54 lines
2.6 KiB
Markdown
54 lines
2.6 KiB
Markdown
# Quick Access
|
|
|
|
Quick Access is an optional presentation module. Feature modules register
|
|
compact tool metadata through the Core manifest contract and contribute their
|
|
renderer through `quickAccess.tools`. Quick Access owns the rail, overlay,
|
|
effective preference calculation, and settings UI. It never copies or owns the
|
|
underlying business objects.
|
|
|
|
## Resolution
|
|
|
|
The live catalogue is derived from installed module manifests. Personal
|
|
catalogues contain only currently authorized tools; system and tenant
|
|
administrators can inspect the complete registered catalogue and inherited
|
|
constraints. Effective visibility is resolved in this order:
|
|
|
|
1. module installation and tenant entitlement;
|
|
2. system availability, blocking, forcing, and ordering;
|
|
3. tenant availability, blocking, forcing, and ordering;
|
|
4. the user's enabled state and ordering;
|
|
5. the active View or Workflow projection;
|
|
6. the current principal's permissions.
|
|
|
|
An upper scope may block or force a category or tool. Lower scopes cannot
|
|
override that decision, but may configure any still-available item. Stale
|
|
preferences are retained and diagnosed so uninstalling and reinstalling a
|
|
contributing module does not silently discard a user's arrangement.
|
|
|
|
## Categories
|
|
|
|
The initial stable categories are Work, Calendar, Messages, and Files. Messages
|
|
may contain Mail, Postbox, and future chat contributions in one overlay. A
|
|
category is a presentation grouping only; channel-specific authority,
|
|
retention, acknowledgement, encryption, and delivery state remain with each
|
|
owner module.
|
|
|
|
## Safety
|
|
|
|
Quick Access is not an authorization boundary. Every contribution keeps its
|
|
own permission requirements and View surface. Full-page routes remain the
|
|
canonical fallback. Launch-context version 2 contains only the tenant/account
|
|
identity, a reference-contract-version-1 active object, acting-assignment
|
|
identifiers, temporal selection, exact View identity, View recommendations or
|
|
focus, and a safe return route. Cross-tenant object references are discarded
|
|
and unknown versions fail closed. View focus applies only when at least one
|
|
focused tool is currently enabled, context-compatible, and authorized; a
|
|
recommendation only changes ordering and emphasis.
|
|
|
|
Each renderer performs owner-side reads and effects and explicitly reports
|
|
either a result-contract-version-1 completion with a typed owner reference or
|
|
a cancellation reason. Closing the drawer is not completion. The host may
|
|
listen for that correlated result while its unsaved page state remains mounted.
|
|
Disabling this module removes the rail without making any domain state
|
|
unavailable through its owning module.
|