[Privacy] Add an aggregate-only Campaign report UI #80

New Issue

zemion · 2026-07-21T19:46:32+02:00

zemion commented

2026-07-21 19:46:32 +02:00

Problem / User Need

Campaign readers who need outcome totals should not automatically receive recipient rows, message-level evidence, provider diagnostics, or other system internals. The product needs a deliberately aggregate-only report projection and surface.

Acceptance Criteria

A distinct permission/policy path returns only approved aggregate campaign outcomes and never recipient identifiers, addresses, personalized content, attachment paths/keys, worker claims, provider responses, or attempt diagnostics.
The aggregate UI shows business-relevant totals, exclusions, completion/partial/unknown state, time range, and clearly defined denominator semantics.
Drill-down, exports, direct detail routes, and client-side cached detailed data remain unavailable to aggregate-only readers.
The backend projection enforces the boundary independently of the WebUI, including tenant isolation and inference-resistant handling of small/filtered groups according to policy.
Status filters and count affordances follow the coherent model selected in #65.
Permission, response-shape, direct-route, cache, small-count/privacy, and optional-module tests are included.
Adaptive Docs describes what an aggregate reader can and cannot inspect.

#6 owns the operator source-of-truth report.
#65 owns report filter/count interaction.
This issue owns the reader-safe aggregate projection and UI.

## Problem / User Need Campaign readers who need outcome totals should not automatically receive recipient rows, message-level evidence, provider diagnostics, or other system internals. The product needs a deliberately aggregate-only report projection and surface. ## Acceptance Criteria - A distinct permission/policy path returns only approved aggregate campaign outcomes and never recipient identifiers, addresses, personalized content, attachment paths/keys, worker claims, provider responses, or attempt diagnostics. - The aggregate UI shows business-relevant totals, exclusions, completion/partial/unknown state, time range, and clearly defined denominator semantics. - Drill-down, exports, direct detail routes, and client-side cached detailed data remain unavailable to aggregate-only readers. - The backend projection enforces the boundary independently of the WebUI, including tenant isolation and inference-resistant handling of small/filtered groups according to policy. - Status filters and count affordances follow the coherent model selected in #65. - Permission, response-shape, direct-route, cache, small-count/privacy, and optional-module tests are included. - Adaptive Docs describes what an aggregate reader can and cannot inspect. ## Related Work - #6 owns the operator source-of-truth report. - #65 owns report filter/count interaction. - This issue owns the reader-safe aggregate projection and UI.

zemion commented

2026-07-22 09:47:38 +02:00

Codex State: done

Summary

A separate aggregate-reader route and UI expose only campaign-level business totals under tenant/campaign ACLs and the dedicated aggregate-report permission.
Small-cell, complementary, time-range, and overlapping population suppression prevent subtraction attacks; recipient detail, diagnostics, exports, drill-downs, and outcome shortcuts are absent.

Verification

Campaign backend: 180 passed, 16 subtests passed
npm run test:aggregate-report (pass)
Cross-metric suppression regression (pass)

## Codex State: done ### Summary - A separate aggregate-reader route and UI expose only campaign-level business totals under tenant/campaign ACLs and the dedicated aggregate-report permission. - Small-cell, complementary, time-range, and overlapping population suppression prevent subtraction attacks; recipient detail, diagnostics, exports, drill-downs, and outcome shortcuts are absent. ### Verification - `Campaign backend: 180 passed, 16 subtests passed` - `npm run test:aggregate-report (pass)` - `Cross-metric suppression regression (pass)`

zemion closed this issue

2026-07-22 09:47:38 +02:00

zemion referenced this issue

2026-07-22 09:48:30 +02:00

[Task] Audit and migrate Campaign interfaces to the product-wide pattern language #74

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-campaign#80