feat(schedules): register agent_schedule in authz on create/delete

[harvhan]

Summary

Registers an agent_schedule resource in the authorization service on schedule
create (with the owning agent as its parent edge) and deregisters it on delete,
so schedules participate in fine-grained authorization.

Schedules have no Postgres row — Temporal is the store and the authz selector is
the schedule id ({agent_id}--{schedule_name}). The register/deregister calls
therefore live in ScheduleService, alongside the Temporal write, so the
compensation boundary can be scoped to the Temporal create only.

Behavior

• Create: register the schedule (with parent=agent) before the
  Temporal create. Unconditional and fail-closed — a register failure
  aborts the create. If the Temporal create fails after a successful register,
  a compensating deregister removes the tuple so no orphan is left. The
  post-create read-back (describe) is outside the compensation scope: a describe
  failure must not deregister a schedule that was actually created.
• Delete: deregister after the Temporal delete, best-effort (logged,
  never blocks the delete).
• No resolvable creator (agent-bypass / internal paths with neither a user
  nor service-account identity): registration is skipped with a warning and the
  schedule is still created. Interim behavior until on-behalf-of-user identity
  is threaded.

Per-account routing (which authz backend the call lands on) is owned by the
authorization service; this repo calls register/deregister unconditionally.
Follows the agent_api_key register/deregister pattern (#248), which this PR is
stacked on.

Requires

A companion change in the authorization service mapping the schedule resource
type to its SpiceDB agent_schedule definition; without it the
register/deregister call is rejected before reaching the backend.

Changes

• schedule_service.py: register-before-create + compensate-on-temporal-failure;
  best-effort deregister on delete; _register_schedule_in_auth /
  _deregister_schedule_from_auth helpers; inject the authorization service.
• authorization_types.py: add the schedule resource type + factory.
• tests/integration/services/test_schedule_service_dual_write.py: 7 cases
  (parent-edge contract, fail-closed create, compensating deregister on Temporal
  failure, read-back failure does NOT compensate, best-effort deregister on
  delete, no-creator skip).
• tests/unit/services/test_schedule_service.py: fixture updated for the new
  constructor arg.

Test plan

• pytest tests/integration/services/test_schedule_service_dual_write.py — 7/7
• pytest tests/unit/services/test_schedule_service.py — 27/27
• pytest tests/unit/use_cases/test_schedules_use_case.py — 18/18
• ruff clean

Stacked on

#248 (base branch). Rebase onto the default branch once #248 merges.

🤖 Generated with Claude Code

Greptile Summary

This PR integrates agent_schedule resources into the authorization service on create and delete, following the existing agent_api_key pattern. Register-before-create is fail-closed with a compensating deregister on Temporal failure; delete is best-effort post-Temporal.

• schedule_service.py: Injects DAuthorizationService, adds _register_schedule_in_auth (fail-closed, returns bool to drive compensation) and _deregister_schedule_from_auth (best-effort, never propagates). The post-create read-back is intentionally outside the compensation scope, which is correctly verified by a dedicated test case.
• authorization_types.py: Adds the schedule enum value and corresponding factory methods to both AgentexResource and AgentexResourceOptionalSelector, matching all existing resource types.
• Tests: 7 integration test cases cover the parent-edge contract, fail-closed create, compensating deregister, read-back-failure non-compensation, best-effort delete, and no-creator skip. Unit test fixture updated for the new constructor argument.

Confidence Score: 5/5

Safe to merge; the compensation and bypass logic are correct and all edge cases are covered by the new test suite.

The register-before-create / compensate-on-Temporal-failure contract is correctly implemented: orphan tuples are prevented on create failures, and delete is best-effort so auth never blocks a Temporal delete. The read-back exclusion from compensation scope is explicitly tested. The no-creator skip and auth-bypass paths are both handled without leaving orphan state. The 7-case integration test suite directly mirrors the documented behavior contracts.

No files require special attention.

Important Files Changed

Filename	Overview
agentex/src/api/schemas/authorization_types.py	Adds schedule to AgentexResourceType enum and factory methods to both AgentexResource and AgentexResourceOptionalSelector; directly mirrors the api_key pattern, no issues.
agentex/src/domain/services/schedule_service.py	Injects DAuthorizationService, adds register/deregister helpers with correct fail-closed/best-effort semantics, and scopes compensation to the Temporal create only (read-back is outside scope); logic is sound.
agentex/tests/integration/services/test_schedule_service_dual_write.py	New 7-case integration test file covering the full dual-write contract: parent-edge shape, fail-closed create, compensating deregister, read-back non-compensation, best-effort delete, and no-creator skip.
agentex/tests/unit/services/test_schedule_service.py	Minimal fixture update to supply the new authorization_service constructor argument; no behavioral changes to the existing 27 unit tests.

Sequence Diagram

sequenceDiagram
    participant Caller
    participant ScheduleService
    participant AuthzService
    participant Temporal

    Note over ScheduleService: create_schedule()
    ScheduleService->>AuthzService: "register_resource(schedule, parent=agent)"
    alt register fails
        AuthzService-->>ScheduleService: raises Exception
        ScheduleService-->>Caller: raises (fail-closed, Temporal never called)
    else "register succeeds (registered=True)"
        AuthzService-->>ScheduleService: None
        ScheduleService->>Temporal: create_schedule(schedule_id)
        alt Temporal create fails
            Temporal-->>ScheduleService: raises Exception
            ScheduleService->>AuthzService: deregister_resource(schedule) [compensate]
            Note over ScheduleService: best-effort, swallows errors
            ScheduleService-->>Caller: re-raises original exception
        else Temporal create succeeds
            Temporal-->>ScheduleService: None
            ScheduleService->>Temporal: describe_schedule (read-back)
            Note right of ScheduleService: Outside compensation scope
            ScheduleService-->>Caller: ScheduleResponse
        end
    else no creator identity
        Note over ScheduleService: Skips register (warning logged)
        ScheduleService->>Temporal: create_schedule(schedule_id)
        Temporal-->>ScheduleService: None
        ScheduleService-->>Caller: ScheduleResponse
    end

    Note over ScheduleService: delete_schedule()
    ScheduleService->>Temporal: delete_schedule(schedule_id)
    Temporal-->>ScheduleService: None
    ScheduleService->>AuthzService: deregister_resource(schedule) [best-effort]
    ScheduleService-->>Caller: None

Loading

_{Reviews (2): Last reviewed commit: "feat(schedules): register agent_schedule..." | Re-trigger Greptile}