feat(drive): expose authorized typed Workspace Drive API

Hare/yoi

T-722: reuse T-721 storage/CAS/receipts with clone-bound transaction authorization against attached Server authority. Add migration 84 audited Worker read_only/read_write grants and removal/deletion fencing, member-facing ordinary access, owner-controlled grant settings, Workspace-bound decimal entry references, bounded text/binary chunks, streamed HTTP receive/download with integrity and safe headers, typed errors and generated Rust/OpenAPI/TypeScript contracts.

Validation: root cargo check; server-api 83 default / 91 typescript tests; FeatureStorage 16; Drive 31 unit + 12 integration; Workspace Server 691 library + 11 binary tests (--test-threads=4), including 9 real DB/LocalFileSystem HTTP tests for two Workers/non-owner usage, revoke during reception, concurrent CAS, response-loss receipts, chunk expiry and safe binary media. cargo fmt --all -- --check and git diff --check HEAD passed. Existing OpenAPI schemas/routes semantically unchanged; dependent TS digest projections regenerated.

This commit is contained in:

Hare

2026-10-09 00:02:09 +09:00

parent 9da79ab9f0

commit b5ea162f83

25 changed files with 6416 additions and 16 deletions

									
										crates/workspace-server/Cargo.toml
									
		+1
		
												View File
												
				@@ -11,6 +11,7 @@ name = "yoi-server"

				path = "src/main.rs"

				[dependencies]

				api-macros = { workspace = true, features = ["axum"] }

				async-trait.workspace = true

				axum = { workspace = true, features = ["ws"] }

				chrono = { version = "0.4", default-features = false, features = ["clock"] }