feat(drive): complete updated_by created_by

src/domain/entities/folder.rs

@@ -50,6 +50,20 @@ pub struct Folder {
     /// HTTP ETag emitted in PROPFIND/GET/HEAD responses — see
     /// [`Folder::etag`] for the formula and rationale.
     tree_modified_at: u64,
+
+    /// User that originally created this folder. Stamped at INSERT
+    /// from the caller's id and never updated afterwards (provenance,
+    /// not ownership — see §14 of the Drive plan). `None` when the
+    /// referenced user is later deleted (FK is `ON DELETE SET NULL`)
+    /// or for stub/DTO-reconstructed folders that never touched the DB.
+    created_by: Option<Uuid>,
+
+    /// User that performed the most recent mutation that touched
+    /// `updated_at` (rename, move, trash, restore, content overwrite).
+    /// Authorship signal — does NOT propagate via the tree-ETag flush
+    /// trigger. `None` when the referenced user is deleted or for
+    /// stub/DTO-reconstructed folders.
+    updated_by: Option<Uuid>,
 }
 
 // We no longer need this module, now we use a String directly
@@ -67,6 +81,8 @@ impl Default for Folder {
             created_at: 0,
             modified_at: 0,
             tree_modified_at: 0,
+            created_by: None,
+            updated_by: None,
         }
     }
 }
@@ -119,6 +135,10 @@ impl Folder {
             created_at: now,
             modified_at: now,
             tree_modified_at: now,
+            // Provenance is unknown for in-memory construction; the DB
+            // reconstruction path supplies real values.
+            created_by: None,
+            updated_by: None,
         })
     }
 
@@ -179,7 +199,10 @@ impl Folder {
     /// `tree_modified_at` comes from the trigger-maintained column on
     /// `storage.folders` and feeds [`Folder::etag`]. `drive_id` is the
     /// post-D0 `storage.folders.drive_id NOT NULL` column — every
-    /// path-based lookup scopes by this axis.
+    /// path-based lookup scopes by this axis. `created_by` /
+    /// `updated_by` are the §14 provenance columns; both are nullable
+    /// because the M1 FK is `ON DELETE SET NULL` (a deleted user
+    /// leaves authored rows in place).
     #[allow(clippy::too_many_arguments)]
     pub fn with_timestamps_and_tree(
         id: String,
@@ -191,6 +214,38 @@ impl Folder {
         created_at: u64,
         modified_at: u64,
         tree_modified_at: u64,
+    ) -> FolderResult<Self> {
+        Self::with_timestamps_tree_and_provenance(
+            id,
+            name,
+            storage_path,
+            parent_id,
+            owner_id,
+            drive_id,
+            created_at,
+            modified_at,
+            tree_modified_at,
+            None,
+            None,
+        )
+    }
+
+    /// Full constructor including the §14 provenance columns
+    /// (`created_by` / `updated_by`). Direct PG-row callers use this
+    /// to preserve authorship through the entity layer.
+    #[allow(clippy::too_many_arguments)]
+    pub fn with_timestamps_tree_and_provenance(
+        id: String,
+        name: String,
+        storage_path: StoragePath,
+        parent_id: Option<String>,
+        owner_id: Option<Uuid>,
+        drive_id: Uuid,
+        created_at: u64,
+        modified_at: u64,
+        tree_modified_at: u64,
+        created_by: Option<Uuid>,
+        updated_by: Option<Uuid>,
     ) -> FolderResult<Self> {
         let name = normalize_storage_name(&name);
         if let Err(reason) = validate_storage_name(&name) {
@@ -210,6 +265,8 @@ impl Folder {
             created_at,
             modified_at,
             tree_modified_at,
+            created_by,
+            updated_by,
         })
     }
 
@@ -253,6 +310,22 @@ impl Folder {
         self.drive_id
     }
 
+    /// User that originally created this folder (§14 provenance).
+    /// `None` when the referenced user has been deleted
+    /// (FK is `ON DELETE SET NULL`) or for in-memory/DTO-reconstructed
+    /// entities.
+    pub fn created_by(&self) -> Option<Uuid> {
+        self.created_by
+    }
+
+    /// User that performed the most recent mutation that bumped
+    /// `updated_at`. Authorship signal — distinct from ownership.
+    /// `None` when the referenced user has been deleted or for
+    /// in-memory/DTO-reconstructed entities.
+    pub fn updated_by(&self) -> Option<Uuid> {
+        self.updated_by
+    }
+
     /// Latest descendant-write timestamp. Statement-level Postgres
     /// triggers enqueue every file/folder write into
     /// `storage.tree_etag_dirty`; the background `TreeEtagFlushService`
@@ -348,6 +421,10 @@ impl Folder {
             created_at,
             modified_at,
             tree_modified_at: modified_at,
+            // DTO round-trips through this constructor lose
+            // provenance; callers that need it reload through the repo.
+            created_by: None,
+            updated_by: None,
         }
     }
 
@@ -391,6 +468,10 @@ impl Folder {
             // ancestors' listings now show a new name, so the
             // collection has materially changed.
             tree_modified_at: now,
+            // Provenance is preserved across the in-memory rebuild;
+            // real persisted updates re-read from the DB.
+            created_by: self.created_by,
+            updated_by: self.updated_by,
         })
     }
 
@@ -425,6 +506,8 @@ impl Folder {
             created_at: self.created_at,
             modified_at: now,
             tree_modified_at: now,
+            created_by: self.created_by,
+            updated_by: self.updated_by,
         })
     }