@stackonward/cli 0.0.1 → 1.0.0

package/dist/resources/templates/go-backend/internal/common/middleware/cors.go

@@ -0,0 +1,68 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"{{module}}/internal/common/types"
+)
+
+var localDevelopmentAllowedHeaders = strings.Join([]string{
+	"Origin",
+	"Content-Type",
+	"Accept",
+	"Authorization",
+	"Checkout-Client-Nonce",
+	"Checkout-Presentation-Accept",
+	types.HeaderRequestID,
+	types.HeaderCorrelationID,
+	types.HeaderProductCode,
+	types.HeaderClientType,
+	types.HeaderClientVersion,
+	types.HeaderClientPlatform,
+	types.HeaderClientLocale,
+	types.HeaderClientTimezone,
+	types.HeaderClientTimezoneOffset,
+	types.HeaderClientScreenWidth,
+	types.HeaderClientScreenHeight,
+	types.HeaderClientViewportWidth,
+	types.HeaderClientViewportHeight,
+	types.HeaderClientColorDepth,
+	types.HeaderClientPixelRatio,
+	types.HeaderClientTouchPoints,
+	types.HeaderClientJavaEnabled,
+	types.HeaderClientJavaScriptEnabled,
+	types.HeaderClientCookiesEnabled,
+	types.HeaderDeviceID,
+	types.HeaderIdempotencyKey,
+	types.HeaderCheckoutSessionToken,
+	types.HeaderAppVersion,
+	types.HeaderReferralCode,
+	types.HeaderAttributionSource,
+	types.HeaderAttributionTouchID,
+	types.HeaderAttributionCampaignID,
+	types.HeaderXRealIP,
+	types.HeaderXForwardedFor,
+}, ", ")
+
+// CORS 返回本地开发环境的跨域中间件。
+// 生产环境由 APISIX 网关统一处理 CORS，此中间件仅用于本地联调（如 Paykit localhost:5173 → backend localhost:3010）。
+func CORS() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.Header("Access-Control-Allow-Origin", "*")
+		c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
+		c.Header("Access-Control-Allow-Headers", localDevelopmentAllowedHeaders)
+		c.Header("Access-Control-Expose-Headers", "X-Request-ID")
+		c.Header("Access-Control-Max-Age", "86400")
+
+		// 预检请求直接返回，不进入后续 handler
+		if c.Request.Method == http.MethodOptions {
+			c.AbortWithStatus(http.StatusNoContent)
+			return
+		}
+
+		c.Next()
+	}
+}

package/dist/resources/templates/go-backend/internal/common/middleware/event_context.go

@@ -0,0 +1,18 @@
+package middleware
+
+import (
+	"github.com/gin-gonic/gin"
+
+	"{{module}}/internal/core/eventbus"
+)
+
+// EventMetadataInjector 中间件：在请求入口将 EventMetadata 注入到 context 中
+// 使后续 Service 层的 EventBus.Publish 能自动携带客户端上下文（IP/UserAgent/RequestID）
+func EventMetadataInjector() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		meta := BuildEventMetadata(c)
+		ctx := eventbus.ContextWithMetadata(c.Request.Context(), meta)
+		c.Request = c.Request.WithContext(ctx)
+		c.Next()
+	}
+}

package/dist/resources/templates/go-backend/internal/common/middleware/gateway_identity.go

@@ -0,0 +1,279 @@
+package middleware
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"{{module}}/internal/common/ctxutil"
+	"{{module}}/internal/common/types"
+	"{{module}}/pkg/apierror"
+)
+
+// GatewayAuthStateChecker 定义网关鉴权态查询契约。
+//
+// 由应用装配层注入真实实现，避免共享中间件绑定具体模块。
+// 中间件层只关心“令牌是否已撤销”和“身份当前是否允许继续访问”，
+// 具体状态机判断由身份模块实现。
+type GatewayIdentityAccessMode string
+
+const (
+	// GatewayIdentityAccessModeAllowed 正常允许访问。
