feat(userpat): route policy writes through membership; enforce 1 role per scope (#1668)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: AmanGIT07

cmd/serve.go

@@ -488,7 +488,7 @@ func buildAPIDependencies(
 	metaschemaRepository := postgres.NewMetaSchemaRepository(logger, dbc)
 	metaschemaService := metaschema.NewService(metaschemaRepository)
 
-	userPATService := userpat.NewService(logger, userPATRepo, cfg.App.PAT, organizationService, roleService, policyService, projectService, auditRecordRepository)
+	userPATService := userpat.NewService(logger, userPATRepo, cfg.App.PAT, organizationService, roleService, membershipService, projectService, auditRecordRepository)
 	membershipService.SetUserPATService(userPATService)
 	patAlertService := userpat.NewAlertService(userPATRepo, userService, organizationService, mailDialer, dbc, cfg.App.PAT.Alert, logger, auditRecordRepository)
 	auditRecordService := auditrecord.NewService(auditRecordRepository, userService, serviceUserService, sessionService, userPATService)

core/userpat/errors/errors.go

@@ -17,4 +17,5 @@ var (
 	ErrScopeMismatch    = errors.New("role does not support the specified scope")
 	ErrRoleNotFound     = errors.New("one or more requested roles do not exist")
 	ErrProjectForbidden = errors.New("user does not have access to one or more specified projects")
+	ErrDuplicateScope   = errors.New("only one role per resource type is allowed")
 )