feat: the authority core's decisions, and readers that honour resource owners

.github/workflows/go.yml

@@ -0,0 +1,56 @@
+name: go
+
+# Every Go module in the repository is vetted and race-tested on each pull
+# request and on main. tools/noproxygate's test is the no-proxy gate: it
+# type-checks every module and refuses requests, dials and subprocesses that
+# bypass host.HTTPTransport and host.DialOptions.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  modules:
+    name: find Go modules
+    runs-on: ubuntu-latest
+    outputs:
+      modules: ${{ steps.find.outputs.modules }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - id: find
+        name: list every go.mod
+        run: |
+          modules=$(find . -name go.mod -not -path '*/node_modules/*' -printf '%h\n' | sed 's|^\./||' | sort | jq -R . | jq -cs .)
+          echo "$modules"
+          test "$(echo "$modules" | jq length)" -gt 0
+          echo "modules=$modules" >> "$GITHUB_OUTPUT"
+
+  test:
+    name: ${{ matrix.module }}
+    needs: modules
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        module: ${{ fromJSON(needs.modules.outputs.modules) }}
+    defaults:
+      run:
+        working-directory: ${{ matrix.module }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version-file: ${{ matrix.module }}/go.mod
+          cache-dependency-path: ${{ matrix.module }}/go.sum
+      - name: go vet
+        run: go vet ./...
+      - name: go test -race
+        run: go test -race -count=1 ./...

libraries/authority-client/contract/catalog.codefly.json

@@ -1,7 +1,7 @@
 {
   "schema": "codefly/module-api-contracts/v1",
   "package": "local",
-  "version": "0.0.0",
+  "version": "0.0.1",
   "endpoints": [
     {
       "service": "local",
@@ -10,7 +10,7 @@
       "kind": "protobuf",
       "package": "api",
       "path": "contract.binpb",
-      "digest": "sha256:d2fcb57f3608ea6c57918565db2d83cc69d7e9cebee33edadf2160a3fee8d635",
+      "digest": "sha256:9fcee9f110613a97881cfdfd035de3b82b7b58cac138e1093a47ba4460436d72",
       "services": [
         {
           "name": "GatewayService",

libraries/authority-client/go/go.mod

@@ -4,7 +4,7 @@ go 1.27.3
 
 require (
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2
-	github.com/codefly-dev/core v0.19.7-0.20261025185759-e501458995d0
+	github.com/codefly-dev/core v0.19.7-0.20261026022918-8af4b787a435
 	github.com/codefly-dev/sdk-go v0.4.0
 	google.golang.org/genproto/googleapis/api v0.0.0-20261019180522-ce908d29299b
 	google.golang.org/grpc v1.84.0

libraries/authority-client/go/go.sum

@@ -28,8 +28,8 @@ github.com/cheggaaa/pb/v3 v3.2.1 h1:aprZbFRG+B7+ug76S8QZ6Y1PW168UHzOmbC3wa+aU6I=
 github.com/cheggaaa/pb/v3 v3.2.1/go.mod h1:U9hSVxoKqJrZIE3PkFG1xXXNaK/Ilzg+EF/scpXzEdw=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
-github.com/codefly-dev/core v0.19.7-0.20261025185759-e501458995d0 h1:YEFvkyokBsUWbHoaoKOi6iJtMrqNNR7HsWdUQGN50TA=
-github.com/codefly-dev/core v0.19.7-0.20261025185759-e501458995d0/go.mod h1:1ina3kP+YSAL4tlZvnEYd4P8bFGnJECfkP86ojeeF1A=
+github.com/codefly-dev/core v0.19.7-0.20261026022918-8af4b787a435 h1:3M1c4Ver3YRaHj4rk1+mj1uweqTF5bO2QHZ50rI7sNI=
+github.com/codefly-dev/core v0.19.7-0.20261026022918-8af4b787a435/go.mod h1:1ina3kP+YSAL4tlZvnEYd4P8bFGnJECfkP86ojeeF1A=
 github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ=
 github.com/codefly-dev/gortk v0.2.0/go.mod h1:dDWUMFgAP063OCGhTEpV7FFUj9+zTcxxO/nV80VKEwg=
 github.com/codefly-dev/sdk-go v0.4.0 h1:3Jm0bP+UsLI4iZYp3wqVa42bcXBumMIIF/aeweKOAhY=

libraries/authority-client/go/workcontext/claims.go

@@ -111,12 +111,23 @@ func (c *Claims) Scopes() []*basev0.WorkScopeV1 {
 
 // Allows asks for one literal action on one exact resource. An empty resourceID
 // asks for the whole kind; a resource-limited grant cannot satisfy that request.
-// No wildcard expansion, action implication or cross-grant merging occurs.
+// No wildcard expansion, action implication or cross-grant merging occurs. It
+// names no resource owner, so an owner-selected grant never satisfies it: a
+// module whose resources have owners asks AllowsOwned.
 func (c *Claims) Allows(kind, action, resourceID string) bool {
+	return c.AllowsOwned(kind, action, resourceID, "")
+}
+
+// AllowsOwned is Allows for a resource owned by ownerID (the owner the
+// module's own record names): an owner-selected grant covers it only when it
+// names that owner, and, with ids, the id too. A grant naming no owner covers
+// it whatever its owner. An empty resourceID with an owner asks for every
+// resource that owner holds, the list path.
+func (c *Claims) AllowsOwned(kind, action, resourceID, ownerID string) bool {
 	if c == nil || kind == "" || action == "" {
 		return false
 	}
-	ask := &basev0.WorkScopeV1{ResourceKind: kind, Actions: []string{action}}
+	ask := &basev0.WorkScopeV1{ResourceKind: kind, Actions: []string{action}, ResourceOwnerId: ownerID}
 	if resourceID != "" {
 		ask.ResourceIds = []string{resourceID}
 	}

libraries/authority-client/go/workcontext/claims_test.go

@@ -25,7 +25,9 @@ type fixture struct {
 	Probes                []struct {
 		Kind, Action string
 		ResourceID   string `json:"resource_id"`
-		Allowed      bool
+		// Owner, when the probe names one, asks the owner-aware AllowsOwned.
+		Owner   *string
+		Allowed bool
 	}
 }
 
@@ -100,8 +102,12 @@ func TestCoreFixtures(t *testing.T) {
 				}
 			}
 			for _, p := range f.Probes {
-				if c.Allows(p.Kind, p.Action, p.ResourceID) != p.Allowed {
-					t.Fatalf("probe %s %s %s", p.Kind, p.Action, p.ResourceID)
+				got := c.Allows(p.Kind, p.Action, p.ResourceID)
+				if p.Owner != nil {
+					got = c.AllowsOwned(p.Kind, p.Action, p.ResourceID, *p.Owner)
+				}
+				if got != p.Allowed {
+					t.Fatalf("probe %s %s %s owner %v", p.Kind, p.Action, p.ResourceID, p.Owner)
 				}
 			}
 		})