feat(quorum-schema-declaration): implement spec (#151)#155
feat(quorum-schema-declaration): implement spec (#151)#155rubenvdlinde wants to merge 3 commits into
Conversation
Declares x-openregister-aggregations (totalParticipantCount, presentParticipantCount) and x-openregister-calculations (quorumPercentage, quorumMet) on the Meeting schema in decidesk_register.json, making quorum status readable as derived fields on every Meeting object without imperative service code. Also adds attendanceStatus field to Participant schema (required for the presentParticipantCount aggregation filter) and an integration test that skips cleanly in the build container but asserts against a live OpenRegister engine when DECIDESK_INTEGRATION=1. Chain spec 1 of 3 (quorum-schema-declaration). Successors quorum-guard-rewrite and quorum-service-deletion depend on this merging. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Code Review — Juan Claude van DammeResult: PASS (1 merge conflict resolved, 0 unfixed, 0 blocking) What was reviewedPR #155 adds declarative quorum fields to the Meeting schema via Merge conflict resolved
Quality suite results
Out-of-scope inherited debt (informational)The following pre-existing issues were found on unchanged files — they are NOT blockers for this PR but should be addressed in a follow-up cleanup PR:
🤖 Changes Juan Claude van Damme applied
View full diff · 14 files changed, 295 insertions(+), 1 deletion(-) |
|
|
||
| $this->settingsService->expects($this->once()) | ||
| ->method('getSettings') | ||
| ->willReturn($settings); |
There was a problem hiding this comment.
[fixed: merge conflict resolved] Chose origin/development version: expects($this->once())->method('getUser')->willReturn(...) over PR's bare method('getUser')->willReturn(...). The expects($this->once()) asserts the mock is called exactly once, which is the correct stricter form for this test.
Security Review — Clyde BarcodeResult: FAIL (1 fixed CRITICAL, 1 unfixed WARNING)
Fixed
Unfixed (blocking)
Inherited debt (informational, non-blocking)
See inline comments for per-finding detail. 🤖 Changes Clyde Barcode applied
View full diff · 14 files changed, 291 insertions(+), 1 deletion(-) |
|
📍 [fixed: missing DI wiring restored admin/auth guards] Rule: CWE-287 / OWASP A07:2021 — AnalyticsController factory omitted required IUserSession and IGroupManager params; PHP ArgumentCountError on instantiation bypassed all auth checks. Added both params mirroring VotingBehaviourController factory pattern in same file. |
|
📍 [unfixed: WARNING — escalated, data-schema investigation required] Rule: OWASP A01:2021 — getMyItems() passes $user->getDisplayName() as assignee filter. Display names are non-unique and user-controlled in Nextcloud; two users sharing a display name see each other's action items. Fix: change to $user->getUID() and verify assignee field stores UIDs in existing ActionItem records before applying. |
|
Closing — wrapper bug (push to literal pr-branch instead of PR head ref) caused Juan's merge-conflict resolution and Clyde's CRITICAL DI fix to be lost. Fixed in hydra#239. Rebuilding from scratch with new wrapper to validate end-to-end pipeline. |
2 participants
Closes #151
Summary
Auto-generated draft PR for OpenSpec change
quorum-schema-declaration.The Hydra builder ran the spec but could not run
gh pr createitself(Phase D+E credential strip — Claude has no
GH_TOKENby design).The entrypoint detected commits on the feature branch with no PR and
created this draft so the reviewer + security + applier can proceed.
Spec Reference
/spec/Commits on this branch
Files changed
docs/data-model.mdlib/Settings/decidesk_register.jsonopenspec/architecture/adr-000-data-model.mdopenspec/changes/quorum-schema-declaration/design.mdopenspec/changes/quorum-schema-declaration/tasks.mdpackage-lock.jsontests/Integration/Meeting/QuorumDeclarativeTest.phptests/unit/Controller/SettingsControllerTest.phpPR auto-created by Hydra builder entrypoint (
hydra_ensure_pr_exists)because Claude's session closed without running
gh pr create.Reviewer + applier follow as normal.