feat(resource): Add immutable option for project, domain, and role

Python Keystone's resource_options framework registers an `immutable`
option (id 0000) on project, domain, and role, blocking update/delete
unless a request explicitly clears it. This was previously unwired
here: the project_option/role_option DB tables existed but nothing
above the entity layer used them.

Adds ProjectOptions/RoleOptions core types, persists them through the
existing tables, exposes `options.immutable` on the v3 project, domain,
and role APIs, and enforces the block in the resource/role services
before update or delete, surfacing a 403 Forbidden.

Signed-off-by: Claude <noreply@anthropic.com>

Author: claude

crates/api-types/src/error_conv.rs

@@ -204,6 +204,7 @@ impl From<RoleProviderError> for KeystoneApiError {
             },
             ref err @ RoleProviderError::Conflict(..) => Self::Conflict(err.to_string()),
             ref err @ RoleProviderError::Validation { .. } => Self::BadRequest(err.to_string()),
+            err @ RoleProviderError::Immutable(..) => Self::forbidden(err),
             other => Self::InternalError(other.to_string()),
         }
     }
@@ -316,6 +317,7 @@ impl From<ResourceProviderError> for KeystoneApiError {
                 identifier: x,
             },
             ResourceProviderError::InvalidProjectDomain(x) => Self::BadRequest(x),
+            err @ ResourceProviderError::Immutable(..) => Self::forbidden(err),
             other => Self::InternalError(other.to_string()),
         }
     }

crates/api-types/src/v3/domain.rs

@@ -18,6 +18,7 @@ use serde::{Deserialize, Serialize};
 use validator::Validate;
 
 use crate::Link;
+pub use crate::v3::project::ProjectOptions;
 
 /// Short domain representation.
 #[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
@@ -79,6 +80,14 @@ pub struct Domain {
     /// The domain name.
     #[cfg_attr(feature = "validate", validate(length(min = 1, max = 255)))]
     pub name: String,
+
+    /// The resource options for the domain. A domain is a project with
+    /// `is_domain = true` and shares its resource options, hence the shared
+    /// `ProjectOptions` type.
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub options: Option<ProjectOptions>,
 }
 
 /// New domain data.
@@ -120,6 +129,14 @@ pub struct DomainCreate {
     /// The domain name.
     #[cfg_attr(feature = "validate", validate(length(min = 1, max = 255)))]
     pub name: String,
+
+    /// The resource options for the domain. A domain is a project with
+    /// `is_domain = true` and shares its resource options, hence the shared
+    /// `ProjectOptions` type.
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub options: Option<ProjectOptions>,
 }
 
 /// Complete response with the domain data.
@@ -174,6 +191,14 @@ pub struct DomainUpdate {
     #[cfg_attr(feature = "builder", builder(default))]
     #[cfg_attr(feature = "validate", validate(length(min = 1, max = 255)))]
     pub name: Option<String>,
+
+    /// The resource options for the domain. A domain is a project with
+    /// `is_domain = true` and shares its resource options, hence the shared
+    /// `ProjectOptions` type.
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub options: Option<ProjectOptions>,
 }
 
 /// Domain update request.

crates/api-types/src/v3/domain_conv.rs

@@ -41,12 +41,14 @@ impl From<&provider_types::Domain> for api_types::DomainShort {
 
 impl From<provider_types::Domain> for api_types::Domain {
     fn from(value: provider_types::Domain) -> Self {
+        let opts: api_types::ProjectOptions = value.options.into();
         Self {
             description: value.description,
             enabled: value.enabled,
             extra: value.extra,
             id: value.id,
             name: value.name,
+            options: opts.immutable.is_some().then_some(opts),
         }
     }
 }
@@ -59,6 +61,7 @@ impl From<api_types::DomainCreate> for provider_types::DomainCreate {
             extra: value.extra,
             id: value.id,
             name: value.name,
+            options: value.options.map(Into::into),
         }
     }
 }
@@ -71,6 +74,7 @@ impl From<api_types::DomainUpdateRequest> for provider_types::DomainUpdate {
             enabled: domain.enabled,
             extra: domain.extra,
             name: domain.name,
+            options: domain.options.map(Into::into),
         }
     }
 }

crates/api-types/src/v3/project.rs

@@ -98,12 +98,40 @@ pub struct Project {
     #[cfg_attr(feature = "validate", validate(length(min = 1, max = 255)))]
     pub name: String,
 
