fabi/PiCloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test/docs(apply): §6 M1 group-create journey + design note

Browse Source 
`tests/group_create.rs`: a nested `[group]` tree with no server groups yet →
`pic apply --dir` creates both (parent from directory nesting), claims them for
the `[project]`, and re-applies as a no-op; a member with only editor (no
group-admin) is refused and leaves nothing behind. Design doc §6 records M1
shipped (parent-by-nesting, Phase-0 create-in-tx, claim, RBAC + attach ceiling)
with reparent/divergence still deferred to M2.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-07-07 20:07:12 +02:00
parent 0078ae8b26
commit dcc387c345
3 changed files with 211 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
docs/design/groups-and-project-tool.md
View File

@@ -796,6 +796,23 @@ ownership track (§7 M1–M3) is complete. Deferred (separate later work):** §6
(`--adopt-server-structure` / `--force-local-structure`); declarative group create/reparent (lifting "groups
pre-exist"); per-env approval gating (`[project.environments]`).
**§6 group-tree M1 shipped — declarative group CREATE.** A `[group]` node's PARENT is now inferred from
directory nesting (the nearest ancestor directory holding a `[group]`; the topmost group binds to the repo's
`[project] parent_group` attach point, else the instance root). `discover::build_tree` emits `parent` (plus the
group's `name`/`description`) per group node, sorted parents-first by directory depth; `TreeNode` gained those
fields (`#[serde(default)]`, so a pre-§6 CLI still reconciles existing groups). Server-side, `apply_tree` runs a
**Phase 0** (`create_missing_groups_tx`) that resolves-or-creates every group node IN the apply tx
(parents-first, a same-tree parent resolved before its child via `read_group_id_by_slug_tx`), under the coarse
`GROUP_STRUCTURAL_LOCK_KEY` (taken only when it creates), enforcing the **attach-point ceiling** and **RBAC**
(`InstanceCreateGroup` at the root / `GroupAdmin(parent)` for a subgroup) per create; the group is then CLAIMED
in Phase A alongside existing groups (a fresh group is `decide_group_claim` → `Claim`). `prepare_tree` gained a
caller-supplied `resolved_ids` map (existing + just-created) and returns a `to_create` list the plan path
previews (empty current → a full-create plan; ownership → `claim`) — a to-create group's token part is identical
to its post-create part, so plan/apply tokens match across a create. `authz_tree` skips a to-create group (its
authorization is the service-side create gate). Reparent of an EXISTING diverged group + the detect-and-refuse
flags are M2. Pinned by `tests/group_create.rs`. **Still deferred:** §6 structural-divergence detection + M2
reparent; per-env approval gating.
---
## 8. Diagrams