Backend: scope driver grants space access from app-owned membership (IdP groups stay read-only) #214

New issue

Closed

opened 2026-08-13 15:17:14 +00:00 by Cordy · 0 comments

Cordy commented

2026-08-13 15:17:14 +00:00

Owner

Parent: #211. Depends on the membership store.

Today scope.Driver.resolve grants /spaces/<g> access purely from auth.User.Groups (IdP). Extend it so a user also reaches spaces where the app-owned store lists them as a member, with the same read/write + -ro semantics.

Scope

resolve consults both sources: IdP-group membership (existing, read/write per -ro) and app-owned membership (owner=write, member role=write/read).
List of /spaces (kindSyntheticSpaces) unions IdP groups + app-owned spaces the user belongs to (dedupe by name).
Precedence + de-dup when a name exists in both (spec it: app-owned wins, or refuse the collision at create — see store issue).
Keep #177 (admins scoped like users) intact.

Acceptance: scope tests covering: member of an app-owned space can read/write; non-member cannot see or resolve it; read-role member is read-only; owner is write; IdP-group spaces unchanged; listing unions both without duplicates.

Parent: #211. Depends on the membership store. Today `scope.Driver.resolve` grants `/spaces/<g>` access purely from `auth.User.Groups` (IdP). Extend it so a user also reaches spaces where the app-owned store lists them as a member, with the same read/write + `-ro` semantics. **Scope** - `resolve` consults both sources: IdP-group membership (existing, read/write per `-ro`) **and** app-owned membership (owner=write, member role=write/read). - `List` of `/spaces` (kindSyntheticSpaces) unions IdP groups + app-owned spaces the user belongs to (dedupe by name). - Precedence + de-dup when a name exists in both (spec it: app-owned wins, or refuse the collision at create — see store issue). - Keep #177 (admins scoped like users) intact. **Acceptance:** scope tests covering: member of an app-owned space can read/write; non-member cannot see or resolve it; read-role member is read-only; owner is write; IdP-group spaces unchanged; listing unions both without duplicates.