feat(admin): declare governed DSAR coverage

src/govoplan_admin/backend/dsar_provider.py

@@ -0,0 +1,61 @@
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+from govoplan_core.core.dsar import (
+    DsarErasureActionRef,
+    DsarExecutionResultRef,
+    DsarRecordRef,
+    DsarSubjectRef,
+    dsar_capability_name,
+)
+
+
+ADMIN_DSAR_CAPABILITY = dsar_capability_name("admin")
+
+
+class AdminDsarProvider:
+    """Declare the reviewed absence of subject data in Admin-owned tables."""
+
+    provider_id = "admin"
+    module_id = "admin"
+
+    def search_subject(
+        self,
+        session: object,
+        *,
+        tenant_id: str,
+        subject: DsarSubjectRef,
+    ) -> Sequence[DsarRecordRef]:
+        del session, tenant_id, subject
+        return ()
+
+    def plan_erasure(
+        self,
+        session: object,
+        *,
+        tenant_id: str,
+        subject: DsarSubjectRef,
+        records: Sequence[DsarRecordRef],
+    ) -> Sequence[DsarErasureActionRef]:
+        del session, tenant_id, subject
+        if records:
+            raise ValueError("Admin DSAR cannot plan records it does not own.")
+        return ()
+
+    def execute_erasure(
+        self,
+        session: object,
+        *,
+        tenant_id: str,
+        subject: DsarSubjectRef,
+        actions: Sequence[DsarErasureActionRef],
+        request_id: str,
+    ) -> Sequence[DsarExecutionResultRef]:
+        del session, tenant_id, subject, request_id
+        if actions:
+            raise ValueError("Admin DSAR cannot execute actions it does not own.")
+        return ()
+
+
+__all__ = ["ADMIN_DSAR_CAPABILITY", "AdminDsarProvider"]