3.4 KiB

Surový Blame Historie

China Mobile Asset Library Per-User Isolation

Goal

Give every platform user an isolated China Mobile AIGC asset group for each resolved China Mobile channel. The platform creates and manages the group internally. A user can only create, list, read, update, and delete assets in that group.

Scope

The change applies only after the asset proxy resolves a China Mobile asset channel. Other asset adapters retain their existing action support and request behavior.

Historical China Mobile groups and assets are not migrated. A user receives a new group on their first asset request after rollout.

Data Model

Add a persistent binding table with these fields:

user_id: platform user ID.
channel_id: resolved China Mobile channel ID.
group_id: upstream China Mobile asset group ID.
timestamps managed through the existing GORM conventions.

(user_id, channel_id) is unique. The group identity is deliberately scoped to a channel because channels can represent different China Mobile credentials or resource pools.

Group Lifecycle

The asset proxy resolves the user and channel before dispatching a China Mobile asset request. It calls a dedicated service to obtain the user group binding.

If no binding exists, the service creates an AIGC group through the internal China Mobile adapter path, persists the returned group ID, and returns it. A database uniqueness constraint handles concurrent first requests: after a unique-conflict result, the service reads and returns the winning binding.

If upstream creation or binding persistence fails, the asset request fails. It must never fall back to the shared upstream library. An orphaned upstream group may remain when persistence fails after creation; it is inaccessible through the platform and does not weaken isolation.

Request Authorization

Clients are forbidden from calling all group actions:

CreateAssetGroup
ListAssetGroups
GetAssetGroup
UpdateAssetGroup
DeleteAssetGroup

The proxy returns HTTP 403 before dispatching these actions for a resolved China Mobile channel. Internal group creation bypasses this public-action gate.

For permitted asset actions, the proxy injects the bound group ID and does not trust user-supplied group restrictions:

CreateAsset: overwrite GroupId.
ListAssets: overwrite Filter.GroupIds with the bound group ID.
GetAsset, UpdateAsset, and DeleteAsset: retrieve the asset first and verify its upstream GroupId equals the bound group ID. Treat a mismatch or missing asset as not found, without exposing another user’s asset details.

Error Behavior

Group provisioning failures and binding-store failures stop the request and return an explicit service or upstream error. Authorization failures for group actions return 403. Cross-user asset IDs return the same not-found outcome as an absent asset ID.

Testing

Add focused controller and service tests for:

initial group creation and reuse for the same user and channel;
separate bindings for distinct users or channels;
concurrent initial requests converging on one persisted binding;
client-supplied GroupId and Filter.GroupIds being overwritten;
cross-user get, update, and delete attempts returning not found;
all five public group actions returning 403 only for China Mobile;
regression coverage confirming non-China-Mobile adapters preserve current group-action behavior.

Run focused controller/service tests, then the relevant package test suite.

3.4 KiB Surový Blame Historie