Remove retired grant directives (replaced with graphql invite links) (#2866)

Author: GregorShear

crates/agent/src/directives/grant.rs

@@ -11,7 +11,6 @@ use validator::Validate;
 pub mod accept_demo_tenant;
 pub mod beta_onboard;
 pub mod click_to_accept;
-pub mod grant;
 pub mod storage_mappings;
 
 /// JobStatus is the possible outcomes of a handled directive operation.
@@ -43,7 +42,6 @@ pub enum Directive {
     BetaOnboard(beta_onboard::Directive),
     ClickToAccept(click_to_accept::Directive),
     AcceptDemoTenant(accept_demo_tenant::Directive),
-    Grant(grant::Directive),
     StorageMappings(storage_mappings::Directive),
 }
 
@@ -134,7 +132,6 @@ impl DirectiveHandler {
             }
             Ok(Directive::ClickToAccept(d)) => click_to_accept::apply(d, row, txn).await?,
             Ok(Directive::AcceptDemoTenant(d)) => accept_demo_tenant::apply(d, row, txn).await?,
-            Ok(Directive::Grant(d)) => grant::apply(d, row, txn).await?,
             Ok(Directive::StorageMappings(d)) => {
                 storage_mappings::apply(d, row, &self.logs_tx, txn).await?
             }

crates/agent/src/directives/mod.rs

@@ -596,7 +596,7 @@ impl TestHarness {
 
     pub async fn add_user_grant(&mut self, user_id: Uuid, role: &str, capability: Capability) {
         let mut txn = self.pool.begin().await.unwrap();
-        control_plane_api::directives::grant::upsert_user_grant(
+        control_plane_api::grants::upsert_user_grant(
             user_id,
             role,
             capability,

crates/agent/src/integration_tests/harness.rs

@@ -1,6 +1,5 @@
 pub mod accept_demo_tenant;
 pub mod beta_onboard;
-pub mod grant;
 pub mod storage_mappings;
 
 use crate::TextJson;

crates/control-plane-api/src/directives/mod.rs

@@ -12,6 +12,7 @@ pub mod discovers;
 pub mod draft;
 mod envelope;
 pub mod evolutions;
+pub mod grants;
 mod interval;
 pub mod jobs;
 pub mod live_specs;

…ontrol-plane-api/src/directives/grant.rs crates/control-plane-api/src/grants.rscrates/control-plane-api/src/directives/grant.rs renamed to crates/control-plane-api/src/grants.rs crates/control-plane-api/src/directives/grant.rs renamed to crates/control-plane-api/src/grants.rs

@@ -313,7 +313,7 @@ impl InviteLinksMutation {
         }
 
         // Upsert the user grant (only upgrades capability, never downgrades).
-        crate::directives::grant::upsert_user_grant(
+        crate::grants::upsert_user_grant(
             claims.sub,
             &invite.catalog_prefix,
             invite.capability,

crates/control-plane-api/src/lib.rs

@@ -0,0 +1,23 @@
+begin;
+
+-- Phase 3: Retire grant directives.
+-- The invite links system (Phase 1a-b) has fully replaced grant directives.
+-- Drop the transitional dual-write triggers and clean up old directive rows.
+
+-- Drop triggers first, then their backing functions.
+drop trigger if exists mirror_grant_directive on public.directives;
+drop trigger if exists sync_directive_removal on public.directives;
+
+drop function if exists internal.mirror_grant_directive_to_invite_links();
+drop function if exists internal.sync_directive_removal_to_invite_links();
+
+-- Delete applied_directives for grant directives (FK will not cascade from directives).
+delete from applied_directives
+where directive_id in (
+    select id from directives where spec->>'type' = 'grant'
+);
+
+-- Delete the grant directives themselves.
+delete from directives where spec->>'type' = 'grant';
+
+commit;