fix(access): only administration managers change the segment; portal absence reports get their owner stamped on the server

[rubenvdlinde]

Scope

Two write defects: any instructor could change the organisation's segment, and every portal absence report was refused before learniq saw it. LearniqSettings gets an authorization block, and ExcuseRequest's owner fields move from required into a server-side stamp, the way #1068 did it for Submission.

What changes

LearniqSettings had no authorization block, so the register cascade (read-write for instructors, hr, compliance-officers, team-leads) applied. The menu entry was admin-only; the objects API was not. Now:

action	groups
read	instructors, hr, compliance-officers, team-leads, coordinators, administration-managers, confidential-counsellors
create, update	administration-managers (admins pass OpenRegister's bypass)
delete	nobody but admins

SegmentService reads and writes the row with _rbac: false from the admin-only setup contract, so the wizard is unaffected.

ExcuseRequest listed learnerId, submittedBy, submittedAuthLevel and tenant_id as required. Portaliq's createExcuseRequest (pupil minTrust: low, guardian minTrust: substantial, portaliq#607) sends only the dates, reason, kind and attachment, plus its scope stamp. OpenRegister validates required in saveObject() before ObjectCreatingEvent, so every portal report got a 400. Now required is dateFrom, dateTo, reason, reasonKind, and ExcuseRequestOwnerStamp (on create and update, registered in IntegrityListenerRegistrar):

• portal report (no session, no learnerId, a learnerRef): learnerId, learnerRef, tenant_id from the pupil's LearnerProfile; unknown pupil or failed lookup refuses the write;
• pupil's own report: the pupil is the submitter, submittedAuthLevel: basic;
• guardian's report (submittedByRef set): refused unless the child's profile lists that guardian in guardianRefs; submittedBy is the guardian's user id when they have one; submittedAuthLevel: substantial;
• every other write: learnerRef derived from learnerId (a client value is replaced), submittedAuthLevel: basic when none is sent;
• every write that still lacks the pupil, a submitter (submittedBy or submittedByRef) or the school is refused with excuse-owner-missing.

The recorded level is the minimum the portal action enforced, because portaliq does not send the level it reached.

Versions: both schemas 0.2.0 to 0.3.0, info.version 0.28.1 to 0.29.0. Docs: a short section on portal reports in docs/user-guide/user/05-attendance.md.

Tests

• ExcuseRequestOwnerStampTest (13 tests): pupil and guardian stamps, guardian without an account, guardian of another child, unknown pupil, failed lookup, signed-in create without a pupil, staff create (derived ref, forged ref replaced, default and kept level), missing owner fields, update keeping the stored ref, another schema ignored, registration on create and update.
• ExcuseRequestRegisterTest (3): the required list, and every required field is in both portal actions' field lists (read from the real PortalContributionProvider).
• SegmentFeatureFlagsRegisterTest::testOnlyAdministrationManagersChangeTheSegment.
• The register tests were shown red on development's register first.

Verification (on this branch, bb390304, cut from a84b6273)

• composer check:strict (lane semaphore, TMPDIR=$PWD/.tmp): exit 1 from inherited reds only. lint, phpcs, psalm (no errors), phpstan (no errors) green. phpmd: one finding, CaseListenerRegistrar coupling 13, on development (fix(register): repair what the serial landing of round one still leaves wrong (replaces #1006) #1126 clears it); a new ExcessiveMethodLength on IntegrityListenerRegistrar::register() that this change first caused was fixed by the extraction described below. PHPUnit: 1936 tests, 12 failures, the identical set development carries (compared as a set, not a count; fix(access): enforce the access ratchets on the import records, first aid and the import guards (D23) #1124 and fix(register): repair what the serial landing of round one still leaves wrong (replaces #1006) #1126 close them). No new failure.
• npm run lint: exit 0 (19 inherited warnings). npm run format: exit 0. npm run test:l10n: no such script.
• npm run check:specs, check:schema-l10n, check:l10n-js: exit 0.
• openspec validate settings-and-excuse-authorization: valid.
• opsx-verify (headless, code level; no live instance for this lane): 3 of 3 tasks, 2 of 2 requirements implemented, every scenario pinned by a named test, design D1 to D4 followed, attendance user guide updated. 0 critical, 0 warnings. One suggestion: if portaliq ever passes the trust level it reached, record that instead of the action's minimum (D3).
• Hydra gates: HYDRA_GATE_BASE_REF=origin/development --scope-to-diff: exit 4, 38 of 39 applicable gates ran; gate-3 stub-scan, gate-16 spec-coverage, gate-47 security-change-has-tests, gate-101 pass. The reds are the inherited set named on fix(access): enforce the access ratchets on the import records, first aid and the import guards (D23) #1124: gate-108 (orderLineId on three mock Entitlement objects, from feat(payments): retire orders for shillinq; raise fee contributions there and grant entitlements on its settled signal (D19) #1082), gate-113 (payments spec cites tests feat(payments): retire orders for shillinq; raise fee contributions there and grant entitlements on its settled signal (D19) #1082 deleted), gate-112 newman-reach, gate-53 and gate-68 (the gate's Node script fails to load as an ES module on this box).

Landing

Cut from development (a84b6273), independent of #1124 and #1126, so its full-suite failure set is development's known twelve. All three PRs edit lib/Settings/learniq_register.json (info.version and info.description); the schemas touched here (LearniqSettings, ExcuseRequest) are touched by neither of the other two. IntegrityListenerRegistrar: the Submission owner stamp moves, unchanged and in the same order, into a private registerOwnerStamps() beside the new one, which keeps register() under phpmd's method length limit.

OpenSpec change: openspec/changes/settings-and-excuse-authorization/.

CI (read once, 2026-09-28)

PHPUnit in CI: 1936 tests, 12 failures, development's known set; phpmd red on the inherited CaseListenerRegistrar coupling. The CI PHPUnit job also runs with coverage, where failOnRisky and beStrictAboutCoverageMetadata turn 10 tests into risky ones (CourseSharingControllerTest, StoreControllerTest, CourseShareExportServiceTest, CourseMetadataFilterTest, CourseStorePublisherTest: they execute classes their #[CoversClass] does not list). That makes the job exit 1 even with zero failures. None of those files is touched here; it is inherited from the course store changes and does not show locally with --no-coverage. CI Hydra Gates runs full-tree and reports the same inherited set as a local full run (gate-3, gate-25, gate-49, gate-55, gate-62, gate-108); none is on a file this PR touches.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/learniq @ f5a2b85

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	❌
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 107/107
npm			✅	✅ 747/747
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					❌
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it on any branch from the Actions tab, or locally with npx playwright test.
Hydra gates					❌

---

Quality workflow — 2026-09-27 18:52 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/learniq @ 1d286a3

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 107/107
npm			✅	✅ 747/747
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					❌
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it on any branch from the Actions tab, or locally with npx playwright test.
Hydra gates					❌

---

Quality workflow — 2026-09-28 07:26 UTC

Download the full PDF report from the workflow artifacts.