[Security] Explain recipient, attachment, and review sub-object access #85

New Issue

2026-07-30T17:34:15+02:00

zemion commented

2026-07-30 17:34:15 +02:00

Follow-up to #50. Add first-class resource access explanations for recipient rows and source snapshots, attachment bindings and frozen resolutions, validation issues, review decisions, and attachment-policy overrides.

Acceptance criteria

Stable, non-enumerable resource identifiers are documented for each sub-object.
Explanations identify the parent Campaign/version and whether access is inherited or further restricted.
Missing or hidden objects do not leak recipient or file data.
Review and attachment override evidence requires the appropriate diagnostic permission.
Focused authorization and provenance tests cover allowed, denied, missing, and stale-version cases.

See docs/ACCESS_EXPLANATION_COVERAGE.md.

Follow-up to #50. Add first-class resource access explanations for recipient rows and source snapshots, attachment bindings and frozen resolutions, validation issues, review decisions, and attachment-policy overrides. ## Acceptance criteria - Stable, non-enumerable resource identifiers are documented for each sub-object. - Explanations identify the parent Campaign/version and whether access is inherited or further restricted. - Missing or hidden objects do not leak recipient or file data. - Review and attachment override evidence requires the appropriate diagnostic permission. - Focused authorization and provenance tests cover allowed, denied, missing, and stale-version cases. See `docs/ACCESS_EXPLANATION_COVERAGE.md`.

zemion added the module/campaign

type

task

area/api codex/ready area/security

labels 2026-07-30 17:34:15 +02:00

zemion referenced this issue

2026-07-30 17:46:45 +02:00

Decide campaign sub-object resource access explanation scope #50

zemion commented

2026-08-19 20:30:27 +02:00

Implemented and pushed in 14e9487.

The Campaign access-explanation provider now covers recipient records/source snapshots, attachment resolutions/bindings, validation issues, review decisions, and attachment overrides. Child identifiers are stable and non-enumerable; version-bound children use <version UUID>:<child UUID>. Explanations identify their Campaign/version authorization parent and further restrictions, while denied, missing, stale, and cross-tenant probes disclose no protected data.

Verification:

Campaign suite: 100 tests passed
Core access contract suite: 13 tests passed
manifest registry: 68/68 passed
static module contract scan passed
Ruff and diff checks passed

Implemented and pushed in `14e9487`. The Campaign access-explanation provider now covers recipient records/source snapshots, attachment resolutions/bindings, validation issues, review decisions, and attachment overrides. Child identifiers are stable and non-enumerable; version-bound children use `<version UUID>:<child UUID>`. Explanations identify their Campaign/version authorization parent and further restrictions, while denied, missing, stale, and cross-tenant probes disclose no protected data. Verification: - Campaign suite: 100 tests passed - Core access contract suite: 13 tests passed - manifest registry: 68/68 passed - static module contract scan passed - Ruff and diff checks passed

zemion closed this issue

2026-08-19 20:30:27 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-campaign#85