[Feature] Implement function-organization Postbox access through IDM, Organizations, and Core contracts #3

New Issue

2026-07-07T21:00:57+02:00

zemion commented

2026-07-07 21:00:57 +02:00

Imported from the repository seed backlog.

Source: /mnt/DATA/git/govoplan-postbox/docs/POSTBOX_BACKLOG.md
Line: 7
Section: P1 Immediate
Milestone: P1 Immediate

Backlog item:

Implement role-organization-bound access checks through core/access contracts

Refined boundary and acceptance criteria

Resolve the authenticated account to identities and effective direct/delegated/acting-for function assignments through idm.directory.
Resolve concrete function, function type, unit, and bounded hierarchy facts through organizations.directory.
Use Core/Access permission evaluation for generic Postbox actions, but do not require a function-to-RBAC-role mapping merely to access the postbox bound to that function.
Return separate discover/read/send/reply/acknowledge/administer decisions with assignment, function, unit, delegation, policy, and binding provenance.
Assignment changes affect current/future access and cache state; they do not rewrite historical access/delivery evidence.
Enforce tenant isolation, validity windows, account-specific acting context, classification constraints, and fail-closed behavior when required identity facts are unavailable.
Batch directory lookups and cover vacancy, multiple incumbents, delegation expiry, revocation, and reassignment in tests.

Dependencies: IDM effective assignment contract and Organizations hierarchy contract. Parent story: #16.

Imported from the repository seed backlog. - Source: `/mnt/DATA/git/govoplan-postbox/docs/POSTBOX_BACKLOG.md` - Line: `7` - Section: `P1 Immediate` - Milestone: `P1 Immediate` Backlog item: ```text Implement role-organization-bound access checks through core/access contracts ```  ## Refined boundary and acceptance criteria - Resolve the authenticated account to identities and effective direct/delegated/acting-for function assignments through `idm.directory`. - Resolve concrete function, function type, unit, and bounded hierarchy facts through `organizations.directory`. - Use Core/Access permission evaluation for generic Postbox actions, but do not require a function-to-RBAC-role mapping merely to access the postbox bound to that function. - Return separate discover/read/send/reply/acknowledge/administer decisions with assignment, function, unit, delegation, policy, and binding provenance. - Assignment changes affect current/future access and cache state; they do not rewrite historical access/delivery evidence. - Enforce tenant isolation, validity windows, account-specific acting context, classification constraints, and fail-closed behavior when required identity facts are unavailable. - Batch directory lookups and cover vacancy, multiple incumbents, delegation expiry, revocation, and reassignment in tests. Dependencies: [IDM effective assignment contract](https://git.add-ideas.de/GovOPlaN/govoplan-idm/issues/5) and [Organizations hierarchy contract](https://git.add-ideas.de/GovOPlaN/govoplan-organizations/issues/5). Parent story: #16.

zemion added this to the P1 Immediate milestone 2026-07-07 21:00:57 +02:00

zemion changed title from ~~[Feature] Implement role-organization-bound access checks through core/access contracts~~ to [Feature] Implement function-organization Postbox access through IDM, Organizations, and Core contracts

2026-07-28 18:59:06 +02:00

zemion referenced this issue

2026-07-28 19:03:42 +02:00

[User Story] Deliver campaign messages to organizational function postboxes #16

zemion referenced this issue from GovOPlaN/govoplan-access

2026-07-28 19:03:43 +02:00

Add semantic access admin WebUI and acting-in-place context selector #10

zemion added the

module/access module/idm module/organizations module/postbox area/api area/security codex/ready labels 2026-07-28 19:04:43 +02:00

zemion commented

2026-07-29 00:19:18 +02:00

Codex State: progress

Function-bound access now combines generic Postbox actions with current IDM direct/delegated/acting assignments, enforces tenant and validity boundaries, requires explicit acting context, reports vacancy/incumbents, and uses batch incumbency lookup. Assignment removal immediately removes current access because no second membership/cache model is kept. More granular reply/export/classification policy remains for later slices.

## Codex State: progress Function-bound access now combines generic Postbox actions with current IDM direct/delegated/acting assignments, enforces tenant and validity boundaries, requires explicit acting context, reports vacancy/incumbents, and uses batch incumbency lookup. Assignment removal immediately removes current access because no second membership/cache model is kept. More granular reply/export/classification policy remains for later slices.

zemion added

and removed

labels 2026-07-29 00:20:18 +02:00

zemion added the source/backlog-import label 2026-07-29 14:15:14 +02:00

zemion commented

2026-07-31 15:23:53 +02:00

Close-out audit, 2026-07-31

Since the previous progress note, bdc161e added the explicit fail-closed access decision table and source/assignment provenance. Current tests cover generic permission ordering, direct/delegated/directory/governance/system assignments, exact acting context, vacancy, tenant isolation, assignment removal, and inactive Postboxes.

Remaining acceptance work is now narrow:

add a distinct reply action/permission/decision (the Core contract currently has discover/read/send/acknowledge/administer);
apply explicit classification constraints to access decisions;
add real-directory tests for function/unit deactivation, reassignment, and delegated-expiry transitions.

Keep open until those contracts and tests land.

## Close-out audit, 2026-07-31 Since the previous progress note, `bdc161e` added the explicit fail-closed access decision table and source/assignment provenance. Current tests cover generic permission ordering, direct/delegated/directory/governance/system assignments, exact acting context, vacancy, tenant isolation, assignment removal, and inactive Postboxes. Remaining acceptance work is now narrow: - add a distinct `reply` action/permission/decision (the Core contract currently has discover/read/send/acknowledge/administer); - apply explicit classification constraints to access decisions; - add real-directory tests for function/unit deactivation, reassignment, and delegated-expiry transitions. Keep open until those contracts and tests land.

zemion referenced this issue

2026-07-31 15:23:53 +02:00

[Feature] Create focused tests for access changes when role assignments are granted, revoked, or expire #5

zemion commented

2026-07-31 18:22:14 +02:00

Implemented in GovOPlaN/govoplan-core@e37d8fe and GovOPlaN/govoplan-postbox@0b6ebc3. Postbox access now has a distinct reply permission/action, explicit public/internal/confidential/restricted clearance decisions, stable binding-state provenance, and fail-closed validation of active same-tenant units/functions. The service also enforces message/container classification ceilings. Focused contract and integration tests pass.

zemion closed this issue

2026-07-31 18:22:14 +02:00

zemion removed the

status

in-progress

label 2026-07-31 18:22:15 +02:00

zemion commented

2026-07-31 22:55:10 +02:00

Post-closure verification: explicit acting-in-place context is now implemented in GovOPlaN/govoplan-access@9776f86 and consumed through the Core principal contract. GovOPlaN/govoplan-postbox@e3daf40 rejects arbitrary assignment overrides and uses the effective assignment selected by the authenticated principal. Focused Access/Postbox tests and the full module startup smoke passed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-postbox#3