Help us shape the future of Go! Take the 2026 Go Developer Survey

organization

package module
v0.0.0-...-3ab7798 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 29, 2026 License: MIT Imports: 23 Imported by: 0

README

go-organization

Trusted organization credential authority

CredentialAuthorityReader is an optional storage projection for credential owners, separate from the member-authenticated Repository.Read contract. Request CredentialAuthorityQuery{TenantID: tenant, OrganizationID: organization} for current active owner authority without borrowing the key creator's identity. Set ActorID only when the operation also needs that actual human's current membership. Owner-only observations contain a zero Actor; failures contain no positive projection.

Version is the current organization aggregate/policy epoch. CredentialVersion is the independent durable organization credential epoch: member/role changes do not revoke independent organization keys; archive/delete advance it, and restoration cannot rewind it. A credential consumer binds the credential's owner version to CredentialVersion and evaluates current policy separately. Validate(query, now) checks exact bindings and the original read's at-most-twenty-second validity; copying or retrying cannot renew it. These types authenticate nobody and grant no permission. A durable adapter must fence the same facts inside the caller's protected transaction before use.

Explicit active-organization profile

NewActiveOrganizationService opts into genuine single-factor password/bearer selection. PrepareActiveSet freezes the submitted bearer's exact SessionID and observed session CAS, actual target membership and the existing organization aggregate epoch. Empty OrganizationID explicitly clears; selection never grants permission. GetActive rechecks current membership, lifecycle, policy and original scope/version, returning no metadata on denial. Existing NewService admission is unchanged, and cookie/CSRF, MFA and passkey selection remain unsupported.

The storage-neutral command carries the complete session-owned source/successor and original exclusive deadline. A native adapter must enlist the session owner's effect inside the one organization-owned transaction; this root API alone is not a durable backend. ActiveOrganizationOperationRequest binds stable keyed intent to session plus requested organization/absence, not the observed source version. Retained keys recover original status without re-preparation. Active-set receipts use the exact session RecordID, session before/after versions and zero OrganizationID; a current selection is read separately through GetActive.

Transport-neutral direct-operation requests

AssignTeamDynamicRoleOperationRequest retains an original key and exact organization, custom-role and team identities with organization/role/team/binding epochs. RevokeTeamDynamicRoleOperationRequest naturally repeats an exact positive binding without a key or caller command. Native team mutation advances its shared team epoch; current compatible organization/team membership remains necessary for effective permission. Existing role assign/revoke descriptors and actual human self-actor bindings already admit original recovery syntax; the team is never impersonated as a human target. Custody-redacted validation grants no authority, and absence/tombstones never establish success or permit unknown-outcome replay. These neutral contracts alone enable no durable workflow or HTTP/Reference route; raw direct/team APIs and their policy, lifecycle and query owners are unchanged.

AssignDynamicRoleOperationRequest retains an original key, exact organization, custom-role and target IDs, plus organization/role/current-membership/binding epochs. Zero binding version selects first assignment; revocation requires a positive binding version through RevokeDynamicRoleOperationRequest, without a key or caller command. Membership is an observed positive epoch, not incremented by a binding mutation. Original target recovery may be nonself. Syntax grants no permission, and tombstones/absence alone prove no prior success. Current native role-action, manager/session, original-query and exact-binding fences remain authoritative; unknown outcomes never authorize redispatch. These neutral custody-redacted contracts enable no durable workflow, team-binding facade or HTTP route; raw direct/team role APIs are unchanged.

CreateDynamicRoleOperationRequest and UpdateDynamicRoleOperationRequest retain one original key, chosen organization/role IDs, exact epochs and complete ordered name/statements intent. DeleteDynamicRoleOperationRequest naturally repeats exact-version retirement without a key or caller command. Only actual original correlation/receipts—not a tombstone—prove success. Intrinsic validation preserves the native 64-statement/8192-encoded-byte ceiling and deny statements; the deployment's immutable catalog and current role-write/session/query authority remain native decisions. Executing adapters must freeze borrowed statements before callbacks. Original CRUD recovery is self-actor scoped. These neutral contracts alone enable no durable workflow or HTTP route; raw role APIs remain unchanged, including direct/team assignment and terminal binding invalidation.

UpdateTeamOperationRequest carries an original key, the chosen team and exact organization/team epochs plus the bounded replacement name. DeleteTeamOperationRequest naturally repeats terminal deletion at those exact epochs without a key or caller command. Original effect correlation and current team-write/session/query authority—not tombstone presence—establish recovery. Their original recovery bindings are self-actor scoped. These neutral contracts alone enable no durable workflow or HTTP route; explicit team APIs are unchanged.

AddTeamMemberOperationRequest carries one original key; RemoveTeamMemberOperationRequest is naturally repeatable without a key or caller command. Both bind the chosen organization, team and user plus exact organization, team, organization-admission and team-binding versions. Removal requires a positive binding version. Organization readmission never revives a prior team binding. OperationRecoveryRequest accepts the exact original target binding; actual current manager/session authority and original receipts remain native decisions, not syntax-validation grants.

CreateOperationRequest, UpdateOperationRequest, AddMemberOperationRequest and UpdateMemberOperationRequest carry one required identity.IdempotencyKey; RemoveMemberOperationRequest is a non-keyed, exact-version repeat operation. The durable operation owner allocates command IDs and create IDs, retains original request correlation, and distinguishes not-committed, committed and unknown outcomes. A retained request key or absent membership never establishes a committed domain mutation. Matching retries must not allocate another command or renew original authority.

OperationRecoveryRequest carries an original safe binding plus current authentication; it grants no permission to resubmit or disclose the operation. Every request's Validate checks syntax and custody presence only, without IO or authentication. These direct request types reject implicit JSON/text export; HTTP integrations own separate bounded wire schemas and credential acquisition. Metadata replacement retains UpdateRequest's bounded name/slug and exact expected organization version. A matching Update key recovers only its original command; changed metadata, organization or version conflicts, and an unknown outcome grants no permission to execute again. Current authority is still required to disclose its original outcome. Static member-role replacement retains MemberRequest's role and exact positive organization/member versions, including owner transitions and native last-owner protection. Matching keys preserve the original role intent and command; current disclosure may admit exact self-demotion history without granting renewed management authority. OperationRecoveryRequest accepts that original outcome, not ownership-transfer execution or disclosure. Existing CreateRequest, UpdateRequest, MemberRequest and Prepare* APIs are unchanged. These additive contracts alone do not enable a durable operation or HTTP route.

CreateTeamOperationRequest selects one required original key, exact organization version, caller-chosen canonical team ID and bounded team name. Creation adds no team members; the native owner allocates the command and retains existing current manager/session authority, quotas and atomic organization-epoch/audit/outbox effects. Matching key/intent repetitions recover only the actual original command, including from a fresh session or reconstructed service. Changed team ID, name or version conflicts; unknown outcomes never permit new execution or renewed authority. OperationRecoveryRequest accepts exact self-actor team-create bindings as safe correlation, not execution or disclosure authority. Existing CreateTeamRequest and explicit APIs are unchanged; these neutral contracts alone add no durable initiating workflow or HTTP route.

LeaveMemberOperationRequest selects only the authenticated human's own membership at an exact original organization version. It contains no target, idempotency key or caller command ID; the native owner must capture the member version and allocate the command. Natural repetition must reconcile actual original metadata, never infer success from absent membership, replay unknown work or remove a readmitted membership through old intent. OperationRecoveryRequest admits exact self-leave bindings for metadata-only recovery; syntax grants neither current-principal nor disclosure authority. The native owner must enforce current verified self-session and action policy without treating the removed membership as a renewed grant. Existing LeaveRequest, explicit preparation and legacy native recovery are unchanged; these neutral contracts alone add no durable workflow or HTTP route.

LifecycleOperationRequest carries one required initiating key for owner-only archive or restore at an exact organization version, a required visible-ASCII reason and bounded correlation, and the complete original action-bound password proof projection. The native signed-proof owner still authenticates provenance, current session/owner, configured audience, freshness and exclusive expiry. Syntax validation has no trusted clock: expired original projections remain representable for matching-key historical classification, not fresh execution. Matching retries must not prepare again or renew proof/authority; changed reason, version, complete proof or configuration conflicts. OperationRecoveryRequest admits only exact self-owner Archive/Restore original bindings in addition to its existing operations. Neither a mapping nor an absent outcome proves success or noncommit. Existing LifecycleRequest and explicit preparation remain unchanged; hard deletion and external asynchronous cascades remain separate.

InvitationSendOperationRequest selects one existing verified recipient by user and identifier ID, the exact organization/version, and one required initiating key. The durable native owner allocates command and invitation IDs and retains the original member role, deadline and delivery policy. Matching retries recover only that original outcome; an unknown outcome cannot authorize another send. There is no submitted address, caller role or proof in this request. Existing explicit InvitationSendRequest and native acceptance contracts are unchanged.

InvitationResendOperationRequest carries the original key and exact invitation and organization versions without a caller command ID, recipient, role or expiry override. The organization epoch is read-only; the invitation version must leave room for both successor and terminal transitions. Native resend keeps the original recipient/deadline and atomically supersedes the predecessor proof. InvitationResendOperationResult retains the original outcome with an optional authorized original-delivery observation (DeliveryState == 0 means absent). It never exposes proof or a delivery-effect ID; a status failure cannot erase known commitment or authorize redispatch. Existing explicit preparation and native result types remain unchanged. These neutral contracts alone enable no durable execution or HTTP route.

InvitationCancelOperationRequest selects an exact invitation/organization and their versions for natural-repeat cancellation. It accepts neither an initiating key nor a caller command ID or recipient proof. The native owner must allocate the command and reconcile actual original metadata under current manager/session authority; a cancelled or absent row alone never proves a successful command. Recipient withdrawal cannot prevent revocation. Versions retain the existing native cancel bounds, and correlation is diagnostic rather than natural intent. Existing explicit cancellation APIs and StoreResult are unchanged. This neutral request alone enables no initiating execution or HTTP route.

InvitationRejectOperationRequest selects an exact invitation/organization and their versions for natural-repeat rejection by the current verified intended recipient. It accepts no key, caller command ID or invitation proof; membership, manager authority and unrelated Get permission are not substitutes for recipient authority. The native owner must allocate the command and reconcile actual original metadata, never infer success from a rejected or absent row. Versions retain the existing native reject bounds, and correlation is diagnostic rather than natural intent. Credentials/selectors remain redacted and non-serializable. Existing explicit rejection APIs and StoreResult are unchanged; this neutral request alone enables no initiating execution or HTTP route.

InvitationExpireOperationRequest selects exact invitation/organization versions and a non-secret reason for natural-repeat manager expiry. It accepts no key, caller command ID or recipient proof. The native owner allocates the command and uses the existing InvitationConfig.ExpirationReasons allowlist, not arbitrary caller text or a separate reason policy. Matching repetitions require actual original metadata under current original-manager/session authority; changed reason or organization epoch conflicts. An expired row alone is not a receipt, and an unknown outcome never permits another execution. Correlation is diagnostic and credentials/selectors remain redacted and non-serializable. Existing explicit expiry APIs and StoreResult are unchanged; this neutral request alone enables no initiating execution or HTTP route.

InvitationAcceptRequest remains once, not keyed: callers retain their original CommandID, exact organization/invitation versions and privately held proof. Its Validate checks bounded syntax without consuming proof or granting membership. InvitationAcceptAdmitter is an additional synchronous transport gate after native preparation, before execution of that same preparation. It receives authenticated original capability ID/lifetime and safe command binding, not proof bytes; success never replaces native current-recipient/final checks. For transports with before-handler middleware, PreparedInvitationAcceptance separates native preparation and rate admission from later execution. Admission() reads authenticated original metadata without IO; only Execute(ctx) executes that same opaque preparation after all additional gates. The handle is redacted/non-serializable, serial-use and not durable recovery authority. Discarding it cannot execute, consume proof or start detached work. InvitationAcceptRecoveryRequest selects only direct original acceptance history with current authentication, the full saved binding and owning organization. It contains no proof/key and never resubmits. Bare-ID recovery after losing the entire response and a separate HTTP recovery route are not selected. These neutral contracts alone do not enable native execution or an HTTP endpoint.

Status: experimental. Explicit-organization membership and the selected existing-recipient invitation, opt-in team-membership and domain-reservation profiles are implemented. This is not a stable release or complete organization unit.

go-organization supplies storage-neutral organization policy and a native PostgreSQL adapter. The selected profile creates organizations, updates bounded names/slugs, admits existing active users, updates static membership roles, lists members and removes members while protecting the last owner.

API and selection

Service.SlugAvailable checks a candidate in the authenticated session's tenant without requiring organization membership or management permission. The explicit identity.organization.slug-available policy evaluates the authenticated human and organization.slug candidate resource. The result contains only Available; it reveals no organization ID or metadata and neither reserves the slug nor promises a later create/update will succeed. Slugs retain create/update's lowercase ASCII label syntax (1..63 bytes, no leading/trailing hyphen).

Repositories opt in through additive OrganizationSlugReader, leaving existing Repository implementations compatible. Readers use current primary occupancy for the exact tenant/candidate, including archived rows that still occupy the tenant's unique slug. Other tenants do not collide. The service rechecks policy, source, current session and original freshness; errors or changed authority return no availability. This core API alone adds no native adapter or HTTP route.

LifecycleConfig selects native owner archive/restore. Current owners supply a fresh action-bound password proof and exact discovered organization version. Archive denies native child authority and cancels pending invitations atomically; restore never revives terminal child state. Hard deletion and complete asynchronous external cascades remain unselected.

DynamicRoleConfig selects bounded custom roles. Current owners/administrators create/read/list/update/delete roles and assign or revoke them for current members. CheckPermission evaluates exact registered action/resource statements through the existing authorization RBAC engine, with explicit deny precedence and a required current organization policy version. Custom roles confer no organization-management or ownership authority. Zero configuration disables this profile. TeamBindingsVersion: 1 additionally selects team bindings with terminal team lifecycle and its forward migration; zero keeps the existing direct-only profile.

GetDynamicRole optionally accepts TargetUserID to return that exact member's current membership and absent/live/tombstone role binding. Fresh managers can discover the versions needed to revoke or reassign without application history; ListDynamicRoles does not accept a target selector. The team profile instead accepts exclusive TargetTeamID for exact team/binding versions, then PrepareAssignTeamDynamicRole or PrepareRevokeTeamDynamicRole.

DomainConfig selects authenticated domain reservation custody: current owners/administrators prepare a reservation, read their organization's current claim, and withdraw its exact version. Zero leaves this profile disabled. Reservations are globally exclusive in the native PostgreSQL adapter but are never proof of domain ownership and never enable SSO routing.

InvitationService.PrepareResend selects a current owner/administrator and the exact pending invitation and organization versions. It preserves the original recipient, verified identifier, member role and exclusive deadline; it does not accept a replacement address or a renewed lifetime. Preparation alone issues no proof. Durable supersession requires the native capability/delivery owners and one atomic commit, so the predecessor and successor are never independently consumable. Retain the original command for retries and recovery.

Invitation.IssuedVersion identifies the pending proof generation. A pending or naturally expired projection has Version == IssuedVersion; a durable terminal transition has Version == IssuedVersion + 1. For source compatibility, zero IssuedVersion means the original issued version1. Resend requires room for both the successor version and its later terminal transition.

InvitationService.PrepareExpire selects the current owner/administrator and an exact pending invitation/version with a reason from configured InvitationConfig.ExpirationReasons. An empty registry leaves expiry disabled. Explicit expiry can precede the natural deadline or terminalize an elapsed pending row: InvitationExpired at its issued version is only a natural projection; the next version is a durable terminal effect that prevents every prior proof from authorizing acceptance. See the adapter's schema and recovery requirements.

InvitationService.PrepareReject admits only the authenticated intended verified recipient of an exact pending invitation, using original organization/invitation versions without membership or an invitation proof. The native adapter atomically stores the next terminal version with canonical audit/event effects; the original capability can no longer authorize acceptance. See the adapter's migration and recovery requirements.

Use the native postgres.Service for durable operations. The root Service owns real session authentication, external policy, validation and immutable command preparation. Its Repository and exact UnitOfWork.Execute/Recover contracts are adapter boundaries, not application workflow instructions.

