[maia-andre]

Resolves: #8689

📝 Summary

Registers Signature Rejection in the Policy Workbench catalog and covers it through the existing Workbench flow.

This PR is stacked on #9335, which adds the module from #8688: only the last two commits are new here. Please review #9335 first. I will rebase this one onto main once it is merged.

• Registration: rejection_enabled is added once to realDefinitions.ts, in the How signing works category. The four dependent keys are not catalog entries.
• No engine change. useRealPolicyWorkbench.ts and policyWorkbenchCompoundPolicies.ts are untouched: load, edit, save, reload and removal all go through the generic compound flow from Make the Policy Workbench compound helper use policy definitions #8687.

🧪 How to test

1. Open Settings → LibreSign → Document signing settings and search for rejection. Signature rejection is listed once under How signing works.
2. Open it, create the Everyone rule, allow rejection and pick an option in each group. Save.
3. Reload the page and open the rule again: the five values are restored.
4. Create a group rule, reload, then remove it: the five keys of that group are cleared.

Automated:

npx vitest run src/tests/views/Settings/PolicyWorkbench/settings/signature-rejection src/tests/views/Settings/PolicyWorkbench/settings/realDefinitions.spec.ts
npx playwright test playwright/e2e/policy-workbench-signature-rejection-rule-management.spec.ts --project=chromium
cd tests/integration && vendor/bin/behat features/policies/signature_rejection_authorization.feature -v

Validation evidence

• Focused regression/acceptance test:

  • realDefinitions.spec.ts: Signature Rejection is registered once and the four dependent keys are not.

  • signature-rejection/useRealPolicyWorkbench.spec.ts, 5 tests:

    • Signature Rejection appears once in the catalog, without its helpers.
    • A saved system rule restores all five values after reload, including values prepared while rejection is disabled.
    • A group rule is saved, reloaded and removed through the same generic flow, and removing it clears all five keys.
    • A backend validation error is shown, the editor stays open, and nothing is reported as saved.

    The error test mocks the request failure the same way the existing Workbench save-error tests do. All 5 fail without the registration line.

  • Playwright policy-workbench-signature-rejection-rule-management.spec.ts: configures a system rule, checks the compound request carries the five values, reloads, checks the five values in the editor and through the API, then restores the five keys as it found them. It passed in the local devcontainer twice: starting from an existing explicit rule and starting from the built-in defaults.

  • Later review coverage: the fallback through createRealPolicyWorkbenchState() for true and false; Playwright reopening the saved rule through Edit after reload and changing a locked system rule in both directions, 3 of 3 passing; Preferences.spec.ts saving and clearing the five values.

  • Behat policies/signature_rejection_authorization.feature, 18 scenarios and 450 steps passing in the local devcontainer after rebasing on main: who may write each rule with real subadmin and delegation fixtures, refusals that store nothing, delegated limits under a group rule created by an instance admin, and saving and clearing a personal preference. Group admin cases are covered through the API, not in the browser.

• Relevant lint/type/static-analysis checks: npm run lint (no errors, no warnings in the changed files), npm run stylelint, npm run ts:check.
• Broader suite required by the changed surface: npx vitest run src/tests/views/Settings/PolicyWorkbench src/tests/views/Preferences src/tests/store/policies.spec.ts, 109 files and 769 tests passing.
• CI reviewed

🎨 UI / Front-end changes

• Signature rejection card under How signing works, editing the five rejection settings as one rule.
• Screenshots before/after added for user-visible changes

Catalog	Editor with the defaults

Rule being configured	Same rule after a page reload

Card after reload	Setting after reload

• Tested in relevant browsers when applicable: Chromium (Playwright)
• Component/unit (Vitest) and/or E2E (Playwright) tests added or updated
• Accessibility verified when applicable: each radio group is a fieldset with a legend; no further audit
• Design review approved when applicable
• Documentation updated when applicable: not applicable

✅ Checklist

• I have read and followed the contribution guide.
• The diff does not contain unrelated refactors or generated changes.
• Commits follow Conventional Commits where applicable.
• All commits include the required DCO sign-off.

🤖 AI (if applicable)

• The content of this PR was partially or fully generated using AI

[vitormattos]

Requesting focused verification of instance-admin and delegated group-admin behavior before merge; see the inline test matrix.

The merge-base changed after approval.