agent-exec transport 9e9255c1a5d63cb004c963f5c112b634/1574b796b404

tests/integration/multi-instance/multi_instance_test.go

@@ -475,6 +475,8 @@ func (e *env) loginAlice(t *testing.T) *userClient {
 	}, nil)
 
 	apiKey := e.cliOut(t, "apikey", "create", "--dsn", e.dbDSN, "--owner", aliceOwner, "--name", "mi-acceptance")
+	// IAM U4 把建项目改为系统动作 project.create：由引导管理员经真实 API 授予 alice。
+	e.grantAliceProjectCreate(t)
 	uc := &userClient{
 		api:     &http.Client{Timeout: httpWait, Transport: bearerRT{key: apiKey}},
 		apiB:    &http.Client{Timeout: httpWait, Transport: bearerRT{key: apiKey}},
@@ -486,6 +488,46 @@ func (e *env) loginAlice(t *testing.T) *userClient {
 	return uc
 }
 
+// grantAliceProjectCreate 以 mi-root 身份经 admin API 为 alice 追加系统授权
+// project.create（保留其已有授权；PUT 为整体替换，按 authorityEpoch 乐观并发）。
+func (e *env) grantAliceProjectCreate(t *testing.T) {
+	t.Helper()
+	rootKey := e.cliOut(t, "apikey", "create", "--dsn", e.dbDSN, "--owner", "mi-root", "--name", "mi-acceptance-root")
+	root := &http.Client{Timeout: httpWait, Transport: bearerRT{key: rootKey}}
+	var users []struct {
+		UserID string `json:"userId"`
+		Owner  string `json:"owner"`
+	}
+	e.do(t, root, "GET", "/api/admin/users", nil, &users)
+	userID := ""
+	for _, u := range users {
+		if u.Owner == aliceOwner {
+			userID = u.UserID
+		}
+	}
+	if userID == "" {
+		t.Fatalf("user %s not found in /api/admin/users", aliceOwner)
+	}
+	var grants struct {
+		Actions        []string `json:"actions"`
+		AuthorityEpoch int64    `json:"authorityEpoch"`
+	}
+	e.do(t, root, "GET", "/api/admin/users/"+userID+"/system-grants", nil, &grants)
+	actions := grants.Actions
+	has := false
+	for _, a := range actions {
+		has = has || a == "project.create"
+	}
+	if !has {
+		actions = append(actions, "project.create")
+	}
+	e.do(t, root, "PUT", "/api/admin/users/"+userID+"/system-grants", map[string]any{
+		"expectedAuthorityEpoch": grants.AuthorityEpoch,
+		"idempotencyKey":         "mi-alice-project-create",
+		"actions":                actions,
+	}, nil)
+}
+
 // bearerRT 为所有请求附加 Authorization: Bearer <key>。
 type bearerRT struct{ key string }