From e890a90d086cc9b7f08bb393eea69a82a52b0a53 Mon Sep 17 00:00:00 2001 From: Albrecht Degering Date: Tue, 4 Aug 2026 09:29:35 +0200 Subject: [PATCH] Invalidate tenant entitlements after module changes --- src/govoplan_admin/backend/api/v1/routes.py | 2 ++ src/govoplan_admin/backend/manifest.py | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/src/govoplan_admin/backend/api/v1/routes.py b/src/govoplan_admin/backend/api/v1/routes.py index 19a7847..d5aa045 100644 --- a/src/govoplan_admin/backend/api/v1/routes.py +++ b/src/govoplan_admin/backend/api/v1/routes.py @@ -911,6 +911,7 @@ def update_system_tenant_modules( audit_event="tenant_modules.system_policy_updated", ) session.commit() + lifecycle.registry.invalidate_tenant_entitlement(tenant.id) return TenantModuleEntitlementResponse.model_validate( module_entitlement_payload(tenant.id, state) ) @@ -988,6 +989,7 @@ def update_tenant_modules( ), ) session.commit() + lifecycle.registry.invalidate_tenant_entitlement(tenant.id) return TenantModuleEntitlementResponse.model_validate( module_entitlement_payload(tenant.id, state) ) diff --git a/src/govoplan_admin/backend/manifest.py b/src/govoplan_admin/backend/manifest.py index 0f76c88..cc749aa 100644 --- a/src/govoplan_admin/backend/manifest.py +++ b/src/govoplan_admin/backend/manifest.py @@ -91,7 +91,7 @@ manifest = ModuleManifest( title="Govern modules per tenant", summary="System administrators set each tenant's module ceiling and forced modules; tenant module administrators choose within that ceiling.", body=( - "Deployment activation installs and loads module code for the whole instance. Tenant module governance is a separate entitlement layer: system administrators mark modules unavailable, available, or forced for a tenant and may also change that tenant's selection. A tenant module administrator can only enable or disable available modules; forced modules and required dependencies remain effective. Module entitlement never grants permissions, and malformed policy fails closed to protected administration modules. Enabling a capability module such as Encryption only makes its services available; data encryption remains an explicit owning-module policy or migration decision." + "Deployment activation installs and loads module code for the whole instance. Tenant module governance is a separate entitlement layer: system administrators mark modules unavailable, available, or forced for a tenant and may also change that tenant's selection. A tenant module administrator can only enable or disable available modules; forced modules and required dependencies remain effective. Module entitlement never grants permissions, and malformed policy fails closed to protected administration modules. Disabling a module stops new API, capability, schedule, and worker admission for that tenant; accepted durable work remains queued and requires an operator decision rather than being executed or discarded. Enabling a capability module such as Encryption only makes its services available; data encryption remains an explicit owning-module policy or migration decision." ), layer="configured", documentation_types=("admin",),