Module access_review 

Access review of a restricted project group (issue #151, step 5).

The managers of a group (and administrators) see who may read it: every member with role, source (manual or identity provider), last sign-in and whether the account is active, the administrator policy and the history of administrator elevations. Confirming the review writes a dated, audited record that keeps the member list as it was; to_csv and the JSON form of AccessReport are the evidence an auditor can be given.

Structs

AccessReport

Everything an access review shows; also the JSON evidence.

ReviewMember

One member as the review shows them.

ReviewRecord

A confirmed review.

ReviewSchedule

When the access review of a group is due.

Constants

MAX_NOTE_CHARS

Longest accepted note of a review (also the column’s CHECK).

STALE_DAYS

A member without sign-in for this many days is flagged as stale.

Functions

confirm

Confirms that the access of a restricted group was reviewed.

due_for

The groups whose access review is due and that the actor manages (all of them for administrators), for the “review due” flag of the group list.

remind_due

Reminds the managers of every group whose access review is due (the hourly housekeeping): once when the review becomes due and again after each further interval without one. A group without managers reminds the active administrators.

report

The access report of a restricted group.

schedule

The review schedule of a group (no permission check: the callers show it to people who manage the group).

snapshot

The member list as it was at a confirmed review (managers and administrators), for the auditor’s question “who had access then”.

to_csv

The report as one CSV table (RFC 4180, formula-safe): a row per member, elevation and confirmed review, told apart by the first column.