# China Mobile Asset Library Per-User Isolation

## Goal

Give every platform user an isolated China Mobile AIGC asset group for each
resolved China Mobile channel. The platform creates and manages the group
internally. A user can only create, list, read, update, and delete assets in
that group.

## Scope

The change applies only after the asset proxy resolves a China Mobile asset
channel. Other asset adapters retain their existing action support and request
behavior.

Historical China Mobile groups and assets are not migrated. A user receives a
new group on their first asset request after rollout.

## Data Model

Add a persistent binding table with these fields:

- `user_id`: platform user ID.
- `channel_id`: resolved China Mobile channel ID.
- `group_id`: upstream China Mobile asset group ID.
- timestamps managed through the existing GORM conventions.

`(user_id, channel_id)` is unique. The group identity is deliberately scoped
to a channel because channels can represent different China Mobile credentials
or resource pools.

## Group Lifecycle

The asset proxy resolves the user and channel before dispatching a China Mobile
asset request. It calls a dedicated service to obtain the user group binding.

If no binding exists, the service creates an `AIGC` group through the internal
China Mobile adapter path, persists the returned group ID, and returns it. A
database uniqueness constraint handles concurrent first requests: after a
unique-conflict result, the service reads and returns the winning binding.

If upstream creation or binding persistence fails, the asset request fails. It
must never fall back to the shared upstream library. An orphaned upstream group
may remain when persistence fails after creation; it is inaccessible through
the platform and does not weaken isolation.

## Request Authorization

Clients are forbidden from calling all group actions:

- `CreateAssetGroup`
- `ListAssetGroups`
- `GetAssetGroup`
- `UpdateAssetGroup`
- `DeleteAssetGroup`

The proxy returns HTTP 403 before dispatching these actions for a resolved
China Mobile channel. Internal group creation bypasses this public-action gate.

For permitted asset actions, the proxy injects the bound group ID and does not
trust user-supplied group restrictions:

- `CreateAsset`: overwrite `GroupId`.
- `ListAssets`: overwrite `Filter.GroupIds` with the bound group ID.
- `GetAsset`, `UpdateAsset`, and `DeleteAsset`: retrieve the asset first and
  verify its upstream `GroupId` equals the bound group ID. Treat a mismatch or
  missing asset as not found, without exposing another user's asset details.

## Error Behavior

Group provisioning failures and binding-store failures stop the request and
return an explicit service or upstream error. Authorization failures for group
actions return 403. Cross-user asset IDs return the same not-found outcome as
an absent asset ID.

## Testing

Add focused controller and service tests for:

- initial group creation and reuse for the same user and channel;
- separate bindings for distinct users or channels;
- concurrent initial requests converging on one persisted binding;
- client-supplied `GroupId` and `Filter.GroupIds` being overwritten;
- cross-user get, update, and delete attempts returning not found;
- all five public group actions returning 403 only for China Mobile;
- regression coverage confirming non-China-Mobile adapters preserve current
  group-action behavior.

Run focused controller/service tests, then the relevant package test suite.