false));
     }
 
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testAddPrivateWithAllowedUserByEmail(OutputType format, MockServerClient mock){
+        mock.when(
+                request().withMethod("GET").withPath("/user-info"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("user")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/user/1264/workspaces"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("workspaces/workspaces_list")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/studios/templates")
+                        .withQueryStringParameter("workspaceId", "75887156211589")
+                        .withQueryStringParameter("max", "20"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_templates_response")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/compute-envs")
+                        .withQueryStringParameter("status", "AVAILABLE")
+                        .withQueryStringParameter("workspaceId", "75887156211589"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody("{\"computeEnvs\":[{\"id\":\"vYOK4vn7spw7bHHWBDXZ2\",\"name\":\"demo\",\"platform\":\"aws-batch\",\"status\":\"AVAILABLE\",\"message\":null,\"lastUsed\":null,\"primary\":true,\"workspaceName\":null,\"visibility\":null}]}").withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/compute-envs/vYOK4vn7spw7bHHWBDXZ2"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("compute_env_demo")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        // Resolution: the email is not a full member, so the resolver falls back to collaborators,
+        // where it finds the user (userId 21) — mirroring how a workspace collaborator is looked up.
+        mock.when(
+                request().withMethod("GET").withPath("/orgs/27736513644467/members"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody("{\"members\":[],\"totalSize\":0}").withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/orgs/27736513644467/collaborators"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody("{\"members\":[{\"memberId\":255080245994226,\"userId\":21,\"userName\":\"nonowner\",\"email\":\"nonowner@seqera.io\",\"role\":\"collaborator\"}],\"totalSize\":1}").withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        // The resolved user id (21) is what gets sent in the request.
+        mock.when(
+                request().withMethod("POST").withPath("/studios")
+                        .withQueryStringParameter("workspaceId", "75887156211589")
+                        .withQueryStringParameter("autostart", "false")
+                        .withBody(json("""
+                           {
+                             "isPrivate": true,
+                             "allowedUserIds": [21]
+                           }
+                           """, MatchType.ONLY_MATCHING_FIELDS))
+                , exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_created_response")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        ExecOut out = exec(format, mock, "studios", "add", "-n", "studio-a66d", "-w", "75887156211589", "-t" ,"cr.seqera.io/public/data-studio-vscode:1.93.1-snapshot", "-c", "demo",
+        "--private", "--allow-user", "nonowner@seqera.io");
+
+        assertOutput(format, out, new StudiosCreated("3e8370e7",75887156211589L, "[organization1 / workspace1]",
+                "http://localhost:"+mock.getPort()+"/orgs/organization1/workspaces/workspace1", false));
+    }
+
     @ParameterizedTest
     @EnumSource(OutputType.class)
     void testAddWithNonExistentLabel(OutputType format, MockServerClient mock){

From 5eaa493fb388d862781993d2560dd81165478072 Mon Sep 17 00:00:00 2001
From: sabulous <sabri.sahin@seqera.io>
Date: Fri, 24 Jul 2026 17:37:30 +0200
Subject: [PATCH 5/5] feat: accept single string for allow-user parameter
 instead of a list

---
 .../commands/studios/AbstractStudiosCmd.java  | 13 ++---
 .../cli/commands/studios/AddAsNewCmd.java     |  6 +--
 .../tower/cli/commands/studios/AddCmd.java    |  6 +--
 .../tower/cli/commands/studios/StartCmd.java  |  6 +--
 .../tower/cli/studios/StudiosCmdTest.java     | 48 +++++++++++++++++++
 5 files changed, 62 insertions(+), 17 deletions(-)

diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java
index 7d429bfd1..bc34037a2 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java
@@ -16,7 +16,6 @@
 
 package io.seqera.tower.cli.commands.studios;
 
