ADR 0008 — Prices are the operator's

ADR 0008 — Prices are the operator's An architecture diagram generated by Archify. The catalogue is the operator's · billing:catalog is Operator: true · one billing_plans · Architecture component The catalogue is the operator's billing:catalog is Operator: true · one billing_plans httpx.OperatorPermission · AUTH_NOT_OPERATOR before the Authorizer is asked · the mechanism httpx.OperatorPermission AUTH_NOT_OPERATOR before the Authorizer is asked plan rest.Spec · OperatorWrite: true · create, update, delete under billing:catalog · the mechanism plan rest.Spec · OperatorWrite: true create, update, delete under billing:catalog tenant.Bootstrap · Operator: true · the first tenant only · no request body carries the flag · the mechanism tenant.Bootstrap · Operator: true the first tenant only · no request body carries the flag kit/app validatePermissions · route kind and manifest Operator must agree · kept true by kit/app validatePermissions route kind and manifest Operator must agree Rejected: a price list per tenant · seeded by the operator · the hole moved, not closed · Architecture component Rejected: a price list per tenant seeded by the operator · the hole moved, not closed operator grants seeded by auth · billing:catalog on admin only if tenant.Operator · Architecture component operator grants seeded by auth billing:catalog on admin only if tenant.Operator admin tenant switcher · GET /admin/tenant/tenants · OperatorPermission · Architecture component admin tenant switcher GET /admin/tenant/tenants · OperatorPermission kept by declared by set by checked by instead of declared the same way only when Operator the mechanism kept true by Legend Backend Security External

Context

  • • Before: billing_plans was a tenant-owned table written under billing:manage, the permission that also subscribes and cancels, which every tenant's own administrator holds
  • • The E5 review, from past_due, created a free plan and subscribed to it; the next renewal charged nothing and the debt vanished

Consequences

  • • One catalogue every tenant reads and only the operator writes; an edit is not retroactive because the price is stamped on the subscription
  • • One written-down exception to tenant scoping; RefuseWhileSubscribed counts under system access; rest.Spec and httpx.Resource grow OperatorWrite

Evidence

  • • go test ./modules/billing -run TestThePriceListIsTheOperators, and TestTheGeneratedScreenIsGuardedTheSameWay beside it
  • • kit/httpx proves the refusal comes before the Authorizer; kit/app refuses a route and manifest that disagree; a one-tenant operator deployment sees no difference