[OpenSpec] contract-approval-ownership-guard

[github-actions]

⚠️ OpenSpec-managed issue — this content is automatically synced
from the openspec/ directory. Manual edits will be overwritten on next sync.

Artifacts

• ✅ Metadata
• ✅ Proposal
• ✅ Specs
• 🔲 Design
• ✅ Tasks
• 🔲 Plan
• 🔲 Review

Specs

• 📄 contract-decision-delegation

Tasks

• 1.1 Add ContractApprovalService::authorizeSubmit(string $contractUuid, \OCP\IUser $user, array $groupNames): bool
• 1.2 Change ContractApprovalService::loadContract() used by the submit
• 1.3 submitForApproval() MUST throw (or the controller MUST short-circuit
• 2.1 In ContractApprovalController, inject IGroupManager and IConfig
• 2.2 Add a private authorizeContract(string $contractUuid): ?JSONResponse
• 2.3 Call authorizeContract() at the top of submit() and
• 2.4 Update the class-level docblock to describe the ownership guard
• 3.1 PHPUnit: authenticated non-owning user (no admin/aanbod-beheerder
• 3.2 PHPUnit: owning aanbod-beheerder (matching _organisation) and
• 3.3 PHPUnit: submitRenewal() covered by the same three cases.
• 3.4 Regression: existing ContractApprovalService / ContractApprovalController
• 4.1 Update openspec/specs/contract-decision-delegation/spec.md (or add
• 4.2 Note in hydra/openspec/architecture/adr-005-security.md's tracked

---

Synced from openspec/changes/contract-approval-ownership-guard by OpenSpec workflow
App: softwarecatalog