-import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
@@ -97,15 +96,13 @@ private DataStudioDto getStudioById(Long wspId, String sessionId) throws ApiExce
      * Resolves each {@code --allow-user} value (a numeric user ID, username, or email) to a numeric
      * user ID. Returns {@code null} when nothing was provided, so the allow list is left untouched.
      */
-    protected List<Long> resolveAllowedUserIds(List<String> allowUsers, Long wspId) throws ApiException {
-        if (allowUsers == null) {
+    protected List<Long> resolveAllowedUserIds(String allowUser, Long wspId) throws ApiException {
+        if (allowUser == null) {
             return null;
         }
-        List<Long> userIds = new ArrayList<>(allowUsers.size());
-        for (String value : allowUsers) {
-            userIds.add(resolveUserId(value, wspId));
-        }
-        return userIds;
+        // The platform currently permits a single additional user, so the CLI exposes one value; the
+        // API field is a list for forward-compatibility, hence the resolved id is wrapped in a list.
+        return List.of(resolveUserId(allowUser, wspId));
     }
 
     private Long resolveUserId(String userToAllow, Long wspId) throws ApiException {
diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java
index 7dc7d3e36..d0d46a33a 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java
@@ -66,8 +66,8 @@ public class AddAsNewCmd extends AbstractStudiosCmd{
     @CommandLine.Option(names = {"--private"}, description = "Create a private studio that only you can access or manage (default: false)", defaultValue = "false")
     public Boolean isPrivate;
 
-    @CommandLine.Option(names = {"--allow-user"}, description = "User (numeric ID, username, or email), besides the creator, allowed to connect to and start this studio when it is private. Repeatable. The platform currently accepts only one additional user; extra users are rejected by the API.")
-    public List<String> allowedUserIds;
+    @CommandLine.Option(names = {"--allow-user"}, description = "User (numeric ID, username, or email), besides the creator, allowed to connect to and start this studio when it is private.")
+    public String allowedUser;
 
     @CommandLine.Option(names = {"--labels"}, description = "Comma-separated list of labels", split = ",", converter = Label.StudioResourceLabelsConverter.class)
     public List<Label> labels;
@@ -102,7 +102,7 @@ DataStudioCreateRequest prepareRequest(DataStudioDto parentDataStudio, String pa
         }
         request.setLabelIds(getLabelIds(labels, wspId));
         request.setIsPrivate(isPrivate);
-        request.setAllowedUserIds(resolveAllowedUserIds(allowedUserIds, wspId));
+        request.setAllowedUserIds(resolveAllowedUserIds(allowedUser, wspId));
         if (parentCheckpointId == null) {
             DataStudioListCheckpointsResponse response = studiosApi().listDataStudioCheckpoints(parentDataStudio.getSessionId(), parentDataStudio.getWorkspaceId(), null, 1, null);
             if (!response.getCheckpoints().isEmpty()) {
diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java
index e2b86d615..0fe5a44ea 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java
@@ -82,8 +82,8 @@ public class AddCmd extends AbstractStudiosCmd{
     @CommandLine.Option(names = {"--ssh"}, description = "Enable SSH connectivity to the studio (default: false).")
     public Boolean ssh;
 
-    @CommandLine.Option(names = {"--allow-user"}, description = "User (numeric ID, username, or email), besides the creator, allowed to connect to and start this studio when it is private. Repeatable. The platform currently accepts only one additional user; extra users are rejected by the API.")
-    public List<String> allowedUserIds;
+    @CommandLine.Option(names = {"--allow-user"}, description = "User (numeric ID, username, or email), besides the creator, allowed to connect to and start this studio when it is private.")
+    public String allowedUser;
 
