Release v0.1.5

src/govoplan_access/backend/manifest.py

@@ -2,8 +2,16 @@ from __future__ import annotations
 
 from govoplan_access.backend.db.base import AccessBase
 from govoplan_access.backend.db import models as access_models  # noqa: F401 - populate access metadata
-from govoplan_core.core.access import CAPABILITY_ACCESS_PERMISSION_EVALUATOR, CAPABILITY_ACCESS_PRINCIPAL_RESOLVER
-from govoplan_core.core.modules import MigrationSpec, ModuleContext, ModuleManifest, PermissionDefinition, RoleTemplate
+from govoplan_core.core.access import (
+    CAPABILITY_ACCESS_ADMINISTRATION,
+    CAPABILITY_ACCESS_DIRECTORY,
+    CAPABILITY_ACCESS_GOVERNANCE_MATERIALIZER,
+    CAPABILITY_ACCESS_PERMISSION_EVALUATOR,
+    CAPABILITY_ACCESS_PRINCIPAL_RESOLVER,
+    CAPABILITY_ACCESS_TENANT_PROVISIONER,
+)
+from govoplan_core.core.module_guards import persistent_table_uninstall_guard
+from govoplan_core.core.modules import FrontendModule, FrontendRoute, MigrationSpec, ModuleContext, ModuleManifest, NavItem, PermissionDefinition, RoleTemplate
 
 
 def _permission(scope: str, label: str, description: str, category: str, level: str) -> PermissionDefinition:
@@ -105,31 +113,120 @@ ACCESS_ROLE_TEMPLATES: tuple[RoleTemplate, ...] = (
     ),
 )
 
+ADMIN_READ_SCOPES = (
+    "admin:users:read",
+    "admin:groups:read",
+    "admin:roles:read",
+    "admin:api_keys:read",
+    "admin:settings:read",
+    "system:tenants:read",
+    "system:accounts:read",
+    "system:roles:read",
+    "system:settings:read",
+    "system:governance:read",
+    "system:audit:read",
+    "access:tenant:read",
+    "access:account:read",
+    "access:governance:read",
+)
+
 
 def _legacy_principal_resolver(context: ModuleContext) -> object:
     del context
-    from govoplan_core.auth.dependencies import LegacyPrincipalResolver
+    from govoplan_access.backend.auth.dependencies import LegacyPrincipalResolver
 
     return LegacyPrincipalResolver()
 
 
 def _legacy_permission_evaluator(context: ModuleContext) -> object:
     del context
-    from govoplan_core.auth.dependencies import LegacyPermissionEvaluator
+    from govoplan_access.backend.auth.dependencies import LegacyPermissionEvaluator
 
     return LegacyPermissionEvaluator()
 
 
+def _access_directory(context: ModuleContext) -> object:
+    del context
+    from govoplan_access.backend.directory import SqlAccessDirectory
+
+    return SqlAccessDirectory()
+
+
+def _tenant_provisioner(context: ModuleContext) -> object:
+    del context
+    from govoplan_access.backend.tenancy.provisioning import LegacyTenantAccessProvisioner
+
+    return LegacyTenantAccessProvisioner()
+
+
+def _access_administration(context: ModuleContext) -> object:
+    del context
+    from govoplan_access.backend.administration import SqlAccessAdministration
+
+    return SqlAccessAdministration()
+
+
+def _governance_materializer(context: ModuleContext) -> object:
+    del context
+    from govoplan_access.backend.governance_materializer import SqlAccessGovernanceMaterializer
+
+    return SqlAccessGovernanceMaterializer()
+
+
+def _route_factory(context: ModuleContext):
+    from fastapi import APIRouter
+
+    from govoplan_access.backend.runtime import configure_runtime
+
+    configure_runtime(context)
+
+    from govoplan_access.backend.api.v1.auth import router as auth_router
+    from govoplan_access.backend.api.v1.routes import router as access_admin_router
+
+    router = APIRouter()
+    router.include_router(auth_router)
+    router.include_router(access_admin_router)
+    return router
+
+
 manifest = ModuleManifest(
     id="access",
     name="Access",
-    version="0.1.4",
+    version="0.1.5",
+    dependencies=("tenancy",),
     permissions=ACCESS_PERMISSIONS,
     role_templates=ACCESS_ROLE_TEMPLATES,
+    route_factory=_route_factory,
     migration_spec=MigrationSpec(module_id="access", metadata=AccessBase.metadata),
+    uninstall_guard_providers=(
+        persistent_table_uninstall_guard(
+            access_models.Account,
+            access_models.User,
+            access_models.Group,
+            access_models.Role,
+            access_models.SystemRoleAssignment,
+            access_models.UserGroupMembership,
+            access_models.UserRoleAssignment,
+            access_models.GroupRoleAssignment,
+            access_models.ApiKey,
+            access_models.AuthSession,
+            label="Access",
+        ),
+    ),
+    nav_items=(NavItem(path="/admin", label="Admin", icon="admin", required_any=ADMIN_READ_SCOPES, order=900),),
+    frontend=FrontendModule(
+        module_id="access",
+        package_name="@govoplan/access-webui",
+        routes=(FrontendRoute(path="/admin", component="AdminPage", required_any=ADMIN_READ_SCOPES, order=900),),
+        nav_items=(NavItem(path="/admin", label="Admin", icon="admin", required_any=ADMIN_READ_SCOPES, order=900),),
+    ),
     capability_factories={
         CAPABILITY_ACCESS_PRINCIPAL_RESOLVER: _legacy_principal_resolver,
         CAPABILITY_ACCESS_PERMISSION_EVALUATOR: _legacy_permission_evaluator,
+        CAPABILITY_ACCESS_DIRECTORY: _access_directory,
+        CAPABILITY_ACCESS_TENANT_PROVISIONER: _tenant_provisioner,
+        CAPABILITY_ACCESS_ADMINISTRATION: _access_administration,
+        CAPABILITY_ACCESS_GOVERNANCE_MATERIALIZER: _governance_materializer,
     },
 )