Skip to content

feat: policy signature flow#7518

Draft
vitormattos wants to merge 1326 commits into
mainfrom
feat/policy-signature-flow-phase1-groundwork
Draft

feat: policy signature flow#7518
vitormattos wants to merge 1326 commits into
mainfrom
feat/policy-signature-flow-phase1-groundwork

Conversation

@vitormattos
Copy link
Copy Markdown
Member

No description provided.

@vitormattos vitormattos added this to the Next Major (34) milestone Apr 14, 2026
@vitormattos vitormattos self-assigned this Apr 14, 2026
@github-project-automation github-project-automation Bot moved this to 0. Needs triage in Roadmap Apr 14, 2026
@vitormattos vitormattos marked this pull request as draft April 14, 2026 17:54
@vitormattos vitormattos force-pushed the feat/policy-signature-flow-phase1-groundwork branch 2 times, most recently from 955dec8 to 2b5c509 Compare April 14, 2026 20:24
@vitormattos vitormattos marked this pull request as ready for review April 14, 2026 20:34
@vitormattos vitormattos force-pushed the feat/policy-signature-flow-phase1-groundwork branch 3 times, most recently from e0949a0 to e843d15 Compare April 23, 2026 14:49
@vitormattos vitormattos marked this pull request as draft April 23, 2026 14:50
@vitormattos vitormattos force-pushed the feat/policy-signature-flow-phase1-groundwork branch 5 times, most recently from a34a632 to 6aa5f3b Compare April 28, 2026 13:46
vitormattos added a commit that referenced this pull request Apr 28, 2026
FIXES:
- Register all 6 signature_text individual policy keys in SignatureTextPolicy
- Each key now has proper normalizers and defaults matching backend
- Fix mock object type errors by converting willReturnMap to willReturnCallback
- Mock callbacks now always return string (never null) to match type hints
- Update mock expectations from once()/exactly(2) to atLeastOnce() for deleteKey()
- Align test expectations with actual migration call counts

DETAILS:
* SignatureTextPolicy: Now exposes 6 individual keys via keys() and get()
* Each key (template, template_font_size, signature_width, etc.) has proper specs
* Render mode key includes allowed values: 'default', 'graphic', 'text'
* Migration tests: Fixed mock return types to prevent TypeError
* All getValueString() calls now guaranteed to return string via callback
* Adjusted deleteKey() and setValueString() expectations to handle migration flow

Test Results Expected:
- 0 Unknown policy key errors (all 6 now registered)
- 0 Mock type errors (callbacks always return string)
- 0 Mock expectation violations (atLeastOnce accounts for cleanup calls)
vitormattos added a commit that referenced this pull request Apr 28, 2026
…olicy

- Fix useSignatureTextPolicy.ts accessing .effectiveValue instead of non-existent .value
- Simplify useSignatureTextPolicy return type annotation using ComputedRef
- Fix model.ts serializeSignatureTextPolicyConfig to return JSON string
- Fix model.ts normalizeSignatureTextPolicyConfig to handle JSON string inputs
- Fix SignatureTextRuleEditor.vue Emits type to use EffectivePolicyValue
- Remove trailing newline from SignatureTextPolicy.php

Fixes: TypeScript type checking and PHP-CS formatting failures in PR #7518
Tests: npm run ts:check passes, php-cs formatting validated
vitormattos added a commit that referenced this pull request Apr 28, 2026
FIXES:
- Register all 6 signature_text individual policy keys in SignatureTextPolicy
- Each key now has proper normalizers and defaults matching backend
- Fix mock object type errors by converting willReturnMap to willReturnCallback
- Mock callbacks now always return string (never null) to match type hints
- Update mock expectations from once()/exactly(2) to atLeastOnce() for deleteKey()
- Align test expectations with actual migration call counts

