Implement typed effective identity relationships

This commit is contained in:
2026-08-02 14:44:42 +02:00
parent 820ea5eeab
commit 6f6c45f6e2
13 changed files with 1901 additions and 3 deletions
+11
View File
@@ -20,6 +20,7 @@ vendor or protocol.
- inbound synchronization from external identity-management systems
- identity lifecycle import, update, disable, and reconciliation jobs
- identity-to-organization-function assignment links inside GovOPlaN
- typed business groups and effective-dated identity relationship links
- bridge views that combine identity and organization facts, such as identity
candidates for organization function assignments
- mapping external identities, accounts, groups, organizational units,
@@ -73,6 +74,12 @@ assignment links:
- `GET /api/v1/idm/organization-function-assignments`
- `POST /api/v1/idm/organization-function-assignments`
- `PATCH /api/v1/idm/organization-function-assignments/{assignment_id}`
- `GET|POST /api/v1/idm/typed-groups`
- `PATCH /api/v1/idm/typed-groups/{group_id}`
- `GET|POST /api/v1/idm/relationships`
- `PATCH /api/v1/idm/relationships/{relationship_id}`
- `POST /api/v1/idm/relationships/{relationship_id}/revoke`
- `GET /api/v1/idm/typed-groups/{group_id}/memberships`
The candidate endpoint returns searchable identity/account candidates for IDM
assignment forms. Assignment writes validate the identity/account link through
@@ -139,6 +146,10 @@ shared `govoplan.idm.expire_assignments` task also emits the corresponding
`idm.function_assignment.expired.v1` event. IDM records the event marker in the
same database transaction, making repeated sweeps idempotent.
Typed group and relationship behavior, including effective-time resolution and
the provider-neutral capability consumed by Distribution Lists, is documented
in [Typed groups and effective-dated relationships](docs/TYPED_RELATIONSHIPS.md).
## First Milestone
The first useful milestone is a read-only synchronization preview: