[Privacy] Provide governed Files DSAR coverage #44

New Issue

2026-08-20T22:14:03+02:00

zemion commented

2026-08-20 22:14:03 +02:00

Objective

Adopt the Core data-subject request provider contract for Files-owned personal data without bypassing Files retention, legal-hold, evidence, purge-authority, or object-recovery controls.

Acceptance criteria

Search is tenant-scoped, bounded, and supports direct membership / Files subject references.
Export includes safe file, version, folder, share, and evidence metadata without connector credentials, storage secrets, or raw file bytes.
Plans distinguish reversible subject-reference detachment and share revocation from retained evidence and manual review of unstructured file content.
Execution is idempotent, revalidates tenant and subject ownership, and fails closed on stale or forged actions.
Retention, legal hold, Form evidence, and Campaign evidence remain explicit blockers; byte purge continues through the separately authorized Files lifecycle workflow.
Provider discovery, disabled-module behavior, retry/concurrency, documentation, and cross-module checks are covered.

Parent: GovOPlaN/govoplan#47. ## Objective Adopt the Core data-subject request provider contract for Files-owned personal data without bypassing Files retention, legal-hold, evidence, purge-authority, or object-recovery controls. ## Acceptance criteria - [ ] Search is tenant-scoped, bounded, and supports direct membership / Files subject references. - [ ] Export includes safe file, version, folder, share, and evidence metadata without connector credentials, storage secrets, or raw file bytes. - [ ] Plans distinguish reversible subject-reference detachment and share revocation from retained evidence and manual review of unstructured file content. - [ ] Execution is idempotent, revalidates tenant and subject ownership, and fails closed on stale or forged actions. - [ ] Retention, legal hold, Form evidence, and Campaign evidence remain explicit blockers; byte purge continues through the separately authorized Files lifecycle workflow. - [ ] Provider discovery, disabled-module behavior, retry/concurrency, documentation, and cross-module checks are covered.

zemion added the area/db area/governance area/security codex/ready module/files

labels 2026-08-20 22:22:01 +02:00

zemion commented

2026-08-20 22:41:42 +02:00

Implemented and pushed in govoplan-files@ce4eaef.

Files now publishes privacy.dsar.files with bounded, tenant-scoped direct-membership search across managed assets, exact versions, folders, shares, Form/Campaign evidence, non-secret connector configuration evidence, and integrity evidence. It excludes raw bytes, object keys, metadata payloads, usernames, tokens, passwords, environment names, secret references, and encrypted credential values.

Erasure planning explicitly separates retained evidence, manual review of unstructured content/ownership/names/paths, subject-targeted share revocation, and mutable actor-reference detachment. Execution revalidates provider, tenant, subject, resource, and current field under row locking and is idempotent. Physical purge remains behind Files lifecycle authority, blockers, approval, audit, fencing, and recovery.

Verification: Files Ruff passed; 161 tests and 33 subtests passed. Core workflow discovery/plan/execution and disabled-module behavior are covered. The complete workspace focused gate passed, including manifest/inventory checks, backend/migration matrices, 59 WebUI permutations, full-product bundle budgets, 7 Playwright conformance tests, and all module UI structural checks.

Implemented and pushed in `govoplan-files@ce4eaef`. Files now publishes `privacy.dsar.files` with bounded, tenant-scoped direct-membership search across managed assets, exact versions, folders, shares, Form/Campaign evidence, non-secret connector configuration evidence, and integrity evidence. It excludes raw bytes, object keys, metadata payloads, usernames, tokens, passwords, environment names, secret references, and encrypted credential values. Erasure planning explicitly separates retained evidence, manual review of unstructured content/ownership/names/paths, subject-targeted share revocation, and mutable actor-reference detachment. Execution revalidates provider, tenant, subject, resource, and current field under row locking and is idempotent. Physical purge remains behind Files lifecycle authority, blockers, approval, audit, fencing, and recovery. Verification: Files Ruff passed; 161 tests and 33 subtests passed. Core workflow discovery/plan/execution and disabled-module behavior are covered. The complete workspace focused gate passed, including manifest/inventory checks, backend/migration matrices, 59 WebUI permutations, full-product bundle budgets, 7 Playwright conformance tests, and all module UI structural checks.

zemion closed this issue

2026-08-20 22:41:42 +02:00

zemion referenced this issue from GovOPlaN/govoplan

2026-08-20 22:41:43 +02:00

[Privacy] Complete DSAR provider coverage across data-owning modules #47

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-files#44