The repository contains the extracted access seed implementation under src/govoplan_access/backend. Session, API-key, and password helper services, interactive auth routes, FastAPI auth dependencies, and the legacy administration router are owned here. Access-side admin service helpers remain here for users, groups, roles, system accounts, sessions, API keys, tenant access enforcement, admin/audit lookup capabilities, tenant owner provisioning, and governance-template materialization into access-owned groups and roles. Governance-template metadata CRUD lives in govoplan-admin. The transitional administration WebUI route shell and access-owned panels live under webui/src as @govoplan/access-webui. Generic system administration panels are contributed by @govoplan/admin-webui through core's admin.sections UI capability. Live access ORM models are defined here while retaining their historical table names; tenant records live in govoplan-tenancy, governance templates in govoplan-admin, audit logs in govoplan-audit, and system settings in govoplan-core. The staged extraction path is documented in:

/mnt/DATA/git/govoplan-core/docs/ACCESS_EXTRACTION_PLAN.md
/mnt/DATA/git/govoplan-core/docs/MODULE_ARCHITECTURE.md

Initial Ownership

This module will own:

accounts and login identity
authentication routes and session lifecycle
API keys
legacy administration route contribution during the transition
tenant-local users
groups and memberships
roles and role assignments
principal resolution
permission evaluation
access administration backend routes
access administration WebUI route contributions
published FastAPI auth dependency API
access administration, tenant provisioning, and governance materializer capabilities
access-owned migrations

The governance-template routes under /admin/system/governance-templates are contributed by govoplan-admin; access must not register those routes.

govoplan-access depends on govoplan-tenancy; the registry loads tenancy before access for authenticated platform composition.

WebUI Package

The repository root and webui/ directory both expose the package @govoplan/access-webui. The package contributes the /admin route and admin nav item through core's module WebUI contract. The route shell consumes module-owned admin.sections contributions from installed platform modules and continues to render access-owned tenant/user/group/role panels locally. Core supplies shared admin components, route rendering, and icon resolution.

The kernel remains responsible for module discovery, route aggregation, database/session lifecycle, migration orchestration, capability registry, and stable contracts.

Gitea Workflow

This repository uses the shared GovOPlaN Gitea issue workflow. Issue templates are installed under .gitea/, and the shared label taxonomy is copied to docs/gitea-labels.json.

From the core checkout, labels can be synced once a local GITEA_TOKEN is available:

cd /mnt/DATA/git/govoplan-core
./scripts/gitea-sync-labels.py --root /mnt/DATA/git/govoplan-access --apply

Development Install

From the core checkout:

cd /mnt/DATA/git/govoplan-core
./.venv/bin/python -m pip install -e ../govoplan-access