  • PrepareCreate selects a preallocated canonical ID and tenant-unique lowercase ASCII slug. The creator becomes an owner atomically.
  • PrepareUpdate replaces only Name (1–256 UTF-8 bytes, no ASCII control characters or surrounding whitespace) and Slug (1–63 lowercase ASCII letters/digits/ hyphens, no leading/trailing hyphen), preserving exact spelling. It requires a current owner or administrator and the expected organization version. Identical values return ErrConflict without a transition. Slug collisions conflict within the same tenant, including reserved lifecycle states.
  • PrepareAddMember requires an existing active target user, static role and expected organization/member versions. Administrators cannot add owners.
  • PrepareUpdateMember changes an exact active membership's static role with expected organization/member versions. Only owners may grant or demote owners; the final recovery-capable owner cannot be demoted. See static role updates for authority and recovery.
  • PrepareRemoveMember requires exact versions and retains a tombstone. Only owners remove owners; the final owner cannot be removed.
  • PrepareLeaveMember accepts an explicit organization/version and derives self from the current session, including ordinary members. It cannot select another target or remove the final recovery-capable owner. See self leave.
  • PrepareOwnerTransfer selects an existing active nonowner member and exact organization/source/target versions. A current owner and operation-bound primary proof are required; the former owner becomes an ordinary member. See ownership transfer for authority and recovery.
  • Execute accepts the same immutable prepared command for bounded retries.
  • Get and ListMembers require current active membership on every call. Listing uses exclusive UserID keysets and limits 1–100 over current committed state, not a retained snapshot. Earlier concurrent additions require restart.
  • ListOrganizations lists only the authenticated human's active organizations with 1–200 results, per-organization policy and stable visible-ID pagination. Its additive repository capability leaves existing implementations compatible. See organization listing for filtering and bounds.
  • Recover authenticates the current actor against exact original scope. An ID alone grants no result access; recovery never re-executes a command.

Membership removal advances scoped organization authorization, not unrelated global user or credential authority. Re-admission advances the retained membership and scoped authority rather than resetting them. Metadata updates advance only the existing organization/policy epoch; they do not change memberships, scoped subject authority or global identity authority. Read the updated organization through authenticated Get after the receipt.

The selected update profile maps the planning operation identity.organization.update onto the existing Authentication, stable CommandID, OrganizationVersion, and PrepareUpdate/Execute/Get model. It retains the committed canonical-ID policy and create-name 256-byte bound, not older generated catalog assumptions of 22-character IDs and 128-byte names. Optional typed additional fields and the one-call/HTTP UpdateResult surface are unselected; they are never silently cleared or emulated.

Non-goals

The root boundary does not own:

  • enterprise single sign-on protocol behavior or SCIM wire behavior;
  • billing or user interfaces;
  • session persistence or application authorization policy; or
  • database clients, migrations, transactions, caches, or background workers.

Domain challenges and ownership proofs, hard-delete commands, active selection, cache invalidation, SSO/SCIM and HTTP/browser transport are unselected. Reserved database states are not public operations. Their presence in planning material does not make them available.

Selected invitation boundary

The storage-neutral InvitationService adds owner-send, intended-recipient acceptance/rejection and owner/administrator resend/cancellation/expiry preparation to the same immutable Command/UnitOfWork contract. This root boundary alone is not durable invitation issuance or consumption; the native postgres.NewInvitationService supplies the sole coordinator, capability and delivery owners from actual public configuration. Applications do not implement a token store or transaction coordinator.

Send selects an existing active user and exact verified email identifier. It freezes the organization, recipient, identifier/version, member-only role and exclusive expiry; it never accepts a caller-selected address or privileged role. Acceptance requires independent genuine session authentication and an exact one-use, non-bearer capability for that recipient, invitation and organization. Existing active membership conflicts without overwriting its role or consuming the capability. Current recipient, policy, expiry and membership must be fenced again by native execution, atomically with shared capability consumption.

Get/List expose only current owner-authorized scalar metadata and the existing delivery owner's state/effect ID. They expose no transport address, proof or encrypted custody. Provider Accepted is not confirmed Delivered. Pending records project as expired at the exclusive deadline without a new mutation. Listing uses exclusive invitation-ID keysets with limits1–100. Prospective-user signup and grants above member are not selected by this profile.

Configuration explicitly selects a lifetime within15 minutes–30 days and a pending bound within1–10000; the reference selection is48 hours/100. A48-hour composition must explicitly enlarge capability lifetime limits and delivery deduplication retention to at least lifetime+24 hours. No default capability policy is silently weakened. Neither verification nor metadata is permission to consume, and unknown command outcomes retain the original invitation ID.

Native send/accept and new-service metadata recovery are exercised by the genuine public consumer. A definitive failed acceptance terminal-releases its unused grant: it is not reusable under a new command. A new owner-authorized send can issue a distinct grant within the pending limit; it does not silently resend or cancel the old pending row. Preserve the safe recovery handle before executing and reconcile ambiguous outcomes before selecting any new command.

The owning lifecycle catalog adds invitation.created.v1 (invitation0→1) and invitation.accepted.v1 (issued invitation version→next terminal version). Acceptance also requires the distinct existing membership.created.v1 transition for its actual membership version; an invitation event must not masquerade as that membership event. Exact audit actions are identity.organization.create_invitation and identity.organization.accept_invitation.

PrepareCancel(InvitationCancelRequest) selects the exact live pending invitation and expected organization/invitation versions. It authenticates a current owner or administrator, not the recipient, and needs no invitation proof or current recipient email. The distinct callable operation is identity.organization.invitation.cancel; its canonical audit action is identity.organization.cancel_invitation (standard retention), paired with invitation.cancelled.v1 (invitation1→2). Existing send/accept retention is unchanged. Cancellation grants no membership and changes no organization or global identity authority. Cancelled IDs remain terminal: a still cryptographically valid predecessor proof, including an already-prepared acceptance, cannot pass the shared pending/version fence. Retries preserve the original command; metadata recovery requires current management authority.

ListMine(InvitationListMineRequest) is a distinct current-recipient read, without organization membership or administrator permission. It returns only safe Invitation values bound to the authenticated human and an exact current verified email identifier ID/version. Every supported lifecycle state is visible; pending records project expired at their exclusive deadline. Old identifier versions, removed or unverified identifiers are not historical access grants. No delivery status, address, capability or ciphertext is returned.

The optional InvitationListMineReader preserves existing repository callers. Pages use limits1–200 and a scope-bound opaque continuation, with tenant-unique invitation IDs in C byte order. This is a current keyset, not a snapshot: earlier inserts require restarting. No page escapes on late identity/session/policy or invitation withdrawal; original session freshness is never renewed. Retained invitation metadata itself grants neither membership nor acceptance authority.

Lifecycle and ownership

Supply a real native stateful opaque bearer session with verified single-factor password authentication. Organization-, factor- and passkey-bound sessions are rejected, not downgraded. Supply external policy, canonical-ID validation, positive operation budgets of at most five seconds, and finite member/per-user/per-tenant limits. Native budgets must fit the enclosing budget.

The caller owns primary pools, transport, retained keys and shutdown. Mutable key maps are copied; no package background work or authorization cache starts. Do not log names or bearer-bearing preparations. Commands and authentication reject automatic serialization; persist only safe recovery scope.

Outcomes and retries

Inspect StoreResult.Receipt.Outcome, not error presence alone. Terminal NotCommitted replay may return a nil error. Unknown means the server may have committed: reconcile through scoped recovery, never a new command ID. Preparing again captures new observations and is not an idempotent replay. Retries and recovery never renew original session expiry.

FAQ and tradeoffs

Why explicit IDs? Active-session organization selection is a later profile; current membership and policy are checked for the supplied ID.

Why a tenant lock? The native adapter serializes tenant mutations to protect cardinality and last-owner invariants. This profile makes no throughput claim.

Planning and verification

The repository goal describes the full later unit, not current completion. modules.json records the experimental root and optional adapter. Full platform composition and release qualification remain pending.

See the security boundary, release notes, and SECURITY.md for private reporting; no stable release is supported.

Use Go 1.27.2 and the qualified public Tools v2.1.2 binary; the planned module minimum remains Go 1.27.0. make check, make ci and make fast-check validate configuration, repository structure, cohesion, offline specification decisions, local documentation links and whole-tree/history secrets. CI uses the same structural commands plus validated PR-base or push-before changed-content secret checks on every change. Ordinary Required has a five-minute job limit; changed secrets have a forty-second fatal timeout. Scheduled/manual runs retain whole-tree secrets and online authority refresh. make check-full explicitly preserves the previous full/online contract. These commands do not run application tests or establish runtime/release proof. See contributing for public tooling installation and scope.

See the versioned Golib ecosystem index and package-family guidance for the shared design language.

Optional team-membership profile

Set the same explicit TeamConfig{Version: 1, MaximumTeams: 100, MaximumMembers: 100} on core and native contributor configuration, and install the adapter's forward TeamMigrationSource after existing organization migrations. Zero configuration disables the entire profile and registers no team mutations. Limits are bounded startup policy, not implied protocol defaults. MaximumMembers caps currently compatible active bindings, not lifetime retained removal tombstones; operators retain responsibility for storage/retention sizing.

Owners and administrators call PrepareCreateTeam, PrepareAddTeamMember or PrepareRemoveTeamMember, then the adapter's ordinary Execute; preserve its prepared command/recovery binding for replay or ambiguous commits. Requests bind the exact organization policy, team, organization-member and team-membership versions. Use ListTeams for management, ListMyTeams for the authenticated subject, and ListTeamMembers for managers or current members of that team. Reads are bounded exclusive-ID pages and revalidate native current session, organization membership and scoped authority after action policy.

Each team mutation advances the organization policy epoch. Membership changes also advance that subject's existing organization-scoped authorization epoch, without changing roles, granting permissions or global session authority. Organization removal immediately makes old team bindings unusable; re-admission requires an explicit team add against the new organization-member version and retained team tombstone version. The additional team lifecycle profile selects exact get, versioned name update and terminal delete only after its forward migration and explicit LifecycleVersion: 1. Direct custom roles are selected separately by DynamicRoleConfig; its optional TeamBindingsVersion: 1 adds effective team permissions. Active team selection, HTTP/reference registration and full M23 remain unselected.

License

MIT. See LICENSE.

Documentation navigation

Complete documentation map

Use the versioned ecosystem entry for package selection. The frozen compatibility cohort is separate from current package releases and unpublished source changes. Adopting them does not silently update that cohort.

Documentation

Overview

Package organization owns storage-neutral organization and membership policy. Its selected profiles use an explicitly selected organization and genuine bearer sessions. Invitation preparation selects only existing verified email recipients and member grants. Durable adapters own locking and atomic effects; active-session selection, dynamic team permissions and caches remain unselected.

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrInvalidInput rejects invalid configuration or bounded request syntax.
	ErrInvalidInput = errors.New("organization: invalid input")
	// ErrForbidden deliberately conflates absence, inactive authority and denial.
	ErrForbidden = errors.New("organization: forbidden")
	// ErrConflict rejects duplicate or stale optimistic transitions.
	ErrConflict = errors.New("organization: conflict")
	// ErrLastOwner denies removal or demotion of the final recovery-capable owner.
	ErrLastOwner = errors.New("organization: last owner")
	// ErrLimit denies a configured organization or membership cardinality limit.
	ErrLimit = errors.New("organization: limit exceeded")
	// ErrUnavailable redacts dependency, invalid-output and panic diagnostics.
	ErrUnavailable = errors.New("organization: unavailable")
	// ErrSensitiveSerialization prevents implicit export of runtime custody.
	ErrSensitiveSerialization = errors.New("organization: sensitive serialization forbidden")
)

Functions

func CanonicalDomain 

func CanonicalDomain(input string) (string, error)

CanonicalDomain implements this profile's deterministic ASCII-only name policy: 2 or more LDH labels, 1..63 bytes each, at most 253 canonical bytes, and a final label containing at least one ASCII letter. ASCII case folds and one terminal root dot is removed. Whitespace, wildcard, IP literals, Unicode and implicit IDNA conversion are rejected, not trimmed or interpreted. An ASCII A-label is treated as supplied ASCII; this function makes no IDNA conformance claim.

func OrganizationSessionScope 

func OrganizationSessionScope(tenant identity.TenantID, org ID) (string, error)

OrganizationSessionScope derives the canonical owned key for exact tenant and organization IDs. Length framing prevents tuple ambiguity; hashing keeps two maximum IDs within session's bounded namespace. It grants no authority.

func ValidateRoleStatements 

func ValidateRoleStatements(c DynamicRoleConfig, statements []RoleStatement) error

ValidateRoleStatements rejects unknown or ambiguous statements before storage and again before evaluation. Empty statements intentionally grant nothing.

Types

type ActiveOrganizationOperationRequest 

type ActiveOrganizationOperationRequest struct {
	Authentication Authentication
	IdempotencyKey identity.IdempotencyKey
	SessionID      string
	OrganizationID ID
	CorrelationID  string
}

ActiveOrganizationOperationRequest is stable keyed intent: exact session and requested organization or explicit absence. Observed versions are not intent. A matching retained key recovers its original command, never prepares anew.

func (ActiveOrganizationOperationRequest) Format 

func (ActiveOrganizationOperationRequest) Format(s fmt.State, _ rune)

func (ActiveOrganizationOperationRequest) MarshalJSON 

func (ActiveOrganizationOperationRequest) MarshalJSON() ([]byte, error)

func (ActiveOrganizationOperationRequest) MarshalText 

func (ActiveOrganizationOperationRequest) MarshalText() ([]byte, error)

func (ActiveOrganizationOperationRequest) Validate 

func (r ActiveOrganizationOperationRequest) Validate() error

Validate checks syntax and custody presence, never current authority.

type ActiveOrganizationReadRequest 

type ActiveOrganizationReadRequest struct {
	Authentication Authentication
	CorrelationID  string
}

ActiveOrganizationReadRequest has no user/session override: the submitted bearer selects the exact session, without authority or activity renewal.

func (ActiveOrganizationReadRequest) Format 

func (ActiveOrganizationReadRequest) Format(s fmt.State, _ rune)

func (ActiveOrganizationReadRequest) MarshalJSON 

func (ActiveOrganizationReadRequest) MarshalJSON() ([]byte, error)

func (ActiveOrganizationReadRequest) MarshalText 

func (ActiveOrganizationReadRequest) MarshalText() ([]byte, error)

type ActiveOrganizationRequest 

type ActiveOrganizationRequest struct {
	Authentication Authentication
	CommandID      identity.CommandID
	SessionID      string
	OrganizationID ID
	CorrelationID  string
}

ActiveOrganizationRequest selects an organization, or explicit absence when OrganizationID is empty. SessionID must equal the submitted bearer's stable session; its CAS is observed once and frozen, never caller supplied. Preserve CommandID after uncertainty and recover rather than prepare another attempt.

func (ActiveOrganizationRequest) Format 

func (ActiveOrganizationRequest) Format(s fmt.State, _ rune)

func (ActiveOrganizationRequest) MarshalJSON 

func (ActiveOrganizationRequest) MarshalJSON() ([]byte, error)

func (ActiveOrganizationRequest) MarshalText 

func (ActiveOrganizationRequest) MarshalText() ([]byte, error)

type ActiveOrganizationView 

type ActiveOrganizationView struct {
	SessionID      string
	SessionVersion uint64
	Selected       bool
	Organization   Organization
	Member         Member
}

ActiveOrganizationView is current non-secret selection, not an access grant. Unselected sessions have zero Organization/Member; denials return a zero view.

type AddMemberOperationRequest 

type AddMemberOperationRequest struct {
	Authentication                     Authentication
	IdempotencyKey                     identity.IdempotencyKey
	OrganizationID                     ID
	UserID                             identity.UserID
	Role                               Role
	OrganizationVersion, MemberVersion uint64
	CorrelationID                      string
}

AddMemberOperationRequest is the transport-neutral keyed membership admission. Expected versions and role have MemberRequest's semantics. A retry preserves the original key and intent; it does not obtain a fresh authority observation or alter a retained command after an ambiguous result.

func (AddMemberOperationRequest) Format 

func (AddMemberOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials, keys and request values from diagnostics.

func (AddMemberOperationRequest) MarshalJSON 

func (AddMemberOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental transport/persistence of direct custody.

func (AddMemberOperationRequest) MarshalText 

func (AddMemberOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of direct custody.

func (AddMemberOperationRequest) Validate 

func (r AddMemberOperationRequest) Validate() error

Validate checks bounded syntax; it does not prove current membership, authority, expected versions or durable outcome.

type AddTeamMemberOperationRequest 

type AddTeamMemberOperationRequest struct {
	Authentication                                                                 Authentication
	IdempotencyKey                                                                 identity.IdempotencyKey
	OrganizationID, TeamID                                                         ID
	UserID                                                                         identity.UserID
	OrganizationVersion, TeamVersion, OrganizationMemberVersion, MembershipVersion uint64
	CorrelationID                                                                  string
}

AddTeamMemberOperationRequest admits one exact organization membership to one team under an original key. All four versions retain TeamMemberRequest's semantics: zero MembershipVersion means never bound; otherwise supply the retained binding version. The owner allocates the command, not the target IDs. Matching keys recover only the original outcome under current manager/session authority. Changed IDs or versions conflict; unknown results never reexecute. Authentication and the required key are borrowed opaque custody.

func (AddTeamMemberOperationRequest) Format 

func (AddTeamMemberOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials, key and request metadata from diagnostics.

func (AddTeamMemberOperationRequest) MarshalJSON 

func (AddTeamMemberOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of custody.

