bert.hausmans
e3c9211e3f
Adds PurposeGuardProvider as a parallel interface to PurposeDefinition (value object stays untouched). Seven concrete providers, one per v1.0 purpose, each declaring its publish-guard list. Registry resolves and caches providers via guards_class config key. Universal guards (MaxOneIdentityKeyPerTargetEntity, AppendStrategyRequiresCollectionTarget, NoAmbiguousTrustLevels, IdentityKeyBindingsOnlyInFirstSection) wire into every purpose. The section guard is a cheap no-op when section_level_submit=false. ArtistAdvanceGuards omits RequiresIdentityKeyBinding because the artist subject is resolved via portal token, not form data. Same reasoning for supplier_intake (production_request) and the auth-based purposes. Includes a cross-cutting BindingTypeRegistryConsistencyTest that verifies tasks 5/7/8 do not contradict each other (registry ↔ guards ↔ purpose required_bindings). Refs: RFC-WS-6.md §3 (Q9, Q13) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
31 lines
1.1 KiB
PHP
31 lines
1.1 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\FormBuilder\Purposes\Guards;
|
|
|
|
use App\FormBuilder\Bindings\BindingTypeRegistry;
|
|
use App\FormBuilder\Publishing\AppendStrategyRequiresCollectionTarget;
|
|
use App\FormBuilder\Publishing\IdentityKeyBindingsOnlyInFirstSection;
|
|
use App\FormBuilder\Publishing\MaxOneIdentityKeyPerTargetEntity;
|
|
use App\FormBuilder\Publishing\NoAmbiguousTrustLevels;
|
|
use App\FormBuilder\Purposes\PurposeGuardProvider;
|
|
|
|
final readonly class ArtistAdvanceGuards implements PurposeGuardProvider
|
|
{
|
|
public function __construct(private BindingTypeRegistry $registry) {}
|
|
|
|
public function publishGuards(): array
|
|
{
|
|
return [
|
|
new MaxOneIdentityKeyPerTargetEntity(),
|
|
// Active for artist_advance — schemas may use section_level_submit
|
|
// (Guest List / Contacts / Production sections).
|
|
new IdentityKeyBindingsOnlyInFirstSection(),
|
|
new AppendStrategyRequiresCollectionTarget($this->registry),
|
|
new NoAmbiguousTrustLevels(),
|
|
// No RequiresIdentityKeyBinding — artist resolved via portal token.
|
|
];
|
|
}
|
|
}
|