+	GatewayIdentityAccessModeAllowed GatewayIdentityAccessMode = "allowed"
+	// GatewayIdentityAccessModeVerificationRequired 仅允许完成邮箱验证与会话退出。
+	GatewayIdentityAccessModeVerificationRequired GatewayIdentityAccessMode = "verification_required"
+	// GatewayIdentityAccessModePendingDeletion 仅允许注销恢复相关的极少数路由。
+	GatewayIdentityAccessModePendingDeletion GatewayIdentityAccessMode = "pending_deletion"
+)
+
+type GatewayAuthStateChecker interface {
+	ResolveGatewayAuthState(ctx context.Context, req GatewayAuthStateRequest) (GatewayAuthState, error)
+}
+
+// GatewayAuthStateRequest 是边缘完成本地验签后提交给身份真相源的最小认证事实。
+type GatewayAuthStateRequest struct {
+	TokenJTI        string
+	SessionID       int64
+	IdentityID      types.IdentityID
+	UserPublicID    string
+	AuthProductCode string
+	PrincipalType   string
+}
+
+// GatewayAuthState 是身份真相源一次性裁决后的认证状态。
+type GatewayAuthState struct {
+	Active     bool
+	UserID     types.UserID
+	AccessMode GatewayIdentityAccessMode
+}
+
+// GatewayIdentity 统一完成网关透传认证事实的撤销校验和身份注入。
+//
+// 原因：
+//   - APISIX 负责边缘验签并提取 claim，服务端只消费网关透传的认证事实，避免重复解析 JWT。
+//   - 撤销态校验必须集中在共享中间件层，才能保证平台 API、管理 API 与产品 BFF 一致生效。
+//   - 将校验集中在中间件层，避免 handler/service 出现分散的重复鉴权代码。
+func GatewayIdentity(authStateChecker GatewayAuthStateChecker) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		userPublicID := strings.TrimSpace(c.GetHeader(types.HeaderUserPublicID))
+		if userPublicID == "" {
+			// 无网关注入身份视为公开路由，交由下游路由级中间件决定是否需要登录态。
+			c.Next()
+			return
+		}
+
+		if authStateChecker == nil {
+			abortWithAPIError(c, authStateUnavailable())
+			return
+		}
+
+		// X-Identity-ID 在 JWT 鉴权路径上是必填项（APISIX 从 JWT.iid 注入）。
+		// identity 是 auth source of truth：会话撤销 / 状态机判断 / RBAC 都按 identity_id 索引；
+		// 缺失 X-Identity-ID 视为 token 不完整，与 X-Token-JTI 缺省同等处理（401）。
+		// APIKey / 内部调用走公开路径分支，不会进入此分支。
+		identityIDRaw := strings.TrimSpace(c.GetHeader(types.HeaderIdentityID))
+		if identityIDRaw == "" {
+			abortWithAPIError(c, apierror.Unauthorized())
+			return
+		}
+		identityID, err := parseGatewayInt64Header(identityIDRaw)
+		if err != nil || identityID <= 0 {
+			abortWithAPIError(c, apierror.Unauthorized())
+			return
+		}
+		sessionID, err := parseGatewayInt64Header(strings.TrimSpace(c.GetHeader(types.HeaderSessionID)))
+		if err != nil {
+			abortWithAPIError(c, apierror.Unauthorized())
+			return
+		}
+
+		tokenJTI := strings.TrimSpace(c.GetHeader(types.HeaderTokenJTI))
+		if tokenJTI == "" {
+			abortWithAPIError(c, apierror.Unauthorized())
+			return
+		}
+		tokenExpiresAt, err := parseGatewayUnixHeader(strings.TrimSpace(c.GetHeader(types.HeaderTokenExpiresAt)))
+		if err != nil {
+			abortWithAPIError(c, apierror.Unauthorized())
+			return
+		}
+
+		state, err := authStateChecker.ResolveGatewayAuthState(c.Request.Context(), GatewayAuthStateRequest{
+			TokenJTI:        tokenJTI,
+			SessionID:       sessionID,
+			IdentityID:      types.IdentityID(identityID),
+			UserPublicID:    userPublicID,
+			AuthProductCode: strings.TrimSpace(c.GetHeader(types.HeaderAuthProductCode)),
+			PrincipalType:   strings.TrimSpace(c.GetHeader(types.HeaderUserType)),
+		})
+		if err != nil {
