Release v0.1.5

src/govoplan_access/backend/admin/governance.py

@@ -0,0 +1,43 @@
+from __future__ import annotations
+
+from sqlalchemy.orm import Session
+
+from govoplan_core.admin.common import AdminConflictError
+from govoplan_access.backend.db.models import (
+    ApiKey,
+    Group,
+    Role,
+    Tenant,
+)
+from govoplan_core.tenancy.service import effective_tenant_governance
+
+
+def ensure_group_mutation_allowed(group: Group, *, requested_active: bool | None = None) -> None:
+    if group.system_template_id and group.system_required and requested_active is False:
+        raise AdminConflictError("This centrally required group cannot be deactivated by the tenant.")
+
+
+def ensure_role_mutation_allowed(role: Role, *, requested_assignable: bool | None = None) -> None:
+    if role.system_template_id:
+        if role.system_required and requested_assignable is False:
+            raise AdminConflictError("This centrally required role cannot be made unavailable by the tenant.")
+        raise AdminConflictError("Centrally managed role definitions can only be changed in System administration.")
+
+
+def assert_api_keys_allowed(session: Session, tenant: Tenant) -> None:
+    if not effective_tenant_governance(session, tenant).allow_api_keys:
+        raise AdminConflictError("API-key creation is disabled by system or tenant governance.")
+
+
+def assert_custom_groups_allowed(session: Session, tenant: Tenant) -> None:
+    if not effective_tenant_governance(session, tenant).allow_custom_groups:
+        raise AdminConflictError("Custom tenant groups are disabled by system or tenant governance.")
+
+
+def assert_custom_roles_allowed(session: Session, tenant: Tenant) -> None:
+    if not effective_tenant_governance(session, tenant).allow_custom_roles:
+        raise AdminConflictError("Custom tenant roles are disabled by system or tenant governance.")
+
+
+def active_api_key_count(session: Session, tenant_id: str) -> int:
+    return session.query(ApiKey).filter(ApiKey.tenant_id == tenant_id, ApiKey.revoked_at.is_(None)).count()