func (AddTeamMemberOperationRequest) MarshalText 

func (AddTeamMemberOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of custody.

func (AddTeamMemberOperationRequest) Validate 

func (r AddTeamMemberOperationRequest) Validate() error

Validate checks bounded syntax and custody without IO, current authority, canonical-ID policy, key admission or command allocation.

type AssignDynamicRoleOperationRequest 

type AssignDynamicRoleOperationRequest struct {
	Authentication                                                              Authentication
	IdempotencyKey                                                              identity.IdempotencyKey
	OrganizationID, RoleID                                                      ID
	UserID                                                                      identity.UserID
	OrganizationVersion, RoleVersion, OrganizationMemberVersion, BindingVersion uint64
	CorrelationID                                                               string
}

AssignDynamicRoleOperationRequest binds one original key to an exact direct custom-role assignment for a current organization member. BindingVersion zero selects a never-assigned binding; otherwise use the observed live/tombstone version. The native owner allocates the command, not the role or target IDs. Matching keys recover only original metadata under current manager/session, actual role-action and query authority. They never renew a grant or reexecute an unknown outcome. Authentication/key are borrowed opaque custody; syntax alone proves neither current membership, a registered role nor permission.

func (AssignDynamicRoleOperationRequest) Format 

func (AssignDynamicRoleOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials, original key and exact assignment intent.

func (AssignDynamicRoleOperationRequest) MarshalJSON 

func (AssignDynamicRoleOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of borrowed custody.

func (AssignDynamicRoleOperationRequest) MarshalText 

func (AssignDynamicRoleOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of custody.

func (AssignDynamicRoleOperationRequest) Validate 

func (r AssignDynamicRoleOperationRequest) Validate() error

Validate checks bounded syntax/custody without IO, canonical-ID policy, authentication, catalog lookup, command allocation or execution authority.

type AssignTeamDynamicRoleOperationRequest 

type AssignTeamDynamicRoleOperationRequest struct {
	Authentication                                                Authentication
	IdempotencyKey                                                identity.IdempotencyKey
	OrganizationID, RoleID, TeamID                                ID
	OrganizationVersion, RoleVersion, TeamVersion, BindingVersion uint64
	CorrelationID                                                 string
}

AssignTeamDynamicRoleOperationRequest binds one original key to a custom role for an exact current team. Obtain organization, role, team and binding epochs from GetDynamicRole with TargetTeamID. BindingVersion zero means never assigned; otherwise use the retained live/tombstone version. The native owner allocates the command, not these identities. Actual permission also requires compatible current organization/team membership: this request never names a human target or grants management authority. Matching keys disclose original outcomes under current manager/session, role-action and query policy, never renewed execution. Authentication/key are borrowed opaque custody, not proof of authorization.

func (AssignTeamDynamicRoleOperationRequest) Format 

func (AssignTeamDynamicRoleOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials, original key and exact team-assignment intent.

func (AssignTeamDynamicRoleOperationRequest) MarshalJSON 

func (AssignTeamDynamicRoleOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of borrowed custody.

func (AssignTeamDynamicRoleOperationRequest) MarshalText 

func (AssignTeamDynamicRoleOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of custody.

func (AssignTeamDynamicRoleOperationRequest) Validate 

func (r AssignTeamDynamicRoleOperationRequest) Validate() error

Validate checks bounded syntax and key custody without IO, canonical-ID policy, current authentication, catalog lookup or execution authority.

type Authentication 

type Authentication struct {
	TenantID identity.TenantID
	Bearer   authentication.BearerCredential
}

Authentication selects only explicit bearer transport. Cookie/CSRF workflows require the session owner's native browser composition and are not emulated.

func (Authentication) Format 

func (Authentication) Format(s fmt.State, _ rune)

func (Authentication) MarshalJSON 

func (Authentication) MarshalJSON() ([]byte, error)

func (Authentication) MarshalText 

func (Authentication) MarshalText() ([]byte, error)

type Command 

type Command struct {
	// contains filtered or unexported fields
}

Command is immutable Service-issued preparation, not a transaction/receipt. Zero is invalid. Only a native adapter's public service composes Execute with its own invocation-scoped UnitOfWork; applications need no workflow glue.

func (Command) Format 

func (Command) Format(s fmt.State, _ rune)

func (Command) Input 

func (c Command) Input() (CommandInput, error)

func (Command) MarshalJSON 

func (Command) MarshalJSON() ([]byte, error)

func (Command) MarshalText 

func (Command) MarshalText() ([]byte, error)

type CommandInput 

type CommandInput struct {
	Binding                                          identity.CommandBinding
	Operation                                        Operation
	Organization                                     Organization
	Actor, Target                                    Member
	TargetUser                                       identity.User
	Role                                             Role
	Session                                          session.GetResult
	Bearer                                           authentication.BearerCredential
	MaximumMembers, MaximumPerUser, MaximumPerTenant uint64
	Invitation                                       InvitationInput
	Team                                             Team
	TeamMember                                       TeamMember
	Teams                                            TeamConfig
	DomainClaim                                      DomainClaim
	DomainProof                                      DomainProof
	Domains                                          DomainConfig
	DynamicRole                                      DynamicRole
	RoleBinding                                      RoleBinding
	TeamRoleBinding                                  TeamRoleBinding
	DynamicRoles                                     DynamicRoleConfig
	OwnerTransferProof                               authentication.ReauthenticationProof
	Lifecycle                                        LifecycleConfig
	LifecycleState                                   LifecycleState
	LifecycleReason                                  string
	LifecycleProof                                   authentication.ReauthenticationProof
	// ActiveOrganization is present only for ActiveSet and retains session's
	// exact source/successor with an original exclusive admission deadline.
	ActiveOrganization           session.OrganizationSelectionCommand
	ActiveOrganizationValidUntil time.Time
}

CommandInput is the trusted adapter projection of a Service-issued command. It contains original private session admission and bearer custody: do not log, persist or automatically serialize it. Adapters map every field into the sole durable owner's keyed command; none alone grants mutation permission.

func (CommandInput) Format 

func (CommandInput) Format(s fmt.State, _ rune)

func (CommandInput) MarshalJSON 

func (CommandInput) MarshalJSON() ([]byte, error)

func (CommandInput) MarshalText 

func (CommandInput) MarshalText() ([]byte, error)

type Config 

type Config struct {
	Clock                                            clock.Clock
	MaximumDuration                                  time.Duration
	PolicyID                                         string
	PolicyVersion                                    uint64
	MaximumMembers, MaximumPerUser, MaximumPerTenant uint64
	ValidateCanonicalID                              func(context.Context, ID) error
	Teams                                            TeamConfig
	Domains                                          DomainConfig
	DynamicRoles                                     DynamicRoleConfig
	Lifecycle                                        LifecycleConfig
	// OwnerTransferAudience explicitly selects the signed primary-proof audience.
	// Empty disables ownership transfer; it is independent of session audience.
	OwnerTransferAudience string
}

Config is explicit immutable policy. Limits are finite and enforced again by the durable adapter under its own locks. MaxMembers follows the reference organization.max_members range; MaxPerUser follows organization.max_per_user. MaximumPerTenant is an additional deployment-selected cap, not a reference default. Canonical validation preserves, rather than transforms, supplied IDs.

type CreateDynamicRoleOperationRequest 

type CreateDynamicRoleOperationRequest struct {
	Authentication         Authentication
	IdempotencyKey         identity.IdempotencyKey
	OrganizationID, RoleID ID
	OrganizationVersion    uint64
	Name, CorrelationID    string
	Statements             []RoleStatement
}

CreateDynamicRoleOperationRequest binds one original key to a chosen role ID, exact organization epoch, bounded name and ordered statements. The native owner allocates the command; creation has no prior role epoch. Matching retries recover only the original outcome, never execute again after an unknown result. Authentication/key and Statements are borrowed custody: an executing adapter must copy the complete intent before callbacks. Validate grants no authority and cannot decide membership in the deployment's immutable permission catalog.

func (CreateDynamicRoleOperationRequest) Format 

func (CreateDynamicRoleOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials, original key and replacement intent.

func (CreateDynamicRoleOperationRequest) MarshalJSON 

func (CreateDynamicRoleOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of borrowed custody.

func (CreateDynamicRoleOperationRequest) MarshalText 

func (CreateDynamicRoleOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of custody.

func (CreateDynamicRoleOperationRequest) Validate 

func (r CreateDynamicRoleOperationRequest) Validate() error

Validate checks bounded syntax and custody without IO, catalog or authority.

type CreateOperationRequest 

type CreateOperationRequest struct {
	Authentication            Authentication
	IdempotencyKey            identity.IdempotencyKey
	Name, Slug, CorrelationID string
}

CreateOperationRequest is the transport-neutral keyed create operation. The durable owner allocates the organization and command IDs only when the original scoped key is admitted. Matching retries recover that command; changed intent conflicts, and unknown outcomes never allocate another ID. Authentication and the single required key are opaque borrowed custody. Name/Slug use CreateRequest's bounds; no tenant or actor override exists.

func (CreateOperationRequest) Format 

func (CreateOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials, keys and request values from diagnostics.

func (CreateOperationRequest) MarshalJSON 

func (CreateOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental transport/persistence of direct custody.

func (CreateOperationRequest) MarshalText 

func (CreateOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of direct custody.

func (CreateOperationRequest) Validate 

func (r CreateOperationRequest) Validate() error

Validate checks bounded syntax and custody presence without owner IO, authentication, authorization, key admission or command allocation.

type CreateRequest 

type CreateRequest struct {
	Authentication            Authentication
	CommandID                 identity.CommandID
	ID                        ID
	Slug, Name, CorrelationID string
}

CreateRequest preallocates the canonical ID and preserves CommandID across retries. Slugs are lowercase ASCII labels of 1..63 bytes, unique per tenant; names are 1..256 UTF-8 bytes without control characters. They are never logs.

type CreateTeamOperationRequest 

type CreateTeamOperationRequest struct {
	Authentication         Authentication
	IdempotencyKey         identity.IdempotencyKey
	OrganizationID, TeamID ID
	OrganizationVersion    uint64
	Name, CorrelationID    string
}

CreateTeamOperationRequest selects original-key creation of one empty team. OrganizationID, the caller-chosen canonical TeamID, exact organization version and bounded Name retain CreateTeamRequest's semantics. Authentication selects the actual actor; no caller command, actor override or membership is supplied. The native owner allocates the command and enforces current manager/session authority, canonical IDs, configured team limits and atomic effects.

Matching key/intent retries classify only the original command under current disclosure authority, including from a fresh session or reconstructed service. Changed team ID, name or version conflicts. An unknown outcome never permits new execution or renewed authority. Credentials and the one required key are opaque borrowed custody; CorrelationID is diagnostic rather than key intent. Existing explicit preparation/execution APIs and StoreResult are unchanged.

func (CreateTeamOperationRequest) Format 

func (CreateTeamOperationRequest) Format(s fmt.State, _ rune)

Format redacts credential, key and request metadata from diagnostics.

func (CreateTeamOperationRequest) MarshalJSON 

func (CreateTeamOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental transport or persistence of direct custody.

func (CreateTeamOperationRequest) MarshalText 

func (CreateTeamOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of direct custody.

func (CreateTeamOperationRequest) Validate 

func (r CreateTeamOperationRequest) Validate() error

Validate checks bounded syntax and credential/key presence without IO, authentication, canonical-ID policy, authorization, key admission or command allocation. Name retains the existing 1..256-byte bounded-text contract and OrganizationVersion must leave room for the native policy-epoch increment. Syntax alone proves neither team creation nor original-history authority.

type CreateTeamRequest 

type CreateTeamRequest struct {
	Authentication         Authentication
	CommandID              identity.CommandID
	OrganizationID, TeamID ID
	OrganizationVersion    uint64
	Name, CorrelationID    string
}

CreateTeamRequest creates a named bounded team without adding members. IDs preserve canonical caller identities and are unique within an organization.

type CredentialAuthorityObservation 

type CredentialAuthorityObservation struct {
	TenantID          identity.TenantID
	OrganizationID    ID
	Version           uint64
	CredentialVersion uint64
	Actor             Member
	ReadStartedAt     time.Time
	VerifiedAt        time.Time
	ValidUntil        time.Time
}

CredentialAuthorityObservation is a trusted, uncached active-owner projection. Version is current aggregate/policy authority; CredentialVersion is a separate durable revocation epoch. Member/role changes advance the former, not the latter; archive/delete advance the latter and restoration must never rewind it. Actor is zero for owner-only queries and the exact current member otherwise. Times retain the original read's freshness, bounded by twenty seconds from its start. Copying/retrying this value cannot renew validity. Neither this value nor its structural validation authenticates a key or grants any permission.

func (CredentialAuthorityObservation) Validate 

func (o CredentialAuthorityObservation) Validate(q CredentialAuthorityQuery, now time.Time) error

Validate checks exact requested bindings and original bounded freshness at now. Consumers must still fence current storage state at their protected operation and independently enforce credential authentication and current policy.

type CredentialAuthorityQuery 

type CredentialAuthorityQuery struct {
	TenantID       identity.TenantID
	OrganizationID ID
	ActorID        identity.UserID
}

CredentialAuthorityQuery selects trusted current storage facts, not a public authorization endpoint. An empty ActorID requests organization ownership only; a nonempty ActorID requires that actual user's current active membership.

func (CredentialAuthorityQuery) Validate 

func (q CredentialAuthorityQuery) Validate() error

Validate rejects malformed identifiers without canonicalizing them or granting permission. Canonical-ID policy remains the composing consumer's responsibility.

type CredentialAuthorityReader 

type CredentialAuthorityReader interface {
	ObserveCredentialAuthority(context.Context, CredentialAuthorityQuery) (CredentialAuthorityObservation, error)
}

CredentialAuthorityReader exposes storage facts to trusted credential owners. Failure returns a zero observation; no creator identity is inferred. Existing member-only Repository reads retain their separate authentication workflow.

type DeleteDynamicRoleOperationRequest 

type DeleteDynamicRoleOperationRequest struct {
	Authentication                   Authentication
	OrganizationID, RoleID           ID
	OrganizationVersion, RoleVersion uint64
	CorrelationID                    string
}

DeleteDynamicRoleOperationRequest naturally repeats terminal retirement at exact organization/role epochs, without a key, caller command or replacement. Retirement denies all bindings and cannot reuse the role ID. Only matching original effect correlation and the actual native receipt prove prior success; a missing/deleted role alone never does. Current manager/session, role-write and query authority still apply. Retain an unknown result's original binding for explicit recovery; natural syntax cannot identify an unattached command.

func (DeleteDynamicRoleOperationRequest) Format 

func (DeleteDynamicRoleOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials and exact historical selectors.

func (DeleteDynamicRoleOperationRequest) MarshalJSON 

func (DeleteDynamicRoleOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of borrowed custody.

func (DeleteDynamicRoleOperationRequest) MarshalText 

func (DeleteDynamicRoleOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of custody.

func (DeleteDynamicRoleOperationRequest) Validate 

func (r DeleteDynamicRoleOperationRequest) Validate() error

Validate checks exact terminal selectors, not execution or disclosure rights.

type DeleteTeamOperationRequest 

type DeleteTeamOperationRequest struct {
	Authentication                   Authentication
	OrganizationID, TeamID           ID
	OrganizationVersion, TeamVersion uint64
	CorrelationID                    string
}

DeleteTeamOperationRequest naturally repeats exact-version terminal deletion, without a key or caller command. Only actual original effect correlation and the original native receipt establish prior success; a retired/absent ID alone never does. Deletion cannot revive the team or retained membership bindings. Current manager/session, actual team-write and outcome-query policy still apply. Retain an unknown result's original binding for explicit recovery: natural syntax cannot identify an unattached or uncommitted command.

func (DeleteTeamOperationRequest) Format 

func (DeleteTeamOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials and request metadata from diagnostics.

func (DeleteTeamOperationRequest) MarshalJSON 

func (DeleteTeamOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of custody.

func (DeleteTeamOperationRequest) MarshalText 

func (DeleteTeamOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of custody.

func (DeleteTeamOperationRequest) Validate 

func (r DeleteTeamOperationRequest) Validate() error

Validate checks exact positive incrementable epochs without manufacturing execution or historical-disclosure authority from a terminal row.

type DeleteTeamRequest 

type DeleteTeamRequest struct {
	Authentication                   Authentication
	CommandID                        identity.CommandID
	OrganizationID, TeamID           ID
	OrganizationVersion, TeamVersion uint64
	CorrelationID                    string
}

DeleteTeamRequest permanently retires this team identity at exact epochs. Existing member bindings cease to grant access without per-member fan-out; recreating the ID is forbidden. Historical command recovery remains separate.

type DomainClaim 

type DomainClaim struct {
	ID, OrganizationID ID
	TenantID           identity.TenantID
	Domain             string
	Version            uint64
	State              DomainClaimState
}

