[Feature] Govern module availability and selection per tenant #9

New Issue

2026-08-03T21:10:38+02:00

zemion commented

2026-08-03 21:10:38 +02:00

Goal

Separate deployment-wide module activation from tenant entitlement.

System administrators must be able to:

mark installed modules unavailable, available, or forced per tenant;
change a tenant's selected modules;
preserve protected administration and dependency closure.

A tenant Module administrator must be able to enable or disable only modules available under system policy.

Contract

Deployment activation controls installed/runtime code globally.
Tenant entitlement controls whether an active module is operationally available in one tenant.
Module entitlement never grants Access permissions.
Forced modules and dependencies cannot be disabled at tenant scope.
Optimistic revisions, audit evidence, and configuration-change evidence are required.
User/group UI visibility is owned by Views through each module's root surface, not by a second personal module-state store.

Implementation status

Versioned tenant entitlement document in Core scope settings
Restrictive malformed-policy handling and dependency closure
System policy and tenant selection APIs
System and tenant administration surfaces
Dedicated tenant Module administrator role
Shell metadata filtering and authenticated module-route enforcement
Push and deployment verification
Complete background/public/capability enforcement tracked in GovOPlaN/govoplan-core (linked follow-up)

## Goal Separate deployment-wide module activation from tenant entitlement. System administrators must be able to: - mark installed modules unavailable, available, or forced per tenant; - change a tenant's selected modules; - preserve protected administration and dependency closure. A tenant Module administrator must be able to enable or disable only modules available under system policy. ## Contract - Deployment activation controls installed/runtime code globally. - Tenant entitlement controls whether an active module is operationally available in one tenant. - Module entitlement never grants Access permissions. - Forced modules and dependencies cannot be disabled at tenant scope. - Optimistic revisions, audit evidence, and configuration-change evidence are required. - User/group UI visibility is owned by Views through each module's root surface, not by a second personal module-state store. ## Implementation status - [x] Versioned tenant entitlement document in Core scope settings - [x] Restrictive malformed-policy handling and dependency closure - [x] System policy and tenant selection APIs - [x] System and tenant administration surfaces - [x] Dedicated tenant Module administrator role - [x] Shell metadata filtering and authenticated module-route enforcement - [ ] Push and deployment verification - [ ] Complete background/public/capability enforcement tracked in GovOPlaN/govoplan-core (linked follow-up)

zemion added the module/admin area/module-system area/tenancy

area/webui module/core labels 2026-08-03 21:10:38 +02:00

zemion commented

2026-08-03 21:29:58 +02:00

Codex State: progress

Summary

Implemented per-tenant unavailable, available, and forced module policy plus system and tenant selection APIs and administration panels.
Added the narrow admin:module:read/write permissions and module_admin tenant role template.
Protected the revision check with a tenant-row lock and preserved the reserved entitlement document during generic tenant updates.

Changed Files

src/govoplan_admin/backend/api/v1/routes.py
webui/src/features/admin/TenantModuleManagementPanel.tsx
/mnt/DATA/git/govoplan-core/src/govoplan_core/core/module_entitlements.py
/mnt/DATA/git/govoplan-tenancy/src/govoplan_tenancy/backend/api/v1/routes.py

Verification

Core/Admin/Tenancy unit tests, manifest-shape checks, WebUI TypeScript, focused cross-module checks, and all-module devserver smoke passed.

Next / Blocked

Push the coordinated Core/Admin/Tenancy changes and verify the two administration panels against a multi-tenant deployment.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - Implemented per-tenant unavailable, available, and forced module policy plus system and tenant selection APIs and administration panels. - Added the narrow admin:module:read/write permissions and module_admin tenant role template. - Protected the revision check with a tenant-row lock and preserved the reserved entitlement document during generic tenant updates. ### Changed Files - `src/govoplan_admin/backend/api/v1/routes.py` - `webui/src/features/admin/TenantModuleManagementPanel.tsx` - `/mnt/DATA/git/govoplan-core/src/govoplan_core/core/module_entitlements.py` - `/mnt/DATA/git/govoplan-tenancy/src/govoplan_tenancy/backend/api/v1/routes.py` ### Verification - `Core/Admin/Tenancy unit tests, manifest-shape checks, WebUI TypeScript, focused cross-module checks, and all-module devserver smoke passed.` ### Next / Blocked - Push the coordinated Core/Admin/Tenancy changes and verify the two administration panels against a multi-tenant deployment. Suggested status label: `status/in-progress`

zemion commented

2026-08-20 01:25:35 +02:00

Verified the tenant module-entitlement implementation and current main. Evidence: Admin backend tests and Ruff pass; Admin installer and interface-pattern suites pass; Core module-entitlement/module-system coverage passes 144 tests, including forced modules, dependency closure, optimistic revisions, and public/background/capability enforcement; rendered Playwright conformance passes 7/7; manifest registry passes 68/68. Fixed the exact Admin surface inventory for the existing tenant DSAR surface in 8a75c82 and pushed it. Closing as complete.

Verified the tenant module-entitlement implementation and current main. Evidence: Admin backend tests and Ruff pass; Admin installer and interface-pattern suites pass; Core module-entitlement/module-system coverage passes 144 tests, including forced modules, dependency closure, optimistic revisions, and public/background/capability enforcement; rendered Playwright conformance passes 7/7; manifest registry passes 68/68. Fixed the exact Admin surface inventory for the existing tenant DSAR surface in 8a75c82 and pushed it. Closing as complete.

zemion closed this issue

2026-08-20 01:25:35 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-admin#9