From d3895e9a18fb4f52ec854c23ffd0b86613e553ed Mon Sep 17 00:00:00 2001 From: Kaien Date: Sun, 9 Aug 2026 12:39:34 +0300 Subject: [PATCH] docs(proto): ResolveLinkedAccount fail-closed on ambiguous identity (FailedPrecondition); comment-only, no regen (generated doc comments drift until next regen) --- users.proto | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/users.proto b/users.proto index b96d7c8..b2a394f 100644 --- a/users.proto +++ b/users.proto @@ -27,9 +27,15 @@ service UsersService { // identity to the stable global_user_id. It NEVER creates a global user or // a linked account. // - // linked=false means the account is not linked to any global user. When - // several links exist for the same account (legacy duplicates), the oldest - // (smallest linked_account id) wins — deterministic across retries. + // Identity boundary invariant: (platform, account_id) -> at most one + // canonical global_user_id. + // - no rows -> linked=false (account not linked; nothing created) + // - one distinct global user -> that user; if several legacy link rows + // exist for the SAME user, the oldest (smallest linked_account id) wins, + // deterministic across retries + // - more than one distinct global user -> FAILS CLOSED with + // FailedPrecondition (ambiguous identity); callers must not persist + // anything under a guessed identity rpc ResolveLinkedAccount(ResolveLinkedAccountRequest) returns (ResolveLinkedAccountResponse); }