feat: nested spaces — SpaceSign gate, legalOwner limits, keyless governance + external seats (SYN-51, SYN-54, SYN-57)

accountlimit/accountlimit.go

@@ -42,6 +42,11 @@ type SpaceLimits struct {
 	// FileStorageLimitBytes is the default account file-storage pool for
 	// identities without an explicit accountLimit document (files v2).
 	FileStorageLimitBytes uint64 `yaml:"fileStorageLimitBytes" bson:"fileStorageLimitBytes"`
+	// ExternalSeatsLimit is the default external-seat pool (nested spaces) for
+	// identities without an explicit accountLimit document. Production networks
+	// keep it 0 (seats are granted per identity by the payment node); self-hosted
+	// networks set it to open external admissions up.
+	ExternalSeatsLimit uint32 `yaml:"externalSeatsLimit" bson:"externalSeatsLimit"`
 }
 
 type Limits struct {
@@ -51,7 +56,10 @@ type Limits struct {
 	SpaceMembersRead  uint32    `bson:"spaceMembersRead"`
 	SpaceMembersWrite uint32    `bson:"spaceMembersWrite"`
 	SharedSpacesLimit uint32    `bson:"sharedSpacesLimit"`
-	UpdatedTime       time.Time `bson:"updatedTime"`
+	// ExternalSeatsLimit caps the distinct non-org identities admitted across all
+	// child spaces of the identity's spaces (nested spaces / paid external seats)
+	ExternalSeatsLimit uint32    `bson:"externalSeatsLimit"`
+	UpdatedTime        time.Time `bson:"updatedTime"`
 }
 
 type AccountLimit interface {
@@ -125,12 +133,13 @@ func (al *accountLimit) GetLimits(ctx context.Context, identity string) (limits
 	}
 	// default limit
 	return Limits{
-		Identity:          identity,
-		SpaceMembersRead:  al.defaultLimits.SpaceMembersRead,
-		SpaceMembersWrite: al.defaultLimits.SpaceMembersWrite,
-		SharedSpacesLimit: al.defaultLimits.SharedSpacesLimit,
-		FileStorageBytes:  al.defaultLimits.FileStorageLimitBytes,
-		UpdatedTime:       time.Now(),
+		Identity:           identity,
+		SpaceMembersRead:   al.defaultLimits.SpaceMembersRead,
+		SpaceMembersWrite:  al.defaultLimits.SpaceMembersWrite,
+		SharedSpacesLimit:  al.defaultLimits.SharedSpacesLimit,
+		FileStorageBytes:   al.defaultLimits.FileStorageLimitBytes,
+		ExternalSeatsLimit: al.defaultLimits.ExternalSeatsLimit,
+		UpdatedTime:        time.Now(),
 	}, nil
 }