Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Define lifecycle and persistence semantics for request-scoped policies

Aperta
  • Qualcosa non va?
#8,715 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
php, typescript
Ambito
authorization, backend-api-design, security, testing

Direzione di ricerca

Start by reading the listed policy runtime files, PolicyService, the FilePolicyApplier implementations, and the frontend policy helpers. Trace how request overrides, personal defaults, group context, and snapshots are currently resolved, then run the existing policy and security tests. Done means the lifecycle source of truth and independent permissions are implemented, fail-closed frontend behavior is covered, backend authorization remains authoritative, and the required security tests pass without breaking existing policies.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

backend enhancement frontend javascript php

Goal

Define and enforce clear lifecycle rules for policies that affect a signing request.

The result must make request overrides, personal defaults, and persisted request values separate concepts.

Important current behavior

The current policy resolver links two permissions together: canUseAsRequestOverride and canSaveAsUserDefault are produced from the same condition.

These permissions are not the same.

A policy may allow a value for one request without allowing the user to save that value as a personal default.

Do not enable personal preferences only to make request overrides work.

Also review the frontend helper for request overrides. Missing or failed policy data must not be treated as permission to edit a security-relevant request setting.

Lifecycle model

Audit current policies and classify each relevant policy as one or more of:

  • runtime policy;
  • request/document snapshot;
  • request override allowed;
  • personal default allowed;
  • admin-only;
  • group-delegable.

Keep this classification close to the policy code and cover it with tests. Do not create a second policy engine.

Required architecture rules

Request override and personal default

The backend must be able to decide these permissions independently.

Existing policy behavior must stay compatible unless a linked issue requires a change.

Server authority

The frontend may hide or show controls, but it does not grant permission.

The backend must validate:

  • the authenticated actor;
  • the policy key;
  • the submitted value;
  • whether a request override is allowed;
  • whether a personal default is allowed;
  • the active group context.

Keep the current rule that an active group context is valid only when the current actor belongs to that group.

Fail closed

If effective policy data is missing or cannot be loaded, frontend controls that change request policy values must not become editable by default.

Snapshots

A stored snapshot must contain a value resolved by the backend.

Do not trust a client-provided snapshot or client-provided source scope.

After a request-scoped value reaches its freeze point, normal requester input must not rewrite it.

The lifecycle definition must say what the freeze point is for drafts, active signing requests, later edits, and added signers.

Public data

Do not expose hidden policy layers, group membership, user preferences, or internal policy metadata to public signer endpoints.

Files to inspect

Start with:

lib/Service/Policy/Runtime/DefaultPolicyResolver.php
lib/Service/Policy/Runtime/PolicyContextFactory.php
lib/Service/Policy/PolicyService.php
lib/Service/Policy/AbstractFilePolicyApplier.php
lib/Service/Policy/FilePolicyApplier.php
src/store/policies.ts
src/views/Preferences/personalPreferenceVisibility.ts

Use the existing FilePolicyApplier implementations as examples.

Output

The implementation must leave a clear source of truth for policy lifecycle rules and tests that show the expected behavior.

Avoid a large unrelated refactor. If the audit finds a separate bug, create a focused follow-up issue instead of mixing it into this one.

Target branch

main

Milestone: Next Major (36)

Tests

At minimum, cover:

  • request override permission independent from personal-default permission;
  • missing frontend policy state fails closed;
  • unauthorized active group context is rejected by the backend;
  • client values cannot bypass a locked higher-level policy;
  • snapshot values come from backend resolution;
  • public policy state does not expose private user/group data;
  • existing policies keep their current behavior unless intentionally changed.

Done when

  • Policy lifecycle types are clear.
  • Request override and personal default permissions can be handled independently.
  • Frontend request-override checks fail closed.
  • Backend authorization remains the source of truth.
  • Snapshot ownership and freeze points are defined.
  • Security tests cover the rules above.
  • Existing policy behavior remains compatible.
Additional context
  • If you have questions, feel free to ask in this issue.
  • Give a ⭐️ star to this repository if you find LibreSign useful and would like to support the project.
  • You can also join our community: https://t.me/LibreSign
Lingua principale
PHP
Stelle
818
Fork
146
Merge medio
8h 6m
PR unite (30g)
500

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di LibreSign/libresign

Tutte le issue di LibreSign/libresign

Issue simili

Altre issue su PHP

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.