[Feature] Add typed IDM groups and effective-dated relationship resolution #7

New Issue

2026-07-31T14:48:09+02:00

zemion commented

2026-07-31 14:48:09 +02:00

Goal

Model typed IDM groups and effective-dated identity relationships as reusable, tenant-safe facts for Distribution Lists and other capability consumers.

Boundary

Identity lifecycle status remains an account/identity lifecycle indicator such as active, suspended, or retired.
A business status used for audience selection is a typed group, organization function, or effective-dated relationship. It must not overload identity lifecycle state.
Organizations continues to own unit, structure, and function definitions.
IDM owns identity-to-group membership/relationship links and identity-to-function assignments.
Distribution Lists stores provider references and immutable expansion evidence, not copies of IDM records.

Scope

Define typed group references and relationship kinds with tenant scope.
Add effective valid_from/valid_until, active/revoked state, source revision, provenance, and typed properties to membership/relationship links.
Support direct and batch forward/reverse resolution at a caller-supplied effective time.
Preserve external-directory source references without making an external provider mandatory.
Emit versioned create/change/revoke/expire events for cache invalidation and downstream reconciliation.
Expose capability DTOs without leaking ORM models or granting application permissions implicitly.

Acceptance Criteria

Distribution Lists can resolve a typed group to its effective identities and explain every inclusion/exclusion.
Current, future, expired, and revoked relationships are deterministic and covered by tests.
Cross-tenant references are rejected.
Identity lifecycle changes and business group/function facts remain independently queryable.
The model works without Access, Campaign, or Distribution Lists installed.

Related: #5 and GovOPlaN/govoplan-dist-lists#5.

## Goal Model typed IDM groups and effective-dated identity relationships as reusable, tenant-safe facts for Distribution Lists and other capability consumers. ## Boundary - Identity lifecycle status remains an account/identity lifecycle indicator such as active, suspended, or retired. - A business status used for audience selection is a typed group, organization function, or effective-dated relationship. It must not overload identity lifecycle state. - Organizations continues to own unit, structure, and function definitions. - IDM owns identity-to-group membership/relationship links and identity-to-function assignments. - Distribution Lists stores provider references and immutable expansion evidence, not copies of IDM records. ## Scope - Define typed group references and relationship kinds with tenant scope. - Add effective `valid_from`/`valid_until`, active/revoked state, source revision, provenance, and typed properties to membership/relationship links. - Support direct and batch forward/reverse resolution at a caller-supplied effective time. - Preserve external-directory source references without making an external provider mandatory. - Emit versioned create/change/revoke/expire events for cache invalidation and downstream reconciliation. - Expose capability DTOs without leaking ORM models or granting application permissions implicitly. ## Acceptance Criteria - Distribution Lists can resolve a typed group to its effective identities and explain every inclusion/exclusion. - Current, future, expired, and revoked relationships are deterministic and covered by tests. - Cross-tenant references are rejected. - Identity lifecycle changes and business group/function facts remain independently queryable. - The model works without Access, Campaign, or Distribution Lists installed. Related: #5 and GovOPlaN/govoplan-dist-lists#5.