feat(database): Wave 1 authz MVP storage (#422) (#677)

<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
## Summary

Wave 1 authz MVP storage on top of Wave 0 (#666): Goose migrations for
the six tables, dual-write resource-scope identifiers + membership edges
from existing project/team/user/membership statements, and
`PersistCatalogVersion` for compiler `CatalogMutations` (#720). SQLite
gets the same schema and dual-write path for local parity.

Review / maintainability follow-ups:
- Membership-edge deletes use one `DeleteAuthzMembershipEdges(filter)`
API (kept `ForTeamDeactivate` for the subquery).
- Shared `dialect/authz` holds multi-write user helpers,
`MembershipEdgeSchema`, and catalog row builders (engines keep SQL).
Removed the three identical dual-write adapter files and identity
wrappers.
- Typed authz discriminators (including DDL-aligned principal types),
assignment scope constructors, and `AuthzMembershipEdgeKey`.
- Spanner `activeUniqueKey` lives in Spanner storage (not domain).
- Spanner membership-edge upsert uses a `created_at` no-op update (PK
updates rejected).
- Authz enum SQL parameters bind via `.String()` (matching
`MembershipStatus`), including sibling ResourceKind/CatalogKind binds.
- Spanner nullable authz params bind via `spannerNullString` /
`spannerNullTime` (not Go pointers).
- `CreateAuthzAssignment` mints empty IDs via `ensureManagedID`
(`PrefixAuthzAssignment` / `asgn_`).
- `GetAuthzCatalog` loads a persisted catalog + projected rows; deep
Persist round-trip asserts live in `stmttest` (all dialects). Seeded
`viewer→admin` closure depth is 2; Spanner relation-reference columns
have DEFAULTs.
- `authz_membership_edges` has Wave 0 set FK `(project_id, set_id) →
teams` + MVP `CHECK (user∈team)` with `ON DELETE CASCADE` on **all**
dialects (Spanner matched to Postgres/SQLite). `stmttest`
`DeleteTeamCascadesEdges` asserts hard-deleting a team removes edges on
every engine.

## Validation

```sh
go generate ./internal/service/
go test ./internal/domain/ ./internal/service/ ./internal/storage/v2/dialect/authz/ ./internal/storage/v2/dialect/spanner/ -run ActiveUniqueKey
go test -tags sqlite_integration ./internal/storage/v2/stmttest/ -run 'Authz|PersistCatalog|DualWrite'
go test -tags postgres_integration ./internal/storage/v2/stmttest/ ./internal/storage/v2/dialect/postgres/ -run 'Authz|PersistCatalog|CatalogSeed|DualWrite'
```

Postgres + SQLite green (including `DeleteTeamCascadesEdges`). Spanner
compile-checked + ActiveUniqueKey unit tests; full emulator coverage via
CI `server:test-spanner`.

## Release notes / changeset

Changeset already present: `.changeset/authz-mvp-storage.md`
(`@zitadel/server` minor). Review/maintainability follow-ups are Go
storage/API-shape refactors — no additional changeset.

## Notes

- Stacked on Wave 0 (`cursor/permission-storage-wave0-6e44` / #666).
- Re-synced with rewritten Wave 0 tip after main (`7f696931`): kept Wave
1 shipped schema; folded Wave 0 RSI MATCH SIMPLE + delete notes and
`system-permission-catalog` see-also link. Skipped Wave 0 `grantor_type`
null CHECK (not in Wave 1 migrations).
- Out of scope: resolver (#423), Leopard, filling bundles, #420
auto-compile, Filter support for team-deactivate subqueries, splitting a
second `dialect/authz*` package.

<!-- CURSOR_AGENT_PR_BODY_END -->

<div><a
href="https://cursor.com/agents/bc-9a29c97f-a069-4f09-9bec-244a599e3354?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/background-agent?bcId=bc-9a29c97f-a069-4f09-9bec-244a599e3354&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Silvan <adlerhurst@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: 3 people

.changeset/authz-mvp-storage.md

@@ -0,0 +1,5 @@
+---
+"@zitadel/server": minor
+---
+
+Add authorization MVP storage: resource_scope_index, system catalog seed, assignments, membership edges, and dual-write hooks.

docs/adrs/032-permission-catalogs.md

@@ -398,18 +398,19 @@ policies without reintroducing hard-coded levels and special cases.
 ## Follow-ups
 
