raystack / frontier / 26841972627

43%

main: 43%

Build Type

Pull #1668

github

Committed by AmanGIT07

Commit Message

feat(userpat): route policy writes through membership; enforce 1 role per scope

userpat now uses the membership package for all policy operations rather
than calling policy service directly:

- createPolicies routes each scope to SetOrganizationMemberRole,
  SetPATAllProjectsRole, or SetProjectMemberRole based on scope shape
- Delete and Update wipe existing policies via RemoveAllPATPolicies
- enrichWithScope reads policies via ListPoliciesByPrincipal
- PolicyService interface removed from userpat (replaced by
  MembershipService)
- New ErrDuplicateScope rejects more than one role per resource type
  (org or project) in a single request
- Update guards on PAT expiry upfront with ErrExpired so the membership
  layer never sees an expired PAT
- mapPATError handles the two new errors

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Pull Request Pull Request #1668: feat(userpat): route policy writes through membership; enforce 1 role per scope

Coverage Stats

22 of 26 new or added lines in 3 files covered. (84.62%)

1 existing line in 1 file now uncovered.

16396 of 37998 relevant lines covered (43.15%)

12.06 hits per line