feat(idm): administer typed identity relationships
Module Package Release / publish-packages (push) Successful in 12s
Module Package Release / publish-packages (push) Successful in 12s
This commit is contained in:
@@ -61,6 +61,7 @@ router = APIRouter(prefix="/idm", tags=["idm"])
|
||||
ORGANIZATION_IDENTITY_READ_SCOPES = (
|
||||
"idm:organization_identity:read",
|
||||
"idm:organization_assignment:write",
|
||||
"idm:relationship:write",
|
||||
"organizations:function:assign",
|
||||
"admin:users:read",
|
||||
)
|
||||
|
||||
@@ -56,7 +56,7 @@ from govoplan_idm.backend.workflow_definitions import (
|
||||
from govoplan_idm.backend.search_source import create_idm_search_source
|
||||
|
||||
|
||||
MODULE_VERSION = "0.1.18"
|
||||
MODULE_VERSION = "0.1.19"
|
||||
|
||||
IDM_READ_SCOPES = (
|
||||
"idm:organization_assignment:read",
|
||||
@@ -500,17 +500,113 @@ manifest = ModuleManifest(
|
||||
DocumentationTopic(
|
||||
id="idm.reference.typed-relationships",
|
||||
title="Typed groups and effective relationships",
|
||||
summary="IDM keeps business group membership separate from identity lifecycle status.",
|
||||
summary="Create tenant-scoped business groups, maintain effective-dated identity links, inspect membership decisions, and retain source provenance without turning membership into access authority.",
|
||||
body=(
|
||||
"Typed groups and identity relationships are tenant-scoped, effective-dated facts. "
|
||||
"Current, future, expired, and revoked links remain explainable, including external "
|
||||
"directory source revisions and provenance. Consumers such as Distribution Lists use "
|
||||
"the IDM relationship capability and never infer application permissions from membership."
|
||||
"Typed groups and identity relationships are tenant-scoped institutional facts. Administrators use stable group keys and types, searchable identity and group selectors, effective dates, source references, typed properties, and provenance to record why a relationship exists. "
|
||||
"A future relationship is scheduled but not yet effective. An expired relationship no longer contributes to membership, and revocation stops membership immediately while retaining the actor, time, reason, source, and revision as evidence. Revoked relationships cannot be edited or reactivated; create a replacement when the fact becomes valid again. "
|
||||
"The membership inspector evaluates a selected group, time, and relationship kind through the same Core capability used by downstream consumers. Included and excluded decisions remain visible with reason codes and identity lifecycle state. Business membership never grants application permissions; Access evaluates roles and rights separately."
|
||||
),
|
||||
layer="configured",
|
||||
documentation_types=("admin", "user"),
|
||||
audience=("tenant_admin", "operator", "module_admin"),
|
||||
related_modules=("identity", "organizations", "dist_lists"),
|
||||
conditions=(
|
||||
DocumentationCondition(
|
||||
required_modules=("idm",),
|
||||
any_scopes=("idm:relationship:read", "idm:relationship:write"),
|
||||
),
|
||||
),
|
||||
links=(
|
||||
DocumentationLink(label="IDM relationship administration", href="/idm", kind="runtime"),
|
||||
DocumentationLink(label="Typed groups API", href="/api/v1/idm/typed-groups", kind="api"),
|
||||
DocumentationLink(label="Identity relationships API", href="/api/v1/idm/relationships", kind="api"),
|
||||
DocumentationLink(label="Typed relationship contract", href="docs/TYPED_RELATIONSHIPS.md", kind="repository"),
|
||||
),
|
||||
translations={
|
||||
"de": {
|
||||
"title": "Typisierte Gruppen und wirksame Beziehungen",
|
||||
"summary": "Erstellen Sie mandantenbezogene Fachgruppen, pflegen Sie zeitlich wirksame Identitätsbeziehungen, prüfen Sie Mitgliedschaftsentscheidungen und bewahren Sie die Herkunft auf, ohne Mitgliedschaft mit Zugriffsrechten gleichzusetzen.",
|
||||
"body": "Typisierte Gruppen und Identitätsbeziehungen sind mandantenbezogene institutionelle Tatsachen. Administrierende erfassen mit stabilen Gruppenschlüsseln und -typen, durchsuchbaren Identitäts- und Gruppenauswahlen, Wirksamkeitsdaten, Quellreferenzen, typisierten Eigenschaften und Herkunftsnachweisen, warum eine Beziehung besteht. Eine zukünftige Beziehung ist geplant, aber noch nicht wirksam. Eine abgelaufene Beziehung trägt nicht mehr zur Mitgliedschaft bei. Ein Widerruf beendet die Mitgliedschaft sofort, bewahrt jedoch handelnde Person, Zeitpunkt, Grund, Quelle und Revision als Nachweis. Widerrufene Beziehungen können weder bearbeitet noch reaktiviert werden; wird die Tatsache erneut gültig, ist eine neue Beziehung anzulegen. Die Mitgliedschaftsprüfung wertet eine gewählte Gruppe, einen Zeitpunkt und eine Beziehungsart über dieselbe Core-Fähigkeit aus, die nachgelagerte Verbraucher verwenden. Einbezogene und ausgeschlossene Entscheidungen bleiben mit Begründungscode und Identitätsstatus sichtbar. Eine fachliche Mitgliedschaft erteilt niemals Anwendungsberechtigungen; Access bewertet Rollen und Rechte getrennt.",