+    /// The resource options for the project. Available resource options are
+    /// documented in `ProjectOptions`.
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub options: Option<ProjectOptions>,
+
     /// The ID of the parent for the project.
     #[serde(skip_serializing_if = "Option::is_none")]
     #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
     pub parent_id: Option<String>,
 }
 
+/// Project resource options.
+#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(
+    feature = "builder",
+    derive(derive_builder::Builder),
+    builder(
+        build_fn(error = "crate::error::BuilderError"),
+        setter(strip_option, into)
+    )
+)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ProjectOptions {
+    /// When `true`, the project cannot be updated or deleted until an
+    /// administrator explicitly sets this back to `false`. Also used for
+    /// domains, which persist through the same underlying project.
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub immutable: Option<bool>,
+}
+
 /// New project data.
 #[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
 #[cfg_attr(
@@ -160,7 +188,13 @@ pub struct ProjectCreate {
     #[cfg_attr(feature = "validate", validate(length(min = 1, max = 255)))]
     pub name: String,
 
-    // TODO: add options
+    /// The resource options for the project. Available resource options are
+    /// documented in `ProjectOptions`.
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub options: Option<ProjectOptions>,
+
     /// The ID of the parent of the project.
     ///
     /// If specified on project creation, this places the project within a
@@ -246,6 +280,13 @@ pub struct ProjectUpdate {
     #[cfg_attr(feature = "builder", builder(default))]
     #[cfg_attr(feature = "validate", validate(length(min = 1, max = 255)))]
     pub name: Option<String>,
+
+    /// The resource options for the project. Available resource options are
+    /// documented in `ProjectOptions`.
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub options: Option<ProjectOptions>,
 }
 
 /// Project update request.

crates/api-types/src/v3/project_conv.rs

@@ -19,6 +19,22 @@ use openstack_keystone_core_types::resource as provider_types;
 
 use crate::v3::project as api_types;
 
+impl From<provider_types::ProjectOptions> for api_types::ProjectOptions {
+    fn from(value: provider_types::ProjectOptions) -> Self {
+        Self {
+            immutable: value.immutable,
+        }
+    }
+}
+
+impl From<api_types::ProjectOptions> for provider_types::ProjectOptions {
+    fn from(value: api_types::ProjectOptions) -> Self {
+        Self {
+            immutable: value.immutable,
+        }
+    }
+}
+
 impl From<provider_types::Project> for api_types::ProjectShort {
     fn from(value: provider_types::Project) -> Self {
         Self {
@@ -43,6 +59,7 @@ impl From<&provider_types::Project> for api_types::ProjectShort {
 
 impl From<provider_types::Project> for api_types::Project {
     fn from(value: provider_types::Project) -> Self {
+        let opts: api_types::ProjectOptions = value.options.into();
         Self {
             description: value.description,
             domain_id: value.domain_id,
@@ -51,6 +68,7 @@ impl From<provider_types::Project> for api_types::Project {
             id: value.id,
             is_domain: value.is_domain,
             name: value.name,
+            options: opts.immutable.is_some().then_some(opts),
             parent_id: value.parent_id,
         }
     }
@@ -66,6 +84,7 @@ impl From<api_types::ProjectCreate> for provider_types::ProjectCreate {
             id: None,
             is_domain: value.is_domain,
             name: value.name,
+            options: value.options.map(Into::into),
             parent_id: value.parent_id,
         }
     }
@@ -79,6 +98,7 @@ impl From<api_types::ProjectUpdateRequest> for provider_types::ProjectUpdate {
             enabled: project.enabled,
             extra: project.extra,
             name: project.name,
+            options: project.options.map(Into::into),
         }
     }
 }

crates/api-types/src/v3/role.rs

@@ -44,6 +44,32 @@ pub struct Role {
     #[cfg_attr(feature = "openapi", schema(inline, additional_properties))]
     #[serde(flatten)]
     pub extra: HashMap<String, Value>,
+
+    /// The resource options for the role. Available resource options are
+    /// documented in `RoleOptions`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub options: Option<RoleOptions>,
+}
+
+/// Role resource options.
+#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(
+    feature = "builder",
+    derive(derive_builder::Builder),
+    builder(
+        build_fn(error = "crate::error::BuilderError"),
+        setter(strip_option, into)
+    )
+)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct RoleOptions {
+    /// When `true`, the role cannot be updated or deleted until an
+    /// administrator explicitly sets this back to `false`.
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub immutable: Option<bool>,
 }
 
