wtclaude
43147b796a
R2, and the first phase where this module WRITES to a game. Groups and grants are authored on the website and pushed into each server's own permission store, so every plugin that already calls `UserHasPermission` honours them with no adapter, and a wipe stops being a data-loss event. **Seven org-lead decisions (D28-D34).** A grant is keyed to the website USER and resolved to every Steam id they have linked at push time (D28); every authored row carries a scope — a server or `*` (D29); groups are mirrored as real groups rather than flattened (D30); a holder the site did not author is REPORTED, never undone, with adopt and revoke offered (D31); one verb, with the plugin diffing locally (D32); a permission no server has registered is reported unresolved and never self-registered (D33); authoring is people and groups by hand, with rules deferred (D34). **Three sets, and every interesting question is a difference between two.** `desired − pushed` is what to apply; `pushed − desired` is what to RETIRE, because the site put it there and has since withdrawn it; `present − desired` is drift. The middle one is why `rust_perm_pushed` exists: a name in the store that is not in the desired set is either something the site retired or something a human granted, and those two have opposite correct answers. **What lands is not what was sent.** A grant naming a permission the server has not registered did not land — `GrantUserPermission` no-ops silently — and a member the store has never seen could not be placed. Neither is recorded as pushed, so the site never believes it gave a privilege it did not. The loop asks a cheap question every thirty seconds — does the digest of the desired set still equal what this server last confirmed — and syncs on a change, a restart, a wipe, a drift hook, a failed attempt past its backoff, or the fifteen-minute audit that finds drift on a server nobody has touched. **This module's first admin page**, because a permission model is the first thing here that has to be composed rather than configured. What is on it is decided by what an operator can get wrong: four states are invisible from the game and from a list of grants, and each is a sentence rather than a number. Walked end to end against a real core at the pinned ref, the real sidecar, and a stand-in speaking protocol 4 — including a restart that emptied the store and was fully re-pushed. Four defects the browser found that 133 green tests did not. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PMH6bw1jXMgbyF3ZWGEzSM
43 lines
2.1 KiB
SQL
43 lines
2.1 KiB
SQL
-- ── The teardown ──────────────────────────────────────────────────────────
|
|
--
|
|
-- Destructive, and run ONLY by an explicit admin purge (MODULE_API.md §2.6).
|
|
-- Nothing on the boot path executes this file, and uninstalling the module does
|
|
-- not either: removing an operator's data is a second decision they make on
|
|
-- purpose, offered inside the uninstall flow and confirmed separately.
|
|
--
|
|
-- It exists because `schema.sql` does. A module that can create tables and
|
|
-- cannot drop them leaves an operator with orphaned data and no supported way to
|
|
-- remove it, so core refuses to load a module that declares one without the
|
|
-- other.
|
|
--
|
|
-- **Drop in the reverse of creation order**, which this file depends on:
|
|
-- `rust_server_state` carries a foreign key into `rust_servers`, so dropping the
|
|
-- parent first fails on the constraint — and a purge that fails halfway leaves
|
|
-- exactly the orphaned data it exists to remove.
|
|
--
|
|
-- What does NOT belong here: rows written into core's tables. Core prunes what
|
|
-- it knows this module registered, because it is the side that knows which
|
|
-- registrant owned what.
|
|
|
|
-- Phase 7. Children before parents: every one of these carries a foreign key
|
|
-- into `rust_servers`, `users` or `rust_perm_groups`.
|
|
DROP TABLE IF EXISTS rust_perm_catalogue;
|
|
DROP TABLE IF EXISTS rust_perm_sync;
|
|
DROP TABLE IF EXISTS rust_perm_revocations;
|
|
DROP TABLE IF EXISTS rust_perm_drift;
|
|
DROP TABLE IF EXISTS rust_perm_pushed;
|
|
DROP TABLE IF EXISTS rust_perm_grants;
|
|
DROP TABLE IF EXISTS rust_perm_group_members;
|
|
DROP TABLE IF EXISTS rust_perm_group_permissions;
|
|
DROP TABLE IF EXISTS rust_perm_groups;
|
|
DROP TABLE IF EXISTS rust_account_links;
|
|
DROP TABLE IF EXISTS rust_ingest_cursor;
|
|
DROP TABLE IF EXISTS rust_presence;
|
|
DROP TABLE IF EXISTS rust_events;
|
|
DROP TABLE IF EXISTS rust_gather_totals;
|
|
DROP TABLE IF EXISTS rust_player_wipe_stats;
|
|
DROP TABLE IF EXISTS rust_players;
|
|
DROP TABLE IF EXISTS rust_wipes;
|
|
DROP TABLE IF EXISTS rust_server_state;
|
|
DROP TABLE IF EXISTS rust_servers;
|