     @CommandLine.Option(names = {"--labels"}, description = "Comma-separated list of labels", split = ",", converter = Label.StudioResourceLabelsConverter.class)
     public List<Label> labels;
@@ -134,7 +134,7 @@ DataStudioCreateRequest prepareRequest(Long wspId) throws ApiException {
         if (description != null && !description.isEmpty()) {request.description(description);}
         request.setLabelIds(getLabelIds(labels, wspId));
         request.setIsPrivate(isPrivate);
-        request.setAllowedUserIds(resolveAllowedUserIds(allowedUserIds, wspId));
+        request.setAllowedUserIds(resolveAllowedUserIds(allowedUser, wspId));
         if (spot != null) {
             request.setSpot(spot);
         }
diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java
index 1b89aa96c..5f21b5202 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java
@@ -64,8 +64,8 @@ public class StartCmd extends AbstractStudiosCmd {
     @CommandLine.Option(names = {"--ssh"}, description = "Optional override to enable SSH connectivity to the studio.")
     public Boolean ssh;
 
-    @CommandLine.Option(names = {"--allow-user"}, description = "Override the users (numeric ID, username, or email), besides the creator, allowed to connect to and start this studio when it is private. Replaces the existing list; omit to leave it unchanged. Repeatable. The platform currently accepts only one additional user; extra users are rejected by the API. Only the studio creator may change it.")
-    public List<String> allowedUserIds;
+    @CommandLine.Option(names = {"--allow-user"}, description = "Override the user (numeric ID, username, or email), besides the creator, allowed to connect to and start this studio when it is private. Omit to leave the allow list unchanged. Only the studio creator may change it.")
+    public String allowedUser;
 
     @Override
     protected Response exec() throws ApiException {
@@ -118,7 +118,7 @@ private DataStudioStartRequest getStartRequestWithOverridesApplied(DataStudioDto
         request.setConfiguration(newConfig);
         request.setDescription(appliedDescription);
         request.setLabelIds(getLabelIds(labels, studioDto.getWorkspaceId()));
-        request.setAllowedUserIds(resolveAllowedUserIds(allowedUserIds, studioDto.getWorkspaceId()));
+        request.setAllowedUserIds(resolveAllowedUserIds(allowedUser, studioDto.getWorkspaceId()));
         if (spot != null) {
             request.setSpot(spot);
         }
diff --git a/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java b/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java
index 47850595c..12704ca5d 100644
--- a/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java
+++ b/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java
@@ -868,6 +868,54 @@ void testStart(OutputType format, MockServerClient mock) {
                 "[organization1 / workspace1]",  "http://localhost:"+mock.getPort()+"/orgs/organization1/workspaces/workspace1", true));
     }
 
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testStartWithAllowedUser(OutputType format, MockServerClient mock) {
+
+        mock.when(
+                request().withMethod("GET").withPath("/user-info"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("user")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/user/1264/workspaces"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("workspaces/workspaces_list")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/studios/3e8370e7").withQueryStringParameter("workspaceId", "75887156211589"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_view_response_studio_stopped")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        // A username override is resolved to a user id via the organization members.
+        mock.when(
+                request().withMethod("GET").withPath("/orgs/27736513644467/members"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody("{\"members\":[{\"memberId\":1,\"userId\":7,\"userName\":\"someuser\",\"email\":\"someuser@seqera.io\",\"role\":\"member\"}],\"totalSize\":1}").withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        // Assert the resolved id (7) is sent on the start request.
+        mock.when(
+                request().withMethod("PUT").withPath("/studios/3e8370e7/start").withQueryStringParameter("workspaceId", "75887156211589")
+                        .withBody(json("""
+                           {
+                             "allowedUserIds": [7]
+                           }
+                           """, MatchType.ONLY_MATCHING_FIELDS))
+                , exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_start_response")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        ExecOut out = exec(format, mock, "studios", "start", "-w", "75887156211589", "-i", "3e8370e7", "--allow-user", "someuser");
+
+        assertOutput(format, out, new StudioStartSubmitted("3e8370e7", "3e8370e7",75887156211589L,
+                "[organization1 / workspace1]",  "http://localhost:"+mock.getPort()+"/orgs/organization1/workspaces/workspace1", true));
+    }
+
     @ParameterizedTest
     @EnumSource(OutputType.class)
     void testStartByName(OutputType format, MockServerClient mock) {