Add governed DSAR coverage for Notifications #5

New Issue

2026-08-21T04:03:46+02:00

zemion commented

2026-08-21 04:03:46 +02:00

Goal

Cover notification messages, delivery evidence, and personal notification preferences in the Core data-subject request workflow tracked by GovOPlaN/govoplan#47.

Scope

provide and document privacy.dsar.notifications
correlate exact tenant recipient account, membership, identity, and email selectors
export bounded message content, lifecycle state, and sanitized delivery attempts
export bounded personal channel and source-muting preferences
delete only subject-addressed in-product notification copies and personal preferences
require manual review for external-channel delivery records
make execution tenant-scoped, change-safe, fail-closed, and idempotent
add focused provider and Core workflow tests

Acceptance criteria

unrelated recipients and tenants cannot be discovered or mutated
deleting an inbox copy does not traverse or delete its source-module record
external delivery evidence is never automatically removed
payload, metadata, content, and attempts have explicit export bounds
conflicting aliases and foreign records/actions fail closed
focused tests, Ruff, and manifest checks pass

## Goal Cover notification messages, delivery evidence, and personal notification preferences in the Core data-subject request workflow tracked by GovOPlaN/govoplan#47. ## Scope - provide and document `privacy.dsar.notifications` - correlate exact tenant recipient account, membership, identity, and email selectors - export bounded message content, lifecycle state, and sanitized delivery attempts - export bounded personal channel and source-muting preferences - delete only subject-addressed in-product notification copies and personal preferences - require manual review for external-channel delivery records - make execution tenant-scoped, change-safe, fail-closed, and idempotent - add focused provider and Core workflow tests ## Acceptance criteria - unrelated recipients and tenants cannot be discovered or mutated - deleting an inbox copy does not traverse or delete its source-module record - external delivery evidence is never automatically removed - payload, metadata, content, and attempts have explicit export bounds - conflicting aliases and foreign records/actions fail closed - focused tests, Ruff, and manifest checks pass

zemion commented

2026-08-21 04:08:40 +02:00

Implemented and pushed in 975d90b.

Notifications now provides privacy.dsar.notifications with exact-tenant account/membership/identity/user/email correlation, bounded message and preference exports, sensitive-key redaction, sanitized delivery-attempt projections, and optional exact resource narrowing. Personal preferences and in-product inbox copies are change-checked and deletable; external-channel delivery evidence requires manual review. Verification: 24 tests plus 8 subtests passed, Ruff passed, and the 68/68 manifest registry check passed.

Implemented and pushed in `975d90b`. Notifications now provides `privacy.dsar.notifications` with exact-tenant account/membership/identity/user/email correlation, bounded message and preference exports, sensitive-key redaction, sanitized delivery-attempt projections, and optional exact resource narrowing. Personal preferences and in-product inbox copies are change-checked and deletable; external-channel delivery evidence requires manual review. Verification: 24 tests plus 8 subtests passed, Ruff passed, and the 68/68 manifest registry check passed.

zemion closed this issue

2026-08-21 04:08:40 +02:00

zemion referenced this issue from GovOPlaN/govoplan

2026-08-21 04:43:55 +02:00

[Privacy] Complete DSAR provider coverage across data-owning modules #47

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-notifications#5