44 lines
1.9 KiB
Python
44 lines
1.9 KiB
Python
from __future__ import annotations
|
|
|
|
from sqlalchemy.orm import Session
|
|
|
|
from govoplan_core.admin.common import AdminConflictError
|
|
from govoplan_access.backend.db.models import (
|
|
ApiKey,
|
|
Group,
|
|
Role,
|
|
Tenant,
|
|
)
|
|
from govoplan_core.tenancy.service import effective_tenant_governance
|
|
|
|
|
|
def ensure_group_mutation_allowed(group: Group, *, requested_active: bool | None = None) -> None:
|
|
if group.system_template_id and group.system_required and requested_active is False:
|
|
raise AdminConflictError("This centrally required group cannot be deactivated by the tenant.")
|
|
|
|
|
|
def ensure_role_mutation_allowed(role: Role, *, requested_assignable: bool | None = None) -> None:
|
|
if role.system_template_id:
|
|
if role.system_required and requested_assignable is False:
|
|
raise AdminConflictError("This centrally required role cannot be made unavailable by the tenant.")
|
|
raise AdminConflictError("Centrally managed role definitions can only be changed in System administration.")
|
|
|
|
|
|
def assert_api_keys_allowed(session: Session, tenant: Tenant) -> None:
|
|
if not effective_tenant_governance(session, tenant).allow_api_keys:
|
|
raise AdminConflictError("API-key creation is disabled by system or tenant governance.")
|
|
|
|
|
|
def assert_custom_groups_allowed(session: Session, tenant: Tenant) -> None:
|
|
if not effective_tenant_governance(session, tenant).allow_custom_groups:
|
|
raise AdminConflictError("Custom tenant groups are disabled by system or tenant governance.")
|
|
|
|
|
|
def assert_custom_roles_allowed(session: Session, tenant: Tenant) -> None:
|
|
if not effective_tenant_governance(session, tenant).allow_custom_roles:
|
|
raise AdminConflictError("Custom tenant roles are disabled by system or tenant governance.")
|
|
|
|
|
|
def active_api_key_count(session: Session, tenant_id: str) -> int:
|
|
return session.query(ApiKey).filter(ApiKey.tenant_id == tenant_id, ApiKey.revoked_at.is_(None)).count()
|