DETAILS:
* SignatureTextPolicy: Now exposes 6 individual keys via keys() and get()
* Each key (template, template_font_size, signature_width, etc.) has proper specs
* Render mode key includes allowed values: 'default', 'graphic', 'text'
* Migration tests: Fixed mock return types to prevent TypeError
* All getValueString() calls now guaranteed to return string via callback
* Adjusted deleteKey() and setValueString() expectations to handle migration flow

Test Results Expected:
- 0 Unknown policy key errors (all 6 now registered)
- 0 Mock type errors (callbacks always return string)
- 0 Mock expectation violations (atLeastOnce accounts for cleanup calls)

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
vitormattos added a commit that referenced this pull request Apr 28, 2026
…olicy

- Fix useSignatureTextPolicy.ts accessing .effectiveValue instead of non-existent .value
- Simplify useSignatureTextPolicy return type annotation using ComputedRef
- Fix model.ts serializeSignatureTextPolicyConfig to return JSON string
- Fix model.ts normalizeSignatureTextPolicyConfig to handle JSON string inputs
- Fix SignatureTextRuleEditor.vue Emits type to use EffectivePolicyValue
- Remove trailing newline from SignatureTextPolicy.php

Fixes: TypeScript type checking and PHP-CS formatting failures in PR #7518
Tests: npm run ts:check passes, php-cs formatting validated
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
@vitormattos vitormattos force-pushed the feat/policy-signature-flow-phase1-groundwork branch 3 times, most recently from 1c39cdb to 892fbd0 Compare April 28, 2026 17:08
@vitormattos vitormattos marked this pull request as ready for review April 28, 2026 20:48
@vitormattos vitormattos marked this pull request as draft April 28, 2026 20:52
@vitormattos vitormattos force-pushed the feat/policy-signature-flow-phase1-groundwork branch 3 times, most recently from c6cc732 to 0e665a6 Compare May 4, 2026 14:31
Comment thread playwright/support/nc-provisioning.ts Fixed
Comment thread playwright/support/nc-provisioning.ts Fixed
Comment thread playwright/support/nc-provisioning.ts Fixed
SignatureBackgroundRuleEditor now follows the policy layer pattern:
- Emits update:modelValue for state changes only
- PolicyWorkbench coordinates policy persistence via policiesStore
- Upload/reset/remove operations still use admin endpoints (fire-and-forget)
- Buttons now directly emit state changes without async persistence

Aligns with policy-centric architecture where RuleEditors only emit values
and the parent PolicyWorkbench handles saveSystemPolicy/saveGroupPolicy calls.

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
…alidation

This commit refactors AdminController following the twofactor-gateway pattern
(Policy layer + minimal endpoint wrappers):

**New:**
- Created UploadValidator trait to consolidate duplicated file upload validation logic
  - Replaces 50+ lines of duplicated error handling in signatureBackgroundSave() and saveCertificatePolicy()
  - Provides reusable validateUploadedFile() method with localized error messages

**Removed (wrappers without additional logic):**
- PATCH /admin/signature-background (signatureBackgroundReset) → DELETE already sufficient
- DELETE /admin/tsa endpoint → Merged into setTsaConfig() as internal resetTsaConfig()
- Converted deleteTsaConfig() from public endpoint to private helper method

**Refactored:**
- saveCertificatePolicy() now handles both POST (upload) and exposes separate deleteCertificatePolicy()
  for DELETE method (maintains backward compatibility via separate route handler)
- Updated saveCertificatePolicy() to use UploadValidator trait

**Impact:**
- Reduced endpoint surface from 24 to 21 HTTP routes (from 19 admin routes)
- Eliminated redundant wrapper methods that only delegated to services
- Improved maintainability by consolidating upload validation logic
- All 2,542 frontend tests pass
- OpenAPI specs regenerated (administration: 19 routes, full: 62 routes)

**Next steps (STAGE 21):**
- Refactor certificate_engine + signing_mode endpoints to PolicyService (multiescopo)
- Consider policy-driven migration for reminder_settings, signature_text, footer_template
- Add WhatsApp Business identification method support for twofactor_gateway integration

