a432091191
Server-side foundation for Phase-2 groups (no group-owned resources yet):
Shared types:
- GroupId, Group; App gains group_id; AppRole::{precedence,max} for
folding the highest effective role across the membership chain.
Repos:
- group_repo: tree CRUD with reparent (ancestor-walk cycle guard under a
coarse instance-wide structural advisory lock; slug frozen; bumps
structure_version) and delete=RESTRICT (refuses non-empty groups).
- group_members_repo: per-(user, group) role grants, mirroring app_members.
Hierarchy-aware authz (§5.3):
- AuthzRepo gains effective_app_role / effective_group_role (default to
direct membership / none, so the ~18 existing test stubs are untouched);
the Postgres impl resolves each via one depth-bounded recursive CTE that
MAXes the app's own row with every ancestor group_members row.
- can(): the Member path now folds inherited group roles, so a group_admin
on any ancestor is implicitly app_admin beneath it. New Capability
variants InstanceCreateGroup / Group{Read,Write,Admin}; group caps carry
no app_id (bound API keys can't manage groups). 8 new unit tests.
Admin API:
- groups_api: group CRUD + reparent (admin at both source and destination
parent, §5.6) + per-group members, all capability-gated.
- apps: POST /apps takes an optional parent group (default root); app
responses carry group_id; my_role now reflects the effective role.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
57 lines
2.0 KiB
Rust
57 lines
2.0 KiB
Rust
//! App scoping: top-level isolation boundary for scripts, routes,
|
|
//! domains, and (forward) data. Every script and route belongs to
|
|
//! exactly one app; cross-app references are not allowed.
|
|
//!
|
|
//! See blueprint §11.5. The orchestrator dispatches via two-phase
|
|
//! lookup: `Host → app_id → route trie`.
|
|
|
|
use chrono::{DateTime, Utc};
|
|
use serde::{Deserialize, Serialize};
|
|
use uuid::Uuid;
|
|
|
|
use crate::{AppId, GroupId};
|
|
|
|
#[derive(Debug, Clone, Serialize, Deserialize)]
|
|
pub struct App {
|
|
pub id: AppId,
|
|
/// URL-safe identifier; appears in dashboard paths. Mutable via the
|
|
/// slug-rename flow which preserves the old slug as a permanent 301
|
|
/// in `app_slug_history`.
|
|
pub slug: String,
|
|
pub name: String,
|
|
pub description: Option<String>,
|
|
/// Parent group in the org tree (Phase 2). Every app has a parent
|
|
/// from day one (§9 backfill seeds the instance root group).
|
|
pub group_id: GroupId,
|
|
pub created_at: DateTime<Utc>,
|
|
pub updated_at: DateTime<Utc>,
|
|
}
|
|
|
|
#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
|
|
#[serde(rename_all = "lowercase")]
|
|
pub enum DomainShape {
|
|
/// Exact host: `app.example.com`.
|
|
Exact,
|
|
/// Wildcard suffix: `*.example.com` matches any subdomain.
|
|
Wildcard,
|
|
/// Parameterized wildcard: `{tenant}.example.com`. Same shape as
|
|
/// `Wildcard` for collision purposes; the binding name surfaces in
|
|
/// request context (future).
|
|
Parameterized,
|
|
}
|
|
|
|
#[derive(Debug, Clone, Serialize, Deserialize)]
|
|
pub struct AppDomain {
|
|
pub id: Uuid,
|
|
pub app_id: AppId,
|
|
/// As the user typed it: `app.example.com`, `*.example.com`, or
|
|
/// `{tenant}.example.com`.
|
|
pub pattern: String,
|
|
pub shape: DomainShape,
|
|
/// Normalized collision key. `exact:<host>` for exact; `wildcard:<suffix>`
|
|
/// for both wildcard and parameterized (parameter name is a binding,
|
|
/// not a discriminator — per blueprint §11.5).
|
|
pub shape_key: String,
|
|
pub created_at: DateTime<Utc>,
|
|
}
|