DomainClaim is a primary custody snapshot bound to an immutable claim identity and exact tenant/organization. Withdrawal advances Version and retains the original Domain and ID forever; a later reservation requires a new ID.

type DomainClaimReadRequest 

type DomainClaimReadRequest struct {
	Authentication          Authentication
	OrganizationID, ClaimID ID
	CorrelationID           string
}

DomainClaimReadRequest selects only an own-organization immutable claim ID, including its withdrawn tombstone. It cannot search for a competing owner.

type DomainClaimRequest 

type DomainClaimRequest struct {
	Authentication                    Authentication
	CommandID                         identity.CommandID
	OrganizationID, ClaimID           ID
	OrganizationVersion, ClaimVersion uint64
	Domain, CorrelationID             string
}

DomainClaimRequest freezes an exact tenant/org, immutable ClaimID, canonical Domain and expected organization epoch. Reserve requires ClaimVersion zero; withdraw requires the exact current requested version. Preserve CommandID and the original prepared command for replay; never retry Unknown with a new ID.

type DomainClaimState 

type DomainClaimState string

DomainClaimState is the closed reservation-only lifecycle. Neither state is domain ownership evidence. Future challenge/proof profiles remain unselected. 

const (
	DomainRequested DomainClaimState = "requested"
	DomainWithdrawn DomainClaimState = "withdrawn"
)

type DomainConfig 

type DomainConfig struct {
	Version, MaximumClaims uint64
	// EvidenceMaximumAge explicitly enables proof issuance and bounds original
	// observation lifetime. identity-platform/REFERENCE_CONFIGURATION.md's
	// sso.domain_proof.ttl allows 15m..48h;
	// zero preserves reservation-only behavior. Observers may return less time.
	EvidenceMaximumAge time.Duration
}

DomainConfig explicitly selects reservation custody and, independently, an optional bounded evidence lifetime. Zero disables it. Version binds immutable deployed policy; MaximumClaims bounds all retained claims (including withdrawn tombstones) per organization to 1..10,000. There is no expiry or automatic takeover.

func (DomainConfig) Validate 

func (c DomainConfig) Validate() error

type DomainEvidenceCommand 

type DomainEvidenceCommand struct {
	// contains filtered or unexported fields
}

DomainEvidenceCommand is immutable organization-issued observation custody. Zero is invalid. Persist its safe Recovery binding before Apply; never repeat an external observation to recover an ambiguous outcome.

func (DomainEvidenceCommand) Command 

func (c DomainEvidenceCommand) Command() Command

Command exposes the trusted storage-neutral projection for native composition, never another observation or a caller-constructible mutation grant.

func (DomainEvidenceCommand) Format 

func (DomainEvidenceCommand) Format(s fmt.State, _ rune)

func (DomainEvidenceCommand) MarshalJSON 

func (DomainEvidenceCommand) MarshalJSON() ([]byte, error)

func (DomainEvidenceCommand) MarshalText 

func (DomainEvidenceCommand) MarshalText() ([]byte, error)

type DomainEvidenceObserver 

type DomainEvidenceObserver interface {
	ObserveDomain(context.Context, DomainClaim) (DomainObservation, error)
}

DomainEvidenceObserver is a deployment-selected external observation seam, called once outside all durable locks. It is not a competing proof authority. DNS/HTTPS adapters must enforce their own bounded challenge verification. Implementations must honor cancellation and support concurrent invocations.

type DomainEvidenceRequest 

type DomainEvidenceRequest struct {
	Claim        DomainClaimRequest
	ProofVersion uint64
}

DomainEvidenceRequest selects an existing requested claim and exact current proof version. This finite profile issues once (zero -> one), then optionally terminally revokes (one -> two); renewal/takeover requires a new claim identity.

type DomainEvidenceResult 

type DomainEvidenceResult struct {
	StoreResult
	Proof DomainProof
}

DomainEvidenceResult retains the sole identity command outcome. Proof is set only for committed outcomes and is the identical original historical proof.

type DomainEvidenceTransition 

type DomainEvidenceTransition interface {
	ApplyDomainEvidence(context.Context, DomainEvidenceCommand) (DomainEvidenceResult, error)
	RecoverDomainEvidence(context.Context, identity.CommandID) (DomainEvidenceResult, error)
}

DomainEvidenceTransition is invocation-scoped authenticated transition custody. Apply attempts an already observed exact command; Recover never observes or reexecutes it. Unknown and not-committed outcomes carry no proof.

type DomainMethod 

type DomainMethod string

DomainMethod names the explicitly supported observer profiles. A method name is not verification: only the configured trusted observer may produce evidence. 

const (
	DomainDNS   DomainMethod = "dns-txt"
	DomainHTTPS DomainMethod = "https"
)

type DomainObservation 

type DomainObservation struct {
	Claim                 DomainClaim
	Method                DomainMethod
	ObservedAt, ExpiresAt time.Time
	Verified              bool
}

DomainObservation is a trusted observer's bounded outcome for the exact claim. The observer, not a request field or method label, must verify the external challenge. Raw challenge material must not be returned, logged or persisted.

type DomainProof 

type DomainProof struct {
	TenantID                   identity.TenantID
	OrganizationID, ClaimID    ID
	Domain                     string
	ClaimVersion, ProofVersion uint64
	Method                     DomainMethod
	ObservedAt, ExpiresAt      time.Time
	Revoked                    bool
}

DomainProof is an organization-owned immutable authoritative snapshot, not a bearer grant. Current use requires GetDomainProof; historical command recovery intentionally returns the original snapshot even after expiry or revocation. Times are UTC microseconds (PostgreSQL precision); expiry is exclusive.

type DomainProofKey 

type DomainProofKey DomainProof

DomainProofKey binds every authority dimension of an exact proof. Zero is invalid. Construct it by converting an authority-issued DomainProof; changing any field never selects a different authority or renews its freshness.

type DomainProofReader 

type DomainProofReader interface {
	GetDomainProof(context.Context, DomainProofKey) (DomainProof, error)
}

DomainProofReader consults primary current authority, never a cached allow.

type DynamicRole 

type DynamicRole struct {
	ID, OrganizationID ID
	TenantID           identity.TenantID
	Name               string
	Version            uint64
	Statements         []RoleStatement
}

DynamicRole is a current bounded custom role snapshot, never a static role. Updating replaces all statements immediately for every current binding; deleting terminally retires its ID and denies all of its bindings.

type DynamicRoleConfig 

type DynamicRoleConfig struct {
	Version, MaximumRoles uint64
	Catalog               []Permission
	// TeamBindingsVersion1 opts into direct+team effective role evaluation and
	// team-target role.assign/revoke. Zero preserves direct-only command bytes.
	TeamBindingsVersion uint64 `json:",omitempty"`
}

DynamicRoleConfig selects the custom-role profile. Zero disables it. MaximumRoles bounds retained role identities per organization (1..100), including deleted tombstones, so delete/create churn cannot grow storage. Catalog is copied at construction, has 1..128 distinct entries, and is part of durable command identity. Changing it requires a deployment policy epoch. Custom management permissions remain unsupported.

func (DynamicRoleConfig) Fingerprint 

func (c DynamicRoleConfig) Fingerprint() string

Fingerprint identifies this complete immutable policy, not a source revision.

func (DynamicRoleConfig) Validate 

func (c DynamicRoleConfig) Validate() error

Validate accepts the disabled zero policy or a bounded complete catalog.

type DynamicRoleReadRequest 

type DynamicRoleReadRequest struct {
	Authentication         Authentication
	OrganizationID, RoleID ID
	TargetUserID           identity.UserID
	// TargetTeamID selects one current team binding; it is mutually exclusive
	// with TargetUserID and requires TeamBindingsVersion1. List rejects both.
	TargetTeamID  ID
	Cursor        string
	Limit         uint32
	CorrelationID string
}

DynamicRoleReadRequest selects one exact role or an exclusive ID-keyset page. Reads require current static owner/admin authority. List requires Limit 1..100 and empty RoleID/target selectors; Get requires RoleID, zero Limit and empty Cursor. Get's optional TargetUserID returns that exact organization membership and its absent/live/tombstone RoleBinding, including versions for a fresh manager. Removed membership state remains explicit; a stored binding is never authority.

type DynamicRoleRequest 

type DynamicRoleRequest struct {
	Authentication                   Authentication
	CommandID                        identity.CommandID
	OrganizationID, RoleID           ID
	OrganizationVersion, RoleVersion uint64
	Name, CorrelationID              string
	Statements                       []RoleStatement
}

DynamicRoleRequest replaces Name/Statements for create/update. Delete accepts neither replacement field and retires all bindings without reassignment. RoleVersion is zero only for create; OrganizationVersion must always match.

type ID 

type ID string

ID preserves a canonical organization identifier, including existing ULIDs. It carries neither ownership nor membership authority. IDs are case-sensitive.

type Invitation 

type Invitation struct {
	ID, OrganizationID         ID
	TenantID                   identity.TenantID
	RecipientUserID            identity.UserID
	RecipientIdentifierID      identity.IdentifierID
	RecipientIdentifierVersion uint64
	CreatedBy                  identity.UserID
	Role                       Role
	Status                     InvitationStatus
	Version                    uint64
	// IssuedVersion is the last pending version bound to an issued proof.
	// Zero preserves legacy source projections and means first issuance (one).
	// Pending/natural-expired Version equals it; terminal Version is one later.
	IssuedVersion uint64
	ExpiresAt     time.Time
}

Invitation is safe scalar metadata. It contains neither a transport address nor proof/digest/ciphertext. It grants no access and never authenticates its recipient. Versions and IDs are exact tenant/organization scoped values.

type InvitationAcceptAdmission 

type InvitationAcceptAdmission struct {
	Binding           identity.CommandBinding
	OrganizationID    ID
	ChallengeID       string
	ChallengeLifetime time.Duration
}

InvitationAcceptAdmission is non-authoritative original preparation metadata for a synchronous transport gate. Binding identifies the caller's original command and intended verified recipient; ChallengeID is the authenticated issuer's original capability ID, not a proof, fingerprint or submitted value. ChallengeLifetime is signed ExpiresAt-IssuedAt, never remaining time or a new configuration lifetime. These values neither consume proof nor grant access.

func (InvitationAcceptAdmission) Format 

func (InvitationAcceptAdmission) Format(s fmt.State, _ rune)

Format redacts preparation correlation and challenge metadata.

func (InvitationAcceptAdmission) MarshalJSON 

func (InvitationAcceptAdmission) MarshalJSON() ([]byte, error)

MarshalJSON rejects implicit export; transports own explicit safe wire types.

func (InvitationAcceptAdmission) MarshalText 

func (InvitationAcceptAdmission) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export.

func (InvitationAcceptAdmission) Validate 

func (r InvitationAcceptAdmission) Validate() error

Validate checks closed original-acceptance correlation and bounded rate facts, not their authenticity or current permission. The lifetime ceiling follows InvitationConfig's 30-day maximum; signed original issuance can be shorter.

type InvitationAcceptAdmitter 

type InvitationAcceptAdmitter func(context.Context, InvitationAcceptAdmission) error

InvitationAcceptAdmitter is an additional synchronous transport admission gate, invoked once outside SQL after native acceptance preparation and before executing that exact preparation. A nil callback is invalid; errors, panics or cancellation deny execution. Implementations must honor ctx, must not start detached work, and must support concurrent independent requests. Returning nil does not replace native current authority, expiry or one-use final fences.

func (InvitationAcceptAdmitter) Format 

func (InvitationAcceptAdmitter) Format(s fmt.State, _ rune)

Format redacts the borrowed synchronous admission callback.

func (InvitationAcceptAdmitter) MarshalJSON 

func (InvitationAcceptAdmitter) MarshalJSON() ([]byte, error)

MarshalJSON rejects implicit callback persistence or transport.

func (InvitationAcceptAdmitter) MarshalText 

func (InvitationAcceptAdmitter) MarshalText() ([]byte, error)

MarshalText rejects implicit callback export.

type InvitationAcceptRecoveryRequest 

type InvitationAcceptRecoveryRequest struct {
	Authentication Authentication
	Binding        identity.CommandBinding
	OrganizationID ID
}

InvitationAcceptRecoveryRequest selects only exact original acceptance history. Binding and OrganizationID are safe correlation saved from the native preparation/result, not authority. Current authentication must independently resolve the original actor and intended verified recipient. There is no proof, request key, new execution or bare-command-ID lookup in this request.

func (InvitationAcceptRecoveryRequest) Format 

func (InvitationAcceptRecoveryRequest) Format(s fmt.State, _ rune)

Format redacts current credentials and original recovery correlation.

func (InvitationAcceptRecoveryRequest) MarshalJSON 

func (InvitationAcceptRecoveryRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental credential/recovery custody serialization.

func (InvitationAcceptRecoveryRequest) MarshalText 

func (InvitationAcceptRecoveryRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit credential/recovery custody export.

func (InvitationAcceptRecoveryRequest) Validate 

func (r InvitationAcceptRecoveryRequest) Validate() error

Validate checks exact acceptance/tenant correlation and authentication syntax only. Historical disclosure still belongs to the native recovery owner.

type InvitationAcceptRequest 

type InvitationAcceptRequest struct {
	Authentication                         Authentication
	CommandID                              identity.CommandID
	ID, OrganizationID                     ID
	OrganizationVersion, InvitationVersion uint64
	Proof                                  capability.Proof
	CorrelationID                          string
}

InvitationAcceptRequest supplies the exact invitation, current organization and invitation versions and privately held capability. Authentication must independently resolve its intended verified recipient; proof is never login.

func (InvitationAcceptRequest) Format 

func (InvitationAcceptRequest) Format(s fmt.State, _ rune)

func (InvitationAcceptRequest) MarshalJSON 

func (InvitationAcceptRequest) MarshalJSON() ([]byte, error)

func (InvitationAcceptRequest) MarshalText 

func (InvitationAcceptRequest) MarshalText() ([]byte, error)

func (InvitationAcceptRequest) Validate 

func (r InvitationAcceptRequest) Validate() error

Validate checks bounded once-request custody without IO or cryptographic verification. It never transfers or consumes Proof. The proof's 32..4096-byte boundary is the invitation.accept request contract; a valid shape is not authority. Existing explicit preparation retains its own independent checks.

type InvitationCancelOperationRequest 

type InvitationCancelOperationRequest struct {
	Authentication                         Authentication
	OrganizationID, InvitationID           ID
	OrganizationVersion, InvitationVersion uint64
	CorrelationID                          string
}

InvitationCancelOperationRequest selects one exact pending invitation for a naturally repeatable cancellation, without a client key or command ID. The native owner allocates the original command and authenticates the current owner/administrator independently of the invitation recipient. Recipient withdrawal must not prevent revocation; no recipient credential or proof is requested. Existing explicit preparation/execution contracts are unchanged.

A repeat must reconcile actual matching original command metadata under current tenant, actor and organization authority, never infer success from a cancelled/absent row or execute again. Unknown outcomes remain unknown until the existing native owner classifies them. CorrelationID is diagnostic, not part of the natural selection or execution authority. Results use StoreResult.

func (InvitationCancelOperationRequest) Format 

func (InvitationCancelOperationRequest) Format(s fmt.State, _ rune)

Format hides borrowed credentials and exact invitation selectors.

func (InvitationCancelOperationRequest) MarshalJSON 

func (InvitationCancelOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects implicit export of request custody.

func (InvitationCancelOperationRequest) MarshalText 

func (InvitationCancelOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of request custody.

func (InvitationCancelOperationRequest) Validate 

func (r InvitationCancelOperationRequest) Validate() error

Validate checks bounded syntax and borrowed credential presence without IO, authentication, authorization, command allocation or historical lookup. Both versions are positive and below MaxUint64: the invitation needs one terminal increment, while the organization bound preserves the existing native cancel profile's currentDomain guard even though cancellation does not advance it. Validation alone never grants revocation or historical disclosure authority.

type InvitationCancelRequest 

type InvitationCancelRequest struct {
	Authentication                         Authentication
	CommandID                              identity.CommandID
	ID, OrganizationID                     ID
	OrganizationVersion, InvitationVersion uint64
	CorrelationID                          string
}

InvitationCancelRequest selects an exact live pending invitation and both original aggregate versions. The current owner/administrator is authenticated independently; cancellation never needs the recipient's bearer or proof.

type InvitationConfig 

type InvitationConfig struct {
	Audience       string
	Lifetime       time.Duration
	MaximumPending uint64
	// ExpirationReasons enables explicit expiry for these registered, non-secret
	// codes only. Empty disables expiry, preserving existing profiles. At most
	// 32 unique 1..64-byte codes are accepted and copied at construction.
	ExpirationReasons []identity.PolicyReason
}

InvitationConfig selects owner-send/member-accept, recipient rejection and administrator cancellation/registered expiry for existing verified email recipients. Lifetime follows reference bounds15m..30d; MaximumPending follows1..10000. Zero is invalid. The composition selects48h/100 explicitly, and must enlarge capability cryptographic lifetime limits to match; the root never weakens the capability owner's defaults or creates signing keys.

type InvitationCursor 

type InvitationCursor string

InvitationCursor is an opaque, non-authoritative continuation. Empty starts a page; return a supplied continuation unchanged, never across subjects.

type InvitationDelivery 

type InvitationDelivery struct {
	Invitation Invitation
	EffectID   delivery.IntentID
	State      delivery.DeliveryState
}

InvitationDelivery combines safe invitation metadata with the existing delivery owner's state. Accepted is provider acceptance, not Delivered; an ambiguous delivery never rolls back an already committed invitation. A missing effect is represented by empty EffectID and zero State, never by inventing provider failure/success. Command outcomes distinguish no queue commitment from an unresolved commit.

type InvitationExpireOperationRequest 

type InvitationExpireOperationRequest struct {
	Authentication                         Authentication
	OrganizationID, InvitationID           ID
	OrganizationVersion, InvitationVersion uint64
	Reason                                 identity.PolicyReason
	CorrelationID                          string
}

InvitationExpireOperationRequest selects an exact pending invitation for naturally repeatable terminal expiry, without a client key, caller command ID or recipient proof. The native owner allocates the original command, admits the current owner/administrator and checks Reason against the original InvitationConfig.ExpirationReasons. Existing explicit preparation is unchanged.

