From 6edaaadf3707e9d738b7d9f97a5c2e2556915ab4 Mon Sep 17 00:00:00 2001 From: Albrecht Degering Date: Mon, 24 Aug 2026 16:33:16 +0200 Subject: [PATCH] release: align governed tenant erasure --- .../DSAR_PROVIDER_COVERAGE.generated.md | 6 +- packages/govoplan-meta/pyproject.toml | 8 +-- requirements-release.txt | 4 +- tools/checks/dsar-coverage-exemptions.json | 1 - .../endpoint-surface-declarations.json | 56 +++++++++++++++++++ 5 files changed, 65 insertions(+), 10 deletions(-) diff --git a/docs/evidence/snapshots/DSAR_PROVIDER_COVERAGE.generated.md b/docs/evidence/snapshots/DSAR_PROVIDER_COVERAGE.generated.md index ee7e79d..07dabe6 100644 --- a/docs/evidence/snapshots/DSAR_PROVIDER_COVERAGE.generated.md +++ b/docs/evidence/snapshots/DSAR_PROVIDER_COVERAGE.generated.md @@ -6,8 +6,8 @@ Every other active module requires a reviewed explanation of why it owns no persistent subject-data store. Adding a migration invalidates that explanation. - Active modules: 72 -- Registered and documented DSAR providers: 48 -- Reviewed no-store rationales: 24 +- Registered and documented DSAR providers: 49 +- Reviewed no-store rationales: 23 - Unexplained coverage gaps: 0 | Module | Repository | Persistence | Coverage | Rationale | @@ -75,7 +75,7 @@ persistent subject-data store. Adding a migration invalidates that explanation. | `soap` | `govoplan-soap` | No module migration | Reviewed no-store rationale | Transport-only module: SOAP binds explicitly published operations and owns no domain or subject-data store. | | `tasks` | `govoplan-tasks` | Migration-owned | Provider | Provider `privacy.dsar.tasks` is registered and documented. | | `templates` | `govoplan-templates` | Migration-owned | Provider | Provider `privacy.dsar.templates` is registered and documented. | -| `tenancy` | `govoplan-tenancy` | No module migration | Reviewed no-store rationale | Orchestration module: tenant lifecycle and settings use Core-owned storage; Access covers account and membership subject data. | +| `tenancy` | `govoplan-tenancy` | Migration-owned | Provider | Provider `privacy.dsar.tenancy` is registered and documented. | | `tickets` | `govoplan-tickets` | Migration-owned | Provider | Provider `privacy.dsar.tickets` is registered and documented. | | `transparency` | `govoplan-transparency` | No module migration | Reviewed no-store rationale | Contract-only module: requests, disclosure reviews, and publications are not persisted; reassess before adding a migration-owned store. | | `views` | `govoplan-views` | Migration-owned | Provider | Provider `privacy.dsar.views` is registered and documented. | diff --git a/packages/govoplan-meta/pyproject.toml b/packages/govoplan-meta/pyproject.toml index 5a9a031..4a4539c 100644 --- a/packages/govoplan-meta/pyproject.toml +++ b/packages/govoplan-meta/pyproject.toml @@ -4,18 +4,18 @@ build-backend = "setuptools.build_meta" [project] name = "govoplan" -version = "0.1.42" +version = "0.1.43" description = "Developer convenience package for a versioned GovOPlaN composition" readme = "README.md" requires-python = ">=3.12" license = { text = "AGPL-3.0-or-later" } dependencies = [ - "govoplan-core[server]==0.1.42", - "govoplan-tenancy==0.1.20", + "govoplan-core[server]==0.1.43", + "govoplan-tenancy==0.1.21", "govoplan-organizations==0.1.20", "govoplan-identity==0.1.20", "govoplan-idm==0.1.24", - "govoplan-access==0.1.23", + "govoplan-access==0.1.24", "govoplan-admin==0.1.22", "govoplan-policy==0.1.22", "govoplan-audit==0.1.20", diff --git a/requirements-release.txt b/requirements-release.txt index da263ce..de9cbc3 100644 --- a/requirements-release.txt +++ b/requirements-release.txt @@ -1,11 +1,11 @@ # Whole-product release install from immutable, independently versioned module tags. # Only add a module after its referenced tag has been published. ../govoplan-core[server] -govoplan-tenancy @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-tenancy.git@v0.1.20 +govoplan-tenancy @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-tenancy.git@v0.1.21 govoplan-organizations @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-organizations.git@v0.1.20 govoplan-identity @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-identity.git@v0.1.20 govoplan-idm @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-idm.git@v0.1.24 -govoplan-access @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-access.git@v0.1.23 +govoplan-access @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-access.git@v0.1.24 govoplan-admin @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-admin.git@v0.1.22 govoplan-policy @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git@v0.1.22 govoplan-audit @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git@v0.1.20 diff --git a/tools/checks/dsar-coverage-exemptions.json b/tools/checks/dsar-coverage-exemptions.json index 2e9d14a..d3ff11b 100644 --- a/tools/checks/dsar-coverage-exemptions.json +++ b/tools/checks/dsar-coverage-exemptions.json @@ -19,7 +19,6 @@ "resources": "Contract-only module: resource catalog and allocation persistence are not implemented; reassess before adding a migration-owned store.", "rest": "Transport-only module: REST binds explicitly published functions and owns no domain or subject-data store.", "soap": "Transport-only module: SOAP binds explicitly published operations and owns no domain or subject-data store.", - "tenancy": "Orchestration module: tenant lifecycle and settings use Core-owned storage; Access covers account and membership subject data.", "transparency": "Contract-only module: requests, disclosure reviews, and publications are not persisted; reassess before adding a migration-owned store.", "workflow": "Presentation-only module: Workflow edits and projects Workflow Engine state; Workflow Engine owns persistence and DSAR coverage.", "xrechnung": "Stateless validation-contract module: XRechnung persists no invoice, report, diagnostic, or handoff; the invoking Files, Procurement, or Payments workflow remains the subject-data owner. Reassess before adding a validation store." diff --git a/tools/inventory/endpoint-surface-declarations.json b/tools/inventory/endpoint-surface-declarations.json index fc579f7..edbb119 100644 --- a/tools/inventory/endpoint-surface-declarations.json +++ b/tools/inventory/endpoint-surface-declarations.json @@ -2007,6 +2007,20 @@ "rationale": "Published integration, interoperability, public-participant, or health endpoint.", "repository": "govoplan-soap" }, + { + "category": "intentionally_headless", + "method": "GET", + "path": "/admin/tenant-erasure-policy", + "rationale": "Tenant-erasure policy is a consequential operator API with recent-authentication and dedicated-permission gates.", + "repository": "govoplan-tenancy" + }, + { + "category": "intentionally_headless", + "method": "PATCH", + "path": "/admin/tenant-erasure-policy", + "rationale": "Tenant-erasure policy is a consequential operator API with recent-authentication and dedicated-permission gates.", + "repository": "govoplan-tenancy" + }, { "category": "intentionally_headless", "method": "GET", @@ -2014,6 +2028,48 @@ "rationale": "Tenant deletion preflight is an administrative safety API consumed before a destructive workflow.", "repository": "govoplan-tenancy" }, + { + "category": "intentionally_headless", + "method": "POST", + "path": "/admin/tenants/{}/erasure-operations", + "rationale": "Tenant erasure is an audited, provider-driven operator workflow whose API exposes the complete review and recovery evidence.", + "repository": "govoplan-tenancy" + }, + { + "category": "intentionally_headless", + "method": "GET", + "path": "/admin/tenants/{}/erasure-operations/{}", + "rationale": "Tenant erasure is an audited, provider-driven operator workflow whose API exposes the complete review and recovery evidence.", + "repository": "govoplan-tenancy" + }, + { + "category": "intentionally_headless", + "method": "POST", + "path": "/admin/tenants/{}/erasure-operations/{}/approve", + "rationale": "Tenant-erasure approval requires typed confirmation, recent authentication, and a distinct authorized account.", + "repository": "govoplan-tenancy" + }, + { + "category": "intentionally_headless", + "method": "POST", + "path": "/admin/tenants/{}/erasure-operations/{}/cancel", + "rationale": "Tenant-erasure cancellation is a recovery control available only before destructive work starts.", + "repository": "govoplan-tenancy" + }, + { + "category": "intentionally_headless", + "method": "POST", + "path": "/admin/tenants/{}/erasure-operations/{}/execute", + "rationale": "Tenant-erasure execution is a consequential operator API with provider checkpoints and fail-closed reconciliation.", + "repository": "govoplan-tenancy" + }, + { + "category": "intentionally_headless", + "method": "POST", + "path": "/admin/tenants/{}/erasure-operations/{}/reconcile", + "rationale": "Tenant-erasure reconciliation resumes idempotent provider steps after pending or outcome-unknown effects.", + "repository": "govoplan-tenancy" + }, { "category": "compatibility", "method": "POST",