feat(policy): grant table feature permissions (analyze, comment, ...) #19

2026-10-13T20:30:21Z

KofTwentyTwo commented

2026-10-13 20:30:21 +00:00

(Migrated from github.com)

Summary

The policy editor catalog and policy documents can now grant table feature permissions registered through core TableFeaturePermissionsMetaData (qqq DATA-ANALYSIS.md §3.6, the contract shared with the collaboration program): <table>.analyze from qbit-data-analysis, and <table>.comment|attach|tag|share|task|assign from qbit-collaboration.

PolicyCatalog reads them generically from PermissionsHelper.getAllAvailablePermissions: any <base>.<suffix> with a suffix that is not a standard action. There is no compile dependency on the unreleased core hook.
The widget JSON is additive. actions is unchanged, and each table resource gains "features": [{"name":"analyze","label":"Analyze"}].
Policy documents may name a feature in Action, and it is accepted only when the catalog has it for every listed resource. "*" still grants only the five standard actions, so existing policies don't start granting analyze.
Parser, generator, claim and group mappers, effective-permission comparison and drift handling all carry feature permissions.

Next UI's AUTHENTIK_POLICY_EDITOR (qqq-frontend-next#95) can render features as extra checkboxes. That's a follow-up there; until then the editor ignores the new field.

Test plan

./mvnw verify: 210 unit tests plus the Authentik Testcontainers contract tests, JaCoCo gates green
New PolicyFeaturePermissionsTest: catalog features and labels, parse, unknown feature rejected, wildcard excludes features, generator round trip, mapper emits person.analyze, effective-permission comparison

🤖 Generated with Claude Code

## Summary The policy editor catalog and policy documents can now grant **table feature permissions** registered through core `TableFeaturePermissionsMetaData` (qqq DATA-ANALYSIS.md §3.6, the contract shared with the collaboration program): `<table>.analyze` from qbit-data-analysis, and `<table>.comment|attach|tag|share|task|assign` from qbit-collaboration. - `PolicyCatalog` reads them generically from `PermissionsHelper.getAllAvailablePermissions`: any `<base>.<suffix>` with a suffix that is not a standard action. There is no compile dependency on the unreleased core hook. - The widget JSON is additive. `actions` is unchanged, and each table resource gains `"features": [{"name":"analyze","label":"Analyze"}]`. - Policy documents may name a feature in `Action`, and it is accepted only when the catalog has it for every listed resource. `"*"` still grants only the five standard actions, so existing policies don't start granting analyze. - Parser, generator, claim and group mappers, effective-permission comparison and drift handling all carry feature permissions. Next UI's AUTHENTIK_POLICY_EDITOR (qqq-frontend-next#95) can render `features` as extra checkboxes. That's a follow-up there; until then the editor ignores the new field. ## Test plan - [x] `./mvnw verify`: 210 unit tests plus the Authentik Testcontainers contract tests, JaCoCo gates green - [x] New `PolicyFeaturePermissionsTest`: catalog features and labels, parse, unknown feature rejected, wildcard excludes features, generator round trip, mapper emits `person.analyze`, effective-permission comparison 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-authentik#19