#243: opt-in live expansion of group receivers for the peer recipient picker (v0.6.55) #291

Merged

Cordy merged 3 commits from feat/recip243 into main

2026-08-20 18:48:41 +00:00

Cordy commented

2026-08-20 18:45:44 +00:00

Owner

Implements the ratified #234 decision D contract, triggered by the dogfood finding that nikola-test (in bao's group-based receive allow-list) never appears in the sender's picker on enc.

Default unchanged: ListRecipients = explicit users ∩ delivery gate; group-only lists stay free-text.
Opt-in path: new settings.peeringExpandGroups (default false, state-backend, live-read — no restart) + a group→members source ⇒ Service.recipientList expands each Registry.ReceiverGroups(peer) entry live, unions with explicit users, dedupes, and passes every candidate through Recipients.Exists — the exact allow-listed-AND-resident delivery gate — so the picker never suggests a refused name.
Source: Manager.GroupMembers via the Keycloak read client (findGroup + /groups/{id}/members, view-users/query-groups — deliberately not Manager.Users). Nil resolver (app-owned/openbao/LDAP for now — follow-up noted on the issue) ⇒ silent degrade. Never materialized (#123/#125).
Audit: peer-recipient-list detail gains expanded when expansion ran.
UI: second switch in the Peering global pane mirroring the enabled toggle (signed-off mockup; fidelity-diffed — swtog structure, label + hint text 1:1).
Tests: recipientList unit-tested via the existing in-package harness — default off, opt-in expansion (non-resident gated, duplicates deduped), no-resolver and opt-in-off degrades.
Docs: peering.md gains "Group receivers and the picker" with the disclosure note.

Implements the ratified #234 decision D contract, triggered by the dogfood finding that `nikola-test` (in bao's group-based receive allow-list) never appears in the sender's picker on enc. - **Default unchanged**: `ListRecipients` = explicit users ∩ delivery gate; group-only lists stay free-text. - **Opt-in path**: new `settings.peeringExpandGroups` (default false, state-backend, live-read — no restart) + a group→members source ⇒ `Service.recipientList` expands each `Registry.ReceiverGroups(peer)` entry live, unions with explicit users, dedupes, and passes **every** candidate through `Recipients.Exists` — the exact allow-listed-AND-resident delivery gate — so the picker never suggests a refused name. - **Source**: `Manager.GroupMembers` via the Keycloak read client (`findGroup` + `/groups/{id}/members`, `view-users`/`query-groups` — deliberately not `Manager.Users`). Nil resolver (app-owned/openbao/**LDAP for now** — follow-up noted on the issue) ⇒ silent degrade. Never materialized (#123/#125). - **Audit**: `peer-recipient-list` detail gains ` expanded` when expansion ran. - **UI**: second switch in the Peering global pane mirroring the enabled toggle (signed-off mockup; fidelity-diffed — swtog structure, label + hint text 1:1). - **Tests**: `recipientList` unit-tested via the existing in-package harness — default off, opt-in expansion (non-resident gated, duplicates deduped), no-resolver and opt-in-off degrades. - **Docs**: peering.md gains "Group receivers and the picker" with the disclosure note.

Cordy added 3 commits

2026-08-20 18:45:45 +00:00