102 خطوط
5.4 KiB
Markdown
102 خطوط
5.4 KiB
Markdown
# Manager Phase 0 — Role, permission, and data-scope audit
|
|
|
|
## Scope lock
|
|
|
|
### Files expected to change
|
|
|
|
- `backend/app/Modules/Identity/Application/RolePermissions.php`
|
|
- `backend/app/Modules/Learner/Http/LearnerController.php`
|
|
- Manager and identity authorization tests
|
|
- This audit document
|
|
|
|
### Modules affected
|
|
|
|
- Identity permissions
|
|
- Manager workspace read model
|
|
- Team and user visibility
|
|
- Personal learner experience shared by learners and managers
|
|
|
|
### API endpoints affected
|
|
|
|
- `GET /api/v1/learner/home`
|
|
- Learner assignment/player endpoints under `/api/v1/learner/*`
|
|
- `GET /api/v1/manager/workspace` is audited and tested; its response contract is unchanged.
|
|
|
|
### Permissions affected
|
|
|
|
- Managers gain `learning.personal.view` for learning assigned to their own account.
|
|
- Managers retain team-scoped read permissions.
|
|
- Managers do not gain course authoring, organization assignment management, user management, platform administration, or organization-wide analytics.
|
|
|
|
### Expected behavior changes
|
|
|
|
- A manager may consume courses and learning paths assigned to the manager's own user account.
|
|
- Personal-learning queries continue to resolve the authenticated user's assignment only.
|
|
|
|
### Behavior that must remain unchanged
|
|
|
|
- Learner personal learning remains functional.
|
|
- Manager team analytics remains restricted to explicitly managed teams.
|
|
- Course Designer and Super Admin capabilities are unchanged.
|
|
- Manager UI is not redesigned in Phase 0.
|
|
|
|
## Current authorization model
|
|
|
|
The application stores one primary role per user. A Manager therefore receives the learner capability needed for self-learning through a permission, without adding a second role or duplicating the learner domain. The same learner endpoints and course player are reused.
|
|
|
|
Manager team scope is the union of members belonging to teams explicitly linked through `team_managers`, constrained again by `organization_id`. Direct reports are automatically attached when a designer assigns a manager to a team; a direct-report relationship alone is not treated as an implicit organization-wide grant.
|
|
|
|
## Permission matrix
|
|
|
|
| Capability | Manager | Enforcement |
|
|
| --- | --- | --- |
|
|
| View own assigned learning | Yes | `learning.personal.view`; assignment must contain authenticated user |
|
|
| Continue own course/player activity | Yes | Assignment, organization, course-version, lesson, and user scope |
|
|
| View explicitly managed teams | Yes | `teams.view` plus `team_managers` membership |
|
|
| View members of managed teams | Yes | User directory and manager workspace team scope |
|
|
| View team learning progress | Yes | `analytics.team.view` and managed member IDs |
|
|
| View team assessments | Yes | Manager workspace uses managed member IDs |
|
|
| View team skills taxonomy | Yes, read-only | `taxonomy.view` |
|
|
| View organization-wide users | No | User directory narrows Manager to managed-team members |
|
|
| View another team's private data | No | Managed team/member ID filters |
|
|
| View another user's personal assignment/player | No | Learner progress resolves assignment through authenticated user |
|
|
| Create or edit a course | No | `courses.author` denied |
|
|
| Use Course Builder, Question Bank, or AI Studio | No | `courses.author` denied |
|
|
| Create organization assignments | No in Phase 0 | `assignments.manage` denied |
|
|
| Create/update/delete teams or users | No | `teams.manage` and `users.manage` denied |
|
|
| Export organization data | No | Export endpoints require `courses.author` |
|
|
| View organization monitoring | No | `analytics.organization.view` denied |
|
|
| Manage subscription/settings/platform | No | Relevant organization/platform permissions denied |
|
|
| Approve requests | Not implemented | No approval capability or workflow currently exists |
|
|
|
|
## Endpoint audit summary
|
|
|
|
- Manager workspace aggregation begins from managed team IDs, then member IDs, and applies the tenant organization to teams, assignments, events, and assessments.
|
|
- User listing uses `UserDirectory::visibleTo`, which limits a Manager to users in managed teams.
|
|
- Team index/detail limits a Manager to teams where the Manager is explicitly attached.
|
|
- Team, user, assignment, course, builder, assessment-authoring, export, monitoring, AI, and platform mutations require permissions the Manager does not have.
|
|
- Personal learner endpoints now authorize by `learning.personal.view`; all reads and mutations remain bound to the authenticated user's own assignment.
|
|
|
|
## Security checks
|
|
|
|
- Cross-team Manager workspace data: covered.
|
|
- Unmanaged team detail by ID: covered.
|
|
- Organization-wide user listing: denied by scoped directory query.
|
|
- Unauthorized team mutation: covered.
|
|
- Unauthorized assignment/course mutation: covered.
|
|
- Another user's personal assignment ID: returns not found.
|
|
- Cross-tenant records: tenant middleware and organization filters remain required.
|
|
- Frontend menu hiding is not treated as an authorization control.
|
|
|
|
## Deferred technical debt
|
|
|
|
### Medium
|
|
|
|
- The Manager frontend route guard currently accepts only `/manager/*`; exposing the shared learner UI inside Manager navigation belongs to Phase 1.
|
|
- Assignment creation for a Manager is intentionally still denied. A team-scoped assignment permission and recipient resolver belong to Phase 3.
|
|
|
|
### Low
|
|
|
|
- Approval workflows and permission names do not exist yet; they should only be introduced if the product workflow is implemented in Phase 4.
|
|
- Manager report export is not available. Any future export must resolve recipients and rows from managed-team scope on the backend.
|