cgalo5758
ad7a219adf
Enforce 10j's verified gaps (schema-hardening change): - Migration 00010: partial unique indexes for one default pool and one primary assignment per workspace, plus CHECKs pinning pool/provider/subscription vocabularies and provider lifecycle timestamps. - Workspace creation shares a transactional provisioning function; extension validates its target pool; last-tier deletion of a defaulted ladder is guarded; signup completes plan-less on a broken ladder. - Boot asserts integration slug parity and validates declared config enums; Stripe invoice amounts are range-checked; domain cancellation runs a final evidence probe; rule authoring is additive-only.
Provisioning Module
The provisioning module orchestrates first-login auto-provisioning. When a user authenticates via OIDC for the first time, AutoProvision creates all governance and resource structures within a single database transaction:
- User — identity record linked to the OIDC subject
- Person — profile record (display name, email)
- Organization — personal org (
org_type = 'personal') - OrgMember — membership with the
ownersystem role - Workspace — default workspace within the org
- Role Assignment — org-scoped role assignment for the owner
- Resource Pool — default pool (
pool_type = 'default',is_auto_managed = true) - Pool Assignment — primary link between workspace and pool (
is_primary = true)
If any step fails, the entire transaction rolls back — no partial structures exist.