From 3acf4a1504a93c9b41e2e342dccbcfe7e07f4456 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com>
Date: Thu, 6 Aug 2026 12:54:13 +0800
Subject: [PATCH] fix(authz): allow approved deployment dispatch

---
 .../install-architecture-provisioner.sh           |  2 +-
 .../install-architecture-provisioner.test.js      | 15 +++++++++++++++
 .../lake-lamp-authz/lake-lamp-authz.service       |  2 +-
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/server-tools/lake-lamp-authz/install-architecture-provisioner.sh b/server-tools/lake-lamp-authz/install-architecture-provisioner.sh
index 7c6c919..5236a2d 100755
--- a/server-tools/lake-lamp-authz/install-architecture-provisioner.sh
+++ b/server-tools/lake-lamp-authz/install-architecture-provisioner.sh
@@ -103,7 +103,7 @@ install -m 0644 "$script_dir/lake-lamp-authz.service" /etc/systemd/system/lake-l
 install -m 0644 "$script_dir/lake-lamp-architecture-provision.service" /etc/systemd/system/lake-lamp-architecture-provision.service
 install -m 0644 "$script_dir/lake-lamp-deployment-event-worker.service" /etc/systemd/system/lake-lamp-deployment-event-worker.service
 install -d -m 0700 "$state_root"
-install -d -m 0750 /var/lib/guanghu/deployment-events
+install -d -m 0770 -o root -g guanghu-authz /var/lib/guanghu/deployment-events
 install -d -m 0700 /var/lib/guanghu/deployment-events/receipts
 install -d -m 0755 /opt/guanghu/architecture-releases
 install -d -m 0755 /etc/guanghu/lake-lamp
diff --git a/server-tools/lake-lamp-authz/install-architecture-provisioner.test.js b/server-tools/lake-lamp-authz/install-architecture-provisioner.test.js
index 1e8cbf2..628fd43 100644
--- a/server-tools/lake-lamp-authz/install-architecture-provisioner.test.js
+++ b/server-tools/lake-lamp-authz/install-architecture-provisioner.test.js
@@ -13,6 +13,10 @@ const architectureProvisionUnit = fs.readFileSync(
   path.join(__dirname, "lake-lamp-architecture-provision.service"),
   "utf8",
 );
+const authorizationUnit = fs.readFileSync(
+  path.join(__dirname, "lake-lamp-authz.service"),
+  "utf8",
+);
 
 test("bootstrap installer preserves secrets and deploys the complete HoloLake capability set", () => {
   for (const file of [
@@ -58,3 +62,14 @@ test("architecture provision broker can update the registered AI discovery servi
     /^ReadWritePaths=.*\/opt\/guanghu\/ai-discovery(?:\s|$)/m,
   );
 });
+
+test("authorization service can enqueue an approved deployment event", () => {
+  assert.match(
+    authorizationUnit,
+    /^ReadWritePaths=.*\/var\/lib\/guanghu\/deployment-events(?:\s|$)/m,
+  );
+  assert.match(
+    source,
+    /install -d -m 0770 -o root -g guanghu-authz \/var\/lib\/guanghu\/deployment-events/,
+  );
+});
diff --git a/server-tools/lake-lamp-authz/lake-lamp-authz.service b/server-tools/lake-lamp-authz/lake-lamp-authz.service
index 5c97b0e..fc8d350 100644
--- a/server-tools/lake-lamp-authz/lake-lamp-authz.service
+++ b/server-tools/lake-lamp-authz/lake-lamp-authz.service
@@ -16,7 +16,7 @@ NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
 ProtectHome=true
-ReadWritePaths=/var/lib/guanghu/lake-lamp-authz /var/lib/guanghu/repo-authorizations /var/lib/guanghu/repo-push-uploads /var/lib/guanghu/forgejo/repositories/bingshuo/hololake-platform.git /var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/guanghu-ice-heart.git -/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/hololake-knowledge-base.git
+ReadWritePaths=/var/lib/guanghu/lake-lamp-authz /var/lib/guanghu/repo-authorizations /var/lib/guanghu/repo-push-uploads /var/lib/guanghu/deployment-events /var/lib/guanghu/forgejo/repositories/bingshuo/hololake-platform.git /var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/guanghu-ice-heart.git -/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/hololake-knowledge-base.git
 ReadOnlyPaths=-/etc/guanghu/secrets/hololake-ai-providers.json
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 LockPersonality=true