+			var apiErr *apierror.APIError
+			if errors.As(err, &apiErr) {
+				abortWithAPIError(c, apiErr)
+			} else {
+				abortWithAPIError(c, authStateUnavailable())
+			}
+			return
+		}
+		if !state.Active || !state.UserID.Valid() {
+			abortWithAPIError(c, apierror.Unauthorized())
+			return
+		}
+		if accessErr := GatewayIdentityAccessError(state.AccessMode, c.Request.Method, c.Request.URL.Path); accessErr != nil {
+			abortWithAPIError(c, accessErr)
+			return
+		}
+
+		// APISIX 只透传外部 public_id；内部 user_id 由 session 真相源解析。
+		identity := &types.UserIdentity{
+			UserID:       state.UserID,
+			UserPublicID: userPublicID,
+			IdentityID:   types.IdentityID(identityID),
+			Type:         strings.TrimSpace(c.GetHeader(types.HeaderUserType)),
+			TenantID:     strings.TrimSpace(c.GetHeader(types.HeaderTenantID)),
+		}
+		c.Set(string(types.ContextKeyUserIdentity), identity)
+		c.Set(string(types.ContextKeySessionID), sessionID)
+		c.Set(string(types.ContextKeyAccessTokenJTI), tokenJTI)
+		c.Set(string(types.ContextKeyAccessTokenExpiresAt), tokenExpiresAt)
+
+		// 桥接到 context.Context，使 Service 层可直接从 ctx 获取 identity ID。
+		ctx := ctxutil.WithIdentityID(c.Request.Context(), identityID)
+		c.Request = c.Request.WithContext(ctx)
+
+		c.Next()
+	}
+}
+
+func authStateUnavailable() *apierror.APIError {
+	return apierror.New(
+		http.StatusServiceUnavailable,
+		apierror.TypeAPI,
+		apierror.CodeServiceUnavailable,
+		"Authentication state service unavailable",
+	)
+}
+
+func parseGatewayInt64Header(value string) (int64, error) {
+	if value == "" {
+		return 0, strconv.ErrSyntax
+	}
+	return strconv.ParseInt(value, 10, 64)
+}
+
+func parseGatewayUnixHeader(value string) (time.Time, error) {
+	unixSeconds, err := parseGatewayInt64Header(value)
+	if err != nil {
+		return time.Time{}, err
+	}
+	if unixSeconds <= 0 {
+		return time.Time{}, strconv.ErrRange
+	}
+	return time.Unix(unixSeconds, 0).UTC(), nil
+}
+
+// GatewayIdentityAccessError 根据身份保障状态裁决当前请求。
+//
+// 白名单必须同时匹配 HTTP 方法和稳定路由后缀，避免公开恢复路径意外扩大为产品数据访问。
+// 未知状态按拒绝处理，确保新增身份状态不会被旧网关静默放行。
+func GatewayIdentityAccessError(mode GatewayIdentityAccessMode, method, path string) *apierror.APIError {
+	switch mode {
+	case GatewayIdentityAccessModeAllowed:
+		return nil
+	case GatewayIdentityAccessModeVerificationRequired:
+		if isVerificationRequiredAllowedRequest(method, path) {
+			return nil
+		}
+		return apierror.New(
+			http.StatusForbidden,
+			apierror.TypeAuthorization,
+			apierror.CodeAccountNotVerified,
+			"Email verification is required",
+		)
+	case GatewayIdentityAccessModePendingDeletion:
+		if isPendingDeletionAllowedRequest(method, path) {
+			return nil
+		}
+		return apierror.New(
+			http.StatusForbidden,
+			apierror.TypeAuthorization,
+			apierror.CodeAccountPendingDeletion,
+			"Account is pending deletion",
+		)
+	default:
+		return apierror.Forbidden()
+	}
+}
+
+func isVerificationRequiredAllowedRequest(method, path string) bool {
+	switch method {
+	case http.MethodGet:
+		return hasRouteSuffix(path,
+			"/users/me",
+			"/auth/user-info",
+			"/api/onex/session",
+		)
