Repository navigation
refactor(authz): #11290 part 1 — canonical ScopeLevel enum + PrincipalFacts→Principal bridge #11758
Description
Discrete sub-issue for the delivered first slice of #11290 (partial-member PR needs its own closeable issue). Scope: (a) canonical superset ScopeLevel with SecretScope/VisibilityLevel as thin aliases, stored values unchanged; (b) PrincipalFacts.scoping_principal() projection (fail-closed company handling); (c) fail-closed tests for superset members in is_visible. Parity matrices written FIRST and unchanged across the refactor. Remaining #11290 scope (re-implement Secret.is_accessible_by + KnowledgeOwnership._check_visibility_grants ON is_visible; ResourceDescriptor group_ids; authenticated flag) stays tracked on #11290.
Activity
refactor(authz): canonical visibility-scope enum + principal bridge — #…
mrveiss commentedon Jul 15, 2026
Closed — merged to Dev_new_gui. Commit: 9a6274f (PR #11760). Canonical superset ScopeLevel + alias enums (stored values pinned by tests), PrincipalFacts.scoping_principal() bridge, fail-closed superset tests; parity matrices (19-row secrets, 26-row knowledge) written first and unchanged. Evidence: 462 passed + 344 startup imports; independent 59 passed. Remaining #11290 scope tracked on #11290 (comment with precise blockers); bycatch #11759.