Add explicit acting-in-place context

src/govoplan_access/backend/auth/dependencies.py

@@ -110,6 +110,10 @@ def _build_principal_ref(
     role_ids = [role.id for role in authorization_context.tenant_roles]
     if include_system_roles:
         role_ids.extend(role.id for role in authorization_context.system_roles)
+    acting_assignment = next(
+        (item for item in idm_assignments if item.source == "acting_for"),
+        None,
+    )
     return PrincipalRef(
         account_id=account.id,
         membership_id=user.id,
@@ -123,6 +127,10 @@ def _build_principal_ref(
         auth_method=auth_method,  # type: ignore[arg-type]
         api_key_id=api_key.id if api_key else None,
         session_id=auth_session.id if auth_session else None,
+        acting_assignment_id=(acting_assignment.id if acting_assignment else None),
+        acting_for_account_id=(
+            acting_assignment.acting_for_account_id if acting_assignment else None
+        ),
         email=account.email,
         display_name=account.display_name or user.display_name,
     )
@@ -436,6 +444,7 @@ def _refresh_principal_context(
         tenant_id=context.tenant.id,
         idm_directory=idm_directory,
         organization_directory=organization_directory,
+        auth_session=context.auth_session,
     )
     include_system = context.auth_session is not None
     authorization_context = collect_user_authorization_context(
@@ -523,6 +532,7 @@ def _resolve_api_key_principal_context(
         tenant_id=api_key.tenant_id,
         idm_directory=idm_directory,
         organization_directory=organization_directory,
+        auth_session=None,
     )
     authorization_context = collect_user_authorization_context(
         session,
@@ -612,6 +622,7 @@ def _resolve_session_principal_context(
         tenant_id=user.tenant_id,
         idm_directory=idm_directory,
         organization_directory=organization_directory,
+        auth_session=auth_session,
     )
     authorization_context = collect_user_authorization_context(
         session,
@@ -657,8 +668,26 @@ def _principal_idm_context(
     tenant_id: str,
     idm_directory: IdmDirectory | None,
     organization_directory: OrganizationDirectory | None,
+    auth_session: AuthSession | None = None,
 ) -> tuple[tuple[OrganizationFunctionAssignmentRef, ...], tuple[Role, ...]]:
-    idm_assignments = _idm_assignments_for_account(idm_directory, account.id, tenant_id=tenant_id)
+    available = _idm_assignments_for_account(
+        idm_directory,
+        account.id,
+        tenant_id=tenant_id,
+    )
+    selected_assignment_id = (
+        auth_session.acting_assignment_id if auth_session is not None else None
+    )
+    idm_assignments = tuple(
+        item
+        for item in available
+        if item.source != "acting_for"
+        or (
+            selected_assignment_id == item.id
+            and auth_session is not None
+            and auth_session.acting_for_account_id == item.acting_for_account_id
+        )
+    )
     idm_roles = tuple(collect_external_function_roles(session, user, idm_assignments, organization_directory=organization_directory))
     return idm_assignments, idm_roles
 
@@ -902,6 +931,7 @@ def _resolve_delegated_user_automation(
         tenant_id=request.tenant_id,
         idm_directory=idm_directory,
         organization_directory=organization_directory,
+        auth_session=None,
     )
     authorization_context = collect_user_authorization_context(
         session,