M5-01 Disclosure Request Setup¶
Milestone: M5 — Disclosure and Verification
SOW Reference: FR2
Requirement Clarity: 🟡 Updated 2026-08-25 — not a single generic request; see below
Dev Status: ❌ Not started — no disclosure controller/service/entity exists (verification.module.ts has empty controllers: []/providers: [])
Overview¶
Let a Staffing Company (as Relying Party) set up a request for a Candidate to disclose credentials. Updated 2026-08-25: this is no longer a single request covering all credential types. Org Admin configures named "packages" in org settings — each a combination of Disclose Credentials, Claim Right to Work (RTW, via DataChecker), and/or Reclaim Employment (HMRC). The Org User picks one configured package per request. MVP ships "Disclose Credentials" alone and "Disclose Credentials + Reclaim Employment"; RTW-involving packages are shown for info only, not built. See M5-00's 2026-08-25 update for full detail, including an open cross-reference to M7-01 on what "Reclaim Employment" actually requires us to build.
Backend Tasks¶
- Design the disclosure-request data model (a
presentation-request.entity.tsalready exists as schema only — confirm it fits or needs revision) - Design a "package" model: org-level named configs, each referencing 1+ atomic request types (Disclose / RTW / Reclaim Employment)
- Create a
DisclosureController/DisclosureServicein the (currently empty)verificationmodule - Implement
POST /relying-party/disclosure-requeststo create a request against a candidate, referencing a package rather than a hardcoded generic request - Compose the outbound email from the package's atomic options — "a single mail with one or more sections of pre-configured text" per the client's own spec
Frontend Tasks¶
- Org settings: package configuration UI (Org Admin picks which atomic options to combine, names the package — e.g. "Teacher Package")
- Build a "Request Disclosure" flow from the candidate record, where the Org User selects a pre-configured package
- Show disclosure request status on the candidate record
Dependencies¶
- M5-02 policy configuration — a disclosure request needs a policy attached.
- M3-07 candidate record — disclosure requests are initiated from here.
Acceptance Criteria¶
- User can create disclosure request (per SOW Appendix 3, FR2 acceptance criteria)
Existing Reference Material¶
- ../../requirements/user_stories/credential-disclosure/disclosure-request-configuration.md
- ../../requirements/epics/credential-disclosure.md
Blockers & Risks¶
None beyond the general M5 "starting from zero" risk noted in ../CONSOLIDATED-SUMMARY.md.