[vladmesh]

Card: service-template-892 — Establish users.grant as Telegram access authority
Branch: pipeline/service-template-892 → main

What the card asks for

Goal

Make the generated service-template the sole runtime authority for Telegram audience access: define the users.grant(channel, external_id) capability backed by User and UserChannel, and make User.status the only Telegram-bot admission gate.

Context

• template/services/backend/spec/users.yaml, src/app/models/user.py, repositories/user.py, and controllers/users.py currently expose only CRUD over a telegram_id row.
• template/services/tg_bot/src/access.py and src/main.py.jinja currently admit users through TG_BOT_ALLOWED_TELEGRAM_IDS plus TG_BOT_TEST_TELEGRAM_ID before handlers run.
• template/services/tg_bot/env.contract.yaml.jinja, AGENTS.md.jinja, README/template docs, template-generation tests, and backend/tg_bot tests define the generated contract.
• This sprint concerns newly generated products. No compatibility shim for already generated applications is required; do not retain the env audience path or owner literal as a fallback.

Acceptance criteria

• The generated backend persists User and UserChannel such that a channel/external identity maps uniquely to a user; User has an explicit status whose active value is the sole stored access decision. Include the migration/schema/generated-contract updates needed for a newly generated project.
• The generated backend exposes an idempotent, typed users.grant(channel, external_id) capability suitable for the orchestrator's internal write path. A successful grant creates or finds the identity and leaves it active; the response exposes enough stable identity/status information for a caller to verify the grant.
• Telegram updates are admitted only after resolving the Telegram channel identity through that capability's data. Unknown, inactive, or malformed identities are denied before handlers; active identities pass. No access decision falls back to an environment allow-list, a temporary test ID, public-by-empty behavior, or an owner literal.
• New generated Telegram-bot configuration, docs, and generated output contain neither TG_BOT_ALLOWED_TELEGRAM_IDS nor TG_BOT_OWNER_TELEGRAM_ID; remove obsolete audience parsing/configuration rather than preserving it.
• Focused unit/integration/template-generation regressions cover idempotent grant, active/inactive/unknown bot admission, and absence of the deleted configuration. Update living contract documentation and generated OpenAPI/spec artifacts when the repository workflow requires it.
• Run the repository's canonical broad checks and report the exact tested commit SHA and receipt. Keep diagnostic logs free of Telegram tokens and identity payloads beyond the existing safe fields.

Out of scope

• codegen_orchestrator API, deployment, seed, ownership-transfer, and QA-TTL implementation.
• Migration or live repair of already generated user repositories.
• Running the final Stand/mega e2e or rotating Telegram credentials.

What the worker reports

Completed grant-based Telegram access on commit 79e9733213518f658ce85c0899ef08da45313a63.

• Added generated users.grant and users.resolve contracts backed by User status and unique UserChannel identities, with migration, OpenAPI generation, and idempotency coverage.
• Telegram bots now fail closed unless backend identity resolution returns status=active; deleted audience, owner, and temporary-test environment paths.
• Updated event, notification, documentation, and Copier regression contracts.

Focused verification passed:

• Rendered backend+tg_bot project: backend user/event tests, tg_bot access/handler tests, and generated OpenAPI assertions for /users/grant, /users/access, and UserAccess.
• Rendered standalone and backend+tg_bot lint checks.
• tests/copier/test_template_generation.py::TestBackendWithTgBotGeneration::<redacted>.

No local broad check was run, per this task's check-cost contract. The dispatcher-owned GitHub CI exact-SHA gate is the authoritative broad evidence; receipt pending that gate.

---

Opened by the secretary CI gate so that the pull_request workflow runs. Title and body are built from the card and the worker's done report.

[vladmesh]

Закрываю как superseded: исходная карточка service-template-892 была заменена более точными service-template-893 и service-template-894, смерженными в PR #71 и #72. Актуальная реализация и проверки находятся в main@edf54dfb1c323d60480761e06ceb982bd79ac9d2.