Guard customer-owned profile and membership transactions

Signed-off-by: Cole Speelman <crspeelman@gmail.com>
2026-09-05 00:33:24 -04:00
parent f142ac23a9
commit d476179148
12 changed files with 369 additions and 10 deletions
@@ -8,6 +8,14 @@ application concern belongs in the shared module.

 ## Gamertan accounts and commerce

+- Customer profile and membership editing requires current ownership for every
+  write, not just changes involving another owner. The existing generic methods
+  intentionally permit application-authorized delegated administrators, so an
+  application preflight alone would leave a demotion race. Explicit owner-managed
+  methods now share their transactional cores while rechecking current direct
+  ownership before any write. Tests cover stale authority and optimistic state,
+  last-owner protection, concurrent winners, and audit-failure rollback. No extra
+  passkey ceremony or database migration is needed for this invariant.
 - A customer may need both purchasing and billing access. Replacing one role at
  a time would create partial permission states and misleading audit history.
  The role-set extension commits all direct roles together with optimistic