Problem
An external partner must create an as-built of the Cloud Seven media room in hydravenues. Today the only credential is the single shared server.admin_token. It grants full read, write and delete on every district and venue. There is no user model, no roles and no per-venue scoping. So we cannot give one person access to one venue.
Also note: the read API (GET /api/v1/venues/{id} and /layout) is public today, so layout JSON is world-readable. But an as-built needs edit access and photo uploads, and attachments only exist behind the admin routes.
Approach (follows the #484 direction: iamnim is the platform identity service)
Do not embed or proxy the hydravenues editor through hydramancer. Instead:
- hydravenues authenticates with iamnim itself. Port the internal/iamnim client and the login/authed/logout flow from hydramancer into hydravenues as a second auth path next to the admin token. The admin token stays for operators and machines.
- Authorization = org membership against Venue.OrganizationID. The field exists and VenueStore.List already filters on it, but nothing binds a credential to it. Add middleware on /admin/venues/{id}/... : resolve the iamnim session to memberships, allow when a membership slug matches the venue's OrganizationID. Admin token bypasses.
- hydramancer stays the front door. Add a "My venues" panel that links to hydravenues.experiencenet.com and hands the session across, same as its /experience/authed?token= flow.
- Provision Cloud Seven: create (or reuse) org cloud-seven in Pantheon, set OrganizationID on the Cloud Seven venue, grant the partner a membership. Same vend pattern as hydraperforceprovision.
Hardening while in there
- hydramancer accepts the session token as a ?token= query parameter; it leaks into logs and referrers. Tighten during the handoff work.
- hydramancer stores the upstream token verbatim without validating it at set time.
Interim for the on-site visit
Until this ships: an operator drives the editor while the partner surveys, or hand over the admin token temporarily and rotate it after. There is no scoped middle ground today.