#715: managed-by-IdP is a verified claim - orphan folders say so #716

Merged

Cordy merged 9 commits from feat-715 into main

2026-09-24 04:04:16 +00:00

Cordy commented

2026-09-24 04:01:20 +00:00

Owner

Closes #715

Root cause: mergeSpaceDirs marked every backend /spaces directory with no app-owned record as Managed: true, and the UI rendered that as "Managed by the identity provider" — an assumption, never a lookup. Orphaned folders (pre-#690 synthesized dirs, IdP groups since deleted, hand-made dirs) carried a false, compliance-relevant attribution. Verified on the dogfood: id.c0rdyceps.ch has no test5/qa656/Fall * groups, yet all read as IdP-managed.

Fix — three honest states:

app-owned record → Owned by X · group Y · app-managed (from #690, unchanged);
directory the IdP listing knows (case-insensitive; live DirList + KnownDirNames via new GroupsAPI.DirNamesFor) → "Managed by the identity provider";
directory matching nothing → orphan: true, rendered as "Folder in storage — no managing group found" in the row AND the details dialog (i18n ×4).

Fail-safe: only a successful live listing is authoritative. No directory client, or a listing error (IdP outage), keeps the old attribution — a customer never sees a mass orphan-flip because Keycloak blipped. Wiring in main.go is late-bound through the handler so Groups/Spaces construction order can't silently disable it.

Tests: spaces_orphan_test.go (orphan split, unverified fallback, DirNamesFor authority states incl. listing failure), existing union tests updated to the new signature, qa715.test.js UI pins.

Closes #715 **Root cause:** `mergeSpaceDirs` marked every backend `/spaces` directory with no app-owned record as `Managed: true`, and the UI rendered that as "Managed by the identity provider" — an assumption, never a lookup. Orphaned folders (pre-#690 synthesized dirs, IdP groups since deleted, hand-made dirs) carried a false, compliance-relevant attribution. Verified on the dogfood: id.c0rdyceps.ch has no `test5`/`qa656`/`Fall *` groups, yet all read as IdP-managed. **Fix — three honest states:** - app-owned record → `Owned by X · group Y · app-managed` (from #690, unchanged); - directory the IdP listing knows (case-insensitive; live `DirList` + `KnownDirNames` via new `GroupsAPI.DirNamesFor`) → "Managed by the identity provider"; - directory matching nothing → `orphan: true`, rendered as "Folder in storage — no managing group found" in the row AND the details dialog (i18n ×4). **Fail-safe:** only a *successful* live listing is authoritative. No directory client, or a listing error (IdP outage), keeps the old attribution — a customer never sees a mass orphan-flip because Keycloak blipped. Wiring in main.go is late-bound through the handler so Groups/Spaces construction order can't silently disable it. **Tests:** `spaces_orphan_test.go` (orphan split, unverified fallback, `DirNamesFor` authority states incl. listing failure), existing union tests updated to the new signature, `qa715.test.js` UI pins.

Cordy added 9 commits

2026-09-24 04:01:22 +00:00