Merge branch 'main' into claude/ci-affected-rung2

Author: fforootd

.changeset/authz-mvp-storage.md

@@ -0,0 +1,5 @@
+---
+"@zitadel/server": minor
+---
+
+Add authorization MVP storage: resource_scope_index, system catalog seed, assignments, membership edges, and dual-write hooks.

docs/adrs/032-permission-catalogs.md

@@ -398,11 +398,19 @@ policies without reintroducing hard-coded levels and special cases.
 ## Follow-ups
 
 1. Design relational migrations for catalogs, permission/relation
-   definitions, expression edges, and assignments shared by both catalogs.
-   (Catalog-specific tables — `resource_scope_index` and app grants — are
+   definitions, expression edges / relation references, and assignments
+   shared by both catalogs.
+   Wave 0 DDL spike and locked decisions:
+   [`docs/design/api/permission-storage.md`](../design/api/permission-storage.md)
+   (implementation tracked by [issue #422](https://github.com/zitadel/nextgen/issues/422)).
+   Wave 1 (#422) ships `authz_expression_edges` + `authz_relation_references`
+   as compiled #720 storage (superseding the Wave 0 D5/D14 “relations+closure
+   only” deferral for MVP); bundle tables remain unfilled by the v1 mapper.
+   Catalog-specific tables — `resource_scope_index` and app grants — are
    tracked in [ADR 033](033-internal-permission-management.md) and
    [ADR 034](034-external-permission-management.md); staff/support grant
-   tables are tracked by [issue #333](https://github.com/zitadel/nextgen/issues/333).)
+   product is tracked by [issue #333](https://github.com/zitadel/nextgen/issues/333)
+   (storage depiction in the Wave 0 / Wave 1 doc).
 2. Add resolver conformance tests that compare single-resource checks and
    list predicates across PostgreSQL and Spanner.
 3. Validate the Leopard-style flattening approach for relation closure

docs/adrs/033-internal-permission-management.md

@@ -267,7 +267,10 @@ scoped SQL query against data we already own.
    types. Canonical names live in
    [`docs/design/api/system-permission-catalog.md`](../design/api/system-permission-catalog.md).
 2. Design relational migrations for `resource_scope_index` and agent
-   delegation tables.
+   delegation columns on `authz_assignments` (D2 — not sibling delegation
+   tables). Wave 0 DDL spike and locked decisions:
+   [`docs/design/api/permission-storage.md`](../design/api/permission-storage.md)
+   (implementation tracked by [issue #422](https://github.com/zitadel/nextgen/issues/422)).
 3. Update OpenAPI security declarations to use the final permission names.
 4. Define agent delegation schema, audit record shape, and denial
    explanation fields.

docs/adrs/047-dialect-id-generation.md

@@ -64,6 +64,7 @@ the dialect generator is the only mint path, not that create always overwrites.
 | user TOTP row | `utotp` |
 | user recovery codes row | `urc` |
 | user passkey row | `upk` |
+| authz assignment | `asgn` |
 
 Existing style mix (`brnd` / `flowdef` / `enc_key` / `upw`) stays until a
 dedicated rename PR. Do not add more without the selection rules below.

docs/design/api/README.md

@@ -30,8 +30,9 @@ Individual decisions are marked inline in each doc:
 4. [`conventions.md`](conventions.md) — IDs, errors, pagination, idempotency A/B split, capabilities split, header-based versioning.
 5. [`authn-and-auth-flows.md`](authn-and-auth-flows.md) — auth_attempts state machine, OIDC adapter, SSR handoff.
 6. [`authz.md`](authz.md) — credential × scope × permission.
-7. [`security-and-origins.md`](security-and-origins.md) — environment-gated origin wildcards, CORS, CSRF.
-8. [`resource-map.md`](resource-map.md) — the full endpoint surface grouped by concern.
+7. [`permission-storage.md`](permission-storage.md) — Wave 0 relational DDL for catalogs, assignments, membership edges, and `resource_scope_index` (feeds issue #422).
+8. [`security-and-origins.md`](security-and-origins.md) — environment-gated origin wildcards, CORS, CSRF.
+9. [`resource-map.md`](resource-map.md) — the full endpoint surface grouped by concern.
 
 ## Sibling doc sets
 

docs/design/api/authz.md

@@ -27,7 +27,7 @@ Permission is denied before any resource content is fetched. Enumeration oracles
 
 | Principal | Identifier | Scope semantics |
 |---|---|---|
-| **user** (user token) | `user_id` | Resolved against `team_memberships` and project grants for the project the user lives in. |
+| **user** (user token) | `user_id` | FGA membership checks use `authz_membership_edges` (dual-written from `team_memberships`); see D3 in [`permission-storage.md`](permission-storage.md). Roster/`team_memberships` stay lifecycle-adjacent only. |
 | **`sk_proj_…`** (claimed) | `project_id`, `team_id` (owning team) | Project-wide. |
 | **`sk_proj_…`** (pre-claim) | `project_id`, `pre_claim: true` | Project-wide against an unclaimed project. |
 | **`sk_proj_…`** (origin-scoped) | `project_id`, `origin_patterns` | Project-wide, gated on request `Origin` matching a pattern. |
@@ -73,8 +73,8 @@ marks that user as team-owned.
 
 The decision engine answers `can principal P perform action A on resource R?` considering:
 
-- Direct permission grants.
-- Role assignments through team_memberships.
+- Direct permission grants (`authz_assignments`).
+- Team usersets via `authz_membership_edges` and relation closure (see [`permission-storage.md`](permission-storage.md)); `team_memberships` is roster/lifecycle only, not the check fact source.
 - Credential-class allowlists (especially `sk_team_`).
 - Resource-scope constraints (`origin_patterns`, project/team boundary, etc.).
 
@@ -97,3 +97,4 @@ Both "ID does not exist" and "authorisation fails" return **404 Not Found**. Thi
 - [`url-architecture.md`](url-architecture.md) — scope resolution that runs before the permission check
 - [`resource-map.md`](resource-map.md) — endpoint surface inventory
 - [`system-permission-catalog.md`](system-permission-catalog.md) — canonical permission names, bundles, and per-resource permission matrix
+- [`permission-storage.md`](permission-storage.md) — Wave 0 relational DDL, dual-write membership edges, and check SQL shape