Repetition must disclose only actual matching original command metadata under current original-manager/session authority, never infer success from expired state. Changed organization epoch or reason conflicts; an unknown outcome does not authorize another execution. CorrelationID is diagnostic, not part of the natural selection or execution authority. Results use StoreResult.

func (InvitationExpireOperationRequest) Format 

func (InvitationExpireOperationRequest) Format(s fmt.State, _ rune)

Format hides borrowed credentials, exact invitation selectors and reason.

func (InvitationExpireOperationRequest) MarshalJSON 

func (InvitationExpireOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects implicit export of request custody.

func (InvitationExpireOperationRequest) MarshalText 

func (InvitationExpireOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of request custody.

func (InvitationExpireOperationRequest) Validate 

func (r InvitationExpireOperationRequest) Validate() error

Validate checks bounded syntax and borrowed credential presence without IO, authentication, authorization, command allocation or historical lookup. Both versions are positive and below MaxUint64, preserving native expiry's current organization guard and space for the terminal invitation increment. Reason retains the original InvitationConfig's 64-byte non-secret-code syntax; only that configured owner can authorize a registered reason. Validation alone grants neither terminal expiry nor historical disclosure authority.

type InvitationExpireRequest 

type InvitationExpireRequest struct {
	Authentication                         Authentication
	CommandID                              identity.CommandID
	ID, OrganizationID                     ID
	OrganizationVersion, InvitationVersion uint64
	Reason                                 identity.PolicyReason
	CorrelationID                          string
}

InvitationExpireRequest terminalizes an exact pending invitation. Reason is a registered non-secret code, never free-form text. Independent owner/admin authentication is required; recipient credentials and proof are not authority.

type InvitationInput 

type InvitationInput struct {
	Record              Invitation
	RecipientIdentifier identity.Identifier
	MaximumPending      uint64
	Proof               capability.Proof
	ExpirationReason    identity.PolicyReason
}

InvitationInput is trusted immutable command custody for the native adapter. Record is safe metadata; RecipientIdentifier contains sensitive canonical email and must enter only authenticated encrypted native preparation custody, never command safe_fields, audit, invitation rows or metadata responses.

func (InvitationInput) Format 

func (InvitationInput) Format(s fmt.State, _ rune)

func (InvitationInput) MarshalJSON 

func (InvitationInput) MarshalJSON() ([]byte, error)

func (InvitationInput) MarshalText 

func (InvitationInput) MarshalText() ([]byte, error)

type InvitationListMineQuery 

type InvitationListMineQuery struct {
	TenantID    identity.TenantID
	RecipientID identity.UserID
	After       ID
	Limit       uint32
}

InvitationListMineQuery is the trusted self scope selected after native session authentication. Read at most Limit+1 rows after the exclusive ID; Limit is 1..200. Tenant+invitation ID is the installed schema's unique key.

type InvitationListMineReader 

type InvitationListMineReader interface {
	ReadInvitationsMine(context.Context, InvitationListMineQuery) (InvitationListMineSnapshot, error)
}

InvitationListMineReader is an optional additive repository capability. Existing InvitationRepository implementations need not implement it unless listing is selected. Read current primary state, honor ctx, and release rows before returning; never retain a positive authority cache or external locks.

type InvitationListMineRequest 

type InvitationListMineRequest struct {
	Authentication Authentication
	Cursor         InvitationCursor
	Limit          uint32
	CorrelationID  string
}

InvitationListMineRequest binds self through Authentication, never a claimed recipient. Limit is 1..200; Cursor is empty or a returned <=512-byte locator. Current verified identifier ID/version matches are required for every state.

type InvitationListMineResult 

type InvitationListMineResult struct {
	Invitations []Invitation
	NextCursor  InvitationCursor
}

InvitationListMineResult owns safe invitation metadata only, without email, capability, delivery custody or permission to accept. All retained installed states are included; live pending rows project Expired at exclusive expiry. Pages use tenant-unique invitation IDs in bytewise C order over current state, not a retained snapshot. Earlier additions require restarting the listing.

type InvitationListMineSnapshot 

type InvitationListMineSnapshot struct {
	Recipient                  identity.User
	IdentifierAuthorityVersion uint64
	Identifiers                []InvitationRecipientIdentifier
	Invitations                []Invitation
}

InvitationListMineSnapshot transfers independently owned primary projections. Identifiers contains the complete bounded (<=128) current verified-email ID/version set, sorted by ID, and IdentifierAuthorityVersion is its directory owner's current epoch. No membership is required. Returned invitations must match Recipient and a current identifier exactly; unknown states fail closed.

type InvitationPage 

type InvitationPage struct {
	Organization Organization
	Actor        Member
	Invitations  []InvitationDelivery
	NextCursor   ID
}

InvitationPage is a current primary keyset page, not a retained snapshot. Actor and Organization are current policy inputs, never returned grants.

type InvitationQuery 

type InvitationQuery struct {
	Operation                    Operation
	TenantID                     identity.TenantID
	ActorID, RecipientUserID     identity.UserID
	OrganizationID, InvitationID ID
	RecipientIdentifierID        identity.IdentifierID
	Cursor                       ID
	Limit                        uint32
}

InvitationQuery is a trusted bounded primary projection selected after real authentication. Send selects a current verified existing email identifier; acceptance does not require the recipient to be a member before mutation.

type InvitationReadRequest 

type InvitationReadRequest struct {
	Authentication     Authentication
	OrganizationID, ID ID
	Cursor             ID
	Limit              uint32
	CorrelationID      string
}

InvitationReadRequest selects owner-only safe metadata. Get requires ID and zero pagination; List requires no ID, Limit1..100 and an exclusive invitation ID cursor in bytewise C order. Pages are current, not retained snapshots.

type InvitationRecipientIdentifier 

type InvitationRecipientIdentifier struct {
	ID      identity.IdentifierID
	Version uint64
}

InvitationRecipientIdentifier is a current verified email's safe identifier projection. It carries no address or proof and cannot authenticate a subject.

type InvitationRejectOperationRequest 

type InvitationRejectOperationRequest struct {
	Authentication                         Authentication
	OrganizationID, InvitationID           ID
	OrganizationVersion, InvitationVersion uint64
	CorrelationID                          string
}

InvitationRejectOperationRequest selects one exact pending invitation for a naturally repeatable rejection, without a client key, caller command ID or invitation proof. The native owner allocates the command and authenticates the current verified intended recipient. Neither organization membership nor manager/Get permission substitutes for that recipient's current authority. Existing explicit preparation/execution contracts remain unchanged.

A repeat must reconcile actual matching original command metadata under current tenant, session and verified-recipient authority, never infer success from a rejected/absent row or execute again. Unknown outcomes require existing native classification, not another mutation attempt. CorrelationID is diagnostic, not natural selection or execution authority. Results use StoreResult.

func (InvitationRejectOperationRequest) Format 

func (InvitationRejectOperationRequest) Format(s fmt.State, _ rune)

Format hides borrowed credentials and exact invitation selectors.

func (InvitationRejectOperationRequest) MarshalJSON 

func (InvitationRejectOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects implicit export of request custody.

func (InvitationRejectOperationRequest) MarshalText 

func (InvitationRejectOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of request custody.

func (InvitationRejectOperationRequest) Validate 

func (r InvitationRejectOperationRequest) Validate() error

Validate checks bounded syntax and borrowed credential presence without IO, authentication, authorization, command allocation or historical lookup. Both versions are positive and below MaxUint64: the invitation needs one terminal increment, while the organization bound preserves the existing native reject profile's currentDomain guard even though rejection does not advance it. Validation alone grants neither rejection nor historical disclosure authority.

type InvitationRejectRequest 

type InvitationRejectRequest struct {
	Authentication                         Authentication
	CommandID                              identity.CommandID
	ID, OrganizationID                     ID
	OrganizationVersion, InvitationVersion uint64
	CorrelationID                          string
}

InvitationRejectRequest selects an exact pending invitation and original versions. Authentication must independently identify its current verified recipient. Rejection needs neither membership nor the invitation bearer.

type InvitationRepository 

type InvitationRepository interface {
	ReadInvitation(context.Context, InvitationQuery) (InvitationSnapshot, error)
	ListInvitations(context.Context, InvitationQuery) (InvitationPage, error)
}

InvitationRepository is the storage-neutral trusted preparation/read port. Returned values are independently owned and bounded. It never authenticates sessions or consumes a capability. Implementations must support cancellation and concurrent independent reads without any positive membership cache.

type InvitationResendOperationRequest 

type InvitationResendOperationRequest struct {
	Authentication                         Authentication
	IdempotencyKey                         identity.IdempotencyKey
	OrganizationID, InvitationID           ID
	OrganizationVersion, InvitationVersion uint64
	CorrelationID                          string
}

InvitationResendOperationRequest selects an exact pending invitation through one original initiating key. The native owner allocates the command, preserves its recipient, role and exclusive expiry, and atomically supersedes its proof. Matching retries recover original metadata without preparing another command, issuing another successor, renewing validity or redispatching delivery. CorrelationID is diagnostic, not initiating intent or execution authority.

func (InvitationResendOperationRequest) Format 

func (InvitationResendOperationRequest) Format(s fmt.State, _ rune)

Format hides credentials, initiating keys and invitation selectors.

func (InvitationResendOperationRequest) MarshalJSON 

func (InvitationResendOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects implicit export of request custody.

func (InvitationResendOperationRequest) MarshalText 

func (InvitationResendOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of request custody.

func (InvitationResendOperationRequest) Validate 

func (r InvitationResendOperationRequest) Validate() error

Validate checks bounded syntax and custody presence without IO, clock reads, authentication, key admission or proof issuance. OrganizationVersion is a read-only epoch; InvitationVersion must leave room for the pending successor and its later terminal transition, matching PrepareResend's native contract.

type InvitationResendOperationResult 

type InvitationResendOperationResult struct {
	StoreResult
	DeliveryState delivery.DeliveryState
}

InvitationResendOperationResult retains the original command outcome even if a later authorized delivery-status read fails. DeliveryState describes only this command's original delivery, not the invitation's latest successor. Zero means no authorized observation; never infer Queued from it. A nonzero state is usable only with a committed receipt and nil error; Accepted is not Delivered, and an unknown provider outcome never authorizes redispatch. This projection contains no invitation proof or delivery effect identifier.

type InvitationResendRequest 

type InvitationResendRequest struct {
	Authentication                         Authentication
	CommandID                              identity.CommandID
	ID, OrganizationID                     ID
	OrganizationVersion, InvitationVersion uint64
	CorrelationID                          string
}

InvitationResendRequest selects an exact pending invitation and organization policy epoch. The original recipient, verified identifier, static member role and exclusive deadline are preserved; callers cannot redirect delivery or extend the grant. Retain CommandID and the prepared command for exact retries.

type InvitationSendOperationRequest 

type InvitationSendOperationRequest struct {
	Authentication        Authentication
	IdempotencyKey        identity.IdempotencyKey
	OrganizationID        ID
	OrganizationVersion   uint64
	RecipientUserID       identity.UserID
	RecipientIdentifierID identity.IdentifierID
	CorrelationID         string
}

InvitationSendOperationRequest is a transport-neutral initiating-key send. The durable owner allocates command and invitation IDs. The exact original key binds organization/version and the intended user's existing verified email identifier; it never binds a submitted email address or claimed actor. Role and expiry retain the native InvitationConfig policy. Matching retries recover only the original outcome, without refreshing authority, allocating replacement installed IDs, generating another proof or redelivering it. CorrelationID is diagnostic input, not initiating intent or replay authority.

func (InvitationSendOperationRequest) Format 

func (InvitationSendOperationRequest) Format(s fmt.State, _ rune)

Format hides initiating keys, credentials and recipient selectors.

func (InvitationSendOperationRequest) MarshalJSON 

func (InvitationSendOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects implicit export of request custody.

func (InvitationSendOperationRequest) MarshalText 

func (InvitationSendOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of request custody.

func (InvitationSendOperationRequest) Validate 

func (r InvitationSendOperationRequest) Validate() error

Validate checks bounded syntax and custody presence without IO, allocation, authentication, recipient verification, key admission or execution authority.

type InvitationSendRequest 

type InvitationSendRequest struct {
	Authentication        Authentication
	CommandID             identity.CommandID
	ID, OrganizationID    ID
	OrganizationVersion   uint64
	RecipientUserID       identity.UserID
	RecipientIdentifierID identity.IdentifierID
	CorrelationID         string
}

InvitationSendRequest binds a caller-preallocated canonical invitation ID, organization/version and exact existing verified recipient identifier. Only the static member role is selected; no caller role/team or address is accepted.

type InvitationService 

type InvitationService struct {
	// contains filtered or unexported fields
}

InvitationService borrows the existing root service/session/policy and explicit repository/verifier. It owns no store, transaction, token engine, delivery worker or goroutine. Immutable construction supports concurrency.

func NewInvitationService 

func NewInvitationService(base *Service, repository InvitationRepository, verifier InvitationVerifier, c InvitationConfig) (*InvitationService, error)

NewInvitationService validates the explicit finite profile without IO. The caller owns borrowed collaborators and their shutdown; none may be mutated concurrently with calls. Invalid or zero configuration has no defaults.

func (*InvitationService) Get 

func (s *InvitationService) Get(ctx context.Context, r InvitationReadRequest) (out InvitationDelivery, err error)

Get returns safe delivery/invitation metadata only to a current genuine owner. It never reveals the canonical address, bearer proof or encrypted custody.

func (*InvitationService) List 

func (s *InvitationService) List(ctx context.Context, r InvitationReadRequest) (out InvitationPage, err error)

List returns an independently owned, bounded page of owner-only metadata. Actor removal/current policy is rechecked on every request, without caching.

func (*InvitationService) ListMine 

func (s *InvitationService) ListMine(ctx context.Context, r InvitationListMineRequest) (out InvitationListMineResult, err error)

ListMine authenticates the actual human recipient and current self-list policy. It needs no organization membership or recipient-selected address. Both decisions precede live session and exact recipient/page revalidation; withdrawal, outage, cancellation or original freshness expiry releases no page.

func (*InvitationService) PrepareAccept 

func (s *InvitationService) PrepareAccept(ctx context.Context, r InvitationAcceptRequest) (out Command, err error)

PrepareAccept verifies but never consumes. Native execution must repeat current recipient/session/policy admission and atomically consume the shared capability with invitation, membership, scoped authority, audit and events.

func (*InvitationService) PrepareCancel 

func (s *InvitationService) PrepareCancel(ctx context.Context, r InvitationCancelRequest) (out Command, err error)

PrepareCancel freezes current owner/administrator admission. The native owner must repeat it under its existing transaction and terminally advance the invitation version; cryptographic validity alone must never bypass that row.

func (*InvitationService) PrepareExpire 

func (s *InvitationService) PrepareExpire(ctx context.Context, r InvitationExpireRequest) (out Command, err error)

PrepareExpire admits explicit expiry before or after the natural deadline. The operation catalog's pending-row transition differs from natural expiry's pending-version projection: native execution must atomically persist the next terminal version, reason, canonical audit and event, invalidating every proof.

func (*InvitationService) PrepareReject 

func (s *InvitationService) PrepareReject(ctx context.Context, r InvitationRejectRequest) (out Command, err error)

PrepareReject freezes recipient admission without consuming a capability. Native execution must repeat current session, recipient and organization admission and atomically terminalize the pending row with audit and events.

func (*InvitationService) PrepareResend 

func (s *InvitationService) PrepareResend(ctx context.Context, r InvitationResendRequest) (out Command, err error)

