The 'Technical Asset (ITA)' module extends CzechIdM's identity management capabilities by introducing a new entity type that groups and manages technical accounts. This module enables organizations to associate technical accounts with specific assets, assign guarantors and managers through both direct assignment and role-based mechanisms, and implement comprehensive audit trails for all operations.

+ Centralize management of technical accounts under logical asset groupings + Enable role-based access control for asset-related operations + Provide audit capabilities for compliance requirements + Support notification workflows via NOTIFY integration

The primary entity representing a technical asset that can contain multiple technical accounts.

'Key Attributes:' +

id

- Primary identifier +

name

- Asset name +

description

- Optional description +

disabled

- Flag indicating if the asset is disabled +

externalId

- Identifier assigned by an external system for integration purposes +

externalCode

- Code from an external system +

validFrom

- Validity start date +

validTill

- Validity end date

'Special Permissions:'

SETTOTECHNICALACCOUNT

Represents direct assignment of an identity as guarantor for a technical asset.

'Relationships:' + One-to-one with Identity (guaranteed person) + Many-to-one with TechnicalAsset

Enables role-based guarantor assignment - users assigned this role become automatic guarantors of the associated asset.

'Relationships:' + Many-to-one with Role + Many-to-one with TechnicalAsset

Represents direct assignment of an identity as manager (disponent) for a technical asset.

'Relationships:' + One-to-one with Identity (managing person) + Many-to-one with TechnicalAsset

Enables role-based manager assignment - users assigned this role become automatic managers of the associated asset.

'Relationships:' + Many-to-one with Role + Many-to-one with TechnicalAsset

┌─────────────────────┐       ┌─────────────────────┐
│   TechnicalAccount  │◄───┐  │   TechnicalAsset    │
└─────────────────────┘    │  └─────────────────────┘
                           │         │      │
                           │         │      ├──► TechnicalAssetGuarantor
                           │         │      │       (direct)
                           │         │      │
                           │         │      ├──► TechnicalAssetManager
                           │         │       (direct)
                           │         │
                           │         ├──► TechnicalAssetGuarantorRole
                           │         │       (role-based)
                           │         │
                           │         └──► TechnicalAssetManagerRole
                           │               (role-based)
                           │
                           └─────────────┐
                                         │
                               [technicalAsset]

'File:'

V15''02''001__tech-asset.sql

Creates the following tables:

idm''technical''asset

idm''technical''asset_audit

idm''technical''asset_guarantor

idm''technical''asset''guarantor''audit

idm''technical''asset''guarantor''role

idm''technical''asset''guarantor''role_audit

idm''technical''asset_manager

idm''technical''asset''manager''audit

idm''technical''asset''manager''role

idm''technical''asset''manager''role_audit

'Base Path:'

/api/technical-assets

/

/

/{id}

/{id}

/{id}

/count

/autocomplete

'Base Path:'

/api/technical-assets/guarantors

Standard CRUD operations for direct guarantor assignments.

'Base Path:'

/api/technical-assets/guarantor-roles

Standard CRUD operations for role-based guarantor assignments.

'Base Path:'

/api/technical-assets/managers

Standard CRUD operations for direct manager assignments.

'Base Path:'

/api/technical-assets/manager-roles

Standard CRUD operations for role-based manager assignments.

IdmBasePermission.ADMIN,
IdmBasePermission.COUNT,
IdmBasePermission.AUTOCOMPLETE,
IdmBasePermission.READ,
IdmBasePermission.CREATE,
IdmBasePermission.UPDATE,
IdmBasePermission.DELETE

'Defined in:'

TechnicalAssetBasePermission.java

This permission is required when: + Creating a TechnicalAccount with an associated TechnicalAsset + Modifying a TechnicalAccount to add/change its TechnicalAsset association

'Use Case Example:'

// User must have SETTOTECHNICALACCOUNT on the target TechnicalAsset
technicalAccount.setTechnicalAsset(asset); // Requires permission check

Guarantors and Managers require 'UPDATE' permission on TechnicalAsset to create related entities (guarantor/manager assignments) for that asset.

All entities implement the

Eventable

interface, triggering event processors on save/delete operations.

+ Triggers on entity creation/update + Initiates NOTIFY line startup process + Updates related audit records

+ Handles cleanup of associated resources + Notifies dependent systems via NOTIFY integration

+ Publishes change events for external consumers + Supports real-time synchronization requirements

Each related entity has dedicated save/delete processors:

TechnicalAssetGuarantorSaveProcessor

TechnicalAssetGuarantorDeleteProcessor

TechnicalAssetGuarantorRoleSaveProcessor

TechnicalAssetGuarantorRoleDeleteProcessor

TechnicalAssetManagerSaveProcessor

TechnicalAssetManagerDeleteProcessor

TechnicalAssetManagerRoleSaveProcessor

TechnicalAssetManagerRoleDeleteProcessor

Located in:

model/service/api/

public interface TechnicalAssetService {
    List<TechnicalAsset> findAll(TechnicalAssetFilter filter);
    TechnicalAsset findById(UUID id);
    TechnicalAsset create(TechnicalAsset entity);
    TechnicalAsset update(TechnicalAsset entity);
    void delete(UUID id);
    long count(TechnicalAssetFilter filter);
}

