5.6 Activities Plugin Workflows
The Activities plugin owns activity definitions, member participation authorizations, and the workflows that request, renew, activate, deny, retract, revoke, and expire those authorizations. It loads first among the active domain plugins.
Domain model
| Model | Responsibility |
|---|---|
ActivityGroup |
Administrative grouping of related activities |
Activity |
Defines term, age limits, approval counts, approver permission, and optional granted role |
Authorization |
One member’s time-bounded authorization for one activity |
Authorization uses the shared ActiveWindow model and defines Approved, Pending, Denied, Revoked, Expired, and Retracted statuses. Use the entity constants, not literal strings.
Request and renewal
AuthorizationsController authorizes the target member/action and dispatches Activities.AuthorizationRequested. The versioned activities-authorization-request.json workflow resolves approvers, creates the pending authorization, opens canonical core workflow approvals, activates after the required decisions, grants the configured role, and sends notifications.
Initial and renewal approval counts come from the Activity configuration. Renewal eligibility, age limits, approver permission, and branch context are registered workflow conditions/actions. Do not reproduce these rules in a form or controller.
Approval architecture
Approvals are core WorkflowApproval/WorkflowApprovalResponse records managed by DefaultWorkflowApprovalManager and displayed by the unified Approvals UI. ActivitiesApprovalContextRenderer supplies activity-specific context.
The former Activities.AuthorizationApproval model/controller no longer exists. Legacy approval URLs redirect to /approvals; keep those redirects until compatibility is intentionally removed.
Retraction and revocation
Pending requests may be retracted by the member who can manage the target member (self or the supported parent/minor relationship). Administrative revocation is permission-controlled and records actor/reason. These paths dispatch the dedicated retracted/revoked workflow definitions so role cleanup and notifications remain consistent.
Use AuthorizationManagerInterface for request, activate, revoke, and retract domain operations. Approval and denial are workflow-engine responsibilities.
Security and tenancy
AuthorizationPolicy combines self/parent management with RBAC for administrative actions. Lists and grid data must be scoped; approver discovery uses the Activity’s configured permission and branch through PermissionsLoader.
Members, activities, authorizations, roles, workflow instances, and approvals must be loaded from the same active tenant. Queued/scheduled processing must bind that tenant before checking expirations or permissions.