rstillwell/Submatter
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
Submatter/plans/Plan-workspace-communications/Epic-workspace-chat/Task-contextual-chat-authorization.md

3.7 KiB
Raw Blame History

kind slug title plan_slug epic_slug status priority tenant_id owner cursor_todo_id updated_at
task contextual-chat-authorization Bind chat to authorized project and supported object contexts workspace-communications workspace-chat blocked P1 global unassigned null 2026-10-22

Task summary

Extend the workspace-chat foundation to project and explicitly supported object contexts without widening private-context access.

Description

Follow the plan's context authorization contract. Projects are generic objects rows (type = 'project'), not a separate table. Existing types include space, task, document, whiteboard, group and form; enable only types with a verified read/write/delegate policy and usable entry point. object_type_defs does not automatically enable custom contexts. Neither object_assignees, parent links nor workspace ownership are ACLs.

This is a bounded chat adapter/API/UI integration, not a general object-permissions rewrite. It is blocked on an authoritative context policy: current objects schema/router proves only tenant ownership. Keep private/unknown/policy-unavailable contexts disabled until that policy is supplied and tested; escalate the missing ACL prerequisite to the conductor rather than inventing one inside chat.

Subtasks

  • Resolve the explicit prerequisite: document the authoritative read/write/delegate policy API and which concrete object types it supports before enabling any object context.
  • Extend the foundation's context union to a tenant-validated object reference; generate a new migration with referential integrity and context indexes as needed. Context binding cannot be silently moved to broaden an audience.
  • Use workspace AND context AND channel checks for discovery, history, threads, writes, membership targets, mentions/counts, notifications, replay and live delivery; prevent channel membership from granting object access.
  • Add project/supported-object conversation entry points that resolve the same durable channel surface as workspace Chat, showing context without leaking inaccessible titles.
  • Test private same-workspace denial, unsupported types, archived/deleted contexts, ancestry-policy changes, revoked membership/subscriptions, and authorized access without duplicate histories.

Owner or assignee

unassigned

Status

blocked — workspace chat foundation and a verified object-level authorization/delegation policy must exist first. User kickoff approval does not waive this prerequisite.

Estimation

M once the policy prerequisite is available.

Acceptance criteria

  • Project chat references actual objects records; no invented projects table or arbitrary context slug grants access.
  • Workspace membership, workspace admin role, object assignment, and channel membership independently cannot bypass private-context denial.
  • Public means public within the permitted context audience; private/direct require membership in addition.
  • Removed access immediately stops subsequent reads, replay, notifications and live payloads; client caches are invalidated.
  • Unsupported contexts fail closed; there is no fallback to workspace-public chat.
  • pnpm lint && pnpm type-check && pnpm test pass; run build for changed server entry points/exports.

Links to related Epic / Plan