--- id: DOM-PFM-CSH-004 title: Application realises: CON-PFM-CSH-004 product_area: platform module: console-shell revision: 1 status: draft design_intent: confirmed origin: >- services-platform:docs/proposals/application-access-and-entitlements.md#10.1 Decided by Andrew on 2026-10-11 (built and accepted 2026-10-15) implementation_evidence: observed source_sha: react-console: baf6dae382d6f41dce976c7f848667ccc37e076f services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 owned_by: SVC-PFM-CSH-console-shell readable_by: [] lifecycle: STATE-PFM-CSH-003 custom_fields: none identity: >- The application key connects personal access and administrative availability views. The console holds these answers for one workspace; Operations owns their underlying records. attributes: - name: application key kind: text required: true computed: false notes: >- Platform’s stable key identifies the application; overview entries with no string key are discarded. - name: name kind: text required: true computed: false notes: 'The response name labels the application, with its key as fallback.' - name: console domains kind: computed required: true computed: true notes: >- Application keys map to one or more console domains; Platform enables administration and shared tools. - name: opened for the person kind: computed required: true computed: true notes: >- Context membership enables mapped domains; staff wildcard permissions do not add applications. Platform’s narrowing depends on the deployed licensing mode. - name: features kind: collection required: true computed: false notes: The console carries context features without using them to enable domains. - name: available to the workspace kind: enum required: true computed: false notes: The overview parser interprets only explicit false as unavailable. - name: licence state kind: enum required: true computed: false notes: >- The administrator receives licensed or not licensed; unrecognized values parse as not licensed. - name: operational state kind: enum required: true computed: false notes: >- Known operational states are retained, and unreadable states become not set up. - name: licence dates kind: date required: false computed: false notes: 'Optional start, end and grace dates retain calendar-day meaning.' - name: reason kind: text required: false computed: true notes: The console turns availability reasons into readable explanations. - name: last asked kind: date required: true computed: false notes: >- The timestamp starts at provider mount and advances on successful application-refresh responses before the ticket check. relationships: - to: DOM-PFM-CSH-002 cardinality: one application key to zero or more menu domains ownership: The menu controls entry content within enabled application domains. cross_service: false - to: DOM-PFM-CSH-003 cardinality: one application domain to zero or more destination paths ownership: The registry associates application domains with destination paths. cross_service: false - to: DOM-PFM-CSH-001 cardinality: one shell context to one personal application list ownership: >- Security supplies the held answer, and Operations owns licensing records behind it. cross_service: true invariants: - id: INV-DOM-PFM-CSH-004-01 statement: >- Context-listed applications enable domains for customer users and staff; wildcard permission rules enable no extra domain. enforced_at: - console provenance: test source: >- react-console:lib/security-context/entitlements.test.ts#gives a staff wildcard no domain the applications did not give - id: INV-DOM-PFM-CSH-004-02 statement: Application absence is explained before page permission is evaluated. enforced_at: - console provenance: test source: >- react-console:lib/console/application-guard.test.ts#prefers the application's answer: nobody can grant a permission inside an application they do not have - id: INV-DOM-PFM-CSH-004-03 statement: A permission-bearing page refuses when no entitlements are available. enforced_at: - console provenance: test source: >- react-console:lib/console/application-guard.test.ts#refuses a page that asks for something when there are no entitlements at all - id: INV-DOM-PFM-CSH-004-04 statement: >- Narrow refresh replaces applications and features while retaining roles, rules and reachable workspaces. enforced_at: - console provenance: observed source: 'react-console:lib/security-context/provider.tsx:refreshApplications' - id: INV-DOM-PFM-CSH-004-05 statement: >- Application-refresh data is installed only while its workspace ticket and selected workspace still match. enforced_at: - console provenance: observed source: >- react-console:lib/security-context/provider.tsx:refreshApplications (ticket check) - id: INV-DOM-PFM-CSH-004-06 statement: >- The administrator response excludes overrides, staff-authored reasons, staff identities and commercial details. enforced_at: - service provenance: observed source: >- services-platform:modules/licensing/aws/api/licensing-api-mapper.ts:toTenantApplications - id: INV-DOM-PFM-CSH-004-07 statement: The administrative route reports an out-of-reach workspace as not found. enforced_at: - api provenance: observed source: >- services-platform:modules/tenants/aws/api/tenant-applications.routes.ts:tenantApplicationsRoutes - id: INV-DOM-PFM-CSH-004-08 statement: >- Features follow the context response and do not enable application sections. enforced_at: - console provenance: test source: >- react-console:lib/security-context/entitlements.test.ts#reads features from the context rather than granting them all physical: [] evidence: - >- react-console at baf6dae: lib/security-context/{entitlements.ts,application-refusal.ts,provider.tsx}; lib/console/{application-guard,domains}.ts; lib/authz/{guard.tsx,evaluate.ts}; components/console/{application-route-gate,application-unavailable}.tsx; lib/applications/**. - >- services-platform at ad3f6a6: docs/proposals/application-access-and-entitlements.md (built and accepted by Andrew 2026-10-15; §5.3, §6.4, §7.1, §7.2, §10.1); modules/tenants/aws/api/tenant-applications.routes.ts; modules/licensing/aws/api/licensing-api-mapper.ts; modules/licensing/db/{applications,tenant-applications}.table.ts (Operations-owned, named for the Code Map). --- # Application ## What It Models The console presents application access through two related answers. The personal list controls application sections and page entry. The administrative overview explains workspace availability and licence dates. Both depend on Platform, but they have different audiences and refresh paths. ## Identity and Attributes A stable application key connects the personal context to console domains. The overview adds name, availability, licensing and operational details. Features accompany the personal list without enabling domains themselves. Freshness uses a provider timestamp initialized on mount and updated by successful application-refresh responses. ## Relationships Applications enable menu sections and classify page paths. The shell retains the personal list for its selected context. Security computes that list, while Operations owns the licensing and operational records. The administrative service reads those records directly rather than reading client memory. ## Invariants The structured invariants cover entitlement-derived sections, application-first page refusal and workspace-safe refresh. Staff wildcard permissions add no application. Administrative responses omit staff-only and commercial details. Refresh replaces applications and features while leaving the remaining context intact. ## How It Is Stored and Shared The console view exists in memory and has no physical tables or metadata registration. Operations stores its own application registry and workspace application state. Security provides the personal context and refresh read; the administrative operation provides the separate overview. ## Open Design Questions The overview parser treats every availability value except explicit false as available. Renewal-warning placement and the scope of returning-tab refresh remain product decisions. A successful but superseded refresh also advances the timestamp, which can postpone the next focus refresh.