fabi/PiCloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
5bb1ccad5e1e9c4453bcea8f0d9111d47444fd46
PiCloud/crates/manager-core/src
History
MechaCat02 5bb1ccad5e feat(apply): [project] parent_group attach-point ceiling 
§6/§7 M2: a project's attach point is its ceiling — applies are refused for
any node not strictly within the declared subtree, so a repo can't reach (or
claim) above its local root even with the RBAC to do so.

- `[project] parent_group = "<slug>"` (ManifestProject + ProjectDecl); absent
  = instance root = no ceiling (the default, backward-compatible).
- `check_within_attach`: the attach group must be a PROPER ancestor of a group
  node (you can't apply the attach point itself) or an ancestor (inclusive) of
  an app node's group; resolved via `groups.ancestors`. Enforced read-only in
  apply_owner (prologue) + apply_tree (per node), before the claim.
- `ApplyError::OutsideAttachPoint` → 422 (a scope error, like Invalid).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-06 20:57:03 +02:00
..
abandoned_repo.rs
feat(v1.1.1-triggers): triggers + outbox schema + repos
2026-06-01 21:46:45 +02:00
admin_session_repo.rs
feat(manager-core): admin auth gate (Phase 3a)
2026-05-25 19:30:25 +02:00
admin_user_repo.rs
feat(manager-core,picloud): accept email on admin create + patch
2026-05-27 19:27:52 +02:00
admin_users_api.rs
fix(audit-2026-06-11/revocation-lag): evict PrincipalCache on credential change
2026-06-12 18:12:54 +02:00
api_key_repo.rs
style: cargo fmt across Phase 3.5 changes
2026-05-26 22:21:37 +02:00
api_keys_api.rs
fix(audit-2026-06-11/revocation-lag): evict PrincipalCache on credential change
2026-06-12 18:12:54 +02:00
api.rs
feat(scripts): group-owned script admin API + pic scripts … --group
2026-06-25 20:10:20 +02:00
app_bootstrap.rs
feat(sealed): author + persist sealed group templates (§11 tail M2)
2026-07-01 19:32:20 +02:00
app_domain_repo.rs
feat(manager-core,orchestrator-core): multi-app scoping (Phase 3b)
2026-05-25 21:03:05 +02:00
app_members_api.rs
fix(api): make app_members POST and PATCH atomic
2026-05-27 22:00:04 +02:00
app_members_repo.rs
feat(groups): tree repos, hierarchy-aware RBAC, admin API
2026-06-24 19:59:00 +02:00
app_repo.rs
feat(groups): tree repos, hierarchy-aware RBAC, admin API
2026-06-24 19:59:00 +02:00
app_secrets_repo.rs
fix(audit-2026-06-11/H-D1): bind AES-GCM AAD on secrets + realtime signing key
2026-06-12 17:15:09 +02:00
app_user_invitation_repo.rs
feat(v1.1.8): invitations flow (migration 0030 + accept_invite returns session)
2026-06-06 12:10:32 +02:00
app_user_password_reset_repo.rs
chore(v1.1.8): clippy --all-targets clean (F2)
2026-06-06 18:03:51 +02:00
app_user_repo.rs
fix(manager-core): F-P-012 keyset cursor on app_user_repo::list (created_at, id) tiebreaker
2026-06-07 20:50:25 +02:00
app_user_role_repo.rs
fix(manager-core): F-P-001 batch app_user_roles lookups in users::list (N+1 → 1)
2026-06-07 20:09:31 +02:00
app_user_session_repo.rs
feat(v1.1.8): app_user_sessions table + repo with sliding TTL
2026-06-05 23:17:24 +02:00
app_user_verification_repo.rs
feat(v1.1.8): email verification flow (migration 0028 + SDK)
