From be52b716caedcb4f69670229350b035b792930a6 Mon Sep 17 00:00:00 2001 From: Albrecht Degering Date: Tue, 21 Jul 2026 20:48:34 +0200 Subject: [PATCH] feat(docs): grant handbook access to authenticated users --- README.md | 8 ++++++++ docs/INSTANCE_AWARE_DOCUMENTATION.md | 6 ++++++ package.json | 4 ++-- pyproject.toml | 6 +++--- src/govoplan_docs/__init__.py | 2 +- src/govoplan_docs/backend/manifest.py | 5 +++-- tests/test_docs_context.py | 12 ++++++++++++ webui/package.json | 4 ++-- webui/src/module.ts | 2 +- 9 files changed, 38 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 317d23d..6babf9f 100644 --- a/README.md +++ b/README.md @@ -22,6 +22,14 @@ This repository owns: Core owns module discovery, configuration package loading, route registry, RBAC evaluation, capability registry, and shared WebUI shell behavior. +While Docs is installed, its managed `docs_reader` tenant role is an automatic +authenticated-member baseline. Access derives its narrow read grant from the +active Docs manifest without per-user assignments or authorization-time writes, +so ordinary users can open their configured handbook without an administrator +assigning documentation access one account at a time. +Administrative documentation remains separately protected by +`docs:documentation:admin` or the applicable administration scope. + ## Documentation model The docs module should render documentation in three layers: diff --git a/docs/INSTANCE_AWARE_DOCUMENTATION.md b/docs/INSTANCE_AWARE_DOCUMENTATION.md index add65ef..542b594 100644 --- a/docs/INSTANCE_AWARE_DOCUMENTATION.md +++ b/docs/INSTANCE_AWARE_DOCUMENTATION.md @@ -28,6 +28,12 @@ documentation may show all layers plus route, permission, module, and capability diagnostics, but it requires the separate administrative documentation authority. +The managed `docs_reader` role grants `docs:documentation:read` automatically +to every authenticated tenant membership while Docs is installed. This only +opens the user projection: each contributed workflow still needs its own +module, capability, permission, and runtime-policy conditions so baseline Help +Center access does not imply authority to perform every documented task. + ## Conditions Documentation topics can declare: diff --git a/package.json b/package.json index c5d633b..627576a 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@govoplan/docs-webui", - "version": "0.1.9", + "version": "0.1.10", "private": true, "type": "module", "main": "webui/src/index.ts", @@ -17,7 +17,7 @@ "README.md" ], "peerDependencies": { - "@govoplan/core-webui": "^0.1.8", + "@govoplan/core-webui": "^0.1.10", "lucide-react": "^1.23.0", "react": "^19.0.0", "react-dom": "^19.0.0", diff --git a/pyproject.toml b/pyproject.toml index 9bd2f37..bade03c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,14 +4,14 @@ build-backend = "setuptools.build_meta" [project] name = "govoplan-docs" -version = "0.1.9" +version = "0.1.10" description = "GovOPlaN documentation module for configured-system, available, and evidence documentation." readme = "README.md" requires-python = ">=3.12" authors = [{ name = "GovOPlaN" }] dependencies = [ - "govoplan-core>=0.1.8", - "govoplan-access>=0.1.8", + "govoplan-core>=0.1.10", + "govoplan-access>=0.1.10", ] [tool.setuptools.packages.find] diff --git a/src/govoplan_docs/__init__.py b/src/govoplan_docs/__init__.py index 1c3ca24..8ee69ca 100644 --- a/src/govoplan_docs/__init__.py +++ b/src/govoplan_docs/__init__.py @@ -2,4 +2,4 @@ __all__ = ["__version__"] -__version__ = "0.1.9" +__version__ = "0.1.10" diff --git a/src/govoplan_docs/backend/manifest.py b/src/govoplan_docs/backend/manifest.py index 91da8a0..6c1ec21 100644 --- a/src/govoplan_docs/backend/manifest.py +++ b/src/govoplan_docs/backend/manifest.py @@ -44,7 +44,7 @@ def _route_factory(context: ModuleContext): manifest = ModuleManifest( id="docs", name="Docs", - version="0.1.9", + version="0.1.10", required_capabilities=(CAPABILITY_AUTH_PRINCIPAL_RESOLVER, CAPABILITY_AUTH_PERMISSION_EVALUATOR), optional_dependencies=("policy", "audit", "ops", "workflow", "search"), permissions=( @@ -63,8 +63,9 @@ manifest = ModuleManifest( RoleTemplate( slug="docs_reader", name="Documentation reader", - description="Read the configured-system documentation browser.", + description="Read the configured-system documentation browser. This role is granted automatically to every authenticated tenant member while Docs is installed.", permissions=(DOCS_READ_SCOPE,), + default_authenticated=True, ), RoleTemplate( slug="docs_admin", diff --git a/tests/test_docs_context.py b/tests/test_docs_context.py index c0636ca..fd011ba 100644 --- a/tests/test_docs_context.py +++ b/tests/test_docs_context.py @@ -33,6 +33,18 @@ class FakePrincipal: class DocsContextTests(unittest.TestCase): + def test_docs_reader_is_the_managed_authenticated_tenant_default(self) -> None: + manifest = get_docs_manifest() + roles = {template.slug: template for template in manifest.role_templates} + + self.assertTrue(roles["docs_reader"].default_authenticated) + self.assertTrue(roles["docs_reader"].managed) + self.assertEqual(roles["docs_reader"].level, "tenant") + self.assertEqual( + roles["docs_reader"].permissions, + ("docs:documentation:read",), + ) + def test_topic_groups_preserve_layer_classification(self) -> None: registry = PlatformRegistry() registry.register(get_tenancy_manifest()) diff --git a/webui/package.json b/webui/package.json index 4212da8..f9fa89d 100644 --- a/webui/package.json +++ b/webui/package.json @@ -1,6 +1,6 @@ { "name": "@govoplan/docs-webui", - "version": "0.1.9", + "version": "0.1.10", "private": true, "type": "module", "main": "src/index.ts", @@ -13,7 +13,7 @@ } }, "peerDependencies": { - "@govoplan/core-webui": "^0.1.8", + "@govoplan/core-webui": "^0.1.10", "lucide-react": "^1.23.0", "react": "^19.0.0", "react-dom": "^19.0.0", diff --git a/webui/src/module.ts b/webui/src/module.ts index d66b845..f2f9a14 100644 --- a/webui/src/module.ts +++ b/webui/src/module.ts @@ -14,7 +14,7 @@ const translations = { export const docsModule: PlatformWebModule = { id: "docs", label: "i18n:govoplan-docs.docs.68a41942", - version: "0.1.9", + version: "0.1.10", dependencies: ["access"], optionalDependencies: ["policy", "audit", "ops", "workflow", "search"], translations,