 1. Design relational migrations for catalogs, permission/relation
-   definitions, and assignments shared by both catalogs.
+   definitions, expression edges / relation references, and assignments
+   shared by both catalogs.
    Wave 0 DDL spike and locked decisions:
    [`docs/design/api/permission-storage.md`](../design/api/permission-storage.md)
    (implementation tracked by [issue #422](https://github.com/zitadel/nextgen/issues/422)).
-   Wave 0 defers `authz_expression_edges` (D5); live catalog rows are
-   `authz_relations` + `authz_relation_closure` until
-   [issue #421](https://github.com/zitadel/nextgen/issues/421).
+   Wave 1 (#422) ships `authz_expression_edges` + `authz_relation_references`
+   as compiled #720 storage (superseding the Wave 0 D5/D14 “relations+closure
+   only” deferral for MVP); bundle tables remain unfilled by the v1 mapper.
    Catalog-specific tables — `resource_scope_index` and app grants — are
    tracked in [ADR 033](033-internal-permission-management.md) and
    [ADR 034](034-external-permission-management.md); staff/support grant
    product is tracked by [issue #333](https://github.com/zitadel/nextgen/issues/333)
-   (storage depiction in the Wave 0 doc).
+   (storage depiction in the Wave 0 / Wave 1 doc).
 2. Add resolver conformance tests that compare single-resource checks and
    list predicates across PostgreSQL and Spanner.
 3. Validate the Leopard-style flattening approach for relation closure

docs/adrs/047-dialect-id-generation.md

@@ -64,6 +64,7 @@ the dialect generator is the only mint path, not that create always overwrites.
 | user TOTP row | `utotp` |
 | user recovery codes row | `urc` |
 | user passkey row | `upk` |
+| authz assignment | `asgn` |
 
 Existing style mix (`brnd` / `flowdef` / `enc_key` / `upw`) stays until a
 dedicated rename PR. Do not add more without the selection rules below.

docs/design/api/permission-storage.md

@@ -1,6 +1,8 @@
 package compiler
 
-import "github.com/zitadel/nextgen/internal/authz"
+import (
+	"github.com/zitadel/nextgen/internal/authz"
+)
 
