weichen
7492feab42
Why: RDM delegated rename rebuilt the creator Host and could commit a Backend project rename after the delegated operator was disabled.
Evidence: SQLite and isolated PostgreSQL targeted checks cover operator/creator disable order, two processes, sorted locks, auth-off local compatibility, and HTTP/command Host wiring; exact committed-head replay remains pending.
Impact: Adds a request-bound single-project extension capability and checks operator plus creator in the final Backend transaction. Global ScopedHost cannot derive delegated authority; RDM cross-database atomicity remains outside the promise.
Refs: Approved Documents delegated-projection amendment 5783940, U3 A1-A4 candidate adcd8fe, Dev feature/iam-u3-account-directory-recovery.
47 lines
2.1 KiB
Go
47 lines
2.1 KiB
Go
package extension
|
|
|
|
import (
|
|
core "agent-system-core"
|
|
"context"
|
|
)
|
|
|
|
// ProjectHost is an optional actor-scoped host projection capability. Metadata
|
|
// can be shared by an authorizer; registered-lifecycle metadata masks credentials.
|
|
// OwnedProject remains an owner-only management lookup. A request-bound
|
|
// delegated projection may carry a separate real operator and fixed creator;
|
|
// its final Store transaction checks both accounts and the persisted owner.
|
|
type ProjectHost interface {
|
|
Owner() string
|
|
OwnedProjects() ([]core.Project, error)
|
|
ProjectMetadata(projectID string) (core.Project, error)
|
|
OwnedProject(projectID string) (core.Project, error)
|
|
EnsureProject(projectID, name string) (core.Project, error)
|
|
RenameOwnedProject(projectID, name string) (core.Project, error)
|
|
ProjectNameAvailable(name, exceptID string) (bool, error)
|
|
}
|
|
|
|
// DelegatedProjectProjectionHost is an optional capability of a current,
|
|
// authenticated RDM request Host. It derives a single-project creator
|
|
// projection while retaining the original operator for final account fencing.
|
|
// A globally reconstructed ScopedHost does not implement this capability.
|
|
type DelegatedProjectProjectionHost interface {
|
|
ProjectProjectionForCreator(creator, projectID string) (ProjectHost, error)
|
|
}
|
|
|
|
// ProjectLifecycle supplies the domain's public project lifecycle and live work
|
|
// authorization. Each Host is scoped to the authenticated actor. Errors with a
|
|
// StatusCode() int method may report 400, 403, 404, 409, or 503 to HTTP clients.
|
|
type ProjectLifecycle struct {
|
|
List func(context.Context, Host) ([]core.Project, error)
|
|
Create func(context.Context, Host, string) (core.Project, error)
|
|
Rename func(context.Context, Host, string, string) (core.Project, error)
|
|
Archive func(context.Context, Host, string) error
|
|
Work func(context.Context, string, core.ID) (bool, error)
|
|
}
|
|
|
|
// ProjectLifecycleRegistry is optional so older Registry implementations retain
|
|
// their contract. Only in-process plugins can register one complete provider.
|
|
type ProjectLifecycleRegistry interface {
|
|
RegisterProjectLifecycle(ProjectLifecycle) error
|
|
}
|