Located in:

model/service/

All services follow the pattern:

Default[EntityName]Service.java

'Key Features:' + Transaction management via Spring's

@Transactional

+ Permission validation before operations + Event publishing for audit trails + Filter-based querying support

Each service has dedicated test class covering: + CRUD operations (Create, Read, Update, Delete) + Filtering functionality + Permission enforcement + Edge cases and validation

'Test Files:'

DefaultTechnicalAssetServiceTest.java
DefaultTechnicalAssetGuarantorServiceTest.java
DefaultTechnicalAssetGuarantorRoleServiceTest.java
DefaultTechnicalAssetManagerServiceTest.java
DefaultTechnicalAssetManagerRoleServiceTest.java

REST endpoint tests covering: + HTTP method validation (GET, POST, PUT, DELETE) + Status code verification + Request/response payload validation + Authentication/authorization checks

'Test Files:'

TechnicalAssetControllerTest.java
TechnicalAssetGuarantorControllerTest.java
TechnicalAssetGuarantorRoleControllerTest.java
TechnicalAssetManagerControllerTest.java
TechnicalAssetManagerRoleControllerTest.java

Tests verifying related entity permission requirements:

TechAccountTechAssetFixTest.java

TechAssetGuarantorRoleTechAssetFixTest.java

TechAssetGuarantorTechAssetFixTest.java

TechAssetManagerRoleTechAssetFixTest.java

TechAssetManagerTechAssetFixTest.java

'Modified Entity:'

TechnicalAccount.java

Added optional attribute:

@ManyToOne(fetch = FetchType.LAZY)
private TechnicalAsset technicalAsset;

This allows each technical account to be optionally associated with a technical asset for organizational purposes.

The

TechnicalAssetSaveProcessor

initiates NOTIFY line startup, enabling real-time notifications when assets are created or modified.

All entities implement comprehensive audit functionality: + Automatic tracking of create/update/delete operations + User attribution for all changes + Timestamp recording for compliance requirements + Separate audit tables for each entity type

'Audit Columns (Standard):'

created_by

created_at

updated_by

updated_at

+

TechnicalAssetBasePermission.java

- Custom permission definitions

+ Save/Delete processors for all 7 entities

+ Entities (6 files) + DTOs (5 files) + Filters (5 files) + Repositories (5 files) + Service APIs (5 files) + Service Implementations (5 files)

+ One controller per entity type

+

V15''02''001__tech-asset.sql

- PostgreSQL migration

+ 5 service tests + 5 controller tests + 1 security test helper modifications

TechGroupPermission.java              - Permission updates
TechnicalAccountDto.java             - Added technicalAsset field
TechnicalAccount.java                - Added technicalAsset relationship
TechnicalAccountFilter.java          - Filter support for asset association
DefaultTechnicalAccountService.java  - Service logic updates
DefaultTechTestHelper.java           - Test helper modifications
DefaultTechnicalAccountServiceTest.java - Updated tests

// Create asset
TechnicalAsset asset = new TechnicalAsset();
asset.setName("Production Database Server");
asset.setDescription("Primary production database");
technicalAssetService.create(asset);
 
// Assign direct guarantor
TechnicalAssetGuarantor guarantor = new TechnicalAssetGuarantor();
guarantor.setTechnicalAsset(asset);
guarantor.setIdentity(guarantorIdentity);
technicalAssetGuarantorService.create(guarantor);
 
// Assign role-based manager
TechnicalAssetManagerRole managerRole = new TechnicalAssetManagerRole();
managerRole.setTechnicalAsset(asset);
managerRole.setRole(managerRoleEntity);
technicalAssetManagerRoleService.create(managerRole);

// User must have SETTOTECHNICALACCOUNT permission on the asset
TechnicalAccount account = new TechnicalAccount();
account.setUsername("db-admin");
account.setTechnicalAsset(asset); // Permission check occurs here
technicalAccountService.create(account);

ADMIN (highest)
    ├── CREATE
    ├── UPDATE
    ├── DELETE
    ├── READ
    ├── COUNT
    └── AUTOCOMPLETE
        └── SETTOTECHNICALACCOUNT (special, asset-specific)

+ Creating guarantor/manager assignments requires 'UPDATE' on the parent TechnicalAsset + This ensures only authorized users can modify asset relationships + Role-based assignments follow the same permission model as direct assignments

= Bulk Operations: Add batch endpoints for mass asset/account associations = = Inheritance Support: Consider allowing assets to inherit permissions from parent organizational units = = Lifecycle Management: Implement state machine for asset lifecycle (draft → active → archived) = = Notification Templates: Extend NOTIFY integration with customizable templates per operation type =