Struct Orgs 

pub struct Orgs { /* private fields */ }

The organizations module (issue #652): organizations, memberships, roles and email invitations. Compose it with Orgs::builder.

Implementations

impl Orgs

pub fn new() -> Self

The module with its defaults: the owner role alone, no manager roles, no staff organization. The same as builder().build(), and what a generated manifest mounts when it has nothing to configure.

pub fn builder() -> OrgsBuilder

A builder with the default role set: owner alone. Named builder rather than new, like every other module in this workspace, because it returns an OrgsBuilder rather than the module itself.

pub fn roles(&self) -> &[String]

The role set, for a caller that wants to publish it.

Trait Implementations

impl Default for Orgs

fn default() -> Self

Returns the “default value” for a type.

impl Module for Orgs

fn requires(&self) -> &'static [Port]

Memberships are rows, so the module needs a database; every route but the admin listing acts for the account a credential proves, so it needs a verifier. A deployment without one refuses to boot rather than serving an organization’s roster to whoever asks.

fn optional(&self) -> &'static [Port]

Clock decides “now” for expiry and single-use, IdGen mints ids and the invitation token, and Mailer delivers the invitation. Each has a working default or a documented absence, so none is required.

fn personal_data(&self) -> &'static [PersonalDataSet]

Three tables, one declaration each — HarnessBuilder::build refuses a table declared twice, so a column that names a second person cannot get a declaration of its own and the choice has to be made once per table:

• org_members is the member’s. Erase is the only disposition that leaves no membership pointing at an account that no longer exists. Its invited_by names whoever added them — a second person on the member’s row — so it is named in redacted: an export of the row shows the column and not the id. Nothing erases it, and the reason is in the declaration rather than left to be discovered: the framework blanks columns only on the rows a subject’s own value matches.
• orgs is retained: the row is not one person’s — deleting it would delete every other member’s organization — and created_by is kept as provenance. Erasure of the creator’s account does not remove the organization, which is what Retain says.
• org_invitations is the inviter’s. The row is keyed by invited_by, so erasing the inviter takes the invitations they sent; the invitee is held only as the SHA-256 of their address, which is not a value an erasure request can carry, so there is nothing to erase for them and nothing of theirs left to read.

fn scheduled<'a>( &'a self, ctx: &'a ModuleContext, cron: &'a str, ) -> BoxFuture<'a, Result<(), AnyError>>

The scheduled pass: delete invitations that have lapsed, so an organization is not left holding addresses it can no longer invite with. An accepted invitation is kept until it lapses — it is what the accept path reads back to tell who spent the token, and it holds only hashes.

fn name(&self) -> &'static str

Kebab-case name; mounted at /v1/<name>.

fn version(&self) -> &'static str

env!("CARGO_PKG_VERSION"), surfaced by /__health.

fn tables(&self) -> &'static [&'static str]

Table names this module owns; duplicates across modules are a build error.

fn migrations(&self) -> Migrations

The module’s migrations, embedded per dialect.

fn validate_config(&self, cfg: &dyn Config) -> Result<(), ConfigError>

Rejects invalid configuration: missing required keys or malformed values, reported together with the module name.

fn self_check(&self) -> Vec<String>

Problems the module can find in itself, with no configuration and no environment: its own embedded data, checked against its own declarations.

fn router(&self, ctx: ModuleContext) -> Router

The module’s router, nested under /v1/<name>.

fn surface(&self) -> Surface

The module’s UI surface (ADR 0010): the actions a renderer may offer and the views that compose them. Input schemas come from the handler’s own body types (Action::input::<Body>()), so the declaration cannot drift from the route. Harness::build validates it; GET /__surface serves the composition. Default: nothing, and a module that declares nothing renders nothing.

fn harness_api(&self) -> u32

Contract version, checked by Harness::build.

fn depends_on(&self) -> &'static [&'static str]

Modules this one’s schema sits on top of, by name.

fn actor_kinds(&self) -> &'static [&'static str]

Actor kinds this module owns, each [a-z0-9_-]; duplicates across modules are a build error, and so is a kind with no handler registered through HarnessBuilder::actor.

fn emits(&self) -> &'static [&'static str]

Event names this module emits ("<module>.<event>"), listed by /__health.

fn public_writes(&self) -> bool

Whether the module has public write endpoints.

fn public_write_policy(&self) -> RoutePolicy

What actually protects those public writes, for a module with no ADR 0010 surface to hang a per-action RoutePolicy on (issue #143).

fn signature_verification(&self) -> SignatureVerification

Which verifier proves this module’s RoutePolicy::Signature deliveries (issue #533): how a webhook handler checks a machine signature before acting.

fn max_body_bytes(&self, _cfg: &dyn Config) -> usize

The largest request body any route of this module accepts, so a runtime can refuse an oversize body before buffering it (issue #440).

fn streaming_routes(&self) -> &'static [StreamRoute]

Routes this module serves in streaming mode (issue #585), each with its own StreamRoute::max_bytes ceiling. Opt-in: the default is empty, and every existing route keeps the buffered behaviour it always had.

fn max_blob_object_bytes(&self) -> u64

The largest object this module’s streamed and multipart blob writes may produce (issue #586), enforced by the ScopedBlob the harness hands the module on put_stream, upload_part and complete_multipart.

fn well_known(&self) -> Option<Router>

Routes this module serves at the root under /.well-known, for spec-mandated discovery documents (OIDC openid-configuration, jwks.json) that must live outside /v1 (issue #46). Paths are relative to the prefix: register /jwks.json, not /.well-known/jwks.json.

fn events( &self, ) -> Vec<(String, Arc<dyn Fn(&Scope, Value) -> Pin<Box<dyn Future<Output = Result<(), Box<dyn Error + Sync + Send>>> + Send>> + Sync + Send>)>

Handlers for events other modules emit; registered at Harness::build.