| D-M5-09-0 |
2026-10-25 |
Built on main after M4-27 and M5-03 landed; the changelog entry and these rulings are fragments. Differences to the brief's names, following the merged code: the administration of M4-26 and M4-27 has no separate controller classes; its "controllers" are the data source AdminRepository and the state mixin AdminActionState, which the emergency views reuse. The phone's pages of the area live next to the entry in apps/client/lib/phone/me/emergency_entry.dart (PhoneEmergencyPage, PhoneEmergencyPersonPage) under the existing phone routes /admin/:section and /admin/:section/:id as /admin/emergency and /admin/emergency/{user_id}. The confirmation is a bottom sheet (EmergencyConfirmSheet) instead of the desktop's ConfirmChange dialog. The phone wireframe is M13 of 01 5.3, after M12. |
D-W-100 (merged names win over the brief's). |
| D-M5-09-1 |
2026-10-25 |
Reuse, not rebuild: EmergencyHome and PersonEmergencyView in packages/admin_ui/lib/src/emergency/ run every list and action through AdminRepository (people, person, devicesOf, revokeDevice, disablePerson, revokeGrant) and keep busy state, notices and refused controls in AdminActionState; the device rows are the DeviceTile of M4-25. The one addition to the data layer is AccessRepository.grantsOf (listGrants with subject_kind and subject_id, all pages), because a person's grants were only reachable per target; the fake server's listGrants reads the same two filters. |
15 3 admin_ui; R-CL-01; brief Design note 1. |
| D-M5-09-2 |
2026-10-25 |
Confirmation and step-up: each action opens one sheet with the plain-language text from l10n that says it takes effect at once (emergencyRevokeDeviceBody, emergencyRevokeGrantBody, emergencyDisableBody), a reason field (required for revokeGrant, which requires one; the other two send the administration's default reason when it is empty) and a confirm button that names the step-up, because 05 gives device.revoke, grant.revoke and user.disable step-up: "Confirm with Face ID" when the theme's platform is iOS, "Confirm with fingerprint or screen lock" otherwise. The button only names what follows: the request goes out at once, and the StepUpInterceptor of M4-09 runs the device key step-up on 401 step_up_required and repeats it with the same Idempotency-Key. A cancelled step-up sends nothing more, leaves the page unchanged and says "Cancelled. Nothing was changed."; a 403 hides the action with the server's reason; 409 last_owner (SR8) shows the problem text and how to resolve it on the desktop or in the console, the client never blocks it beforehand. Stopping a run keeps the stop of M4-21 and M5-02 in the live box and Running now unchanged: run.cancel has no step-up and no confirmation there (D10, the /stop command), so the phone asks nothing more for it. |
07 9.5, SR8; 08 6.2, 14.3; brief Design note 2, requirements 12 and 13. |
| D-M5-09-3 |
2026-10-25 |
Entry rule: "Emergency" shows under Me for an owner (getMe, is_owner, the provider isOwnerProvider the app already has) or for a person whose stored space access, as the server reported it in the SpaceView of the snapshot and of access.changed, holds the capability manage (emergencyRoleOf). No grant is read. An owner sees the person's devices with "Revoke" and "Disable person"; a manager only the grants the server lists for them, and the devices are not requested (device.list is self or owner). A direct link into the area for anyone else shows "Not found or no access" without a request. The person search sends the server's q filter of listUsers. |
01 4; 05 device.list, grant.read, user.disable; 15 1 principle 1; brief Design note 3. |
| D-M5-09-4 |
2026-10-25 |
Exactly four actions on the phone: revoke a device (device.revoke), revoke a grant (grant.revoke), disable a person (user.disable) in the area, and stop a run (run.cancel) where it already is. Every other path under /admin stays "Not found or no access" on the phone, and the Me tab's entries are a closed list (the settings sections, "Emergency", "Log out"), which a test walks. Creating grants, the audit log, statistics and group editing stay on the desktop and in the console. |
R-PR-07; brief requirement 11. |