multitenancy: let the selected tenant's Owner manage its tenant-scoped settings (document numbering, tenant configuration, print templates)
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Feature
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- java
- Domain
- authorization, backend, frontend
Research direction
Start with the role gates on DocumentNumberEndpoint, TenantConfigurationsEndpoint, and PrintEndpoint, then trace TenantConfigurationKeyPolicy and the application shell's Settings navigation. Check how the selected tenant is enforced in the existing endpoint and UI tests. Done means Owners can manage these settings for their selected tenant, instance-wide keys remain staff-only, and tests confirm cross-tenant writes and User access return 403.
Written by the indexing model from the issue text.
Description
Problem
Under TOKEN_GROUPS, a tenant's own administrator is its Owner. Platform staff hold ADMINISTRATOR / OPERATOR. Several per-tenant settings are reachable only by staff:
| Surface | Gate |
|---|---|
Document numbering (DocumentNumberEndpoint, /services/core/numbering) |
@RolesAllowed({"ADMINISTRATOR","OPERATOR"}) on the class |
Tenant configuration (TenantConfigurationsEndpoint: languages, country, APP_BASE_URL, print-template choice) |
@RolesAllowed({"ADMINISTRATOR","OPERATOR"}) on the class |
Print templates: read, edit, duplicate, delete (PrintEndpoint, /{entity}/templates/**) |
ADMINISTRATOR, OPERATOR |
A concrete legal case: a Bulgarian tenant must clear or set to numeric the prefix of its sales-invoice series before its first invoice, because the VAT Act art. 114 requires a 10-digit Arabic-numeral number. Its Owner cannot open Document Numbering, so a member of staff has to do it for each customer.
Proposal
- Let the selected tenant's
Owner(ApplicationRoles.OWNER) read and write these tenant-scoped settings, in addition toADMINISTRATOR/OPERATOR. The writes stay limited to the current tenant; everything here is already tenant-scoped. - Keep instance-wide keys (outside
TenantConfigurationKeyPolicy's allow-list) staff-only. - Show these screens in the application shell's Settings for an Owner, next to Settings → Users.
- ITs: an Owner of tenant A can change A's numbering, configuration and templates; an Owner of A gets 403 on B's; a
Usergets 403.
- Dominant language
- Java
- Stars
- 278
- Forks
- 97
- Avg merge
- 18h 53m
- Merged PRs (30d)
- 228
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from eclipse-dirigible/dirigible
-
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
eclipse-dirigible/dirigible#7958 ·
Maintainers usually reply within 1 day
-
intent: a create-from without fromStatus answers 200 on a missing or unknown source id (no 400/404)Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
eclipse-dirigible/dirigible#7945 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
eclipse-dirigible/dirigible#7891 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
eclipse-dirigible/dirigible#6538 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
eclipse-dirigible/dirigible#4812 ·
Maintainers usually reply within 1 day
All issues in eclipse-dirigible/dirigible
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
apache/rocketmq-dashboard#7250 ·
Maintainers usually reply within 3 days
-
Bug
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
ignatov/intellij-erlang#1093 ·
-
HttpMaxFrameSizeTest.sendOversizedMessageTest() passes silently when maxFrameSize is not enforcedOpen
Difficulty 1/5 Under an hour Newbie friendliness 90/100
apache/activemq#2706 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
federicoiosue/Omni-Notes#1032 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
unitycatalog/unitycatalog#2025 ·
Maintainers usually reply within 4 days