Keep managed project lookup read-only

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/__tests__/plugin-orchestration-apis.test.ts

@@ -425,6 +425,21 @@ describeEmbeddedPostgres("plugin orchestration APIs", () => {
     });
 
     const services = buildHostServices(db, pluginId, "paperclip.missions", createEventBusStub());
+    const missing = await services.projects.getManaged({ companyId, projectKey: "operations" });
+    expect(missing.status).toBe("missing");
+    expect(missing.projectId).toBeNull();
+    await expect(
+      db
+        .select()
+        .from(pluginManagedResources)
+        .where(and(
+          eq(pluginManagedResources.companyId, companyId),
+          eq(pluginManagedResources.pluginId, pluginId),
+          eq(pluginManagedResources.resourceKind, "project"),
+          eq(pluginManagedResources.resourceKey, "operations"),
+        )),
+    ).resolves.toHaveLength(0);
+
     const created = await services.projects.reconcileManaged({ companyId, projectKey: "operations" });
 
     expect(created.status).toBe("created");

server/src/services/plugin-host-services.ts

@@ -1159,6 +1159,7 @@ export function buildHostServices(
           pluginId,
           pluginKey,
           projectKey: params.projectKey,
+          createIfMissing: false,
         });
       },
       async reconcileManaged(params) {

server/src/services/projects.ts

@@ -536,6 +536,7 @@ export function projectService(db: Db) {
       pluginKey: string;
       projectKey: string;
       reset?: boolean;
+      createIfMissing?: boolean;
     }): Promise<PluginManagedProjectResolution> => {
       const plugin = await db
         .select({ id: plugins.id, pluginKey: plugins.pluginKey, manifestJson: plugins.manifestJson })
@@ -598,10 +599,12 @@ export function projectService(db: Db) {
               })
               .where(and(eq(projects.companyId, input.companyId), eq(projects.id, existingBinding.resourceId)));
           }
-          await db
-            .update(pluginManagedResources)
-            .set({ defaultsJson: defaults, updatedAt: new Date() })
-            .where(eq(pluginManagedResources.id, existingBinding.id));
+          if (input.createIfMissing !== false) {
+            await db
+              .update(pluginManagedResources)
+              .set({ defaultsJson: defaults, updatedAt: new Date() })
+              .where(eq(pluginManagedResources.id, existingBinding.id));
+          }
           const project = await getProjectById(existingBinding.resourceId);
           return {
             pluginKey: input.pluginKey,
@@ -614,6 +617,18 @@ export function projectService(db: Db) {
           };
         }
 
+        if (input.createIfMissing === false) {
+          return {
+            pluginKey: input.pluginKey,
+            resourceKind: "project",
+            resourceKey: input.projectKey,
+            companyId: input.companyId,
+            projectId: null,
+            project: null,
+            status: "missing",
+          };
+        }
+
         const project = await createProject(input.companyId, {
           name: declaration.displayName,
           description: declaration.description ?? null,
@@ -636,6 +651,18 @@ export function projectService(db: Db) {
         };
       }
 
+      if (input.createIfMissing === false) {
+        return {
+          pluginKey: input.pluginKey,
+          resourceKind: "project",
+          resourceKey: input.projectKey,
+          companyId: input.companyId,
+          projectId: null,
+          project: null,
+          status: "missing",
+        };
+      }
+
       const project = await createProject(input.companyId, {
         name: declaration.displayName,
         description: declaration.description ?? null,