 // Relation identifies one relation on one object type.
 type Relation struct {

internal/authz/compiler/output.go

@@ -0,0 +1,308 @@
+package domain
+
+import (
+	"time"
+)
+
+// System catalog identity (must match Goose seed).
+const (
+	SystemCatalogID      = "cat_sys_1"
+	SystemCatalogOwnerID = "system"
+)
+
+// PrefixAuthzAssignment is the dialect-minted ID prefix for authz_assignments (asgn_<opaque>).
+const PrefixAuthzAssignment ResourcePrefix = "asgn"
+
+// ResourceKind is the resource_scope_index.resource_kind discriminator.
+type ResourceKind string
+
+const (
+	ResourceKindProject ResourceKind = "project"
+	ResourceKindTeam    ResourceKind = "team"
+	ResourceKindUser    ResourceKind = "user"
+)
+
+func (k ResourceKind) String() string { return string(k) }
+
+// AuthzMemberType is authz_membership_edges.member_type.
+type AuthzMemberType string
+
+const (
+	AuthzMemberTypeUser AuthzMemberType = "user"
+)
+
+func (t AuthzMemberType) String() string { return string(t) }
+
+// AuthzSetType is authz_membership_edges.set_type.
+type AuthzSetType string
+
+const (
+	AuthzSetTypeTeam AuthzSetType = "team"
+)
+
+func (t AuthzSetType) String() string { return string(t) }
+
+// AuthzCatalogKind is authz_catalogs.catalog_kind.
+type AuthzCatalogKind string
+
+const (
+	AuthzCatalogKindSystem   AuthzCatalogKind = "system"
+	AuthzCatalogKindAppGroup AuthzCatalogKind = "app_group"
+)
+
+func (k AuthzCatalogKind) String() string { return string(k) }
+
+// AuthzCatalogStatus is authz_catalogs.status.
+type AuthzCatalogStatus string
+
+const (
+	AuthzCatalogStatusDraft   AuthzCatalogStatus = "draft"
+	AuthzCatalogStatusActive  AuthzCatalogStatus = "active"
+	AuthzCatalogStatusRetired AuthzCatalogStatus = "retired"
+)
+
+func (s AuthzCatalogStatus) String() string { return string(s) }
+
+// AuthzRelationKind is authz_relations.kind.
+type AuthzRelationKind string
+
+const (
+	AuthzRelationKindRelation   AuthzRelationKind = "relation"
+	AuthzRelationKindPermission AuthzRelationKind = "permission"
+)
+
+func (k AuthzRelationKind) String() string { return string(k) }
+
+// AuthzPrincipalType is authz_assignments.principal_type (no project principals; see D13).
+type AuthzPrincipalType string
+
+const (
+	AuthzPrincipalTypeUser   AuthzPrincipalType = "user"
+	AuthzPrincipalTypeTeam   AuthzPrincipalType = "team"
+	AuthzPrincipalTypeAgent  AuthzPrincipalType = "agent"
+	AuthzPrincipalTypeSKProj AuthzPrincipalType = "sk_proj"
+	AuthzPrincipalTypeSKTeam AuthzPrincipalType = "sk_team"
+)
+
+func (t AuthzPrincipalType) String() string { return string(t) }
+
+// AuthzScopeKind is authz_assignments.scope_kind.
+type AuthzScopeKind string
+
+const (
+	AuthzScopeKindProject  AuthzScopeKind = "project"
+	AuthzScopeKindTeam     AuthzScopeKind = "team"
+	AuthzScopeKindResource AuthzScopeKind = "resource"
+)
+
+func (k AuthzScopeKind) String() string { return string(k) }
+
+// AuthzCatalogVersion is the catalog row metadata written with a compiled
+// CatalogMutations payload (see PersistCatalogVersion).
+type AuthzCatalogVersion struct {
+	ID          string
+	CatalogKind AuthzCatalogKind
+	OwnerID     string
+	Version     int
+	SourceHash  *string
+}
+
+// AuthzCatalog is one persisted catalog version plus its projected relation
+// rows (authz_relations / references / expression_edges / relation_closure).
+type AuthzCatalog struct {
+	ID          string
+	CatalogKind AuthzCatalogKind
+	OwnerID     string
+	Version     int
+	Status      AuthzCatalogStatus
+	SourceHash  *string
+	Relations   []AuthzRelation
+	References  []AuthzRelationReference
+	Edges       []AuthzExpressionEdge
+	Closure     []AuthzRelationClosure
+}
+
+// AuthzRelation is one authz_relations row.
+type AuthzRelation struct {
+	ObjectType string
+	Relation   string
+	Kind       AuthzRelationKind
+}
+
+// AuthzRelationReference is one authz_relation_references row.
+type AuthzRelationReference struct {
+	ObjectType  string
+	Relation    string
+	RefType     string
+	RefRelation string
+	Wildcard    bool
+	Condition   string
+	Position    int
+}
+
+// AuthzExpressionEdge is one authz_expression_edges row.
+// Kind is the CHECK value: direct | computed_userset | tuple_to_userset.
+type AuthzExpressionEdge struct {
+	ObjectType         string
+	Relation           string
+	Kind               string
+	SourceObjectType   *string
+	SourceRelation     *string
+	TuplesetObjectType *string
+	TuplesetRelation   *string
+	Position           int
+}
+
+// AuthzRelationClosure is one authz_relation_closure row.
+type AuthzRelationClosure struct {
+	FromObjectType string
+	FromRelation   string
+	ToObjectType   string
+	ToRelation     string
+	Depth          int
+}
+
+// ResourceScope maps a globally addressable resource id to project/team scope