PrepareResend freezes current owner/administrator and original recipient admission without issuing a proof or writing state. The native adapter must atomically supersede the predecessor and issue/enqueue exactly one successor for version+1 through the existing capability, delivery and coordinator owners. The predecessor remains usable until that single commit, never alongside its successor. Historical recovery must not regenerate or redeliver either grant.

func (*InvitationService) PrepareSend 

func (s *InvitationService) PrepareSend(ctx context.Context, r InvitationSendRequest) (out Command, err error)

type InvitationSnapshot 

type InvitationSnapshot struct {
	Organization        Organization
	Actor, Target       Member
	RecipientUser       identity.User
	RecipientIdentifier identity.Identifier
	Record              InvitationDelivery
	PendingCount        uint64
}

InvitationSnapshot is adapter input, not a public metadata response or a permission/proof. Recipient fields are sensitive native owner projections; automatic serialization is denied. Durable application must fence their original verified identifier and independent security epochs with its owner.

func (InvitationSnapshot) Format 

func (InvitationSnapshot) Format(s fmt.State, _ rune)

func (InvitationSnapshot) MarshalJSON 

func (InvitationSnapshot) MarshalJSON() ([]byte, error)

func (InvitationSnapshot) MarshalText 

func (InvitationSnapshot) MarshalText() ([]byte, error)

type InvitationStatus 

type InvitationStatus uint8

InvitationStatus describes the selected durable lifecycle. Zero is invalid. Natural expiry retains its last issued version; explicit expiry is the next durable record version. IssuedVersion distinguishes those projections after resend, while legacy first-issuance rows retain version1/version2 semantics. No terminal state can become pending again. 

const (
	InvitationPending InvitationStatus = iota + 1
	InvitationAccepted
	InvitationExpired
	InvitationCancelled
	InvitationRejected
)

type InvitationVerifier 

type InvitationVerifier interface {
	Verify(context.Context, capability.Proof, capability.Purpose, string) (capability.Grant, error)
}

InvitationVerifier consumes the existing capability owner's non-consuming cryptographic verification contract. A verified grant is not permission or one-use consumption; those remain the native transaction owner's obligation.

type LeaveMemberOperationRequest 

type LeaveMemberOperationRequest struct {
	Authentication      Authentication
	OrganizationID      ID
	OrganizationVersion uint64
	CorrelationID       string
}

LeaveMemberOperationRequest is a natural-repeat self-leave selection at an exact original organization version. The native owner derives the human from Authentication, captures that member's version and allocates the command; there is no target, client key or caller command ID. Authentication is borrowed opaque custody. CorrelationID is diagnostic, not natural intent or authority. A repeat must reconcile actual original metadata; absent membership cannot prove success, unknown work must not be replayed and old intent cannot remove a readmitted membership. Results use StoreResult, never a new membership grant.

func (LeaveMemberOperationRequest) Format 

func (LeaveMemberOperationRequest) Format(s fmt.State, _ rune)

Format hides borrowed credentials and exact self-leave selectors.

func (LeaveMemberOperationRequest) MarshalJSON 

func (LeaveMemberOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects implicit export of request custody.

func (LeaveMemberOperationRequest) MarshalText 

func (LeaveMemberOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of request custody.

func (LeaveMemberOperationRequest) Validate 

func (r LeaveMemberOperationRequest) Validate() error

Validate checks bounded syntax and credential presence without IO, current authentication/membership, policy, last-owner checks, command allocation or outcome lookup. OrganizationVersion is positive and below MaxUint64, leaving room for the existing leave transition. Canonical IDs remain owner-validated; this syntax check neither normalizes identity nor grants historical access.

type LeaveRequest 

type LeaveRequest struct {
	Authentication      Authentication
	CommandID           identity.CommandID
	OrganizationID      ID
	OrganizationVersion uint64
	CorrelationID       string
}

LeaveRequest removes only the authenticated human's current membership in the explicitly selected organization. OrganizationVersion is its exact policy epoch; the current membership version is captured during preparation, never supplied as a target override. The final recovery-capable owner cannot leave. Keep CommandID across retries. Historical recovery still requires current membership; a retained receipt is not permission to read after leaving.

type LifecycleConfig 

type LifecycleConfig struct {
	Version       uint64
	ProofAudience string
}

LifecycleConfig selects native archive/restore, not hard deletion or external integration cascades. Zero disables it. Version1 requires the same explicit signed-proof audience in both operation-specific password primary sources.

func (LifecycleConfig) Validate 

func (c LifecycleConfig) Validate() error

Validate accepts the disabled zero policy or the explicit version1 audience.

type LifecycleOperationRequest 

type LifecycleOperationRequest struct {
	Authentication        Authentication
	IdempotencyKey        identity.IdempotencyKey
	OrganizationID        ID
	OrganizationVersion   uint64
	Reason, CorrelationID string
	Proof                 authentication.ReauthenticationProof
}

LifecycleOperationRequest is the transport-neutral original-key archive or restore request. OrganizationVersion and the required visible-ASCII Reason retain LifecycleRequest's exact semantics. The native owner allocates the command ID and authenticates the original action-bound proof; this projection never confers authority. Matching retries recover only that original command, without preparing again, consuming another proof or renewing any observation. Changed organization, version, reason, complete proof or configuration must conflict. Authentication and the initiating key are borrowed opaque custody.

func (LifecycleOperationRequest) Format 

func (LifecycleOperationRequest) Format(s fmt.State, _ rune)

Format redacts proof, credentials, key and request metadata from diagnostics.

func (LifecycleOperationRequest) MarshalJSON 

func (LifecycleOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental transport or persistence of direct custody.

func (LifecycleOperationRequest) MarshalText 

func (LifecycleOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of direct custody.

func (LifecycleOperationRequest) Validate 

func (r LifecycleOperationRequest) Validate() error

Validate checks bounded syntax without IO, trusted clock observations, authentication, proof provenance, key admission or command allocation. An expired original projection remains syntactically valid for historical matching-key recovery; fresh execution still requires the native signed proof, current session/owner, exact action and original exclusive deadline.

type LifecycleRequest 

type LifecycleRequest struct {
	Authentication        Authentication
	CommandID             identity.CommandID
	OrganizationID        ID
	OrganizationVersion   uint64
	Reason, CorrelationID string
	Proof                 authentication.ReauthenticationProof
}

LifecycleRequest changes one exact organization policy version. Reason is a bounded visible-ASCII code, not free text. Proof must be freshly issued for this exact action, current owner and session by the actual password owner. Copies of visible proof fields do not authenticate their signed provenance.

func (LifecycleRequest) Format 

func (LifecycleRequest) Format(s fmt.State, _ rune)

func (LifecycleRequest) MarshalJSON 

func (LifecycleRequest) MarshalJSON() ([]byte, error)

func (LifecycleRequest) MarshalText 

func (LifecycleRequest) MarshalText() ([]byte, error)

type LifecycleState 

type LifecycleState string

LifecycleState is current primary state, never authority inferred from a retained receipt. Deleted organizations are not discoverable in this profile. 

const (
	LifecycleActive   LifecycleState = "active"
	LifecycleArchived LifecycleState = "archived"
)

type ListOrganizationsRequest 

type ListOrganizationsRequest struct {
	Authentication Authentication
	Cursor         OrganizationCursor
	Limit          uint32
	CorrelationID  string
}

ListOrganizationsRequest lists only the current authenticated human's active organizations. Limit is 1..200 with no default (the operation's typed catalog bound). Cursor is empty or a canonical <=512-byte returned continuation. Pages use bytewise organization-ID order over current committed state; earlier additions require restarting. Unknown authority/errors yield no partial page.

type ListOrganizationsResult 

type ListOrganizationsResult struct {
	Organizations []Organization
	NextCursor    OrganizationCursor
}

ListOrganizationsResult owns its bounded organization snapshots. NextCursor derives only from the last returned visible ID and is empty at the observed end. Neither a snapshot nor continuation is current authorization evidence.

type Member 

type Member struct {
	OrganizationID                ID
	TenantID                      identity.TenantID
	UserID                        identity.UserID
	Role                          Role
	Version, AuthorizationVersion uint64
	Active                        bool
}

Member is a tenant/organization-bound membership snapshot. Removed bindings retain their version and organization-scoped authorization epoch as tombstones. Neither Role nor this structural value authenticates its human user.

type MemberRequest 

type MemberRequest struct {
	Authentication                     Authentication
	CommandID                          identity.CommandID
	OrganizationID                     ID
	UserID                             identity.UserID
	Role                               Role
	OrganizationVersion, MemberVersion uint64
	CorrelationID                      string
}

MemberRequest binds an exact target and organization/member optimistic versions. Add requires Role and preserves an existing removed membership's version (zero only for a never-admitted user). Remove requires the active member's version; it never treats arbitrary absence as successful removal. Update requires a different valid static Role and the exact active membership version. Only owners may grant owner or change an owner; at least one owner (the static profile's recovery administrator) must survive every transition.

type Operation 

type Operation string

Operation is the canonical callable operation, never selected from free text. 

const (
	// ActiveSet changes only the exact authenticated session's selection.
	ActiveSet Operation = "identity.organization.active-set"
	// ActiveGet reads the exact authenticated session's current selection.
	ActiveGet Operation = "identity.organization.active-get"
)
const (
	ReserveDomain  Operation = "identity.organization.domain.reserve"
	WithdrawDomain Operation = "identity.organization.domain.withdraw"
	GetDomainClaim Operation = "identity.organization.domain.get"
)
const (
	// ApplyDomainProof admits one trusted observation for an existing claim.
	ApplyDomainProof Operation = "identity.organization.domain.evidence.apply"
	// RevokeDomainProof terminally retires that exact proof without observing.
	RevokeDomainProof Operation = "identity.organization.domain.evidence.revoke"
)
const (
	CreateDynamicRole Operation = "identity.organization.role.create"
	UpdateDynamicRole Operation = "identity.organization.role.update"
	DeleteDynamicRole Operation = "identity.organization.role.delete"
	GetDynamicRole    Operation = "identity.organization.role.get"
	ListDynamicRoles  Operation = "identity.organization.role.list"
	AssignDynamicRole Operation = "identity.organization.role.assign"
	RevokeDynamicRole Operation = "identity.organization.role.revoke"
	CheckPermission   Operation = "identity.organization.permission-check"
)
const (
	InvitationSend   Operation = "identity.organization.invitation-send"
	InvitationAccept Operation = "identity.organization.invitation.accept"
	InvitationCancel Operation = "identity.organization.invitation.cancel"
	InvitationReject Operation = "identity.organization.invitation.reject"
	InvitationExpire Operation = "identity.organization.invitation.expire"
	InvitationResend Operation = "identity.organization.invitation.resend"
	InvitationGet    Operation = "identity.organization.invitation.get"
	InvitationList   Operation = "identity.organization.invitation.list"
)
const (
	Archive Operation = "identity.organization.archive"
	Restore Operation = "identity.organization.restore"
)
const (
	Create       Operation = "identity.organization.create"
	Update       Operation = "identity.organization.update"
	AddMember    Operation = "identity.organization.member.add"
	UpdateMember Operation = "identity.organization.member.update"
	RemoveMember Operation = "identity.organization.member.remove"
	LeaveMember  Operation = "identity.organization.member.leave"
	Get          Operation = "identity.organization.get"
	ListMembers  Operation = "identity.organization.member.list"
)
const (
	CreateTeam       Operation = "identity.organization.team.create"
	AddTeamMember    Operation = "identity.organization.team.member-add"
	RemoveTeamMember Operation = "identity.organization.team.member-remove"
	GetTeam          Operation = "identity.organization.team.get"
	UpdateTeam       Operation = "identity.organization.team.update"
	DeleteTeam       Operation = "identity.organization.team.delete"
	ListTeams        Operation = "identity.organization.team.list"
	ListMyTeams      Operation = "identity.organization.team.list-mine"
	ListTeamMembers  Operation = "identity.organization.team.member-list"
)
const InvitationListMine Operation = "identity.organization.invitation.list-mine"

InvitationListMine is the authenticated recipient's safe invitation listing, not an organization membership check or an administrator's recipient lookup. 

const ListOrganizations Operation = "identity.organization.list"

ListOrganizations is the current authenticated subject's organization read. It is not an active-organization selection or an arbitrary-user lookup. 

const OwnerTransfer Operation = "identity.organization.owner-transfer"

OwnerTransfer atomically exchanges the authenticated owner's role with an existing nonowner member. It never creates membership or adds another owner. 

const SlugAvailable Operation = "identity.organization.slug-available"

SlugAvailable is an authenticated tenant-local advisory candidate read, not organization discovery, membership authority or a reservation operation.

func (Operation) Descriptor 

func (o Operation) Descriptor() identity.FeatureOperation

Descriptor identifies the one versioned storage-neutral mutation schema. Unknown and read operations return zero, which identity rejects.

type OperationRecoveryRequest 

type OperationRecoveryRequest struct {
	Authentication Authentication
	Binding        identity.CommandBinding
}

OperationRecoveryRequest asks only for the original safe command outcome. Binding is original correlation, never execution or result-access authority. Current authentication and disclosure policy must be checked by the owner; recovery must not rebuild, resubmit or renew the original mutation.

func (OperationRecoveryRequest) Format 

func (OperationRecoveryRequest) Format(s fmt.State, _ rune)

Format redacts credentials and original command correlation.

func (OperationRecoveryRequest) MarshalJSON 

func (OperationRecoveryRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental transport/persistence of direct custody.

func (OperationRecoveryRequest) MarshalText 

func (OperationRecoveryRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of direct custody.

func (OperationRecoveryRequest) Validate 

func (r OperationRecoveryRequest) Validate() error

Validate limits recovery to this selected profile and original tenant scope. LeaveMember, team creation/lifecycle and role CRUD require self actor bindings. Direct-role assignment/revocation preserve the actual target, including nonself. A structurally valid binding still confers no disclosure permission.

type Organization 

type Organization struct {
	ID         ID
	TenantID   identity.TenantID
	Slug, Name string
	Version    uint64
	Active     bool
}

Organization is one immutable primary snapshot, not an access decision. Version is also the organization policy/authority epoch in this profile.

type OrganizationCursor 

type OrganizationCursor string

OrganizationCursor is an opaque, non-authoritative keyset locator. Empty starts a listing; only use a returned cursor unchanged. It binds tenant, authenticated subject and deployed policy, not a snapshot or membership grant.

type OrganizationListEntry 

type OrganizationListEntry struct {
	Organization Organization
	Member       Member
}

OrganizationListEntry is an owned current active organization/self-member projection. Native readers must also verify that Member.AuthorizationVersion is the current organization-scoped authority, not an unrelated global epoch.

type OrganizationListQuery 

type OrganizationListQuery struct {
	TenantID    identity.TenantID
	ActorID     identity.UserID
	After       ID
	MaximumRows uint32
}

OrganizationListQuery is a trusted storage query generated after session authentication. MaximumRows is the configured per-user membership cap (1..1000), not the requested output size. Return at most MaximumRows+1 candidates after the exclusive ID in ascending bytewise order; the extra row detects a changed deployment cap without falsely declaring EOF. No arbitrary target is exposed through the public authenticated list request.

type OrganizationListReader 

type OrganizationListReader interface {
	ReadOrganizations(context.Context, OrganizationListQuery) ([]OrganizationListEntry, error)
}

OrganizationListReader is an additive optional repository capability. Existing Repository implementations remain source-compatible; selecting listing on a reader without this capability returns ErrUnavailable. Reads must honor ctx, release rows/locks before returning, and use current primary state without a positive cache. The authenticated service owns policy filtering/disclosure.

type OrganizationSlugAvailability 

type OrganizationSlugAvailability struct {
	TenantID  identity.TenantID
	Slug      string
	Available bool
}

OrganizationSlugAvailability echoes the exact query scope and exposes no organization identity or metadata. Available is false for every retained row occupying the tenant-local unique slug, including archived organizations.

type OrganizationSlugQuery 

type OrganizationSlugQuery struct {
	TenantID identity.TenantID
	Slug     string
}

OrganizationSlugQuery is an exact trusted primary occupancy query generated after session authentication and explicit candidate policy admission.

type OrganizationSlugReader 

type OrganizationSlugReader interface {
	ReadOrganizationSlug(context.Context, OrganizationSlugQuery) (OrganizationSlugAvailability, error)
}

OrganizationSlugReader is an additive optional Repository capability. Read current primary occupancy without positive caching, honor ctx and release resources before returning. A missing capability returns ErrUnavailable; existing Repository implementations remain compatible. This trusted storage projection is not an authentication endpoint or reservation mechanism.

type OwnerTransferOperationRequest 

type OwnerTransferOperationRequest struct {
	Authentication                                    Authentication
	IdempotencyKey                                    identity.IdempotencyKey
	OrganizationID                                    ID
	TargetUserID                                      identity.UserID
	OrganizationVersion, SourceVersion, TargetVersion uint64
	CorrelationID                                     string
	Proof                                             authentication.ReauthenticationProof
}

