59 lines
3.7 KiB
Markdown
59 lines
3.7 KiB
Markdown
---
|
|
kind: task
|
|
slug: contextual-chat-authorization
|
|
title: Bind chat to authorized project and supported object contexts
|
|
plan_slug: workspace-communications
|
|
epic_slug: workspace-chat
|
|
status: blocked
|
|
priority: P1
|
|
tenant_id: global
|
|
owner: unassigned
|
|
cursor_todo_id: null
|
|
updated_at: "2026-10-22"
|
|
---
|
|
|
|
# Task summary
|
|
|
|
Extend the workspace-chat foundation to project and explicitly supported object contexts without widening private-context access.
|
|
|
|
## Description
|
|
|
|
Follow the [plan's context authorization contract](../Plan-workspace-communications.md). Projects are generic `objects` rows (`type = 'project'`), not a separate table. Existing types include space, task, document, whiteboard, group and form; enable only types with a verified read/write/delegate policy and usable entry point. `object_type_defs` does not automatically enable custom contexts. Neither `object_assignees`, parent links nor workspace ownership are ACLs.
|
|
|
|
This is a bounded chat adapter/API/UI integration, not a general object-permissions rewrite. It is blocked on an authoritative context policy: current `objects` schema/router proves only tenant ownership. Keep private/unknown/policy-unavailable contexts disabled until that policy is supplied and tested; escalate the missing ACL prerequisite to the conductor rather than inventing one inside chat.
|
|
|
|
## Subtasks
|
|
|
|
- [ ] Resolve the explicit prerequisite: document the authoritative read/write/delegate policy API and which concrete object types it supports before enabling any object context.
|
|
- [ ] Extend the foundation's context union to a tenant-validated object reference; generate a new migration with referential integrity and context indexes as needed. Context binding cannot be silently moved to broaden an audience.
|
|
- [ ] Use workspace AND context AND channel checks for discovery, history, threads, writes, membership targets, mentions/counts, notifications, replay and live delivery; prevent channel membership from granting object access.
|
|
- [ ] Add project/supported-object conversation entry points that resolve the same durable channel surface as workspace Chat, showing context without leaking inaccessible titles.
|
|
- [ ] Test private same-workspace denial, unsupported types, archived/deleted contexts, ancestry-policy changes, revoked membership/subscriptions, and authorized access without duplicate histories.
|
|
|
|
## Owner or assignee
|
|
|
|
`unassigned`
|
|
|
|
## Status
|
|
|
|
`blocked` — workspace chat foundation and a verified object-level authorization/delegation policy must exist first. User kickoff approval does not waive this prerequisite.
|
|
|
|
## Estimation
|
|
|
|
`M` once the policy prerequisite is available.
|
|
|
|
## Acceptance criteria
|
|
|
|
- [ ] Project chat references actual `objects` records; no invented projects table or arbitrary context slug grants access.
|
|
- [ ] Workspace membership, workspace admin role, object assignment, and channel membership independently cannot bypass private-context denial.
|
|
- [ ] Public means public within the permitted context audience; private/direct require membership in addition.
|
|
- [ ] Removed access immediately stops subsequent reads, replay, notifications and live payloads; client caches are invalidated.
|
|
- [ ] Unsupported contexts fail closed; there is no fallback to workspace-public chat.
|
|
- [ ] `pnpm lint && pnpm type-check && pnpm test` pass; run build for changed server entry points/exports.
|
|
|
|
## Links to related Epic / Plan
|
|
|
|
- Epic: [Workspace chat](./Epic-workspace-chat.md)
|
|
- Plan: [Workspace communications](../Plan-workspace-communications.md)
|
|
- Dependencies: [Persistence](./Task-chat-persistence.md), [Realtime](./Task-chat-realtime-delivery.md), [UI](./Task-chat-ui-and-navigation.md)
|
|
- Agent integration: [Reviewed agent membership](../Epic-agent-participation/Task-agent-channel-membership.md)
|