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
@vitormattos vitormattos force-pushed the feat/policy-signature-flow-phase1-groundwork branch from df67ffa to 24b6899 Compare May 15, 2026 23:00
vitormattos added a commit that referenced this pull request May 15, 2026
FIXES:
- Register all 6 signature_text individual policy keys in SignatureTextPolicy
- Each key now has proper normalizers and defaults matching backend
- Fix mock object type errors by converting willReturnMap to willReturnCallback
- Mock callbacks now always return string (never null) to match type hints
- Update mock expectations from once()/exactly(2) to atLeastOnce() for deleteKey()
- Align test expectations with actual migration call counts

DETAILS:
* SignatureTextPolicy: Now exposes 6 individual keys via keys() and get()
* Each key (template, template_font_size, signature_width, etc.) has proper specs
* Render mode key includes allowed values: 'default', 'graphic', 'text'
* Migration tests: Fixed mock return types to prevent TypeError
* All getValueString() calls now guaranteed to return string via callback
* Adjusted deleteKey() and setValueString() expectations to handle migration flow

Test Results Expected:
- 0 Unknown policy key errors (all 6 now registered)
- 0 Mock type errors (callbacks always return string)
- 0 Mock expectation violations (atLeastOnce accounts for cleanup calls)

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
vitormattos added a commit that referenced this pull request May 15, 2026
…olicy

- Fix useSignatureTextPolicy.ts accessing .effectiveValue instead of non-existent .value
- Simplify useSignatureTextPolicy return type annotation using ComputedRef
- Fix model.ts serializeSignatureTextPolicyConfig to return JSON string
- Fix model.ts normalizeSignatureTextPolicyConfig to handle JSON string inputs
- Fix SignatureTextRuleEditor.vue Emits type to use EffectivePolicyValue
- Remove trailing newline from SignatureTextPolicy.php

Fixes: TypeScript type checking and PHP-CS formatting failures in PR #7518
Tests: npm run ts:check passes, php-cs formatting validated
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
… and UploadValidator

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
…leEditor

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
…identify_methods policy filtering before result enrichment

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
…ints instead of provisioning_api app config

- Replace setAppConfig('libresign', 'identify_methods', ...) with setSystemPolicy('identify_methods', ...)
- Replace setAppConfig('libresign', 'envelope_enabled', ...) with setSystemPolicy('envelope_enabled', ...)
- Replace setAppConfig('libresign', 'groups_request_sign', ...) with setSystemPolicy('groups_request_sign', ...)
- Replace setAppConfig('libresign', 'crl_external_validation_enabled', ...) with setSystemPolicy('crl_external_validation_enabled', ...)
- Replace setAppConfig('libresign', 'signature_engine', ...) with setCertificateEngine(...)
- Add setSystemPolicy, getSystemPolicyValue, setCertificateEngine helpers to nc-provisioning.ts
- Replace provisioning_api Behat steps for identify_methods with POST /apps/libresign/api/v1/policies/system/identify_methods
- Replace provisioning_api Behat steps for certificate_engine with POST /apps/libresign/api/v1/admin/certificate/engine
- Only tsa_url and internal save/restore for signature_engine still use getAppConfig/setAppConfig (not policies)

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
…n Playwright tests

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
…e related tests

- Admin::__construct() was missing $identifyMethodService arg (arg #7), causing
  test failures in AdminTest (MockObject_FooterService mismatch)
- Add IdentifyMethodService to AdminTest setUp
- Update IdentifyMethodsPolicyValue, IdentifyMethodsPolicy tests
- Update identify_methods_policy.feature and initial_state.feature scenarios

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Replace enabled/disabled radio options with a switch and conditional approver group rendering for cleaner settings UX.

Also make identify_methods integration scenario independent by clearing user/group overrides before asserting empty system payload behavior.

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: 0. Needs triage

Development

Successfully merging this pull request may close these issues.

2 participants