feat(membership): accept PAT principals; add SetPATAllProjectsRole

cmd/serve.go

@@ -488,7 +488,8 @@ func buildAPIDependencies(
 	metaschemaRepository := postgres.NewMetaSchemaRepository(logger, dbc)
 	metaschemaService := metaschema.NewService(metaschemaRepository)
 
-	userPATService := userpat.NewService(logger, userPATRepo, cfg.App.PAT, organizationService, roleService, policyService, projectService, auditRecordRepository)
+	userPATService := userpat.NewService(logger, userPATRepo, cfg.App.PAT, organizationService, roleService, membershipService, projectService, auditRecordRepository)
+	membershipService.SetUserPATService(userPATService)
 	patAlertService := userpat.NewAlertService(userPATRepo, userService, organizationService, mailDialer, dbc, cfg.App.PAT.Alert, logger, auditRecordRepository)
 	auditRecordService := auditrecord.NewService(auditRecordRepository, userService, serviceUserService, sessionService, userPATService)
 

core/membership/errors.go

@@ -15,4 +15,5 @@ var (
 	ErrInvalidResourceType  = errors.New("unsupported resource type")
 	ErrInvalidGroupRole     = errors.New("role is not valid for group scope")
 	ErrLastGroupOwnerRole   = errors.New("cannot change role: this is the last owner of the group")
+	ErrPrincipalExpired     = errors.New("principal has expired")
 )