 /// The role reference data.
@@ -194,6 +220,13 @@ pub struct RoleCreate {
     #[cfg_attr(feature = "openapi", schema(inline, additional_properties))]
     #[serde(flatten)]
     pub extra: HashMap<String, Value>,
+
+    /// The resource options for the role. Available resource options are
+    /// documented in `RoleOptions`.
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub options: Option<RoleOptions>,
 }
 
 /// New role creation request.
@@ -234,6 +267,13 @@ pub struct RoleUpdate {
     #[cfg_attr(feature = "openapi", schema(inline, additional_properties))]
     #[serde(flatten)]
     pub extra: HashMap<String, Value>,
+
+    /// The resource options for the role. Available resource options are
+    /// documented in `RoleOptions`.
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub options: Option<RoleOptions>,
 }
 
 /// Role update request.

crates/api-types/src/v3/role_conv.rs

@@ -16,14 +16,32 @@ use openstack_keystone_core_types::role as provider_types;
 
 use crate::v3::role as api_types;
 
+impl From<provider_types::RoleOptions> for api_types::RoleOptions {
+    fn from(value: provider_types::RoleOptions) -> Self {
+        Self {
+            immutable: value.immutable,
+        }
+    }
+}
+
+impl From<api_types::RoleOptions> for provider_types::RoleOptions {
+    fn from(value: api_types::RoleOptions) -> Self {
+        Self {
+            immutable: value.immutable,
+        }
+    }
+}
+
 impl From<provider_types::Role> for api_types::Role {
     fn from(value: provider_types::Role) -> Self {
+        let opts: api_types::RoleOptions = value.options.into();
         Self {
             id: value.id,
             domain_id: value.domain_id,
             name: value.name,
             description: value.description,
             extra: value.extra,
+            options: opts.immutable.is_some().then_some(opts),
         }
     }
 }
@@ -65,6 +83,7 @@ impl From<api_types::RoleCreateRequest> for provider_types::RoleCreate {
             extra: value.role.extra,
             id: None,
             name: value.role.name,
+            options: value.role.options.map(Into::into),
         }
     }
 }
@@ -76,6 +95,7 @@ impl From<api_types::RoleUpdateRequest> for provider_types::RoleUpdate {
             description: role.description.map(Some),
             extra: role.extra,
             name: role.name,
+            options: role.options.map(Into::into),
         }
     }
 }

crates/cli-manage/src/bootstrap.rs

@@ -720,6 +720,7 @@ mod tests {
             domain_id: None,
             description: None,
             extra: HashMap::new(),
+            options: None,
         }
     }
 
@@ -733,6 +734,7 @@ mod tests {
             description: None,
             is_domain: false,
             extra: HashMap::new(),
+            options: None,
         }
     }
 

crates/core-types/src/auth/tests.rs

@@ -76,6 +76,7 @@ fn make_project() -> Project {
         is_domain: false,
         parent_id: None,
         extra: HashMap::new(),
+        options: Default::default(),
     }
 }
 
@@ -106,6 +107,7 @@ fn make_domain() -> Domain {
         enabled: true,
         description: None,
         extra: HashMap::new(),
+        options: Default::default(),
     }
 }
 
@@ -116,6 +118,7 @@ fn make_disabled_domain() -> Domain {
         enabled: false,
         description: None,
         extra: HashMap::new(),
+        options: Default::default(),
     }
 }
 
@@ -332,6 +335,7 @@ fn make_trust_with_roles(roles: Option<Vec<RoleRef>>) -> SecurityContext {
                     is_domain: false,
                     parent_id: None,
                     extra: HashMap::new(),
+                    options: Default::default(),
                 },
                 project_domain: make_domain(),
             })),