Worker Portal Design Reference

struct AuditEvent {
    id: String,           // evt_abc123
    ts: DateTime<Utc>,
    category: Category,   // case | config | auth | service | plugin | ievs | notice
    action: String,       // dotted: "dashboard.live_changed", "income.edited"
    actor: Actor,         // { kind: worker|system|applicant, name, role?, initials }
    target: Option<Target>, // { type, label, id, link? }
    summary: String,      // human-readable
    meta: serde_json::Value, // structured detail (diffs, before/after)
    signature: Vec<u8>,   // ed25519 over a canonical encoding
}

# Defines dashboards available in this jurisdiction.
# Multiple dashboards per role allowed; the user picks via a dashboard selector.

[dashboard.my_day]
title = "My day"
roles = ["eligibility_worker"]
default_for_role = true

[[dashboard.my_day.row]]
panels = [
  { type = "kpi_strip", span = 12 },
]

[[dashboard.my_day.row]]
panels = [
  { type = "my_worklist", span = 8 },
  { type = "quick_search", span = 4 },
]

[[dashboard.my_day.row]]
panels = [
  { type = "pending_verifications", span = 6, required = true },
  { type = "renewals_due", span = 6 },
]

[[dashboard.my_day.row]]
panels = [
  { type = "time_pressured", span = 5 },
  { type = "recent_activity", span = 7 },
]

# Shell + section composition for case detail.
# Per-role shells allowed; default is "scroll".

[shell.eligibility_worker]
strategy = "scroll"            # scroll | card_grid | tabs

[shell.intake_screener]
strategy = "card_grid"

[shell.snap_only_worker]
strategy = "tabs"

[[section]]
slug = "household"
roles = ["*"]                  # all roles see it
required = true

[[section]]
slug = "income"
roles = ["*"]
required = true

[[section]]
slug = "determination"
roles = ["*"]
required = true

[[section]]
slug = "abawd"
roles = ["eligibility_worker"]
programs = ["snap"]            # only renders for SNAP cases

[[section]]
slug = "notices"
roles = ["*"]

[[section]]
slug = "appeals"
roles = ["*"]

[[section]]
slug = "activity"
roles = ["eligibility_worker", "supervisor"]

# Identity providers configured for this jurisdiction.
# Generic interface — anyone can use kanidm / authentik / keycloak / SAML / etc.

[options]
email_discovery = true         # show email-first input
local_accounts = false         # disable local accounts entirely
local_accounts_collapsed = true  # if enabled, render under an expander

[[idp]]
slug = "state-sso"
label = "State SSO"
provider = "keycloak"          # informational; the actual flow is OIDC
host = "auth.dhs.ga.gov"
chip_text = "KC"
chip_color = "#1e5146"
primary = true

[idp.config]
type = "oidc"
client_id = "canopy-ga"
discovery_url = "https://auth.dhs.ga.gov/realms/ga-dhs/.well-known/openid-configuration"
scopes = ["openid", "profile", "email", "groups"]

[[idp]]
slug = "ad-saml"
label = "Active Directory"
provider = "saml2"
host = "fed.fulton.gov"
chip_text = "AD"
chip_color = "#275f63"

[idp.config]
type = "saml2"
entity_id = "https://fed.fulton.gov/idp"
sso_url = "https://fed.fulton.gov/idp/SSO"
cert_path = "secrets/fulton-saml.pem"

# email_routing maps domain -> idp slug for the discovery flow
[email_routing]
"dhs.ga.gov" = "state-sso"
"fulton.gov" = "ad-saml"

[plugin]
slug         = "child_support"
name         = "Child Support Enforcement"
version      = "0.2.1"
author       = "Georgia DHS · OCSE Integration Team"
license      = "AGPL-3.0-or-later"
canopy_min   = "1.4.0"

[plugin.exports]
panels        = ["child_support"]
case_sections = ["child_support"]

[panel.child_support]
display_name  = "Child support"
icon          = "scales"
description   = "OCSE enforcement actions, arrears balances, payment status."
programs      = ["tanf", "medicaid"]
default_span  = 6
allowed_spans = [4, 6, 8, 12]

[data]
# Implemented schema (ADR-021; drifted illustration corrected by #1218):
# `source` is a canopy service slug, `auth` ∈ {none, service_class, user_jwt},
# TTL/timeout are integer seconds/ms, and `endpoints` is a flat allow-list
# (EMPTY is legal for plugins that perform no upstream fetch). The manifest
# TTL is the plugin author's DEFAULT; deployments override per item via the
# composition layers, and cache_ttl_seconds = 0 disables caching.
source            = "canopy-exchange"
auth              = "service_class"
cache_ttl_seconds = 300
timeout_ms        = 2000
endpoints = [
    "/v1/child-support/balances/{household_id}",
    "/v1/child-support/actions?household_id={household_id}&limit=10",
]

[permissions]
required_roles = ["eligibility_worker", "case_manager", "supervisor"]
audit          = "ocse_read"

[i18n]
default  = "en-US"
catalogs = ["en-US", "es-US"]