GovOPlaN/govoplan-campaign
2
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(campaigns): add accountable work assignments
Module Package Release / publish-packages (push) Successful in 14s
Details

Browse Source
This commit is contained in:
zemion
2026-08-22 00:50:03 +02:00
parent c2f083e5f6
commit 2630498026
23 changed files with 3011 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/govoplan_campaign/backend/capabilities.py
+92
View File
@@ -34,6 +34,8 @@ from govoplan_campaign.backend.db.models import (
CampaignMessageActionAttempt,
CampaignShare,
CampaignVersion,
CampaignWorkAssignment,
CampaignWorkAssignmentEvent,
ImapAppendAttempt,
PostboxDeliveryAttempt,
PrintOutputAttempt,
@@ -48,6 +50,9 @@ READ_ACTIONS = {
"campaigns:discussion:read",
"campaigns:discussion:post",
"campaigns:discussion:moderate",
"campaigns:assignment:read",
"campaigns:assignment:manage",
"campaigns:assignment:complete",
}
CAMPAIGN_RESOURCE_TYPES = {
"campaign",
@@ -62,6 +67,14 @@ CAMPAIGN_COLLABORATION_RESOURCE_TYPES = {
"campaign_collaboration_entry",
"campaigns:collaboration_entry",
}
CAMPAIGN_WORK_ASSIGNMENT_RESOURCE_TYPES = {
"campaign_work_assignment",
"campaigns:work_assignment",
}
CAMPAIGN_WORK_ASSIGNMENT_EVENT_RESOURCE_TYPES = {
"campaign_work_assignment_event",
"campaigns:work_assignment_event",
}
CAMPAIGN_DELIVERY_JOB_RESOURCE_TYPES = {
"campaign_delivery_job",
"campaign_job",
@@ -615,6 +628,85 @@ class CampaignAccessService(CampaignAccessProvider):
},
required_actions=required_actions,
)
elif normalized_type in CAMPAIGN_WORK_ASSIGNMENT_RESOURCE_TYPES:
assignment = session.get(CampaignWorkAssignment, resource_id) # type: ignore[attr-defined]
if assignment is None:
return _missing_resource_provenance(
principal,
resource_type="campaign_work_assignment",
resource_id=resource_id,
)
campaign = session.get(Campaign, assignment.campaign_id) # type: ignore[attr-defined]
normalized_action = action.strip().lower()
required_actions = (
("campaigns:assignment:manage",)
if normalized_action.endswith(":manage")
else (
("campaigns:assignment:complete",)
if normalized_action.endswith(":complete")
else ("campaigns:assignment:read",)
)
)
child_item = _child_provenance(
principal,
resource_id=assignment.id,
source="campaigns.work_assignment",
label="Campaign work assignment",
campaign=campaign,
version_id=assignment.campaign_version_id,
details={
"resource_type": "campaign_work_assignment",
"status": assignment.status,
"due_at": _iso_value(assignment.due_at),
"assignee_type": assignment.assignee_type,
"assignee_resolution_state": assignment.assignee_resolution_state,
"reference_kind": assignment.reference_kind,
"reference_id": assignment.reference_id,
"revision": assignment.resource_revision,
"purpose_disclosed": False,
"assignee_identity_disclosed": False,
"authorization_mode": "accountability_does_not_grant_access",
"assignment_policy_provenance": dict(
assignment.resolution_provenance or {}
),
"permission_classes": {
"read": ["campaigns:assignment:read"],
"complete": ["campaigns:assignment:complete"],
"manage": ["campaigns:assignment:manage"],
},
},
required_actions=required_actions,
)
elif normalized_type in CAMPAIGN_WORK_ASSIGNMENT_EVENT_RESOURCE_TYPES:
event = session.get(CampaignWorkAssignmentEvent, resource_id) # type: ignore[attr-defined]
if event is None:
return _missing_resource_provenance(
principal,
resource_type="campaign_work_assignment_event",
resource_id=resource_id,
)
assignment = session.get(CampaignWorkAssignment, event.assignment_id) # type: ignore[attr-defined]
campaign = session.get(Campaign, event.campaign_id) # type: ignore[attr-defined]
child_item = _child_provenance(
principal,
resource_id=event.id,
source="campaigns.work_assignment_event",
label="Campaign work assignment event",
campaign=campaign,
version_id=assignment.campaign_version_id if assignment else None,
details={
"resource_type": "campaign_work_assignment_event",
"assignment_id": event.assignment_id,
"event_kind": event.event_kind,
"status": event.status_snapshot,
"assignee_type": event.assignee_type_snapshot,
"resolution_state": event.resolution_state_snapshot,
"event_details_disclosed": False,
"assignee_identity_disclosed": False,
"authorization_mode": "immutable_accountability_evidence",
},
required_actions=("campaigns:assignment:read",),
)
elif normalized_type in CAMPAIGN_SHARE_RESOURCE_TYPES:
share = session.get(CampaignShare, resource_id) # type: ignore[attr-defined]
if share is None: