[OpenSpec] organisations-role-mapping-and-access-review #1130

⚠️ OpenSpec-managed issue — this content is automatically synced
from the openspec/ directory. Manual edits will be overwritten on next sync.

Artifacts

• ✅ Metadata
• ✅ Proposal
• ✅ Specs
• ✅ Design
• ✅ Tasks
• 🔲 Plan
• 🔲 Review

Summary

Stackiq's access rules name fixed groups such as gebruik-beheerder and aanbod-beheerder. A municipality that already keeps its buyers in a group called Inkoop cannot tell stackiq that those people are buyers; someone has to copy them into the fixed group by hand and keep it up to date. Nor can anyone check whether the people who hold a role still need it: stackiq fetches each user's last login and never shows it. This change lets a Nextcloud admin choose, per catalogue role, which groups grant it, keeps the role groups in step with that choice, fixes two paths that stopped assigning roles, and adds an Access review page where a functional administrator sees each person's roles, where they come from and when they last signed in, and confirms or withdraws them.

Specs

• 📄 role-mapping-and-access-review

Tasks

• Implement
• Test (PHPUnit tests/Unit/Service/RoleGroupMapTest.php and tests/Unit/Controller/SettingsControllerUserGroupsTest.php)
• Implement
• Test (PHPUnit tests/Unit/Service/RoleGrantSyncTest.php)
• Implement
• Test (PHPUnit tests/Unit/Repair/SeedRolesFromGroupsTest.php and tests/Unit/BackgroundJob/RoleGrantSyncJobTest.php)
• Implement
• Test (PHPUnit tests/Unit/Controller/AccessReviewControllerTest.php and tests/Unit/Settings/AccessReviewDeclarationTest.php)
• Implement
• Test (vitest tests/vitest/accessReviewView.spec.js and Playwright tests/e2e/spec-coverage/access-review.spec.ts)
• Implement
• Test (Playwright tests/e2e/spec-coverage/role-mapping.spec.ts and tests/e2e/spec-coverage/access-review.spec.ts against the demo data)

Design

See design.md for technical design details.

Synced from openspec/changes/organisations-role-mapping-and-access-review by OpenSpec workflow
App: stackiq