OwnerTransferOperationRequest is the original-key ownership transfer to an existing active member. The authenticated session determines the source; OrganizationVersion, SourceVersion and TargetVersion retain the exact OwnerTransferRequest semantics. The former owner becomes RoleMember. The native owner allocates the command ID and authenticates and atomically consumes the original action-bound password proof. Matching retries classify only that original command without preparing or executing again, replacing the proof or renewing authority. Changed target, versions, complete proof or selected configuration conflicts. Authentication and the single required key are opaque borrowed custody; this projection never establishes authority.

func (OwnerTransferOperationRequest) Format 

func (OwnerTransferOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials, key, proof and request metadata from diagnostics.

func (OwnerTransferOperationRequest) MarshalJSON 

func (OwnerTransferOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental transport or persistence of direct custody.

func (OwnerTransferOperationRequest) MarshalText 

func (OwnerTransferOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of direct custody.

func (OwnerTransferOperationRequest) Validate 

func (r OwnerTransferOperationRequest) Validate() error

Validate checks bounded syntax without IO, a trusted clock, current owner or session authentication, proof provenance, key admission or command allocation. An expired original proof remains representable for historical classification; execution still requires the native owner's signed fresh proof and authority.

type OwnerTransferRequest 

type OwnerTransferRequest struct {
	Authentication                                    Authentication
	CommandID                                         identity.CommandID
	OrganizationID                                    ID
	TargetUserID                                      identity.UserID
	OrganizationVersion, SourceVersion, TargetVersion uint64
	CorrelationID                                     string
	// Proof is the original password owner's operation-bound reauthentication
	// projection, not authenticated merely by these visible fields. The native
	// primary owner must authenticate and consume its exact original record.
	Proof authentication.ReauthenticationProof
}

OwnerTransferRequest binds the organization policy epoch and both membership versions. The source is always the authenticated session subject, never an actor supplied by the caller. TargetUserID must identify a different active member or administrator in the same organization. The former owner becomes RoleMember; both membership and scoped authorization versions advance. Preserve CommandID and the prepared command for retries or exact recovery.

type Permission 

type Permission struct {
	ID           string
	Action       authorization.Action
	ResourceType authorization.ResourceType
}

Permission registers one exact action/resource type in the deployment's immutable custom-permission ceiling. No wildcard or organization-management action is admitted: custom roles never confer static owner/admin authority.

type PermissionCheckRequest 

type PermissionCheckRequest struct {
	Authentication      Authentication
	OrganizationID      ID
	OrganizationVersion uint64
	Action              authorization.Action
	ResourceType        authorization.ResourceType
	ResourceID          authorization.ResourceID
	CorrelationID       string
}

PermissionCheckRequest checks the authenticated member's effective custom roles, never another subject. Team bindings participate only under explicit selection. OrganizationVersion is a required current policy fence. Static roles grant management only, not implicit application-resource access.

type PreparedInvitationAcceptance 

type PreparedInvitationAcceptance interface {
	Admission() (InvitationAcceptAdmission, error)
	Execute(context.Context) (StoreResult, error)
}

PreparedInvitationAcceptance is one opaque original native acceptance. A transport obtains it before handler middleware, admits its original rate facts, then executes that same preparation only after all additional gates. Admission returns a copy of authenticated original metadata without IO or renewed authority; it neither consumes proof nor executes. Execute requires a non-nil bounded context and retains the native current authority, original session/expiry, one-use and transaction fences. It never prepares again. Copies/aliases share serial-use custody and must not execute concurrently. Implementations reject implicit serialization and redact diagnostics; the handle contains no caller-exportable credential or proof. This is not a durable recovery handle: save Admission's full binding/organization instead.

type Query 

type Query struct {
	Operation        Operation
	TenantID         identity.TenantID
	ActorID          identity.UserID
	OrganizationID   ID
	TargetID         identity.UserID
	Cursor           identity.UserID
	Limit            uint32
	TeamID           ID
	TeamCursor       string
	DomainClaimID    ID
	DynamicRoleID    ID
	RoleCursor       string
	IncludeTeamRoles bool
	// Lifecycle permits owner-only archived discovery for Get/Archive/Restore.
	// It must never broaden an ordinary member/team/permission query.
	Lifecycle bool
}

Query is a bounded primary read generated by Service after authentication. Adapters must recheck membership on each call; there is no positive cache. TargetID is used only for native identity-owner reads when preparing mutation.

type ReadRequest 

type ReadRequest struct {
	Authentication Authentication
	OrganizationID ID
	Cursor         identity.UserID
	Limit          uint32
	CorrelationID  string
}

ReadRequest chooses an exact organization. Cursor is an exclusive UserID in bytewise database C collation; Limit must be 1..100 for member listing.

type RemoveMemberOperationRequest 

type RemoveMemberOperationRequest struct {
	Authentication                     Authentication
	OrganizationID                     ID
	UserID                             identity.UserID
	OrganizationVersion, MemberVersion uint64
	CorrelationID                      string
}

RemoveMemberOperationRequest is a naturally repeatable exact-version removal, not a keyed operation. There is deliberately no client key or command ID. The durable owner retains its original natural-request correlation and historical receipt; an absent membership alone cannot prove prior success. Current authentication/authorization and last-owner protection still apply to every attempt and historical disclosure.

func (RemoveMemberOperationRequest) Format 

func (RemoveMemberOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials and request values from diagnostics.

func (RemoveMemberOperationRequest) MarshalJSON 

func (RemoveMemberOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental transport/persistence of direct custody.

func (RemoveMemberOperationRequest) MarshalText 

func (RemoveMemberOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of direct custody.

func (RemoveMemberOperationRequest) Validate 

func (r RemoveMemberOperationRequest) Validate() error

Validate checks bounded exact-version removal syntax without inventing replay authority from an absent or tombstoned membership.

type RemoveTeamMemberOperationRequest 

type RemoveTeamMemberOperationRequest struct {
	Authentication                                                                 Authentication
	OrganizationID, TeamID                                                         ID
	UserID                                                                         identity.UserID
	OrganizationVersion, TeamVersion, OrganizationMemberVersion, MembershipVersion uint64
	CorrelationID                                                                  string
}

RemoveTeamMemberOperationRequest naturally repeats an exact team binding removal, with no client key or command. Original retained effect correlation, not absence alone, identifies success. Current manager/session authority and native disclosure checks apply on every attempt. A newer organization admission or team binding cannot be removed using these old versions. Retain an unknown result's binding for explicit original recovery: natural syntax cannot identify an uncommitted or unattached command.

func (RemoveTeamMemberOperationRequest) Format 

func (RemoveTeamMemberOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials and request metadata from diagnostics.

func (RemoveTeamMemberOperationRequest) MarshalJSON 

func (RemoveTeamMemberOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of custody.

func (RemoveTeamMemberOperationRequest) MarshalText 

func (RemoveTeamMemberOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of custody.

func (RemoveTeamMemberOperationRequest) Validate 

func (r RemoveTeamMemberOperationRequest) Validate() error

Validate checks exact positive binding syntax without manufacturing replay authority from an absent or tombstoned membership.

type Repository 

type Repository interface {
	Read(context.Context, Query) (View, error)
}

Repository reads only authoritative owned organization state and delegates target identity reads to identity's native owner. It owns no authentication engine. Implementations must honor deadlines and safely support concurrency.

type RevokeDynamicRoleOperationRequest 

type RevokeDynamicRoleOperationRequest struct {
	Authentication                                                              Authentication
	OrganizationID, RoleID                                                      ID
	UserID                                                                      identity.UserID
	OrganizationVersion, RoleVersion, OrganizationMemberVersion, BindingVersion uint64
	CorrelationID                                                               string
}

RevokeDynamicRoleOperationRequest naturally repeats revocation of one exact direct binding, without a key or caller command. Original effect correlation and the actual native receipt, never absence/tombstones alone, prove success. A newer assignment or organization admission cannot be revoked by these old epochs. Current manager/session, actual role-action and outcome-query authority still apply. Retain an unknown result's original binding for explicit recovery: natural syntax cannot identify an unattached or uncommitted command.

func (RevokeDynamicRoleOperationRequest) Format 

func (RevokeDynamicRoleOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials and exact original binding selectors.

func (RevokeDynamicRoleOperationRequest) MarshalJSON 

func (RevokeDynamicRoleOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of borrowed custody.

func (RevokeDynamicRoleOperationRequest) MarshalText 

func (RevokeDynamicRoleOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of custody.

func (RevokeDynamicRoleOperationRequest) Validate 

func (r RevokeDynamicRoleOperationRequest) Validate() error

Validate checks exact positive binding syntax, not original-history ownership or current authority. The observed membership epoch is positive-only.

type RevokeTeamDynamicRoleOperationRequest 

type RevokeTeamDynamicRoleOperationRequest struct {
	Authentication                                                Authentication
	OrganizationID, RoleID, TeamID                                ID
	OrganizationVersion, RoleVersion, TeamVersion, BindingVersion uint64
	CorrelationID                                                 string
}

RevokeTeamDynamicRoleOperationRequest naturally repeats revocation of one exact team-role binding, without a key or caller command. Only correlated original effects and the real native receipt establish success, never an absent/inactive binding. Old epochs cannot reach a later assignment or revive a terminal team or incompatible membership. Current manager/session, actual role-action and query authority remain required. Unknown outcomes do not authorize replay; retain their original binding for explicit recovery when natural syntax cannot identify an unattached or uncommitted command.

func (RevokeTeamDynamicRoleOperationRequest) Format 

func (RevokeTeamDynamicRoleOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials and exact original team-binding selectors.

func (RevokeTeamDynamicRoleOperationRequest) MarshalJSON 

func (RevokeTeamDynamicRoleOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of borrowed custody.

func (RevokeTeamDynamicRoleOperationRequest) MarshalText 

func (RevokeTeamDynamicRoleOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of custody.

func (RevokeTeamDynamicRoleOperationRequest) Validate 

func (r RevokeTeamDynamicRoleOperationRequest) Validate() error

Validate checks exact positive binding syntax, not original-history ownership or current native team, manager, session, role-action or query authority.

type Role 

type Role string

Role is a closed static role. Unknown values never grant permissions. 

const (
	RoleOwner         Role = "owner"
	RoleAdministrator Role = "administrator"
	RoleMember        Role = "member"
)

func (Role) Valid 

func (r Role) Valid() bool

type RoleBinding 

type RoleBinding struct {
	RoleID, OrganizationID             ID
	TenantID                           identity.TenantID
	UserID                             identity.UserID
	Version, OrganizationMemberVersion uint64
	Active                             bool
}

RoleBinding binds one role to an exact current organization membership epoch. Removal/readmission or any static-role transition invalidates old bindings. Active describes the stored assignment state, not independent permission: current active membership and matching OrganizationMemberVersion still apply.

type RoleBindingRequest 

type RoleBindingRequest struct {
	Authentication                                                              Authentication
	CommandID                                                                   identity.CommandID
	OrganizationID, RoleID                                                      ID
	UserID                                                                      identity.UserID
	OrganizationVersion, RoleVersion, OrganizationMemberVersion, BindingVersion uint64
	CorrelationID                                                               string
}

RoleBindingRequest assigns/revokes one direct role for an active member. BindingVersion is zero for first assignment, otherwise the current tombstone or live version; all supplied organization, role and member epochs must match.

type RoleStatement 

type RoleStatement struct {
	PermissionID string
	ResourceID   authorization.ResourceID
	Effect       authorization.Outcome
}

RoleStatement references only registered permissions, an exact resource ID, and Allow or Deny. Conditions and wildcards remain unselected; optional team inheritance evaluates these same bounded statements without expanding them.

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service owns bounded authentication and pure policy/preparation, not durable transactions. A native adapter supplies the scoped UnitOfWork to Execute. NewService retains borrowed immutable collaborators and starts no goroutines.

func NewActiveOrganizationService 

func NewActiveOrganizationService(sessions *session.SessionService, repository Repository, policy authorization.Service, c Config) (*Service, error)

NewActiveOrganizationService explicitly enables password/bearer selection. The borrowed session owner must fence every original dimension and current selected organization/member on each read. NewService and all other operation profiles retain their existing admission; no dimensions are stripped.

func NewService 

func NewService(sessions *session.SessionService, repository Repository, policy authorization.Service, c Config) (*Service, error)

func (*Service) CheckPermission 

func (s *Service) CheckPermission(ctx context.Context, r PermissionCheckRequest) (out authorization.Decision, err error)

CheckPermission never caches an allow. A policy callback can veto the check; the existing RBAC/deny-overrides engine decides only current exact statements. Returned Revision is the organization policy version, not a reusable lease.

func (*Service) Execute 

func (s *Service) Execute(ctx context.Context, c Command, work UnitOfWork) (out StoreResult, err error)

Execute repeats current action policy with the original Service custody before borrowing the adapter's one-command work. Policy callbacks run before protected SQL; later lock waits require native final admission. It never retries an unknown result or replaces its command identity.

func (*Service) Get 

func (s *Service) Get(ctx context.Context, r ReadRequest) (View, error)

func (*Service) GetActive 

func (s *Service) GetActive(ctx context.Context, r ActiveOrganizationReadRequest) (out ActiveOrganizationView, err error)

GetActive requires current membership, owner aggregate epoch and action policy for every selected read. Unrelated organization changes do not invalidate it.

func (*Service) GetDomainClaim 

func (s *Service) GetDomainClaim(ctx context.Context, r DomainClaimReadRequest) (out View, err error)

GetDomainClaim discloses current custody only to a current owner/admin after current policy and a second primary membership/session read. It is not proof.

func (*Service) GetDynamicRole 

func (s *Service) GetDynamicRole(ctx context.Context, r DynamicRoleReadRequest) (View, error)

GetDynamicRole returns one current custom role after late authority revalidation.

func (*Service) GetLifecycle 

func (s *Service) GetLifecycle(ctx context.Context, r ReadRequest) (out View, err error)

GetLifecycle exposes active/archived metadata only to a current owner with a genuine session and current organization.get policy. Ordinary reads continue denying archived organizations. Use this exact version to prepare restoration.

func (*Service) GetTeam 

func (s *Service) GetTeam(ctx context.Context, r TeamReadRequest) (View, error)

func (*Service) ListDynamicRoles 

func (s *Service) ListDynamicRoles(ctx context.Context, r DynamicRoleReadRequest) (View, error)

ListDynamicRoles returns only current custom roles, not the closed static Role constants.

func (*Service) ListMembers 

func (s *Service) ListMembers(ctx context.Context, r ReadRequest) (View, error)

func (*Service) ListMyTeams 

func (s *Service) ListMyTeams(ctx context.Context, r TeamReadRequest) (View, error)

func (*Service) ListOrganizations 

func (s *Service) ListOrganizations(ctx context.Context, r ListOrganizationsRequest) (out ListOrganizationsResult, err error)

ListOrganizations authenticates self and filters only explicit initial Deny decisions. Captured allows must still allow at final policy admission; current session, exact organization/member snapshots and original freshness are then rechecked after callbacks. Scan work is bounded by MaximumPerUser, never by an unbounded search for a full output page. No mutation or selection is performed.

func (*Service) ListTeamMembers 

func (s *Service) ListTeamMembers(ctx context.Context, r TeamReadRequest) (View, error)

func (*Service) ListTeams 

func (s *Service) ListTeams(ctx context.Context, r TeamReadRequest) (View, error)

func (*Service) PrepareActiveSet 

func (s *Service) PrepareActiveSet(ctx context.Context, r ActiveOrganizationRequest) (out Command, err error)

PrepareActiveSet freezes target membership/policy and the exact session CAS. Native execution must repeat custody and current authority in one Work around the session effect. Empty organization means clear, never a default target.

func (*Service) PrepareAddMember 

func (s *Service) PrepareAddMember(ctx context.Context, r MemberRequest) (Command, error)

func (*Service) PrepareAddTeamMember 

func (s *Service) PrepareAddTeamMember(ctx context.Context, r TeamMemberRequest) (Command, error)

func (*Service) PrepareArchive 

func (s *Service) PrepareArchive(ctx context.Context, r LifecycleRequest) (Command, error)

PrepareArchive freezes owner admission without changing authority. Execute atomically denies the organization and terminally cancels pending invitations.

func (*Service) PrepareAssignDynamicRole 

func (s *Service) PrepareAssignDynamicRole(ctx context.Context, r RoleBindingRequest) (Command, error)

PrepareAssignDynamicRole freezes a direct grant for one exact active membership.

func (*Service) PrepareAssignTeamDynamicRole 

func (s *Service) PrepareAssignTeamDynamicRole(ctx context.Context, r TeamRoleBindingRequest) (Command, error)

PrepareAssignTeamDynamicRole freezes a team-targeted role.assign command. TeamBindingsVersion1 and terminal team lifecycle must be selected explicitly.

func (*Service) PrepareCreate 

func (s *Service) PrepareCreate(ctx context.Context, r CreateRequest) (out Command, err error)

func (*Service) PrepareCreateDynamicRole 

func (s *Service) PrepareCreateDynamicRole(ctx context.Context, r DynamicRoleRequest) (Command, error)