2026-06-06 12:04:09 +02:00
apply_api.rs
feat(apply): [project] parent_group attach-point ceiling
2026-07-06 20:57:03 +02:00
apply_service.rs
feat(apply): [project] parent_group attach-point ceiling
2026-07-06 20:57:03 +02:00
apps_api.rs
feat(stateful-templates): materialize cron+queue templates + hooks (M5.2-M5.4)
2026-07-01 21:47:27 +02:00
auth_api.rs
fix(audit-2026-06-11/H-B1 follow-up): use last X-Forwarded-For hop for login rate-limit key
2026-06-12 18:37:34 +02:00
auth_bootstrap.rs
feat(manager-core,picloud): accept email on admin create + patch
2026-05-27 19:27:52 +02:00
auth_middleware.rs
docs(audit-2026-06-11/tier3): fix stale principal_cache field comment
2026-06-12 19:08:31 +02:00
auth.rs
feat(v1.1.8): app_users table + repo (migration 0026)
2026-06-05 23:15:47 +02:00
authz.rs
feat(shared-queues): group-keyed queue store + enqueue service + SDK (D3.1)
2026-07-02 22:08:21 +02:00
config_api.rs
feat(secrets): group-secrets admin API, masked read, config/effective
2026-06-24 22:00:32 +02:00
config_resolver.rs
feat(modules): owner-aware module lookup — lexical chain walk (Phase 4b C1)
2026-06-26 07:07:04 +02:00
cron_scheduler.rs
feat(stateful-templates): schema + dispatch guards + allow cron/queue on group (M5.1)
2026-07-01 21:34:14 +02:00
dead_letter_repo.rs
feat(v1.1.1-triggers): triggers + outbox schema + repos
2026-06-01 21:46:45 +02:00
dead_letter_service.rs
feat(v1.1.1-dead-letters): service + Rhai SDK + admin endpoints
2026-06-01 22:17:25 +02:00
dead_letters_api.rs
fix(admin-api): accept slug or UUID on per-app endpoints
2026-06-09 18:34:42 +02:00
dev_email_api.rs
feat: E2E #2 (Stash) gap remediation + S6 hardening
2026-06-13 15:01:04 +02:00
dispatcher.rs
feat(shared-queues): materialized competing consumers + dispatcher branch (D3.2)
2026-07-02 22:33:11 +02:00
docs_filter.rs
feat(v1.1.2-docs): manager-core docs service + repo + query DSL parser
2026-06-02 19:55:14 +02:00
docs_repo.rs
feat(modules): group-docs schema + kind-generalized registry (§11.6 docs C1)
2026-06-30 07:33:39 +02:00
docs_service.rs
fix(stage-3): queue DL fan-out + emit-failure visibility
2026-06-10 21:22:15 +02:00
email_inbound_api.rs
style: cargo fmt across audit-2026-06-11 tier-3 changes
2026-06-12 18:38:28 +02:00
email_service.rs
style(email): wrap over-width lines (cargo fmt)
2026-06-24 19:06:52 +02:00
extension_point_repo.rs
feat(modules): no-provider plan check + read-only extension-points ls (§5.5 C4)
2026-06-29 20:31:14 +02:00
files_api.rs
style: cargo fmt across audit-2026-06-11 tier-3 changes
2026-06-12 18:38:28 +02:00
files_repo.rs
feat(modules): GroupFilesService + files::shared_collection handle (§11.6 files C3)
2026-06-30 19:46:39 +02:00
files_service.rs
fix(audit-2026-06-11/C-2): file download attachment + nosniff + CSP + MIME allowlist
2026-06-11 20:24:55 +02:00
files_sweep.rs
test(modules): pin orphan-sweep coverage of group-shared blobs (§11.6 files review)
2026-06-30 20:04:09 +02:00
gc.rs
chore(v1.1.8): GC sweep for app-user sessions + tokens
2026-06-06 15:02:21 +02:00
group_blobs_api.rs
feat(group-blobs): read-only operator admin API for shared collections (M4.1+M4.2)
