[Feature] Expose effective function-assignment resolution and lifecycle events for consumers #5

New Issue

2026-07-28T18:59:04+02:00

zemion commented

2026-07-28 18:59:04 +02:00

Outcome

IDM provides the normalized, tenant-safe assignment contract needed by Postbox and other consumers to determine which identities/accounts currently hold a function in an organizational unit, including delegation and acting-for context.

Existing foundation

idm.directory already resolves active assignments for an identity/account and filters validity windows and invalid delegated sources. This issue extends that useful slice rather than introducing a second assignment model.

Acceptance criteria

Add batch account/identity resolution to avoid one query per postbox or message.
Add reverse resolution for effective incumbents of a concrete function/unit, including an explicit vacant result.
Preserve direct, delegated, acting-for, validity-window, source-assignment, and account-specific provenance in DTOs.
Emit versioned assignment-created/changed/revoked/expired events suitable for cache invalidation, Postbox access updates, and notifications.
Make effective-time evaluation testable and deterministic; reject cross-tenant references.
Distinguish organizational responsibility from application permissions. Holding a function does not itself grant generic module rights.
Do not import Postbox, Access, or Organizations implementations; use Core-owned contracts and the Organizations capability.
Tests cover multiple accounts per identity, multiple simultaneous incumbents, vacancy, delegation expiry, revocation, subunit scope, and batch queries.

Consumer

This is a P1 foundation for function-bound Postbox access and attention routing.

## Outcome IDM provides the normalized, tenant-safe assignment contract needed by Postbox and other consumers to determine which identities/accounts currently hold a function in an organizational unit, including delegation and acting-for context. ## Existing foundation `idm.directory` already resolves active assignments for an identity/account and filters validity windows and invalid delegated sources. This issue extends that useful slice rather than introducing a second assignment model. ## Acceptance criteria - Add batch account/identity resolution to avoid one query per postbox or message. - Add reverse resolution for effective incumbents of a concrete function/unit, including an explicit vacant result. - Preserve direct, delegated, acting-for, validity-window, source-assignment, and account-specific provenance in DTOs. - Emit versioned assignment-created/changed/revoked/expired events suitable for cache invalidation, Postbox access updates, and notifications. - Make effective-time evaluation testable and deterministic; reject cross-tenant references. - Distinguish organizational responsibility from application permissions. Holding a function does not itself grant generic module rights. - Do not import Postbox, Access, or Organizations implementations; use Core-owned contracts and the Organizations capability. - Tests cover multiple accounts per identity, multiple simultaneous incumbents, vacancy, delegation expiry, revocation, subunit scope, and batch queries. ## Consumer This is a P1 foundation for function-bound Postbox access and attention routing.

zemion added the module/idm module/organizations module/identity module/postbox area/api area/db area/security codex/ready

labels 2026-07-28 18:59:04 +02:00

zemion referenced this issue from GovOPlaN/govoplan-campaign

2026-07-28 18:59:05 +02:00

[Feature] Add Postbox as a governed Campaign delivery channel #81

zemion referenced this issue from GovOPlaN/govoplan-postbox

2026-07-28 18:59:06 +02:00

[Feature] Implement function-organization Postbox access through IDM, Organizations, and Core contracts #3

zemion referenced this issue from GovOPlaN/govoplan-postbox

2026-07-28 19:03:42 +02:00

[User Story] Deliver campaign messages to organizational function postboxes #16

zemion commented

2026-07-29 00:19:27 +02:00

Codex State: progress

Implemented deterministic effective-time lookup, batch identity/account resolution, reverse function incumbencies with explicit vacancy, tenant/function validation, active-function and delegated-source checks, and created/changed/revoked/expired lifecycle events. Focused IDM and composed Postbox tests pass. Automatic future-expiry emission, subunit-scope coverage, and the remaining expanded matrix stay open.

## Codex State: progress Implemented deterministic effective-time lookup, batch identity/account resolution, reverse function incumbencies with explicit vacancy, tenant/function validation, active-function and delegated-source checks, and created/changed/revoked/expired lifecycle events. Focused IDM and composed Postbox tests pass. Automatic future-expiry emission, subunit-scope coverage, and the remaining expanded matrix stay open.

zemion added

and removed

labels 2026-07-29 00:20:25 +02:00

zemion referenced this issue

2026-07-31 14:48:09 +02:00

[Feature] Add typed IDM groups and effective-dated relationship resolution #7

zemion commented

2026-07-31 14:49:03 +02:00

AdreMa consumer note: the distinction is now explicit in the Distribution Lists roadmap. IDM lifecycle status remains separate from selectable business state; audiences resolve typed groups, functions, and effective-dated relationships through IDM capabilities. The missing typed-group relationship slice is tracked in #7.

zemion referenced this issue from GovOPlaN/govoplan-dist-lists

2026-07-31 14:49:44 +02:00

[Feature] Define distribution-list DTOs and expansion contract #1

zemion commented

2026-07-31 15:06:34 +02:00

The effective assignment contract is a prerequisite for the new function request and grant journeys in #8 and #9. IDM remains the assignment/change-record owner; Workflow Engine coordinates the pinned process and must not become the assignment source of truth.

zemion commented

2026-07-31 18:08:30 +02:00

Implemented and pushed in govoplan-core 50a8d45 and govoplan-idm f025b0c.

Completed acceptance:

added optional Core-owned idm.assignmentLifecycle worker contract and a once-per-minute Celery beat task;
added transaction-bound, idempotent future-expiry processing with a persisted marker and due-expiry index on both release and dev migration tracks;
created/changed/revoked/expired events preserve tenant, identity/account, function/unit, subunit, delegation, acting-for, and validity provenance;
expanded deterministic tests for multiple linked accounts, account-specific resolution, simultaneous incumbents, vacancy, revocation/reactivation, delegation source validity and cross-tenant rejection, subunit provenance, rollback, and repeated expiry sweeps;
kept function responsibility separate from application permission grants.

Verification:

full govoplan-idm suite: 18 tests passed;
Core module/worker checks: 122 + 3 tests passed;
Ruff and git diff checks passed;
fresh SQLite release and dev migration tracks both reached IDM head 9a0b1c2d3e4f.

Implemented and pushed in govoplan-core 50a8d45 and govoplan-idm f025b0c. Completed acceptance: - added optional Core-owned idm.assignmentLifecycle worker contract and a once-per-minute Celery beat task; - added transaction-bound, idempotent future-expiry processing with a persisted marker and due-expiry index on both release and dev migration tracks; - created/changed/revoked/expired events preserve tenant, identity/account, function/unit, subunit, delegation, acting-for, and validity provenance; - expanded deterministic tests for multiple linked accounts, account-specific resolution, simultaneous incumbents, vacancy, revocation/reactivation, delegation source validity and cross-tenant rejection, subunit provenance, rollback, and repeated expiry sweeps; - kept function responsibility separate from application permission grants. Verification: - full govoplan-idm suite: 18 tests passed; - Core module/worker checks: 122 + 3 tests passed; - Ruff and git diff checks passed; - fresh SQLite release and dev migration tracks both reached IDM head 9a0b1c2d3e4f.

zemion closed this issue

2026-07-31 18:08:31 +02:00

zemion removed the

status

in-progress

label 2026-07-31 18:08:37 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-idm#5