|
||||
}
|
||||
},
|
||||
metadata={
|
||||
"kind": "reference",
|
||||
"route": "/idm",
|
||||
"screen": "Typed groups and identity relationships",
|
||||
"help_contexts": [
|
||||
"idm.relationships.page",
|
||||
"idm.typed-groups.action.reload",
|
||||
"idm.typed-groups.action.create",
|
||||
"idm.typed-groups.action.edit",
|
||||
"idm.typed-groups.action.save",
|
||||
"idm.typed-groups.action.inspect-memberships",
|
||||
"idm.typed-groups.action.resolve-memberships",
|
||||
"idm.typed-groups.editor",
|
||||
"idm.typed-groups.membership-resolution",
|
||||
"idm.typed-groups.field.show-inactive",
|
||||
"idm.typed-groups.field.key",
|
||||
"idm.typed-groups.field.name",
|
||||
"idm.typed-groups.field.type",
|
||||
"idm.typed-groups.field.status",
|
||||
"idm.typed-groups.field.description",
|
||||
"idm.typed-groups.field.source-provider",
|
||||
"idm.typed-groups.field.source-resource-type",
|
||||
"idm.typed-groups.field.source-resource-id",
|
||||
"idm.typed-groups.field.source-revision",
|
||||
"idm.typed-groups.field.properties",
|
||||
"idm.typed-groups.field.provenance",
|
||||
"idm.typed-groups.field.membership-effective-at",
|
||||
"idm.typed-groups.field.membership-kinds",
|
||||
"idm.relationships.action.reload",
|
||||
"idm.relationships.action.create",
|
||||
"idm.relationships.action.edit",
|
||||
"idm.relationships.action.save",
|
||||
"idm.relationships.action.revoke",
|
||||
"idm.relationships.action.confirm-revoke",
|
||||
"idm.relationships.editor",
|
||||
"idm.relationships.confirm-revoke",
|
||||
"idm.relationships.field.show-revoked",
|
||||
"idm.relationships.field.kind",
|
||||
"idm.relationships.field.role",
|
||||
"idm.relationships.field.subject-identity",
|
||||
"idm.relationships.field.target-type",
|
||||
"idm.relationships.field.target-group",
|
||||
"idm.relationships.field.related-identity",
|
||||
"idm.relationships.field.valid-from",
|
||||
"idm.relationships.field.valid-until",
|
||||
"idm.relationships.field.source-provider",
|
||||
"idm.relationships.field.source-resource-type",
|
||||
"idm.relationships.field.source-resource-id",
|
||||
"idm.relationships.field.source-revision",
|
||||
"idm.relationships.field.properties",
|
||||
"idm.relationships.field.provenance",
|
||||
"idm.relationships.field.revocation-reason",
|
||||
],
|
||||
"prerequisites": [
|
||||
"The identities exist in the tenant identity directory.",
|
||||
"The actor has relationship read permission and write permission for mutations.",
|
||||
"The accountable source, effective window, relationship kind, and business purpose are known.",
|
||||
],
|
||||
"steps": [
|
||||
"Create or select a typed group with a stable key, type, and source provenance.",
|
||||
"Create a relationship with searchable subject and target references and the intended validity window.",
|
||||
"Inspect effective memberships at the relevant time and review every included or excluded decision.",
|
||||
"Revoke a relationship with a retained reason when the fact must stop before its scheduled end.",
|
||||
],
|
||||
"outcome": "The tenant has explainable, effective-dated business membership facts that downstream consumers can resolve without importing IDM internals or inferring Access rights.",
|
||||
"limitations": [
|
||||
"Membership resolution is tenant-scoped and rejects cross-tenant group references.",
|
||||
"A revoked relationship is immutable and requires a replacement for later reuse.",
|
||||
"Membership alone never activates an identity or grants an application permission.",
|
||||
],
|
||||
"consequences": [
|
||||
"A future start delays membership until the selected instant.",
|
||||
"Expiry removes the relationship from effective resolution while retaining evidence.",
|
||||
"Revocation immediately removes the relationship from effective resolution and cannot be undone.",
|
||||
"Changing an externally sourced fact without matching provenance can break reconciliation accountability.",
|
||||
],
|
||||
"verification": "Reload both directories, confirm the record revision and source fields, then resolve the target group's memberships at times before, during, and after the validity window. Verify that Access permissions remain unchanged.",
|
||||
},
|
||||
order=28,
|
||||
),
|
||||
DocumentationTopic(
|
||||
|
||||
Reference in New Issue
Block a user