2026-07-01 21:22:07 +02:00
group_collection_repo.rs
refactor(modules): drop dead group_collection_repo::list_for_owner (§11.6 review)
2026-06-30 19:19:48 +02:00
group_docs_repo.rs
feat(group-quota): per-group shared-collection quotas (M3)
2026-07-01 21:17:12 +02:00
group_docs_service.rs
feat(group-quota): per-group shared-collection quotas (M3)
2026-07-01 21:17:12 +02:00
group_files_repo.rs
feat(group-quota): per-group shared-collection quotas (M3)
2026-07-01 21:17:12 +02:00
group_files_service.rs
feat(group-quota): per-group shared-collection quotas (M3)
2026-07-01 21:17:12 +02:00
group_kv_repo.rs
feat(group-quota): per-group shared-collection quotas (M3)
2026-07-01 21:17:12 +02:00
group_kv_service.rs
feat(group-quota): per-group shared-collection quotas (M3)
2026-07-01 21:17:12 +02:00
group_members_repo.rs
feat(groups): tree repos, hierarchy-aware RBAC, admin API
2026-06-24 19:59:00 +02:00
group_pubsub_service.rs
feat(shared-topics): GroupPubsubService + shared publish fan-out + SDK handle (D2)
2026-07-02 21:48:59 +02:00
group_queue_repo.rs
feat(shared-queues): group-keyed queue store + enqueue service + SDK (D3.1)
2026-07-02 22:08:21 +02:00
group_queue_service.rs
feat(shared-queues): group-keyed queue store + enqueue service + SDK (D3.1)
2026-07-02 22:08:21 +02:00
group_quota.rs
feat(group-quota): per-group shared-collection quotas (M3)
2026-07-01 21:17:12 +02:00
group_repo.rs
feat(projects): projects repo + group owner reads; wire into ApplyService
2026-07-06 20:13:34 +02:00
group_scripts_api.rs
fix(modules): validate group module create per kind (Phase 4b review)
2026-06-29 19:32:34 +02:00
groups_api.rs
feat(cli): [project] manifest block, --takeover, groups ls owner column
2026-07-06 20:46:09 +02:00
http_service.rs
fix(stage-1): audit High-severity backend correctness + CI unblocker
2026-06-10 21:03:10 +02:00
invoke_service.rs
feat(executor): thread the defining node into ExecRequest (Phase 4b C2)
2026-06-26 07:17:33 +02:00
kv_api.rs
feat: E2E #2 (Stash) gap remediation + S6 hardening
2026-06-13 15:01:04 +02:00
kv_repo.rs
feat(v1.1.1-kv): migrations + KvService trait + Postgres impl
2026-06-01 21:29:59 +02:00
kv_service.rs
fix(stage-3): queue DL fan-out + emit-failure visibility
2026-06-10 21:22:15 +02:00
lib.rs
feat(projects): projects repo + group owner reads; wire into ApplyService
2026-07-06 20:13:34 +02:00
log_sink.rs
feat: E2E #2 (Stash) gap remediation + S6 hardening
2026-06-13 15:01:04 +02:00
login_rate_limit.rs
fix(audit-2026-06-11/H-B1): login rate limit + Argon2 concurrency cap
2026-06-11 20:42:51 +02:00
materialize.rs
feat(shared-queues): materialized competing consumers + dispatcher branch (D3.2)
2026-07-02 22:33:11 +02:00
migrations.rs
feat: versioning scheme — lockstep crates + four independent surfaces
2026-05-23 00:31:08 +02:00
module_source.rs
feat(modules): extension-point-aware resolver policy (§5.5 C2)
2026-06-29 20:07:59 +02:00
outbox_event_emitter.rs
feat(shared-triggers): emit shared events from group services (M2.3)
2026-07-01 20:33:09 +02:00
outbox_repo.rs
feat(v1.1.9): TriggerEvent::Queue + TriggerKind::Queue + types