+// (resource_scope_index). Answers "where does this path.id live?" for middleware
+// and the future resolver — not a permission grant.
+type ResourceScope struct {
+	ResourceID   string
+	ResourceKind ResourceKind
+	ProjectID    string
+	TeamID       *string
+	CreatedAt    time.Time
+	UpdatedAt    time.Time
+}
+
+func NewProjectResourceScope(projectID string) *ResourceScope {
+	return &ResourceScope{
+		ResourceID:   projectID,
+		ResourceKind: ResourceKindProject,
+		ProjectID:    projectID,
+	}
+}
+
+func NewTeamResourceScope(projectID, teamID string) *ResourceScope {
+	id := teamID
+	return &ResourceScope{
+		ResourceID:   teamID,
+		ResourceKind: ResourceKindTeam,
+		ProjectID:    projectID,
+		TeamID:       &id,
+	}
+}
+
+func NewUserResourceScope(projectID, userID string) *ResourceScope {
+	return &ResourceScope{
+		ResourceID:   userID,
+		ResourceKind: ResourceKindUser,
+		ProjectID:    projectID,
+	}
+}
+
+// AuthzAssignmentScope encodes the CHECK-constrained scope columns.
+type AuthzAssignmentScope struct {
+	Kind       AuthzScopeKind
+	TeamID     *string
+	ResourceID *string
+}
+
+func NewProjectAssignmentScope() AuthzAssignmentScope {
+	return AuthzAssignmentScope{Kind: AuthzScopeKindProject}
+}
+
+func NewTeamAssignmentScope(teamID string) AuthzAssignmentScope {
+	id := teamID
+	return AuthzAssignmentScope{Kind: AuthzScopeKindTeam, TeamID: &id}
+}
+
+func NewResourceAssignmentScope(resourceID string) AuthzAssignmentScope {
+	id := resourceID
+	return AuthzAssignmentScope{Kind: AuthzScopeKindResource, ResourceID: &id}
+}
+
+// AuthzAssignment binds a principal to a catalog relation at an explicit scope.
+// This is a grant row for the grants API / resolver — not dual-written from
+// ordinary CreateUser/CreateTeam.
+//
+// Relation identity is (ObjectType, Relation), matching authz_relations.
+type AuthzAssignment struct {
+	ID              string
+	ProjectID       string
+	CatalogID       string
+	PrincipalType   AuthzPrincipalType
+	PrincipalID     string
+	ObjectType      string
+	Relation        string
+	ScopeKind       AuthzScopeKind
+	ScopeTeamID     *string
+	ScopeResourceID *string
+	GrantorType     *string
+	GrantorID       *string
+	DelegationID    *string
+	ExpiresAt       *time.Time
+	RevokedAt       *time.Time
+	CreatedAt       time.Time
+	UpdatedAt       time.Time
+}
+
+// ApplyScope sets the scope columns from a constructor-built scope value.
+func (a *AuthzAssignment) ApplyScope(scope AuthzAssignmentScope) {
+	a.ScopeKind = scope.Kind
+	a.ScopeTeamID = scope.TeamID
+	a.ScopeResourceID = scope.ResourceID
+}
+
+// AuthzMembershipEdge is the authz projection of set membership (not lifecycle).
+// The resolver expands team grants through these edges; team_memberships remains
+// the roster table and is not read at check time.
+type AuthzMembershipEdge struct {
+	ProjectID  string
+	MemberType AuthzMemberType
+	MemberID   string
+	SetType    AuthzSetType
+	SetID      string
+	CreatedAt  time.Time
+}
+
+// AuthzMembershipEdgeKey identifies one authz_membership_edges row.
+type AuthzMembershipEdgeKey struct {
+	ProjectID  string
+	SetType    AuthzSetType
+	SetID      string
+	MemberType AuthzMemberType
+	MemberID   string
+}
+
+func NewUserTeamMembershipEdge(projectID, teamID, userID string) *AuthzMembershipEdge {
+	return &AuthzMembershipEdge{
+		ProjectID:  projectID,
+		MemberType: AuthzMemberTypeUser,
+		MemberID:   userID,
+		SetType:    AuthzSetTypeTeam,
+		SetID:      teamID,
+	}
+}
+
+func NewUserTeamMembershipEdgeKey(projectID, teamID, userID string) AuthzMembershipEdgeKey {
+	return AuthzMembershipEdgeKey{
+		ProjectID:  projectID,
+		SetType:    AuthzSetTypeTeam,
+		SetID:      teamID,
+		MemberType: AuthzMemberTypeUser,
+		MemberID:   userID,
+	}
+}
+
+// AuthzMembershipEdgeField enumerates AuthzMembershipEdge columns for filter deletes.
+type AuthzMembershipEdgeField uint8
+
+const (
+	AuthzMembershipEdgeFieldUnspecified AuthzMembershipEdgeField = iota
+	AuthzMembershipEdgeFieldProjectID
+	AuthzMembershipEdgeFieldMemberType
+	AuthzMembershipEdgeFieldMemberID
+	AuthzMembershipEdgeFieldSetType
+	AuthzMembershipEdgeFieldSetID
+	AuthzMembershipEdgeFieldCreatedAt
+)

internal/domain/authz.go

@@ -14,6 +14,11 @@ const (
 
 func (s MembershipStatus) String() string { return string(s) }
 
+// IsAuthzActive reports whether the roster status should project an authz membership edge.
+func (s MembershipStatus) IsAuthzActive() bool {
+	return s == MembershipStatusActive
+}
+
 // RosterMembershipStatuses are the participation states that keep a user on a
 // team's roster. [MembershipStatusRemoved] is deliberately absent: a removed
 // membership is history, not roster, and roster reads must not serve it.