Add identity trust administration surfaces

src/govoplan_identity_trust/backend/manifest.py

@@ -14,12 +14,14 @@ from govoplan_core.core.modules import (
     CapabilityDocumentation,
     DocumentationLink,
     DocumentationTopic,
+    FrontendModule,
     MigrationSpec,
     ModuleContext,
     ModuleInterfaceProvider,
     ModuleManifest,
     PermissionDefinition,
     RoleTemplate,
+    ViewSurface,
 )
 from govoplan_core.core.provider_governance import declared_module_architecture
 from govoplan_core.db.base import Base
@@ -34,6 +36,7 @@ DEVICE_READ_SCOPE = "identity_trust:device:read"
 DEVICE_WRITE_SCOPE = "identity_trust:device:write"
 KEY_ACCESS_SCOPE = "identity_trust:key_access:approve"
 ASSURANCE_SCOPE = "identity_trust:assurance:record"
+ASSURANCE_READ_SCOPE = "identity_trust:assurance:read"
 ADMIN_SCOPE = "identity_trust:device:admin"
 
 
@@ -86,6 +89,11 @@ manifest = ModuleManifest(
             "Evaluate key access",
             "Evaluate device and key-epoch trust after Access has approved a resource action.",
         ),
+        _permission(
+            ASSURANCE_READ_SCOPE,
+            "View assurance evidence",
+            "View bounded assurance state and provenance for the acting account or, with administrative authority, another account.",
+        ),
         _permission(
             ASSURANCE_SCOPE,
             "Record assurance evidence",
@@ -102,7 +110,7 @@ manifest = ModuleManifest(
             slug="identity_trust_user",
             name="Identity trust user",
             description="Manage own public device keys.",
-            permissions=(DEVICE_READ_SCOPE, DEVICE_WRITE_SCOPE),
+            permissions=(DEVICE_READ_SCOPE, DEVICE_WRITE_SCOPE, ASSURANCE_READ_SCOPE),
         ),
         RoleTemplate(
             slug="identity_trust_officer",
@@ -110,6 +118,7 @@ manifest = ModuleManifest(
             description="Administer trust epochs and assurance evidence.",
             permissions=(
                 DEVICE_READ_SCOPE,
+                ASSURANCE_READ_SCOPE,
                 KEY_ACCESS_SCOPE,
                 ASSURANCE_SCOPE,
                 ADMIN_SCOPE,
@@ -117,6 +126,42 @@ manifest = ModuleManifest(
         ),
     ),
     route_factory=_router,
+    frontend=FrontendModule(
+        module_id=MODULE_ID,
+        package_name="@govoplan/identity-trust-webui",
+        view_surfaces=(
+            ViewSurface(
+                id="identity_trust.settings.devices",
+                module_id=MODULE_ID,
+                kind="section",
+                label="Device trust",
+                order=10,
+            ),
+            ViewSurface(
+                id="identity_trust.admin.trust",
+                module_id=MODULE_ID,
+                kind="section",
+                label="Identity trust administration",
+                order=20,
+            ),
+            ViewSurface(
+                id="identity_trust.admin.epochs",
+                module_id=MODULE_ID,
+                kind="section",
+                label="Key epoch administration",
+                parent_id="identity_trust.admin.trust",
+                order=30,
+            ),
+            ViewSurface(
+                id="identity_trust.admin.decisions",
+                module_id=MODULE_ID,
+                kind="section",
+                label="Key-access decisions",
+                parent_id="identity_trust.admin.trust",
+                order=40,
+            ),
+        ),
+    ),
     capability_factories={
         CAPABILITY_IDENTITY_TRUST_DIRECTORY: _service,
         CAPABILITY_IDENTITY_TRUST_ASSURANCE: _service,
@@ -162,7 +207,7 @@ manifest = ModuleManifest(
             title="Device keys and key epochs",
             summary="Separate login authority from public device-key and cryptographic-access trust.",
             body=(
-                "Identity Trust stores public keys only. Access first decides whether an account may reach a protected resource; Identity Trust then verifies the current device and key epoch and records an auditable decision. Function and Postbox history grants are explicit epoch policy, and revocation cannot erase plaintext already obtained."
+                "Identity Trust stores public keys only. Users can review and revoke their device keys and inspect assurance provenance in Settings. Security officers can select an authorized account, inspect revoked or compromised-device evidence, rotate subject key epochs, and review key-access decisions in Administration. Access first decides whether an account may reach a protected resource; Identity Trust then verifies the current device and key epoch and records an auditable decision. Function and Postbox history grants are explicit epoch policy, and revocation cannot erase plaintext already obtained. Every revoke and rotation is revision-bound and stale actions must be reloaded."
             ),
             layer="available",
             documentation_types=("admin", "user"),
@@ -211,6 +256,7 @@ def get_manifest() -> ModuleManifest:
 
 __all__ = [
     "ADMIN_SCOPE",
+    "ASSURANCE_READ_SCOPE",
     "ASSURANCE_SCOPE",
     "DEVICE_READ_SCOPE",
     "DEVICE_WRITE_SCOPE",