2026-06-06 19:08:21 +02:00
principal_resolver.rs
feat(v1.1.1-dispatcher): dispatcher loop + retry + depth limit + outbox emitter
2026-06-01 22:01:42 +02:00
project_repo.rs
feat(projects): projects repo + group owner reads; wire into ApplyService
2026-07-06 20:13:34 +02:00
pubsub_repo.rs
feat(shared-topics): GroupPubsubService + shared publish fan-out + SDK handle (D2)
2026-07-02 21:48:59 +02:00
pubsub_service.rs
feat(shared-topics): GroupPubsubService + shared publish fan-out + SDK handle (D2)
2026-07-02 21:48:59 +02:00
queue_repo.rs
fix(manager-core): F-P-006 cap queue::depth scans at 10k rows
2026-06-07 20:16:33 +02:00
queue_service.rs
fix(manager-core): F-S-001 cap kv/docs/pubsub/queue payload sizes (default 256 KB)
2026-06-07 20:00:36 +02:00
queues_api.rs
fix: post-review followups on slug-vs-UUID refactor
2026-06-09 20:03:10 +02:00
realtime_authority.rs
feat(sdk): users::email_available for anonymous registration pre-check (S1)
2026-06-12 20:43:18 +02:00
repo.rs
fix(apply): resolve inherited-bound triggers in diff, state-token, and prune
2026-06-25 21:11:59 +02:00
route_admin.rs
feat(sealed): consume sealed at the two suppression gates (§11 tail M3)
2026-07-01 19:34:22 +02:00
route_repo.rs
feat(suppress): consume group suppressions via the chain (M1.3+M1.4)
2026-07-01 20:07:06 +02:00
sandbox.rs
feat: per-script Rhai sandbox overrides with admin ceiling
2026-05-23 16:26:12 +02:00
scheduler.rs
chore: initial scaffold — workspace, docs, blueprint
2026-05-22 23:16:32 +02:00
secrets_api.rs
feat(secrets): group-secrets admin API, masked read, config/effective
2026-06-24 22:00:32 +02:00
secrets_repo.rs
fix(secrets): composite keyset for group-secret admin list pagination
2026-06-24 22:13:00 +02:00
secrets_service.rs
feat(secrets): group-owned, env-scoped secrets + inherited resolution
2026-06-24 21:48:33 +02:00
ssrf.rs
feat(v1.1.4): outbound HTTP SDK + cron triggers
2026-06-03 20:23:18 +02:00
suppression_repo.rs
feat(suppress): owner-polymorphic suppression repo + reconcile (M1.2)
2026-07-01 20:04:32 +02:00
topic_repo.rs
feat(v1.1.8): F3 realtime auth_mode = 'session' (migration 0033)
2026-06-06 15:00:47 +02:00
topics_api.rs
feat(groups): tree repos, hierarchy-aware RBAC, admin API
2026-06-24 19:59:00 +02:00
trigger_config.rs
feat(v1.1.9): TriggerEvent::Queue + TriggerKind::Queue + types
2026-06-06 19:08:21 +02:00
trigger_repo.rs
feat(shared-queues): materialized competing consumers + dispatcher branch (D3.2)
2026-07-02 22:33:11 +02:00
triggers_api.rs
feat(triggers): show a materialized column in pic triggers ls --app (D1)
2026-07-02 21:30:32 +02:00
users_admin_api.rs
fix(manager-core): F-P-012 keyset cursor on app_user_repo::list (created_at, id) tiebreaker
2026-06-07 20:50:25 +02:00
users_service.rs
fix(review): harden the E2E-gap fixes after security/regression review
2026-06-13 09:59:24 +02:00
vars_api.rs
feat(vars): admin CRUD API + pic vars CLI
2026-06-24 21:11:46 +02:00
vars_repo.rs
feat(vars): admin CRUD API + pic vars CLI
2026-06-24 21:11:46 +02:00
vars_service.rs
feat(vars): VarsService + vars:: SDK + config capabilities
2026-06-24 20:59:23 +02:00