weichen
c4435d1415
Why:
Legacy project metadata can contain credentials outside the settings scope table.
Sharing raw projection settings exposed them, and generic project PATCH bypassed
the system-managed path guard already enforced by project settings endpoints.
Evidence:
SELF member Host regression failed before the fix. The fixed 4f72aaf server
baseline overlay reproduced HTTP metadata leakage and managed PATCH returning 200.
SELF shared Host-to-HTTP, immutable mask, dotted/schema/fallback, public mutation
and atomic managed-write regressions passed; uncached full suite, isolated PG
Store suite and static build passed. Independent delta replay remains a gate.
Impact:
Registered lifecycle metadata returns detached credential-masked views while
preserving service/configuration keys and persisted data. Generic project PATCH
shares the existing managed validator before rename or settings mutation; allowed
metadata key shapes and raw owner-only management lookups remain available.
Refs:
Dev project-member-access plan r1 Task 1 and R5; approved hard secret boundary;
2026-10-13 shared project metadata review follow-up
37 lines
1.5 KiB
Go
37 lines
1.5 KiB
Go
package extension
|
|
|
|
import (
|
|
core "agent-system-core"
|
|
"context"
|
|
)
|
|
|
|
// ProjectHost is an optional actor-scoped host projection capability. Metadata
|
|
// can be shared by an authorizer; registered-lifecycle metadata masks credentials.
|
|
// OwnedProject remains an owner-only management lookup; mutations remain owner-only.
|
|
type ProjectHost interface {
|
|
Owner() string
|
|
OwnedProjects() ([]core.Project, error)
|
|
ProjectMetadata(projectID string) (core.Project, error)
|
|
OwnedProject(projectID string) (core.Project, error)
|
|
EnsureProject(projectID, name string) (core.Project, error)
|
|
RenameOwnedProject(projectID, name string) (core.Project, error)
|
|
ProjectNameAvailable(name, exceptID string) (bool, error)
|
|
}
|
|
|
|
// ProjectLifecycle supplies the domain's public project lifecycle and live work
|
|
// authorization. Each Host is scoped to the authenticated actor. Errors with a
|
|
// StatusCode() int method may report 400, 403, 404, 409, or 503 to HTTP clients.
|
|
type ProjectLifecycle struct {
|
|
List func(context.Context, Host) ([]core.Project, error)
|
|
Create func(context.Context, Host, string) (core.Project, error)
|
|
Rename func(context.Context, Host, string, string) (core.Project, error)
|
|
Archive func(context.Context, Host, string) error
|
|
Work func(context.Context, string, core.ID) (bool, error)
|
|
}
|
|
|
|
// ProjectLifecycleRegistry is optional so older Registry implementations retain
|
|
// their contract. Only in-process plugins can register one complete provider.
|
|
type ProjectLifecycleRegistry interface {
|
|
RegisterProjectLifecycle(ProjectLifecycle) error
|
|
}
|