[maia-andre]

Resolves: #8688

📝 Summary

Adds the policy-local Policy Workbench module for Signature Rejection under src/views/Settings/PolicyWorkbench/settings/signature-rejection/. It is not registered in the catalog yet: that is #9336 (#8689), stacked on this one.

• model.ts: typed normalization of the five backend keys and compose/decompose between them and the editor value. The value unions (cancel/continue, disabled/optional/required, requester/participants/public) come from the generated OpenAPI types, so the module does not add a second source of truth for them.
• realDefinition.ts: definition keyed by rejection_enabled, with the system, group and user scopes. The five keys go through the generic compound.compose()/decompose() contract from Make the Policy Workbench compound helper use policy definitions #8687. The child keys come from meta.compositeChildren, which SignatureRejectionPolicy already declares.
• SignatureRejectionRuleEditor.vue: a switch for rejection and one radio group (NcCheckboxRadioSwitch) for each of the four dependent settings, with translated labels.

Points worth a look:

• Inactive values are kept. The four options stay editable while rejection is off, and the editor says they take effect once it is turned on. Turning rejection or the comment off does not reset the other values, and decompose() always writes the five keys. SignatureRejectionPolicyValidator::validateLayer() accepts values prepared while rejection is disabled.
• No authorization or inheritance logic in Vue. The editor never decides whether a child scope may widen an audience or relax a required comment. The delegation validators in SignatureRejectionPolicy own that, and the Workbench shows their errors through its usual flow (covered in feat(policy): register signature rejection in the policy workbench #9336).
• allowedValues. resolveEditorProps() only receives the parent policy state, so the editor uses the backend allowedValues of rejection_enabled. They describe the current actor, so they limit the switch only on user rules and preferences; on system and group rules the backend decides on save. The allowed values of the four dependent keys do not reach the editor without an engine change, which this issue rules out. Those options are all listed, and the backend validates them on save.
• Personal preferences. The preferences screen edits the five values as one and saves them through the compound endpoint, so the backend validates the whole configuration before any key is written.
• Summary: Disabled, or the outcome and the comment mode, for example Cancel the signing request · No comment.

🧪 How to test

npx vitest run src/tests/views/Settings/PolicyWorkbench/settings/signature-rejection

To see the editor in the browser, use #9336, which registers the module in the catalog.

Validation evidence

• Focused regression/acceptance test: 55 tests in model.spec.ts, realDefinition.spec.ts, SignatureRejectionRuleEditor.spec.ts and personalPreferenceBehavior.spec.ts (fallback composition, the enabled switch per scope, saving and clearing a preference, defaults, compose/decompose of all five keys, every editor option, values kept while another option is inactive, summary, emitted value). The NcCheckboxRadioSwitch stub follows the component's checked/emit contract for radios with a value. The browser run in feat(policy): register signature rejection in the policy workbench #9336 caught a binding mistake that a simpler stub had hidden, and the editor test fails on that mistake now.
• Relevant lint/type/static-analysis checks: npm run lint (no errors, no warnings in the new files), npm run stylelint, npm run ts:check.
• Broader suite required by the changed surface: npx vitest run src/tests/views/Settings/PolicyWorkbench src/tests/views/Preferences src/tests/store/policies.spec.ts, 109 files and 769 tests passing on the feat(policy): register signature rejection in the policy workbench #9336 branch, which also registers the module.
• CI reviewed: 52 passed, 11 skipped, none failed

🎨 UI / Front-end changes

• New Signature Rejection module: model, definition and rule editor. It is not shown in the catalog until Register Signature Rejection in Policy Workbench and add flow tests #8689.
• Screenshots before/after added for user-visible changes: the editor is not reachable from the UI with this PR alone. feat(policy): register signature rejection in the policy workbench #9336 has screenshots of this editor in the Workbench.
• Component/unit (Vitest) and/or E2E (Playwright) tests added or updated
• Tested in relevant browsers when applicable: Chromium, through the Playwright scenario in feat(policy): register signature rejection in the policy workbench #9336
• Accessibility verified when applicable: each radio group is a fieldset with a legend; no further audit
• Design review approved when applicable
• Documentation updated when applicable: not applicable

✅ Checklist

• I have read and followed the contribution guide.
• The diff does not contain unrelated refactors or generated changes.
• Commits follow Conventional Commits where applicable.
• All commits include the required DCO sign-off.

🤖 AI (if applicable)

• The content of this PR was partially or fully generated using AI

[vitormattos]

Requesting a focused regression test for the system fallback composition before resolving this review concern.