feat: manage bounded automation service accounts

tests/test_automation_principal.py

@@ -10,7 +10,11 @@ from govoplan_access.backend.auth.dependencies import (
     AccessAutomationPrincipalProvider,
 )
 from govoplan_access.backend.db.base import AccessBase
-from govoplan_access.backend.db.models import Account, User
+from govoplan_access.backend.db.models import (
+    Account,
+    ServiceAccount,
+    User,
+)
 from govoplan_access.backend.manifest import manifest
 from govoplan_access.backend.security.sessions import (
     UserAuthorizationContext,
@@ -70,6 +74,19 @@ class AutomationPrincipalTests(unittest.TestCase):
                 "dataflow:pipeline:run",
                 "datasources:catalogue:read",
             ),
+            context={
+                "trigger_ref": "dataflow-trigger:1",
+                "delivery_ref": "dataflow-delivery:1",
+                "event_actor": {
+                    "type": "user",
+                    "id": "event-user-1",
+                },
+                "operator_override": {
+                    "type": "user",
+                    "id": "operator-1",
+                    "reason": "approved replay",
+                },
+            },
         )
 
     def test_resolution_intersects_trigger_grant_with_current_scopes(self) -> None:
@@ -106,14 +123,35 @@ class AutomationPrincipalTests(unittest.TestCase):
             ),
             result.principal.scopes,
         )
+        self.assertIsNone(
+            result.principal.principal.service_account_id
+        )
         self.assertEqual(
-            "dataflow-trigger:1",
-            result.principal.principal.service_account_id,
+            self.account.id,
+            result.principal.principal.acting_for_account_id,
         )
         self.assertNotIn(
             "system:settings:write",
             result.principal.scopes,
         )
+        self.assertEqual(
+            "delegated_user",
+            result.provenance["trigger_owner"]["kind"],
+        )
+        self.assertEqual(
+            "event-user-1",
+            result.provenance["event_actor"]["id"],
+        )
+        self.assertEqual(
+            "operator-1",
+            result.provenance["operator_override"]["id"],
+        )
+        self.assertEqual(
+            self.account.id,
+            result.provenance[
+                "current_automation_principal"
+            ]["account_id"],
+        )
 
     def test_revoked_scope_and_suspended_owner_fail_closed(self) -> None:
         context = UserAuthorizationContext(
@@ -151,6 +189,101 @@ class AutomationPrincipalTests(unittest.TestCase):
             suspended.provenance["status"],
         )
 
+    def test_service_account_resolution_uses_current_scope_ceiling(self) -> None:
+        account = Account(
+            id="service-account-backing",
+            email="service@example.invalid",
+            normalized_email="service@example.invalid",
+            display_name="Import worker",
+            auth_provider="service_account",
+        )
+        membership = User(
+            id="service-membership",
+            tenant_id=self.tenant.id,
+            account_id=account.id,
+            email=account.email,
+            display_name=account.display_name,
+            auth_provider="service_account",
+        )
+        service_account = ServiceAccount(
+            id="service-1",
+            tenant_id=self.tenant.id,
+            account_id=account.id,
+            membership_id=membership.id,
+            name="Import worker",
+            normalized_name="import worker",
+            scope_ceiling=[
+                "dataflow:pipeline:run",
+                "datasources:catalogue:read",
+                "system:settings:write",
+            ],
+            is_active=True,
+            revision=1,
+            settings={},
+        )
+        self.session.add_all(
+            (account, membership, service_account)
+        )
+        self.session.flush()
+        request = AutomationPrincipalRequest.service_account(
+            tenant_id=self.tenant.id,
+            service_account_id=service_account.id,
+            authorization_ref="dataflow-trigger:service",
+            grant_scopes=(
+                "dataflow:pipeline:run",
+                "datasources:catalogue:read",
+            ),
+        )
+
+        result = self.provider.resolve_automation_principal(
+            self.session,
+            request=request,
+        )
+
+        self.assertTrue(result.allowed)
+        self.assertEqual(
+            service_account.id,
+            result.principal.principal.service_account_id,
+        )
+        self.assertEqual(
+            frozenset(request.grant_scopes),
+            result.principal.scopes,
+        )
+        self.assertNotIn(
+            "system:settings:write",
+            result.principal.scopes,
+        )
+        self.assertEqual(
+            "service_account",
+            result.provenance["trigger_owner"]["kind"],
+        )
+
+        service_account.scope_ceiling = [
+            "dataflow:pipeline:run"
+        ]
+        self.session.flush()
+        reduced = self.provider.resolve_automation_principal(
+            self.session,
+            request=request,
+        )
+        self.assertFalse(reduced.allowed)
+        self.assertEqual(
+            ("datasources:catalogue:read",),
+            reduced.missing_scopes,
+        )
+
+        service_account.is_active = False
+        self.session.flush()
+        inactive = self.provider.resolve_automation_principal(
+            self.session,
+            request=request,
+        )
+        self.assertFalse(inactive.allowed)
+        self.assertEqual(
+            "inactive_or_inconsistent",
+            inactive.provenance["status"],
+        )
+
     def test_manifest_registers_automation_resolution(self) -> None:
         self.assertIn(
             CAPABILITY_AUTH_AUTOMATION_PRINCIPAL_PROVIDER,