[Task] Enforce tenant module entitlements across non-request execution paths #282

New Issue

2026-08-03T21:10:39+02:00

zemion commented

2026-08-03 21:10:39 +02:00

Goal

Complete enforcement of the tenant module entitlement contract outside normal authenticated HTTP routes.

Required work

Add a stable tenant-entitlement resolver/capability for workers and module-to-module capability calls.
Gate scheduled jobs, queue consumers, workflow/dataflow execution, and module-owned background reconciliation by tenant-effective module state.
Define behavior for queued work when a module becomes unavailable: stop admitting new work, preserve accepted durable work, and expose an operator decision rather than silently dropping it.
Require public tenant-scoped routes to resolve a tenant from their public token/context and enforce entitlement without requiring a signed-in principal.
Ensure capabilities from a globally active but tenant-unavailable provider cannot be invoked for that tenant.
Add permutation tests for API, worker, public-link, and capability paths.
Add bounded caching/invalidation so entitlement checks do not add one avoidable database query per operation.

Safety

A user/group View preference is not an enforcement boundary. Access authorization and tenant module entitlement must both pass.

## Goal Complete enforcement of the tenant module entitlement contract outside normal authenticated HTTP routes. ## Required work - Add a stable tenant-entitlement resolver/capability for workers and module-to-module capability calls. - Gate scheduled jobs, queue consumers, workflow/dataflow execution, and module-owned background reconciliation by tenant-effective module state. - Define behavior for queued work when a module becomes unavailable: stop admitting new work, preserve accepted durable work, and expose an operator decision rather than silently dropping it. - Require public tenant-scoped routes to resolve a tenant from their public token/context and enforce entitlement without requiring a signed-in principal. - Ensure capabilities from a globally active but tenant-unavailable provider cannot be invoked for that tenant. - Add permutation tests for API, worker, public-link, and capability paths. - Add bounded caching/invalidation so entitlement checks do not add one avoidable database query per operation. ## Safety A user/group View preference is not an enforcement boundary. Access authorization and tenant module entitlement must both pass.

zemion added the

type

task

area/module-system area/tenancy

area/security area/api module/core labels 2026-08-03 21:10:39 +02:00

zemion commented

2026-08-03 21:30:19 +02:00

Codex State: ready

Summary

Authenticated request routes and platform module metadata now enforce the active tenant module entitlement.
Non-request execution paths remain intentionally open in this issue: workers, direct capabilities, queued work accepted before disablement, and tenant resolution for public-token routes.

Changed Files

src/govoplan_core/core/lifecycle.py
src/govoplan_core/server/platform.py

Verification

Core entitlement/lifecycle tests and all-module PostgreSQL smoke startup passed.

Next / Blocked

Define accepted-work semantics, then add a shared tenant-entitlement resolver to workers and direct capability invocation boundaries.

Suggested status label: status/ready

## Codex State: ready ### Summary - Authenticated request routes and platform module metadata now enforce the active tenant module entitlement. - Non-request execution paths remain intentionally open in this issue: workers, direct capabilities, queued work accepted before disablement, and tenant resolution for public-token routes. ### Changed Files - `src/govoplan_core/core/lifecycle.py` - `src/govoplan_core/server/platform.py` ### Verification - `Core entitlement/lifecycle tests and all-module PostgreSQL smoke startup passed.` ### Next / Blocked - Define accepted-work semantics, then add a shared tenant-entitlement resolver to workers and direct capability invocation boundaries. Suggested status label: `status/ready`

zemion commented

2026-08-03 21:30:43 +02:00

Codex State: ready

Summary

Authenticated request routes and platform module metadata now enforce the active tenant module entitlement.
Non-request execution paths remain intentionally open in this issue: workers, direct capabilities, queued work accepted before disablement, and tenant resolution for public-token routes.

Changed Files

src/govoplan_core/core/lifecycle.py
src/govoplan_core/server/platform.py

Verification

Core entitlement/lifecycle tests and all-module PostgreSQL smoke startup passed.

Next / Blocked

Define accepted-work semantics, then add a shared tenant-entitlement resolver to workers and direct capability invocation boundaries.

Suggested status label: status/ready

## Codex State: ready ### Summary - Authenticated request routes and platform module metadata now enforce the active tenant module entitlement. - Non-request execution paths remain intentionally open in this issue: workers, direct capabilities, queued work accepted before disablement, and tenant resolution for public-token routes. ### Changed Files - `src/govoplan_core/core/lifecycle.py` - `src/govoplan_core/server/platform.py` ### Verification - `Core entitlement/lifecycle tests and all-module PostgreSQL smoke startup passed.` ### Next / Blocked - Define accepted-work semantics, then add a shared tenant-entitlement resolver to workers and direct capability invocation boundaries. Suggested status label: `status/ready`

zemion commented

2026-08-04 09:32:17 +02:00

Codex State: done

Summary

Tenant-effective module policy now gates authenticated and signed-link routes, capability lookup, scheduled scans, durable consumers, outboxes, and background workers.
New work is rejected while accepted durable work is preserved as operator_action_required; tenantless system events use an explicit system partition.
Poll and Scheduling resolve signed public links through a Core-owned capability contract before tenant policy is applied.

Changed Files

govoplan-core@40c1008
govoplan-admin@e890a90
govoplan-audit@c1e6c15
govoplan-calendar@00add29
govoplan-campaign@f98fe06
govoplan-dataflow@42f87dd
govoplan-mail@7c8cb21
govoplan-notifications@bb59342
govoplan-poll@3c126a7
govoplan-scheduling@9fd2ccd
govoplan-workflow-engine@6e0fcf6

Verification

tools/checks/check-focused.sh: passed, including 121 module-system tests, 50 WebUI module permutations, full-product build, bundle budgets, and dependency boundaries.
Focused entitlement, worker, public-link, Audit outbox, Dataflow, Workflow Engine, Mail, Campaign, Calendar, Poll, Scheduling, and Notifications tests passed.

Next / Blocked

None; acceptance criteria are implemented and pushed.

## Codex State: done ### Summary - Tenant-effective module policy now gates authenticated and signed-link routes, capability lookup, scheduled scans, durable consumers, outboxes, and background workers. - New work is rejected while accepted durable work is preserved as operator_action_required; tenantless system events use an explicit system partition. - Poll and Scheduling resolve signed public links through a Core-owned capability contract before tenant policy is applied. ### Changed Files - `govoplan-core@40c1008` - `govoplan-admin@e890a90` - `govoplan-audit@c1e6c15` - `govoplan-calendar@00add29` - `govoplan-campaign@f98fe06` - `govoplan-dataflow@42f87dd` - `govoplan-mail@7c8cb21` - `govoplan-notifications@bb59342` - `govoplan-poll@3c126a7` - `govoplan-scheduling@9fd2ccd` - `govoplan-workflow-engine@6e0fcf6` ### Verification - `tools/checks/check-focused.sh: passed, including 121 module-system tests, 50 WebUI module permutations, full-product build, bundle budgets, and dependency boundaries.` - `Focused entitlement, worker, public-link, Audit outbox, Dataflow, Workflow Engine, Mail, Campaign, Calendar, Poll, Scheduling, and Notifications tests passed.` ### Next / Blocked - None; acceptance criteria are implemented and pushed.

zemion closed this issue

2026-08-04 09:32:17 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-core#282