Support atomic organization role sets and owner-managed invitations

Signed-off-by: Cole Speelman <crspeelman@gmail.com>
2026-09-05 00:10:08 -04:00
parent ed0cc8ceff
commit c0986168bc
19 changed files with 1052 additions and 69 deletions
@@ -2,6 +2,25 @@

 # Changelog

+## v0.1.0-preview.23 — 2026-09-05
+
+- Add atomic direct organization role sets with optimistic binding IDs, current
+  direct-owner authorization, last-owner protection, and a single audit. Roles
+  may be combined without changing narrower or team grants.
+- Add bounded multiple-role invitations and opt-in owner-managed invitation
+  policy. Persist the required grantor authority and recheck it at acceptance,
+  together with active, fully registered users and recipient email. Suspended
+  members cannot reactivate themselves by accepting an older invitation.
+- Add SQLite schema 10 for invitation role sets and stored owner authority.
+  Legacy single-role data remains readable after explicit migration; older
+  schema-9 applications are not approved writers of the migrated database.
+  Custom repositories must implement the role-set extensions before exposing
+  these operations; there is no non-atomic fallback.
+- Include the owned-organization implementation and tests in the public-source
+  export, and compile the exported tree to catch incomplete source distributions.
+- Cover competing changes and invitation acceptance, failure rollback, stale
+  owners, unsupported adapters, and migration of legacy invitations.
+
 ## v0.1.0-preview.22 — 2026-09-04

 - Add `organizations.CreateOwnedOrganization` for atomic creation of an existing