inbuxa/inbuxa-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 23 Wiki Activity

Add the compliance permission and the Compliance Officer roles
ci / fork-checks (pull_request) Successful in 31s
Details
ci / build (pull_request) Successful in 11m31s
Details

Browse Source 
Personal-data catalog spec, §7 (settled 2026-09-28).

sysComplianceGet (673) sees the data inventory and compliance
overview: superusers and, for their tenant's slice, tenant
administrators, by default and through the one-time grants on servers
that already have their roles stored.

A Compliance Officer role at server level holds it with reading and
exporting the audit log, placing, widening, releasing and exporting
legal holds, seeing account locks, and reading accounts, lists,
domains, tenants and roles. It changes no server setting, creates or
deletes no account, and can't shorten audit retention.

A tenant's accounts can hold only roles of their own tenant (MT-3), so
the tenant role is one "Compliance Officer" role per tenant, without
holds (LH-13): made once for every tenant a server has, and whenever a
tenant is created. While nobody holds it, it is removed with its tenant
so it doesn't block the delete, and put back if the delete is refused
for another reason. Both roles carry a user's own permissions too,
since roles given to a person replace the default user role, which a
tenant's accounts can't hold anyway.

Every server makes these once, new or existing -- the built-in roles
are only made on a server with none -- and records each under P c, so a
role an administrator deletes stays deleted.

Tested: unit tests (neither role changes a setting beyond a user's
own; holds for the server's officer only; per-place records); a new
compliance system test (one server-level role; an officer reads the
audit log, places and releases a hold, and is refused a setting, an
account and audit retention; a tenant gets its role, whose holder reads
the tenant's audit log and no holds; a tenant with an unused role is
deleted and the role goes with it); the system, audit, legal hold,
account lock and SCIM suites; fork checks. The directory suite needs
its LDAP container and wasn't run here.
This commit is contained in:
jcoffey-dev
2026-09-28 08:50:17 -07:00
parent d107c1b2bb
commit 63adb4e2b8
13 changed files with 548 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/spec/features/personal-data-catalog.md
+11
View File
@@ -526,6 +526,17 @@ it (Settled 3). It has no hold permissions, since legal holds are
server-only by the tenant ceiling (LH-13), and it sees the tenant's slice of
the inventory only (§6).
**As built (2026-09-28).** A tenant's accounts can hold only roles of
their own tenant (MT-3), so the tenant role can't be one server-level role:
each tenant gets its own "Compliance Officer" role, made once for every
tenant a server has and whenever a tenant is created; while nobody holds
it, it is removed with its tenant so it doesn't block the delete. For the
same reason (a tenant's accounts can't hold the server-level User role),
both roles carry a user's own permissions as well, and are given in place
of the default user role. Creations are recorded under `P` `c`, so a role
an administrator deletes stays deleted
(`crates/common/src/manager/compliance_roles.rs`).
### Reaching existing servers
New permissions get ids 673 onward and `COUNT` grows (`enums.rs`,