+	case http.MethodPost:
+		return hasRouteSuffix(path,
+			"/auth/verify-email",
+			"/auth/resend-verification",
+			"/auth/logout",
+			"/auth/guest/activation-requests",
+			"/auth/password-recovery/verify-code",
+			"/auth/password-recovery/exchange-link",
+			"/auth/reset-password",
+			"/auth/reset-password/confirm",
+		)
+	default:
+		return false
+	}
+}
+
+func isPendingDeletionAllowedRequest(method, path string) bool {
+	if method != http.MethodPost {
+		return false
+	}
+	return hasRouteSuffix(path,
+		"/deletion/cancel",
+		"/account/deletion/cancel",
+		"/auth/logout",
+	)
+}
+
+func hasRouteSuffix(path string, suffixes ...string) bool {
+	for _, suffix := range suffixes {
+		if path == suffix || strings.HasSuffix(path, suffix) {
+			return true
+		}
+	}
+	return false
+}
+
+// RequireIdentity 路由级中间件，要求请求必须包含已认证的用户身份
+// 用于受保护路由组，替代 JwtAuth
+func RequireIdentity() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		identity := GetUserIdentity(c)
+		if identity == nil {
+			abortWithAPIError(c, apierror.Unauthorized())
+			return
+		}
+		c.Next()
+	}
+}
+
+// RequireAuthenticatedPrincipal 路由级中间件，要求请求包含人类身份或服务账号主体。
+func RequireAuthenticatedPrincipal() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if !hasAuthenticatedPrincipal(c) {
+			abortWithAPIError(c, apierror.Unauthorized())
+			return
+		}
+		c.Next()
+	}
+}

package/dist/resources/templates/go-backend/internal/common/middleware/helpers.go

@@ -0,0 +1,159 @@
+package middleware
+
+import (
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"go.opentelemetry.io/otel/trace"
+
+	"{{module}}/internal/common/types"
+	"{{module}}/internal/core/eventbus"
+)
+
+// GetUserIdentity 从 gin.Context 获取网关注入的用户身份
+func GetUserIdentity(c *gin.Context) *types.UserIdentity {
+	v, ok := c.Get(string(types.ContextKeyUserIdentity))
+	if !ok {
+		return nil
+	}
+	identity, ok := v.(*types.UserIdentity)
+	if !ok {
+		return nil
+	}
+	return identity
+}
+
+// GetUserID 返回业务用户 ID（由 session 真相源解析）。
+//
+// 适用所有业务场景：订阅、订单、积分、权益、生成、签到等。
+// 返回强类型 types.UserID，编译期阻止与 IdentityID 混用；未认证返回 0（IsZero）。
+func GetUserID(c *gin.Context) types.UserID {
+	identity := GetUserIdentity(c)
+	if identity == nil {
+		return 0
+	}
+	return identity.UserID
+}
+
+// GetUserPublicID 返回外部可见用户 ID（来自 JWT.sub，APISIX 注入的 X-User-Public-ID header）。
+func GetUserPublicID(c *gin.Context) string {
+	identity := GetUserIdentity(c)
+	if identity == nil {
+		return ""
+	}
+	return identity.UserPublicID
+}
+
+// GetIdentityID 返回认证身份 ID（来自 JWT.iid，APISIX 注入的 X-Identity-ID header）。
+//
+// 仅 auth domain 内部使用：token 撤销 / 刷新、MFA 配置、登录审计、多 provider account linking。
+// 业务侧（订阅、订单、权益、生成）禁止使用此函数，须改用 GetUserID。
+// 未认证或非 JWT 路径（如 APIKey）返回 0（IsZero）。
+func GetIdentityID(c *gin.Context) types.IdentityID {
+	identity := GetUserIdentity(c)
+	if identity == nil {
+		return 0
+	}
+	return identity.IdentityID
+}
+
+// GetSessionID 从 gin.Context 获取网关注入的会话 ID
+func GetSessionID(c *gin.Context) (int64, bool) {
+	v, ok := c.Get(string(types.ContextKeySessionID))
+	if !ok {
+		return 0, false
+	}
+	sessionID, ok := v.(int64)
+	if !ok || sessionID <= 0 {
