#597: departed owners — liveness freeze, admin surface, transfer #627

Merged

Cordy merged 10 commits from fix-597 into main

2026-09-18 20:47:10 +00:00

Cordy commented

2026-09-18 20:43:46 +00:00

Owner

Backend slice of #597 per the #569 decision.

internal/liveness: one oracle answers "does this username still resolve" — local store first, then the IdP admin client on a short cache (60s/15s), fail-frozen, never mutating. Empty creator reads alive (legacy records never freeze).
Freeze at both serve chokepoints: the /shared grants adapter drops grants from departed creators; the public-link surface answers 404 for them (indistinguishable from expired). Frozen, not revoked — IdP outage self-heals; a re-created account restores everything.
FileStore.RepointGrants: all-or-nothing grant re-pointing (validate-all-then-apply, rollback on save failure). Public links deliberately untouched — they bind to paths and break with the move.
Admin API (all requireAdmin): GET /admin/owners/departed (grouped listing), GET /admin/owners/preview?user= (local-delete preview), POST /admin/owners/transfer — dry-run repoint → unscoped Rename /home/from → /home/to/from (move chokepoint: re-encryption, holds, quota, versions chain all inherit) → apply repoint → audit owner-transfer.
Quota pre-checked via quota.Driver.UserUsage; docs appended to sharing.md + local-accounts.md.

Deliberate: seats seen-list unused for liveness truth (cannot distinguish departed from inactive); freeze events not audited (computed state, not a mutation); links stay as broken records after transfer. Admin UI follows in a separate mockup-first slice.

Backend slice of #597 per the #569 decision. - `internal/liveness`: one oracle answers "does this username still resolve" — local store first, then the IdP admin client on a short cache (60s/15s), fail-frozen, never mutating. Empty creator reads alive (legacy records never freeze). - Freeze at both serve chokepoints: the /shared grants adapter drops grants from departed creators; the public-link surface answers 404 for them (indistinguishable from expired). Frozen, not revoked — IdP outage self-heals; a re-created account restores everything. - `FileStore.RepointGrants`: all-or-nothing grant re-pointing (validate-all-then-apply, rollback on save failure). Public links deliberately untouched — they bind to paths and break with the move. - Admin API (all requireAdmin): `GET /admin/owners/departed` (grouped listing), `GET /admin/owners/preview?user=` (local-delete preview), `POST /admin/owners/transfer` — dry-run repoint → unscoped Rename /home/from → /home/to/from (move chokepoint: re-encryption, holds, quota, versions chain all inherit) → apply repoint → audit `owner-transfer`. - Quota pre-checked via quota.Driver.UserUsage; docs appended to sharing.md + local-accounts.md. Deliberate: seats seen-list unused for liveness truth (cannot distinguish departed from inactive); freeze events not audited (computed state, not a mutation); links stay as broken records after transfer. Admin UI follows in a separate mockup-first slice.

Cordy added 10 commits

2026-09-18 20:43:47 +00:00