user_permissions + user_permission_groups (scope CHECK bilan)

team-lead-ep-09 yangiladi

Yangilandi: pr_url

team-lead-ep-09 bog'liqlik qo'shdi

→ EP-09-T01-S03

team-lead-ep-09 bog'liqlik qo'shdi

→ EP-09-T01-S02

team-lead-ep-09 yangiladi

Yangilandi: estimate_hours

qa-ep-09-t01-s04 izoh qoldirdi

QA tasdiqladi. Spec (09_auth.md #2.3e (3)-(4), Q39=A paket) + openapi/v1/auth.yaml (UserPermission*/UserPermissionGroup* schemalar) bilan solishtirildi: a) scope_organization_id nomi — spec izohi ("SNAPSHOT emas, HAQIQIY scoping ustuni") va contract (auth.yaml:1655,1671,1701,1718) bilan mos, tasdiqlandi. b) CHECK juftligi (org_node->NOT NULL, tenant->NULL) ikkala jadvalda ham bor, Q39=A matniga (#2.3e satr 748,759) mos. c) UNIQUE constraint yo'qligi TO'G'RI qaror: Q39 paket tasdiqda faqat permission_group_items uchun UNIQUE(group_id, permission_code) talab qilingan; user_permissions/user_permission_groups uchun faqat 'ON DELETE CASCADE + scope_organization_id CHECK' sanalgan — UNIQUE yo'q. Contract'da ham duplicate-conflict javobi yo'q. Kamchilik emas. d) owner+org_node cheklovi (R36 ii) app-layer'da qoldirilishi TO'G'RI: §5 biznes qoidalar bo'limida ('tekshiruv o'zgarishdan keyingi holat ustida, bir tranzaksiyada'), guruh kodi CHECK ichida ko'rinmaydi — trigger emas oddiy CHECK bilan ifodalanmaydi, migratsiya doirasidan tashqarida. Test: flock ostida UserPermissionsMigrationTest — 10/10 yashil (mvn test, Testcontainers PG16). Mutatsiya tekshiruvi: chk_user_permissions_scope_organization_id CHECK'ni vaqtincha olib tashladim -> 2 test qizil bo'ldi (Failures: 2), git checkout bilan tikladim, qayta 10/10 yashil. Cross-cutting (migratsiya-leaf): AR-1 tenant_id yo'q ✓; permission_code oddiy FK->permissions.code (AR-10) ✓; snake_case/ko'plik/to'liq FK nomlari ✓; soft-delete yo'q — ataylab (spec maydon ro'yxatida deleted_at yo'q, permission_group_items bilan bir xil naqsh).

qa-ep-09-t01-s04 statusni o'zgartirdi Review → Bajarildi

qa-ep-09-t01-s04 qabul mezonini belgiladi

✓ Ikkala jadvalda ham `organization_id` nomli ustun YO'Q (faqat `scope_organization_id`) — AC11

qa-ep-09-t01-s04 qabul mezonini belgiladi

✓ User o'chirilganda (hard delete) ikkala jadvaldagi qatorlari CASCADE bilan o'chadi

qa-ep-09-t01-s04 qabul mezonini belgiladi

✓ Katalogda yo'q `permission_code` bilan `user_permissions` ga yozish FK bilan rad etiladi — AC13(a)

qa-ep-09-t01-s04 qabul mezonini belgiladi

✓ `scope_type='org_node'` + `scope_organization_id IS NULL` yozish CHECK bilan rad etiladi (va teskarisi ham)

coder-ep-09-t01-s04 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-09-t01-s04 yangiladi

Yangilandi: branch, commit_sha

coder-ep-09-t01-s04 izoh qoldirdi

V5__user_permissions.sql: user_permissions + user_permission_groups, spec #2.3e (3)-(4) bo'yicha aynan (board tavsifi bilan bir xil). scope_type CHECK(tenant|org_node) + scope_organization_id CHECK juftligi ikkala jadvalda ham. permission_code -> permissions.code AR-10 oddiy FK (RESTRICT, V3 uslubi), permission_group_id -> permission_groups.id (default RESTRICT — R46 ruhi: guruh biriktirilgan bo'lsa jimgina CASCADE yo'q). user_id -> users ON DELETE CASCADE. owner guruhi uchun scope_type=tenant cheklovi (Q32=A, R36 ii) ilova qatlamida (409 owner_scope_forbidden) — DB CHECK guruh kodini bilmagani uchun bu yerda emas. UNIQUE constraint qo'shilmadi — spec/kontrakt (auth.yaml) buni talab qilmagan (faqat 646-649 AC va 12 mexanik detal paketi, band 39). Test: UserPermissionsMigrationTest, 10/10 yashil (Testcontainers, real PG 16), flock ostida tor doirada yurgizildi.

coder-ep-09-t01-s04 qabul mezonini belgiladi

✓ Ikkala jadvalda ham `organization_id` nomli ustun YO'Q (faqat `scope_organization_id`) — AC11

coder-ep-09-t01-s04 qabul mezonini belgiladi

✓ User o'chirilganda (hard delete) ikkala jadvaldagi qatorlari CASCADE bilan o'chadi

coder-ep-09-t01-s04 qabul mezonini belgiladi

✓ Katalogda yo'q `permission_code` bilan `user_permissions` ga yozish FK bilan rad etiladi — AC13(a)

coder-ep-09-t01-s04 qabul mezonini belgiladi

✓ `scope_type='org_node'` + `scope_organization_id IS NULL` yozish CHECK bilan rad etiladi (va teskarisi ham)

coder-ep-09-t01-s04 fayllarni qayd etdi

2 ta fayl qayd etildi

coder-ep-09-t01-s04 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-09-t01-s04 ishga oldi

pm-agent bog'liqlik qo'shdi

→ EP-09-T01-S03

pm-agent bog'liqlik qo'shdi

→ EP-09-T01-S02

pm-agent yaratdi

user_permissions + user_permission_groups (scope CHECK bilan)