feat: add deployable alpha silo

hub/src/permissions/principals.ts

@@ -1,4 +1,5 @@
 import type { PrismaClient, PrincipalType } from "@prisma/client";
+import { scopedFeishuPrincipalId } from "../feishu/identityNamespace.js";
 
 export interface PrincipalRef {
   readonly type: PrincipalType;
@@ -40,19 +41,60 @@ export interface PrincipalResolver {
 }
 
 export class PrismaPrincipalResolver implements PrincipalResolver {
-  constructor(private readonly prisma: PrismaClient) {}
+  constructor(
+    private readonly prisma: PrismaClient,
+    private readonly allowLegacyIdentity = process.env["NODE_ENV"] !== "production",
+  ) {}
 
   async resolveActor(actor: ActorInput, scope: PrincipalResolutionScope): Promise<PrincipalResolution> {
     const resolved = new PrincipalCollector();
-    resolved.add({ type: "USER", id: actor.feishuOpenId }, "actor-user");
-    if (actor.chatId !== undefined && actor.chatId !== "") {
-      resolved.add({ type: "FEISHU_CHAT", id: actor.chatId }, "context-chat");
-    }
-
-    const user = await this.prisma.user.findUnique({
-      where: { feishuOpenId: actor.feishuOpenId },
-      select: { id: true },
+    const scopedIdentity = await this.prisma.feishuUserIdentity.findFirst({
+      where: {
+        openId: actor.feishuOpenId,
+        connection: {
+          organizationId: scope.organizationId,
+          status: "ACTIVE",
+          activeSecretVersion: { retiredAt: null },
+        },
+      },
+      select: { userId: true, connectionId: true },
     });
+    // Explicit migration adapter for pre-ADR-0024 fixtures/data. Alpha Silo
+    // ingress always has an ACTIVE connection-scoped identity.
+    const user = scopedIdentity === null && this.allowLegacyIdentity
+      ? await this.prisma.user.findUnique({
+          where: { feishuOpenId: actor.feishuOpenId },
+          select: { id: true },
+        })
+      : scopedIdentity === null ? null : { id: scopedIdentity.userId };
+    const connection = await this.prisma.organizationFeishuApplicationConnection.findUnique({
+      where: { organizationId: scope.organizationId },
+      select: {
+        id: true,
+        status: true,
+        activeSecretVersion: { select: { connectionId: true, retiredAt: true } },
+      },
+    });
+    const activeConnectionId = scopedIdentity?.connectionId ?? (
+      connection?.status === "ACTIVE" && connection.activeSecretVersion !== null &&
+      connection.activeSecretVersion.connectionId === connection.id &&
+      connection.activeSecretVersion.retiredAt === null
+        ? connection.id
+        : undefined
+    );
+    if (activeConnectionId === undefined && !this.allowLegacyIdentity) {
+      throw new Error(`active Feishu Application Connection not found for organization ${scope.organizationId}`);
+    }
+    const userPrincipalId = activeConnectionId === undefined
+      ? actor.feishuOpenId
+      : scopedFeishuPrincipalId("USER", activeConnectionId, actor.feishuOpenId);
+    resolved.add({ type: "USER", id: userPrincipalId }, "actor-user");
+    if (actor.chatId !== undefined && actor.chatId !== "") {
+      const chatPrincipalId = activeConnectionId === undefined
+        ? actor.chatId
+        : scopedFeishuPrincipalId("CHAT", activeConnectionId, actor.chatId);
+      resolved.add({ type: "FEISHU_CHAT", id: chatPrincipalId }, "context-chat");
+    }
 
     if (user !== null) {
       const memberships = await this.prisma.teamMembership.findMany({