[midPoint-git] [Evolveum/midpoint] 147a7f: Fix removal of projections when focus is archived

[mederly]

  Branch: refs/heads/fix/10813
  Home:   https://github.com/Evolveum/midpoint
  Commit: 147a7f8221532fd7cbfa33320aff3cebb92a0941
      https://github.com/Evolveum/midpoint/commit/147a7f8221532fd7cbfa33320aff3cebb92a0941
  Author: Pavol Mederly <mederly at evolveum.com>
  Date:   2025-10-09 (Thu, 09 Oct 2025)

  Changed paths:
    M model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/lens/assignments/AssignmentPathImpl.java
    M model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/lens/assignments/AssignmentPathSegmentImpl.java
    M model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/lens/assignments/PathSegmentEvaluation.java
    M model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/lens/assignments/PayloadEvaluation.java
    M model/model-impl/src/test/java/com/evolveum/midpoint/model/impl/lens/TestPolicyRules2.java
    M model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/TestLifecycle.java
    M model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/TestLifecycleBasic.java

  Log Message:
  -----------
  Fix removal of projections when focus is archived

When the focus was moved into a lifecycle state with assignments being
inactive (e.g., "archived" state), the projections were not removed if:

1) default assignment enforcement policy was set
2) and the projections were mandated by an induced role.

The reason laid in the wrong determination of what assignments are to
be considered inactive for focus lifecycle states that have
"assignments active: NO" property. (I.e., all states except "active",
"deprecated", and "suspended", see "Object Lifecycle" in the docs.)

Originally, all assignments with order=1 were considered inactive
for such focus objects. E.g., if a user (in "archived" LC state) had
an assignment to RoleA and it had inducement to RoleB (all assignments
and roles being in "active" LC state), both assignment and inducement
were considered inactive. This is somewhat reasonable, but more logical
is to restrict the deactivation only to direct assignments, i.e., those
residing right in the focus object. In the case above, only the
assignment from the user to RoleA is inactive; the inducement from RoleA
to RoleB is now considered active.

This fixes the reported issue (MID-10813). See the change in
PathSegmentEvaluation#computeActivity.

Related change:

The object policy rules-related condition in PayloadEvaluation#evaluate
method had to be changed in turn, as the above change caused evaluating
some rules that should not be evaluated. This commit fixes not only this
effect, but also more cases, where object policy rules were evaluated
for inactive (not valid) assignments. Please see adapted tests
(TestLifecycleBasic, TestPolicyRules2) for details.

The solution provided in this commit is limited and hence not ideal.
It is so in order to minimize behavior changes in 4.8.x, as this commit
is to be backported there. The behavior of object policy rules regarding
inactive (not valid) objects needs to be re-thought; see newly
created task MID-10904.



To unsubscribe from these emails, change your notification settings at https://github.com/Evolveum/midpoint/settings/notifications