+		return 0, false
+	}
+	return sessionID, true
+}
+
+// GetAccessTokenJTI 从 gin.Context 获取网关注入的访问令牌 JTI
+func GetAccessTokenJTI(c *gin.Context) (string, bool) {
+	v, ok := c.Get(string(types.ContextKeyAccessTokenJTI))
+	if !ok {
+		return "", false
+	}
+	jti, ok := v.(string)
+	if !ok || strings.TrimSpace(jti) == "" {
+		return "", false
+	}
+	return strings.TrimSpace(jti), true
+}
+
+// GetAccessTokenExpiresAt 从 gin.Context 获取网关注入的访问令牌过期时间
+func GetAccessTokenExpiresAt(c *gin.Context) (time.Time, bool) {
+	v, ok := c.Get(string(types.ContextKeyAccessTokenExpiresAt))
+	if !ok {
+		return time.Time{}, false
+	}
+	expiresAt, ok := v.(time.Time)
+	if !ok || expiresAt.IsZero() {
+		return time.Time{}, false
+	}
+	return expiresAt, true
+}
+
+// GetProductCode 从 gin.Context 获取产品标识
+func GetProductCode(c *gin.Context) types.Product {
+	v, ok := c.Get(string(types.ContextKeyProductCode))
+	if !ok {
+		return ""
+	}
+	code, ok := v.(types.Product)
+	if !ok {
+		return ""
+	}
+	return code
+}
+
+// GetClientContext 从 gin.Context 获取客户端上下文信息
+func GetClientContext(c *gin.Context) *types.ClientContext {
+	v, ok := c.Get(string(types.ContextKeyClientContext))
+	if !ok {
+		return nil
+	}
+	ctx, ok := v.(*types.ClientContext)
+	if !ok {
+		return nil
+	}
+	return ctx
+}
+
+// BuildEventMetadata 从 gin.Context 构建包含客户端上下文的 EventMetadata
+// 供 Service 层在 Publish 事件时使用，确保审计系统能获取 HTTP 上下文信息
+func BuildEventMetadata(c *gin.Context) *eventbus.EventMetadata {
+	meta := &eventbus.EventMetadata{}
+
+	// 提取业务用户 ID（事件元数据消费方仍是 int64，显式 .Int64() 转换避免 implicit conversion）
+	if identity := GetUserIdentity(c); identity != nil {
+		meta.UserID = identity.UserID.Int64()
+	}
+
+	// 提取租户 ID
+	meta.TenantID = GetTenantID(c)
+
+	// 提取分布式追踪 ID（从 OTel span context）
+	if span := trace.SpanFromContext(c.Request.Context()); span.SpanContext().IsValid() {
+		meta.TraceID = span.SpanContext().TraceID().String()
+	}
+
+	// 注入客户端上下文到 Extra
+	var ip, deviceID string
+	if cc := GetClientContext(c); cc != nil {
+		ip = cc.IP
+		deviceID = cc.DeviceID
+	}
+	meta.WithClientContext(
+		ip,
+		c.Request.UserAgent(),
+		deviceID,
+		GetRequestID(c),
+		string(GetProductCode(c)),
+	)
+
+	return meta
+}

package/dist/resources/templates/go-backend/internal/common/middleware/iam_delegated_route_permission.go

@@ -0,0 +1,171 @@
+package middleware
+
+import (
+	"context"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"{{module}}/internal/common/internalapi"
+	"{{module}}/internal/common/types"
+	iamdomain "{{module}}/internal/integrations/onex/iam"
+	"{{module}}/pkg/apierror"
+)
+
+// DelegatedResourceAuthorizer 在常规资源授权能力上增加双主体当前态解析。
+type DelegatedResourceAuthorizer interface {
+	ResourceAuthorizer
+	ResolvePrincipalByID(ctx context.Context, principalID int64) (*iamdomain.PrincipalRecord, error)
+}
+
+// RequireDelegatedInternalRouteResourcePermission 对 actor 与 human 执行相同动作的权限交集裁决。
+func RequireDelegatedInternalRouteResourcePermission(
+	authz DelegatedResourceAuthorizer,
+	policies internalapi.RoutePermissionPolicySet,
+) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if authz == nil {
