⚠️ OpenSpec-managed issue — this content is automatically synced
from the openspec/ directory. Manual edits will be overwritten on next sync.
Artifacts
Summary
Stackiq's access rules name fixed groups such as gebruik-beheerder and aanbod-beheerder. A municipality that already keeps its buyers in a group called Inkoop cannot tell stackiq that those people are buyers; someone has to copy them into the fixed group by hand and keep it up to date. Nor can anyone check whether the people who hold a role still need it: stackiq fetches each user's last login and never shows it. This change lets a Nextcloud admin choose, per catalogue role, which groups grant it, keeps the role groups in step with that choice, fixes two paths that stopped assigning roles, and adds an Access review page where a functional administrator sees each person's roles, where they come from and when they last signed in, and confirms or withdraws them.
Specs
Tasks
Design
See design.md for technical design details.
Synced from openspec/changes/organisations-role-mapping-and-access-review by OpenSpec workflow
App: stackiq
Artifacts
Summary
Stackiq's access rules name fixed groups such as
gebruik-beheerderandaanbod-beheerder. A municipality that already keeps its buyers in a group called Inkoop cannot tell stackiq that those people are buyers; someone has to copy them into the fixed group by hand and keep it up to date. Nor can anyone check whether the people who hold a role still need it: stackiq fetches each user's last login and never shows it. This change lets a Nextcloud admin choose, per catalogue role, which groups grant it, keeps the role groups in step with that choice, fixes two paths that stopped assigning roles, and adds an Access review page where a functional administrator sees each person's roles, where they come from and when they last signed in, and confirms or withdraws them.Specs
Tasks
Design
See design.md for technical design details.
Synced from
openspec/changes/organisations-role-mapping-and-access-reviewby OpenSpec workflowApp:
stackiq