docs(proto): ResolveLinkedAccount fail-closed on ambiguous identity (FailedPrecondition); comment-only, no regen (generated doc comments drift until next regen)
This commit is contained in:
parent
0315e13ce0
commit
d3895e9a18
12
users.proto
12
users.proto
@ -27,9 +27,15 @@ service UsersService {
|
|||||||
// identity to the stable global_user_id. It NEVER creates a global user or
|
// identity to the stable global_user_id. It NEVER creates a global user or
|
||||||
// a linked account.
|
// a linked account.
|
||||||
//
|
//
|
||||||
// linked=false means the account is not linked to any global user. When
|
// Identity boundary invariant: (platform, account_id) -> at most one
|
||||||
// several links exist for the same account (legacy duplicates), the oldest
|
// canonical global_user_id.
|
||||||
// (smallest linked_account id) wins — deterministic across retries.
|
// - no rows -> linked=false (account not linked; nothing created)
|
||||||
|
// - one distinct global user -> that user; if several legacy link rows
|
||||||
|
// exist for the SAME user, the oldest (smallest linked_account id) wins,
|
||||||
|
// deterministic across retries
|
||||||
|
// - more than one distinct global user -> FAILS CLOSED with
|
||||||
|
// FailedPrecondition (ambiguous identity); callers must not persist
|
||||||
|
// anything under a guessed identity
|
||||||
rpc ResolveLinkedAccount(ResolveLinkedAccountRequest) returns (ResolveLinkedAccountResponse);
|
rpc ResolveLinkedAccount(ResolveLinkedAccountRequest) returns (ResolveLinkedAccountResponse);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user