PrepareCreateDynamicRole freezes a new role without reserving or persisting it.

func (*Service) PrepareCreateTeam 

func (s *Service) PrepareCreateTeam(ctx context.Context, r CreateTeamRequest) (Command, error)

func (*Service) PrepareDeleteDynamicRole 

func (s *Service) PrepareDeleteDynamicRole(ctx context.Context, r DynamicRoleRequest) (Command, error)

PrepareDeleteDynamicRole freezes terminal retirement, including all effective bindings.

func (*Service) PrepareDeleteTeam 

func (s *Service) PrepareDeleteTeam(ctx context.Context, r DeleteTeamRequest) (Command, error)

func (*Service) PrepareDomainEvidence 

func (s *Service) PrepareDomainEvidence(ctx context.Context, r DomainEvidenceRequest, observer DomainEvidenceObserver) (out DomainEvidenceCommand, err error)

PrepareDomainEvidence performs one explicitly trusted observation after current claim/session/policy admission. Execute must fence the original expiry again after lock waits. An observer failure leaves no durable command or authority.

func (*Service) PrepareLeaveMember 

func (s *Service) PrepareLeaveMember(ctx context.Context, r LeaveRequest) (Command, error)

PrepareLeaveMember authenticates self, checks current membership/action policy and freezes its exact membership snapshot without writing. Durable adapters must fence that same actor and the final owner under the shared aggregate lock.

func (*Service) PrepareOwnerTransfer 

func (s *Service) PrepareOwnerTransfer(ctx context.Context, r OwnerTransferRequest) (out Command, err error)

PrepareOwnerTransfer requires a fresh, current session and current owner membership. Preparation writes nothing. The adapter must protect both exact memberships, target identity and session through its sole commit boundary.

func (*Service) PrepareRemoveMember 

func (s *Service) PrepareRemoveMember(ctx context.Context, r MemberRequest) (Command, error)

func (*Service) PrepareRemoveTeamMember 

func (s *Service) PrepareRemoveTeamMember(ctx context.Context, r TeamMemberRequest) (Command, error)

func (*Service) PrepareReserveDomain 

func (s *Service) PrepareReserveDomain(ctx context.Context, r DomainClaimRequest) (Command, error)

func (*Service) PrepareRestore 

func (s *Service) PrepareRestore(ctx context.Context, r LifecycleRequest) (Command, error)

PrepareRestore enables only surviving native child state. It never recreates removed members, deleted teams/roles, withdrawn claims or canceled invitations.

func (*Service) PrepareRevokeDomainEvidence 

func (s *Service) PrepareRevokeDomainEvidence(ctx context.Context, r DomainEvidenceRequest, key DomainProofKey) (out DomainEvidenceCommand, err error)

PrepareRevokeDomainEvidence freezes terminal revocation of the exact primary proof. It performs no external observation and cannot refresh original times.

func (*Service) PrepareRevokeDynamicRole 

func (s *Service) PrepareRevokeDynamicRole(ctx context.Context, r RoleBindingRequest) (Command, error)

PrepareRevokeDynamicRole freezes removal of one exact current direct binding.

func (*Service) PrepareRevokeTeamDynamicRole 

func (s *Service) PrepareRevokeTeamDynamicRole(ctx context.Context, r TeamRoleBindingRequest) (Command, error)

PrepareRevokeTeamDynamicRole freezes removal of one exact team-role binding.

func (*Service) PrepareUpdate 

func (s *Service) PrepareUpdate(ctx context.Context, r UpdateRequest) (out Command, err error)

PrepareUpdate authenticates the human actor and checks current organization membership and action policy. Preparation writes nothing; the native adapter must recheck current authority and the expected version under its own locks.

func (*Service) PrepareUpdateDynamicRole 

func (s *Service) PrepareUpdateDynamicRole(ctx context.Context, r DynamicRoleRequest) (Command, error)

PrepareUpdateDynamicRole freezes a complete replacement at exact role/organization epochs.

func (*Service) PrepareUpdateMember 

func (s *Service) PrepareUpdateMember(ctx context.Context, r MemberRequest) (Command, error)

PrepareUpdateMember freezes one exact active membership's static role change. Current owners and administrators may change nonowners; only owners may grant or demote owners. Preparation writes nothing. The native owner must serialize the last-owner invariant with removal, leave and ownership transfer and advance both organization policy and the changed subject's scoped authority atomically.

func (*Service) PrepareUpdateTeam 

func (s *Service) PrepareUpdateTeam(ctx context.Context, r UpdateTeamRequest) (Command, error)

func (*Service) PrepareWithdrawDomain 

func (s *Service) PrepareWithdrawDomain(ctx context.Context, r DomainClaimRequest) (Command, error)

func (*Service) SlugAvailable 

func (s *Service) SlugAvailable(ctx context.Context, r SlugAvailableRequest) (out SlugAvailableResult, err error)

SlugAvailable admits the current verified human session and explicit policy without requiring membership or management permission. It rechecks policy, exact source projection and live session after callbacks, retaining original freshness. Withdrawal, changed source, outage, expiry or cancellation returns zero availability with an error. It performs no mutation or reservation.

type SlugAvailableRequest 

type SlugAvailableRequest struct {
	Authentication      Authentication
	Slug, CorrelationID string
}

SlugAvailableRequest selects a candidate in Authentication's tenant. Slug uses CreateRequest's lowercase ASCII label syntax (1..63 bytes, no leading or trailing hyphen). CorrelationID is a required safe identifier of <=128 bytes. No organization, target user or membership selector is accepted.

type SlugAvailableResult 

type SlugAvailableResult struct {
	Available bool
}

SlugAvailableResult discloses only observed availability. A true result does not reserve the slug or guarantee a later create/update; those operations' authoritative tenant-local uniqueness checks remain required.

type StoreResult 

type StoreResult struct {
	Receipt        identity.CommandResult
	OrganizationID ID
	MemberID       identity.UserID
	// InvitationID is set only for invitation commands, including unknown
	// outcomes. It identifies the original command, never a delivery claim.
	InvitationID ID
}

StoreResult retains the existing identity-owned outcome protocol. A committed result is historical, not current membership, a fresh grant or a new session. Unknown must be reconciled using the same command; never allocate a retry ID.

type Team 

type Team struct {
	ID, OrganizationID ID
	TenantID           identity.TenantID
	Name               string
	Version            uint64
}

Team is a tenant/organization-bound snapshot. Version advances on membership changes; Organization.Version is the shared policy epoch, not this local value.

type TeamConfig 

type TeamConfig struct {
	Version, MaximumTeams, MaximumMembers uint64
	// LifecycleVersion 1 selects get/update/terminal-delete after the native
	// forward migration. Zero preserves the original membership-only profile
	// and its serialized configuration and command framing.
	LifecycleVersion uint64 `json:",omitempty"`
}

TeamConfig explicitly selects the finite membership-only profile. Zero disables it. Version identifies the immutable deployed team policy; quotas have no defaults. Teams never grant organization roles or independent permissions. MaximumTeams follows REFERENCE_CONFIGURATION organization.max_teams (10,000). MaximumMembers is a local storage/cardinality budget capped at the existing 100,000 organization-member ceiling, not a protocol-defined team default.

func (TeamConfig) Validate 

func (c TeamConfig) Validate() error

type TeamMember 

type TeamMember struct {
	TeamID, OrganizationID             ID
	TenantID                           identity.TenantID
	UserID                             identity.UserID
	Version, OrganizationMemberVersion uint64
	Active                             bool
}

TeamMember retains removal tombstones. OrganizationMemberVersion binds the exact admission, so removing and readmitting an org member cannot revive teams.

type TeamMemberRequest 

type TeamMemberRequest struct {
	Authentication                                                                 Authentication
	CommandID                                                                      identity.CommandID
	OrganizationID, TeamID                                                         ID
	UserID                                                                         identity.UserID
	OrganizationVersion, TeamVersion, OrganizationMemberVersion, MembershipVersion uint64
	CorrelationID                                                                  string
}

TeamMemberRequest binds exact organization/team/member epochs. Add requires zero MembershipVersion for a never-bound user or the previous tombstone version. Remove requires the current binding; replay uses the original prepared command.

type TeamReadRequest 

type TeamReadRequest struct {
	Authentication         Authentication
	OrganizationID, TeamID ID
	Cursor                 string
	Limit                  uint32
	CorrelationID          string
}

TeamReadRequest selects an exact team or a paginated team read. GetTeam requires TeamID, Limit zero, and an empty Cursor. Paginated reads use exclusive bytewise ID keysets, 1..100 per page; only ListTeamMembers requires TeamID. Members may read their own team's members; only owners/admins may read all organization teams or other teams.

type TeamRoleBinding 

type TeamRoleBinding struct {
	RoleID, TeamID, OrganizationID ID
	TenantID                       identity.TenantID
	Version                        uint64
	Active                         bool
}

TeamRoleBinding is one organization-scoped custom-role assignment to a terminal team identity. Active is stored assignment state, not a membership grant: effective access also requires current compatible org/team membership. Version zero denotes never assigned; revoked bindings retain their version.

type TeamRoleBindingRequest 

type TeamRoleBindingRequest struct {
	Authentication                                                Authentication
	CommandID                                                     identity.CommandID
	OrganizationID, RoleID, TeamID                                ID
	OrganizationVersion, RoleVersion, TeamVersion, BindingVersion uint64
	CorrelationID                                                 string
}

TeamRoleBindingRequest assigns/revokes one role for an exact current team. OrganizationVersion, RoleVersion, TeamVersion and BindingVersion are obtained from GetDynamicRole with TargetTeamID, including retained binding tombstones. It never names or impersonates a human target and confers no manager authority.

type UnitOfWork 

type UnitOfWork interface {
	Execute(context.Context, Command) (StoreResult, error)
	Recover(context.Context, identity.CommandID) (StoreResult, error)
}

UnitOfWork is invocation-scoped, storage-neutral mutation/recovery authority. The native adapter binds it immutably to one original command and current admitted caller. Recover must reject any other ID, never perform global lookup or replay effects, and preserve committed/not-committed/unknown distinctions.

type UpdateDynamicRoleOperationRequest 

type UpdateDynamicRoleOperationRequest struct {
	Authentication                   Authentication
	IdempotencyKey                   identity.IdempotencyKey
	OrganizationID, RoleID           ID
	OrganizationVersion, RoleVersion uint64
	Name, CorrelationID              string
	Statements                       []RoleStatement
}

UpdateDynamicRoleOperationRequest replaces the complete name and ordered statements at exact organization/role epochs under one original key. Empty statements intentionally grant nothing; replacement affects existing bindings. Borrowed custody must be frozen before callbacks. Current manager/session, role-write, catalog and original-outcome query authority remain native-owned.

func (UpdateDynamicRoleOperationRequest) Format 

func (UpdateDynamicRoleOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials, original key and replacement intent.

func (UpdateDynamicRoleOperationRequest) MarshalJSON 

func (UpdateDynamicRoleOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of borrowed custody.

func (UpdateDynamicRoleOperationRequest) MarshalText 

func (UpdateDynamicRoleOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of custody.

func (UpdateDynamicRoleOperationRequest) Validate 

func (r UpdateDynamicRoleOperationRequest) Validate() error

Validate checks exact incrementable epochs and complete replacement syntax.

type UpdateMemberOperationRequest 

type UpdateMemberOperationRequest struct {
	Authentication                     Authentication
	IdempotencyKey                     identity.IdempotencyKey
	OrganizationID                     ID
	UserID                             identity.UserID
	Role                               Role
	OrganizationVersion, MemberVersion uint64
	CorrelationID                      string
}

UpdateMemberOperationRequest is the transport-neutral keyed static-role replacement for an active member. Role and the positive, incrementable organization/member versions retain MemberRequest's semantics, including owner transitions. The durable owner allocates the command ID; matching retries recover only the original outcome without renewing authority or executing again. Current owner/administrator admission, last-owner safety and historical disclosure remain native decisions, not syntax-validation grants. Authentication and the single required key are borrowed opaque custody.

func (UpdateMemberOperationRequest) Format 

func (UpdateMemberOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials, keys and request values from diagnostics.

func (UpdateMemberOperationRequest) MarshalJSON 

func (UpdateMemberOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental transport/persistence of direct custody.

func (UpdateMemberOperationRequest) MarshalText 

func (UpdateMemberOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of direct custody.

func (UpdateMemberOperationRequest) Validate 

func (r UpdateMemberOperationRequest) Validate() error

Validate checks bounded static-role and exact-version syntax without IO, current authorization, key admission, command allocation or last-owner checks.

type UpdateOperationRequest 

type UpdateOperationRequest struct {
	Authentication            Authentication
	IdempotencyKey            identity.IdempotencyKey
	OrganizationID            ID
	OrganizationVersion       uint64
	Name, Slug, CorrelationID string
}

UpdateOperationRequest is the transport-neutral keyed metadata replacement. Name, Slug and the exact expected OrganizationVersion retain UpdateRequest's semantics. The durable owner allocates the command ID; matching retries recover that original command without refreshing its authority, version or deadlines. Changed intent conflicts, including a changed organization or expected version. Authentication and the single required key are borrowed opaque custody; syntax validation does not authorize an update or establish a committed outcome.

func (UpdateOperationRequest) Format 

func (UpdateOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials, keys and metadata from diagnostics.

func (UpdateOperationRequest) MarshalJSON 

func (UpdateOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental transport/persistence of direct custody.

func (UpdateOperationRequest) MarshalText 

func (UpdateOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of direct custody.

func (UpdateOperationRequest) Validate 

func (r UpdateOperationRequest) Validate() error

Validate checks bounded metadata, exact-version syntax and custody presence without IO, authentication, authorization, key admission or command allocation.

type UpdateRequest 

type UpdateRequest struct {
	Authentication            Authentication
	CommandID                 identity.CommandID
	OrganizationID            ID
	OrganizationVersion       uint64
	Name, Slug, CorrelationID string
}

UpdateRequest replaces only Name and Slug using CreateRequest's bounds and case-sensitive semantics; it neither clears nor accepts other metadata. OrganizationVersion is the exact current organization/policy epoch. Owners and administrators may update; identical metadata returns ErrConflict without a transition, new epoch, audit or lifecycle event. Preserve CommandID across retries and reconcile ambiguous outcomes using the native adapter's recovery.

type UpdateTeamOperationRequest 

type UpdateTeamOperationRequest struct {
	Authentication                   Authentication
	IdempotencyKey                   identity.IdempotencyKey
	OrganizationID, TeamID           ID
	OrganizationVersion, TeamVersion uint64
	Name, CorrelationID              string
}

UpdateTeamOperationRequest selects original-key replacement of a team's bounded name at exact organization/team epochs. The owner allocates the command, not the team ID. Matching key/intent retries recover only the original outcome; changed IDs, versions or name conflict and unknown outcomes never reexecute. Authentication and the required key are borrowed opaque custody. Syntax alone confers no current team-write, session, membership or disclosure authority.

func (UpdateTeamOperationRequest) Format 

func (UpdateTeamOperationRequest) Format(s fmt.State, _ rune)

Format redacts credentials, key and request metadata from diagnostics.

func (UpdateTeamOperationRequest) MarshalJSON 

func (UpdateTeamOperationRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of custody.

func (UpdateTeamOperationRequest) MarshalText 

func (UpdateTeamOperationRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit text and map-key export of custody.

func (UpdateTeamOperationRequest) Validate 

func (r UpdateTeamOperationRequest) Validate() error

Validate checks bounded syntax and custody without IO or owner authority. Name retains UpdateTeamRequest's UTF-8, trimmed 1..256-byte contract.

type UpdateTeamRequest 

type UpdateTeamRequest struct {
	Authentication                   Authentication
	CommandID                        identity.CommandID
	OrganizationID, TeamID           ID
	OrganizationVersion, TeamVersion uint64
	Name, CorrelationID              string
}

UpdateTeamRequest replaces only the bounded Name. Both epochs must match; identical names conflict without advancing epochs or emitting effects.

type View 

type View struct {
	Organization    Organization
	Actor, Target   Member
	TargetUser      identity.User
	OwnerCount      uint64
	Members         []Member
	NextCursor      identity.UserID
	Team            Team
	TeamMember      TeamMember
	Teams           []Team
	TeamMembers     []TeamMember
	NextTeamCursor  string
	DomainClaim     DomainClaim
	DynamicRole     DynamicRole
	DynamicRoles    []DynamicRole
	RoleBinding     RoleBinding
	TeamRoleBinding TeamRoleBinding
	NextRoleCursor  string
	LifecycleState  LifecycleState
	LifecycleReason string
}

View is an independently owned primary snapshot. OwnerCount includes active owners only; it is advisory until rechecked under the mutation's aggregate lock.

Source Files

View all Source files

Directories

Path Synopsis
postgres module

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.