+			abortWithAPIError(c, apierror.Internal("Authorization service is not configured"))
+			return
+		}
+		access := GetIAMDelegatedAccessContext(c)
+		if access == nil || access.Actor == nil {
+			abortWithAPIError(c, apierror.Unauthorized("Delegated access context is required"))
+			return
+		}
+		key, err := internalapi.CanonicalRoutePermissionKey(c.Request.Method, c.FullPath())
+		if err != nil {
+			abortWithAPIError(c, apierror.Forbidden("Internal route permission policy is not registered"))
+			return
+		}
+		policy, ok := policies[key]
+		if !ok {
+			abortWithAPIError(c, apierror.Forbidden("Internal route permission policy is not registered"))
+			return
+		}
+		actor, err := authz.ResolvePrincipalByID(c.Request.Context(), access.Actor.PrincipalID)
+		if err != nil || !delegatedActorPrincipalMatches(actor, access) {
+			abortWithAPIError(c, apierror.Forbidden("Delegated actor authority is unavailable"))
+			return
+		}
+		human, err := authz.ResolvePrincipalByID(c.Request.Context(), access.HumanPrincipalID)
+		if err != nil || !delegatedHumanPrincipalMatches(human, access) {
+			abortWithAPIError(c, apierror.Forbidden("Delegated human authority is unavailable"))
+			return
+		}
+
+		resourceARN := resolveResourceTemplate(c, policy.Resource)
+		requestID := strings.TrimSpace(GetRequestID(c))
+		if requestID == "" {
+			abortWithAPIError(c, apierror.Internal("Request identity is unavailable"))
+			return
+		}
+		workspace := iamdomain.WorkspaceContext{
+			ProductCode:     access.ProductCode,
+			OrganizationRef: access.OrganizationRef,
+		}
+		request := iamdomain.RequestContext{
+			RequestID:      requestID,
+			IdempotencyKey: c.GetHeader(types.HeaderIdempotencyKey),
+			UserAgent:      c.Request.UserAgent(),
+			Method:         c.Request.Method,
+			Action:         policy.Action,
+			SourceIP:       ResolveTrustedClientIP(c),
+			RouteName:      c.FullPath(),
+		}
+		resource := iamdomain.ResourceContext{ARN: resourceARN, OwnerScope: access.OrganizationRef}
+		actorContext, err := authz.AssembleAdminAccessContext(c.Request.Context(), actor, iamdomain.AdminAccessContextInput{
+			Principal: iamdomain.PrincipalContext{SourceIP: request.SourceIP},
+			Workspace: workspace,
+			Request:   request,
+			Resource:  resource,
+		})
+		if err != nil {
+			abortWithAPIError(c, apierror.Internal("Delegated actor authorization context is invalid"))
+			return
+		}
+		actorID := actor.ID
+		humanContext, err := authz.AssembleAdminAccessContext(c.Request.Context(), human, iamdomain.AdminAccessContextInput{
+			Principal: iamdomain.PrincipalContext{SourceIP: request.SourceIP, DelegatedBy: &actorID},
+			Workspace: workspace,
+			Request:   request,
+			Resource:  resource,
+		})
+		if err != nil {
+			abortWithAPIError(c, apierror.Internal("Delegated human authorization context is invalid"))
+			return
+		}
+
+		actorRequest := iamdomain.EvaluateRequest{
+			PrincipalID: actor.ID,
+			Action:      policy.Action,
+			Resource:    resourceARN,
+			Context:     actorContext,
+		}
+		humanRequest := iamdomain.EvaluateRequest{
+			PrincipalID: human.ID,
