weichen
adcd8fefd2
Why: Account disable could be followed by late Backend business writes, API key creation could implicitly create users, account bootstrap locks could invert, and directory cursors were process-local or leaked out-of-scope changes. Evidence: Local go test ./... and isolated PostgreSQL package suites passed on the staged candidate; exact committed-head SELF replay and stage 6 human review remain pending. Impact: Adds final account transactions and external-effect checks across HTTP, Host, Bus and run manager; tightens API key issuance and persists versioned cursor signing. Delegated RDM rename still needs the separately proposed real-operator contract, so A1 and stage 6 are not complete. Refs: Documents U3 r1, approved A1-A4 amendment fb3a821, pending delegated-projection amendment 5783940, Dev feature/iam-u3-account-directory-recovery.
42 lines
1.8 KiB
Go
42 lines
1.8 KiB
Go
package store
|
|
|
|
import (
|
|
"database/sql"
|
|
"fmt"
|
|
"time"
|
|
|
|
core "agent-system-core"
|
|
)
|
|
|
|
// UpsertPluginAccountChecked fences the node-level plugin registry write with
|
|
// the request actor's effective account state. Admin authorization belongs to
|
|
// the caller; an enabled account alone does not authorize plugin management.
|
|
func (s *Store) UpsertPluginAccountChecked(actor, id, dir string, m core.PluginManifest, allowImplicitDefault bool) error {
|
|
return s.withEffectiveAccountWrite(actor, allowImplicitDefault, func(tx *sql.Tx, _ Account) error {
|
|
_, err := tx.Exec(s.q(`INSERT INTO plugins(id,dir,manifest,enabled,loaded_at) VALUES(?,?,?,?,?)
|
|
ON CONFLICT(id) DO UPDATE SET dir=excluded.dir, manifest=excluded.manifest, enabled=excluded.enabled, loaded_at=excluded.loaded_at`),
|
|
id, dir, marshalJSON(m), 1, nowISO())
|
|
return err
|
|
})
|
|
}
|
|
|
|
// SetPluginSchemaVersionAccountChecked checks the stored version and writes it
|
|
// in the final actor-fenced transaction. It preserves the legacy loader's
|
|
// refusal to downgrade a plugin schema.
|
|
func (s *Store) SetPluginSchemaVersionAccountChecked(actor, pluginID string, version int, allowImplicitDefault bool) error {
|
|
return s.withEffectiveAccountWrite(actor, allowImplicitDefault, func(tx *sql.Tx, _ Account) error {
|
|
var current int
|
|
err := tx.QueryRow(s.q(`SELECT version FROM plugin_schema WHERE plugin_id=?`), pluginID).Scan(¤t)
|
|
if err != nil && err != sql.ErrNoRows {
|
|
return err
|
|
}
|
|
if version < current {
|
|
return fmt.Errorf("plugins: %s: schema %d older than stored %d", pluginID, version, current)
|
|
}
|
|
_, err = tx.Exec(s.q(`INSERT INTO plugin_schema(plugin_id,version,updated_at) VALUES(?,?,?)
|
|
ON CONFLICT(plugin_id) DO UPDATE SET version=excluded.version, updated_at=excluded.updated_at`),
|
|
pluginID, version, time.Now().UTC().Format(time.RFC3339))
|
|
return err
|
|
})
|
|
}
|