Declare platform integrations in one versioned app manifest

from fastapi import Depends
from egav_base import AsyncBaseService, AsyncBaseCRUD
from egav_base.async_database import async_transaction_context
from egav_app_sdk import (
    get_app_context, requires_permission, requires_feature, enforce_quota,
)
from .models import Project
from .schemas import ProjectCreate, ProjectUpdate, ProjectResponse

class ProjectCRUD(AsyncBaseCRUD[Project]):
    model = Project

class ProjectService(
    AsyncBaseService[Project, ProjectCreate, ProjectUpdate, ProjectResponse, ProjectCRUD]
):
    model = Project
    crud = ProjectCRUD
    response_schema = ProjectResponse
    # list/search/sort/pagination, soft-delete, audit — all inherited

# Three gates compose declaratively on one route:
@router.post(
    "/v1/my-saas/portal/projects",
    dependencies=[
        Depends(requires_permission("project.create")),  # AuthZ permission gate
        Depends(requires_feature("projects")),           # plan has the feature
        Depends(enforce_quota("max_projects")),          # under the quota
    ],
)
async def create_project(
    payload: ProjectCreate,
    ctx = Depends(get_app_context),          # resolved tenant + user
    db = Depends(get_db),
):
    async with async_transaction_context(db):            # commit happens here
        return await ProjectService(db).create(payload)

from fastapi import APIRouter, Depends, Request
from egav_authz_client import RequireAuthz
from egav_cp_client.feature_gates import (
    require_active_subscription,
    require_feature,
    require_quota,
)

router = APIRouter()

async def project_count(request: Request) -> int:
    # Usage probe for the quota gate — what the org already consumed.
    return await count_projects(request.state.identity.org_guid)

# The reference implementation: five gates declared once on the route.
# RequireAuthz authenticates the user's bearer and checks the permission
# against AuthZ; one cached entitlements fetch from the Control Plane
# powers the subscription, feature and quota gates.
@router.post(
    "/v1/my-saas/portal/projects",
    dependencies=[
        Depends(RequireAuthz("project", "create")),  # 1 · auth + 2 · permission
        Depends(require_active_subscription),        # 3 · subscription -> 402 when lapsed
        Depends(require_feature("projects")),        # 4 · feature -> 403 when not in plan
        Depends(require_quota("max_projects", current_usage=project_count)),  # 5 · quota -> 429
    ],
)
async def create_project(payload: ProjectCreate):
    # Gates passed — do the work. Each failed gate has already returned
    # 401 / 402 / 403 / 429 (or 503 when the platform is unreachable),
    # in the platform's standard error envelope.
    return await save_project(payload)