+			Action:      policy.Action,
+			Resource:    resourceARN,
+			Context:     humanContext,
+		}
+		actorDecision, err := authz.Evaluate(c.Request.Context(), actorRequest)
+		if err != nil {
+			abortWithAPIError(c, apierror.Internal("Delegated actor authorization failed"))
+			return
+		}
+		humanDecision, err := authz.Evaluate(c.Request.Context(), humanRequest)
+		if err != nil {
+			abortWithAPIError(c, apierror.Internal("Delegated human authorization failed"))
+			return
+		}
+		logAccessDecision(c.Request.Context(), authz, actorRequest, actorDecision, policy.DecisionLogRisk)
+		logAccessDecision(c.Request.Context(), authz, humanRequest, humanDecision, policy.DecisionLogRisk)
+		if !actorDecision.Allowed || !humanDecision.Allowed {
+			decision := actorDecision
+			if actorDecision.Allowed {
+				decision = humanDecision
+			}
+			SetResourcePermissionDecision(c, ResourcePermissionDecision{
+				Action: policy.Action, Resource: resourceARN, Allowed: false,
+				ReasonCode: decision.ReasonCode, ReasonKind: string(decision.ReasonKind), PrincipalID: human.ID,
+			})
+			abortWithAPIError(c, apierror.Forbidden("Forbidden: "+decision.ReasonCode))
+			return
+		}
+
+		actorScope, err := authz.ResolveScope(c.Request.Context(), actor.ID, policy.Action, workspace)
+		if err != nil {
+			abortWithAPIError(c, apierror.Internal("Delegated actor scope resolution failed"))
+			return
+		}
+		humanScope, err := authz.ResolveScope(c.Request.Context(), human.ID, policy.Action, workspace)
+		if err != nil {
+			abortWithAPIError(c, apierror.Internal("Delegated human scope resolution failed"))
+			return
+		}
+		intersection := humanScope.Narrow(actorScope)
+		decision := ResourcePermissionDecision{
+			Action: policy.Action, Resource: resourceARN, Allowed: true,
+			ReasonCode: iamdomain.ReasonAllowed, ReasonKind: string(iamdomain.ReasonKindAuthorization),
+			PrincipalID: human.ID, ScopeConstraintSummary: summarizeScopeConstraint(intersection),
+		}
+		SetResourcePermissionDecision(c, decision)
+		SetScopeConstraint(c, intersection)
+		SetScopePrincipalID(c, human.ID)
+		c.Request = c.Request.WithContext(withAdminAccessContext(c.Request.Context(), humanContext))
+		c.Next()
+	}
+}
+
+func delegatedActorPrincipalMatches(principal *iamdomain.PrincipalRecord, access *DelegatedAccessContext) bool {
+	return principal != nil && principal.IsActive && principal.ID == access.Actor.PrincipalID &&
+		principal.PrincipalNo == access.Actor.PrincipalNo && principal.Version == access.Actor.PrincipalVersion &&
+		principal.PrincipalType == string(iamdomain.PrincipalTypeServiceAccount)
+}
+
+func delegatedHumanPrincipalMatches(principal *iamdomain.PrincipalRecord, access *DelegatedAccessContext) bool {
+	return principal != nil && principal.IsActive && principal.ID == access.HumanPrincipalID &&
+		principal.PrincipalNo == access.HumanPrincipalNo && principal.Version == access.HumanPrincipalVersion &&
+		principal.PrincipalType == string(iamdomain.PrincipalTypeHumanUser) && principal.IdentityID != nil &&
+		*principal.IdentityID == access.IdentityID
+}