47 lines
2.1 KiB
Markdown
47 lines
2.1 KiB
Markdown
# Quick Access
|
|
|
|
Quick Access is an optional presentation module. Feature modules register
|
|
compact tool metadata through the Core manifest contract and contribute their
|
|
renderer through `quickAccess.tools`. Quick Access owns the rail, overlay,
|
|
effective preference calculation, and settings UI. It never copies or owns the
|
|
underlying business objects.
|
|
|
|
## Resolution
|
|
|
|
The live catalogue is derived from installed module manifests. Personal
|
|
catalogues contain only currently authorized tools; system and tenant
|
|
administrators can inspect the complete registered catalogue and inherited
|
|
constraints. Effective visibility is resolved in this order:
|
|
|
|
1. module installation and tenant entitlement;
|
|
2. system availability, blocking, forcing, and ordering;
|
|
3. tenant availability, blocking, forcing, and ordering;
|
|
4. the user's enabled state and ordering;
|
|
5. the active View or Workflow projection;
|
|
6. the current principal's permissions.
|
|
|
|
An upper scope may block or force a category or tool. Lower scopes cannot
|
|
override that decision, but may configure any still-available item. Stale
|
|
preferences are retained and diagnosed so uninstalling and reinstalling a
|
|
contributing module does not silently discard a user's arrangement.
|
|
|
|
## Categories
|
|
|
|
The initial stable categories are Work, Calendar, Messages, and Files. Messages
|
|
may contain Mail, Postbox, and future chat contributions in one overlay. A
|
|
category is a presentation grouping only; channel-specific authority,
|
|
retention, acknowledgement, encryption, and delivery state remain with each
|
|
owner module.
|
|
|
|
## Safety
|
|
|
|
Quick Access is not an authorization boundary. Every contribution keeps its
|
|
own permission requirements and View surface. Full-page routes remain the
|
|
canonical fallback. Launch context version 1 contains only the tenant/account
|
|
identity, safe active-object reference, acting-assignment identifiers,
|
|
temporal selection, exact View identity, and return route. Cross-tenant object
|
|
references are discarded and unknown context versions are ignored. The
|
|
destination reauthorizes every read and effect. Disabling this module removes
|
|
the rail without making any domain state unavailable through its owning
|
|
module.
|