chenchenandClaude Opus 4.8
19fd4f3326
Replace the user-facing env_map mistake with a built-in env convention keyed by resource type + provider — users never see/edit env names; they only fill plain resource fields. Supports git (gitea/github/gitlab), vm, database (mysql/pg/redis/mongo, with alias normalisation), storage (azure blob / bucket). Lenient: missing optional fields are skipped; only unsupported type or a KV read failure errors. Other issues found in review and fixed: - start timeout: template-agent start now uses a longer timeout (default 60s, AGENT_RUNTIME_START_TIMEOUT_SECONDS) since AM provisions synchronously — 5s would time out. amTemplateDo takes a per-call timeout. - orphan agent: if AM start succeeds but the Manager record fails to persist, the orphan is rolled back (best-effort amDeleteTemplateAgent). - findUserTemplateAgent now guards template_id<>'' so the new endpoints can't touch a legacy task deployment. - binding_ids defaults to [] (not null). - removed ResourceBinding.EnvMap field entirely. Tests rewritten for the built-in convention (blob metadata-only, db provider prefixes incl pg/mg aliases, git provider-agnostic names, ownership, unsupported type, empty); adapter round-trip + router tests still pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
43 lines
2.7 KiB
Go
43 lines
2.7 KiB
Go
package model
|
|
|
|
// ResourceBinding is the Manager-side resource record described by docs/plan.md P1.
|
|
// It stores user-owned resource metadata and a Secret Store reference only;
|
|
// plaintext credentials must never be stored here.
|
|
type ResourceBinding struct {
|
|
Id int `json:"id"`
|
|
UserId int `json:"user_id" gorm:"index;not null"`
|
|
TenantId string `json:"tenant_id" gorm:"type:varchar(64);index"` // legacy compatibility only; do not use as a product boundary.
|
|
ProjectId string `json:"project_id" gorm:"type:varchar(64);index"`
|
|
BindingScope string `json:"binding_scope" gorm:"type:varchar(512);index"`
|
|
Name string `json:"name" gorm:"type:varchar(128);not null"`
|
|
ResourceType string `json:"resource_type" gorm:"type:varchar(32);index;not null"`
|
|
Provider string `json:"provider" gorm:"type:varchar(64);default:'custom'"`
|
|
ExternalId string `json:"external_id" gorm:"type:varchar(512)"`
|
|
SecretRef string `json:"secret_ref" gorm:"type:varchar(512)"`
|
|
Metadata string `json:"metadata" gorm:"type:text"`
|
|
PermissionScope string `json:"permission_scope" gorm:"type:text"`
|
|
Constraints string `json:"constraints" gorm:"type:text"`
|
|
Status string `json:"status" gorm:"type:varchar(32);default:'active';index"`
|
|
CreatedAt int64 `json:"created_at" gorm:"autoCreateTime;column:created_at"`
|
|
UpdatedAt int64 `json:"updated_at" gorm:"autoUpdateTime;column:updated_at"`
|
|
}
|
|
|
|
// ResourceGrant assigns a ResourceBinding to a role and child Agent.
|
|
// It is the auditable Manager expression of "user grants bound resource to role".
|
|
type ResourceGrant struct {
|
|
Id int `json:"id"`
|
|
UserId int `json:"user_id" gorm:"index;not null"`
|
|
TenantId string `json:"tenant_id" gorm:"type:varchar(64);index"` // legacy compatibility only; do not use as a product boundary.
|
|
ProjectId string `json:"project_id" gorm:"type:varchar(64);index"`
|
|
BindingScope string `json:"binding_scope" gorm:"type:varchar(512);index"`
|
|
ResourceId int `json:"resource_id" gorm:"index;not null"`
|
|
Role string `json:"role" gorm:"type:varchar(128);index;not null"`
|
|
AgentId string `json:"agent_id" gorm:"type:varchar(128);index;not null"`
|
|
PermissionScope string `json:"permission_scope" gorm:"type:text"`
|
|
Constraints string `json:"constraints" gorm:"type:text"`
|
|
Status string `json:"status" gorm:"type:varchar(32);default:'active';index"`
|
|
RevokedAt int64 `json:"revoked_at" gorm:"default:0"`
|
|
CreatedAt int64 `json:"created_at" gorm:"autoCreateTime;column:created_at"`
|
|
UpdatedAt int64 `json:"updated_at" gorm:"autoUpdateTime;column:updated_at"`
|
|
}
|