[Security] Explain campaign governance, import, template, and export sub-objects #87

New Issue

2026-07-30T17:34:16+02:00

zemion commented

2026-07-30 17:34:16 +02:00

Follow-up to #50. Complete Campaign access explanations for shares and ownership-transfer records, import mappings/executions, reusable templates/revisions, export packages, and durable report/protocol artifacts.

Acceptance criteria

Each persisted child has a stable resource identifier and explicit provenance contract.
Shares and ownership transfers distinguish governance visibility from content access.
Imports identify source/version provenance without returning source rows to unauthorized callers.
Templates and exports use their own owner/share/diagnostic permissions where they are independently governed.
Optional template/reporting modules fail closed with an explicit unavailable-evidence reason.
Tests cover the complete supported/unsupported matrix.

See docs/ACCESS_EXPLANATION_COVERAGE.md.

Follow-up to #50. Complete Campaign access explanations for shares and ownership-transfer records, import mappings/executions, reusable templates/revisions, export packages, and durable report/protocol artifacts. ## Acceptance criteria - Each persisted child has a stable resource identifier and explicit provenance contract. - Shares and ownership transfers distinguish governance visibility from content access. - Imports identify source/version provenance without returning source rows to unauthorized callers. - Templates and exports use their own owner/share/diagnostic permissions where they are independently governed. - Optional template/reporting modules fail closed with an explicit unavailable-evidence reason. - Tests cover the complete supported/unsupported matrix. See `docs/ACCESS_EXPLANATION_COVERAGE.md`.

zemion added the module/campaign

type

task

area/api codex/ready area/security

labels 2026-07-30 17:34:16 +02:00

zemion referenced this issue

2026-07-30 17:46:45 +02:00

Decide campaign sub-object resource access explanation scope #50

zemion commented

2026-08-20 05:40:28 +02:00

Implemented and pushed in 5c27527. Access explanations now cover Campaign shares, Core ownership-transfer records, independently user-owned import mapping profiles, version-bound saved import executions, and durable validation/build/execution-snapshot/review artifacts with stable typed identifiers. Governance visibility is explicitly separate from content access; import provenance exposes source identity/revision but no rows, filenames, mappings, or arbitrary source metadata. Reusable template/revision and export-package lookups fail closed through their optional owning modules (templates / reporting) with an unavailable_or_hidden result. Computed reports now state their independent read/export/diagnostic permission classes. The supported/unsupported matrix and bilingual manifest-driven administration documentation were updated. Verification: 398 Campaign tests plus 26 subtests passed; focused access/documentation tests passed 31/31; Ruff and diff checks passed; the 68-module manifest registry passed; the focused workspace backend, dependency, architecture, layout, primitive, and foundation gates passed. The full 57-permutation WebUI matrix had passed immediately before this backend-only slice; no WebUI source changed here.

Implemented and pushed in `5c27527`. Access explanations now cover Campaign shares, Core ownership-transfer records, independently user-owned import mapping profiles, version-bound saved import executions, and durable validation/build/execution-snapshot/review artifacts with stable typed identifiers. Governance visibility is explicitly separate from content access; import provenance exposes source identity/revision but no rows, filenames, mappings, or arbitrary source metadata. Reusable template/revision and export-package lookups fail closed through their optional owning modules (`templates` / `reporting`) with an `unavailable_or_hidden` result. Computed reports now state their independent read/export/diagnostic permission classes. The supported/unsupported matrix and bilingual manifest-driven administration documentation were updated. Verification: 398 Campaign tests plus 26 subtests passed; focused access/documentation tests passed 31/31; Ruff and diff checks passed; the 68-module manifest registry passed; the focused workspace backend, dependency, architecture, layout, primitive, and foundation gates passed. The full 57-permutation WebUI matrix had passed immediately before this backend-only slice; no WebUI source changed here.

zemion closed this issue

2026-08-20 05:40:28 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-campaign#87