feat: add governed Campaign DSAR coverage
This commit is contained in:
File diff suppressed because it is too large
Load Diff
@@ -65,11 +65,19 @@ from govoplan_campaign.backend.documentation import (
|
||||
CAMPAIGN_USER_DOCUMENTATION,
|
||||
documentation_topics,
|
||||
)
|
||||
from govoplan_campaign.backend.dsar_provider import CAMPAIGN_DSAR_CAPABILITY
|
||||
from govoplan_campaign.backend.search_source import create_campaign_search_source
|
||||
|
||||
register_campaign_change_tracking()
|
||||
|
||||
|
||||
def _dsar_provider(context: ModuleContext) -> object:
|
||||
del context
|
||||
from govoplan_campaign.backend.dsar_provider import CampaignDsarProvider
|
||||
|
||||
return CampaignDsarProvider()
|
||||
|
||||
|
||||
def _permission(
|
||||
scope: str, label: str, description: str, category: str
|
||||
) -> PermissionDefinition:
|
||||
@@ -409,6 +417,7 @@ manifest = ModuleManifest(
|
||||
name=REPORT_PROVIDER_CAPABILITY_PREFIX + "campaigns",
|
||||
version="1.0.0",
|
||||
),
|
||||
ModuleInterfaceProvider(name=CAMPAIGN_DSAR_CAPABILITY, version="0.1.0"),
|
||||
),
|
||||
requires_interfaces=(
|
||||
ModuleInterfaceRequirement(
|
||||
@@ -659,6 +668,65 @@ manifest = ModuleManifest(
|
||||
),
|
||||
documentation=(
|
||||
*CAMPAIGN_USER_DOCUMENTATION,
|
||||
DocumentationTopic(
|
||||
id="campaigns.privacy.data-subject-requests",
|
||||
title="Review Campaign data in a data-subject request",
|
||||
summary="Collect recipient, version, delivery, report, and artifact metadata without rewriting immutable evidence.",
|
||||
body=(
|
||||
"Campaign's DSAR provider searches the effective tenant by normalized recipient email, direct membership references, and namespaced Campaign job, entry, version, or Campaign references. "
|
||||
"It isolates matching inline-recipient fields and job metadata, and reports built versions, delivery attempts, Postbox and print outcomes, message-action corrections, recipient-specific report projections, generated-message digests, and attachment metadata. It does not export EML bytes, object or local paths, provider target snapshots, worker claims, idempotency material, secrets, credentials, or unrelated recipient addresses. "
|
||||
"Built, locked, published, terminal, delivered, or corrected records remain retained with a reason and continue through Campaign's configured retention/redaction process. Draft recipient content and user-owned attachment content require coordinated manual review because the same data may occur in version JSON, jobs, and generated artifacts. The provider can idempotently delete a personal recipient-import mapping profile and revoke an active Campaign share aimed at the subject. It never rewrites delivered evidence or deletes generated artifacts directly. Campaign reports are derived projections rather than a separate personal-data store."
|
||||
),
|
||||
layer="configured",
|
||||
documentation_types=("admin",),
|
||||
audience=("privacy_officer", "campaign_manager", "records_manager", "operator"),
|
||||
order=42,
|
||||
conditions=(
|
||||
DocumentationCondition(
|
||||
required_modules=("campaigns", "access"),
|
||||
any_scopes=(
|
||||
"access:privacy:read",
|
||||
"access:privacy:manage",
|
||||
"access:privacy:erase",
|
||||
),
|
||||
),
|
||||
),
|
||||
links=(
|
||||
DocumentationLink(
|
||||
label="Data-subject requests",
|
||||
href="/admin?section=tenant-data-subject-requests",
|
||||
kind="runtime",
|
||||
),
|
||||
DocumentationLink(
|
||||
label="Campaign handbook",
|
||||
href="govoplan-campaign/docs/CAMPAIGN_HANDBOOK.md",
|
||||
kind="repository",
|
||||
),
|
||||
),
|
||||
related_modules=("access", "audit", "files", "mail", "postbox", "reporting"),
|
||||
metadata={
|
||||
"kind": "workflow",
|
||||
"route": "/admin?section=tenant-data-subject-requests",
|
||||
"screen": "Data-subject requests",
|
||||
"help_contexts": ["admin.privacy.data-subject-requests"],
|
||||
"prerequisites": [
|
||||
"The privacy request and recipient selectors have been independently authorized and corroborated.",
|
||||
"The reviewer understands the effective Campaign retention policy and delivery-evidence obligations.",
|
||||
],
|
||||
"steps": [
|
||||
"Run the Campaign provider search and review recipient, version, job, attempt, report-projection, and artifact dispositions.",
|
||||
"Inspect matching draft content manually and keep every evidence retention reason with the case decision.",
|
||||
"Execute only an approved user-owned mapping deletion or subject-targeted share revocation.",
|
||||
"Use Campaign retention and artifact reconciliation for approved content redaction or expiry; do not mutate delivered evidence ad hoc.",
|
||||
],
|
||||
"limitations": [
|
||||
"Generated EML bytes and attachment content are not embedded in the JSON export; authorized Campaign or Files review paths remain authoritative.",
|
||||
"Draft recipient erasure is manual until a coordinated version/job/artifact rewrite contract can prove that no partial copy remains.",
|
||||
],
|
||||
"outcome": "Campaign personal data receives an explicit retained, review, revoke, or delete disposition without weakening delivery evidence.",
|
||||
"verification": "Confirm matching recipients are isolated, no locator or credential material appears, report counts derive from the same matched jobs, and repeated reversible actions are unchanged.",
|
||||
},
|
||||
),
|
||||
DocumentationTopic(
|
||||
id="campaigns.access.child-evidence",
|
||||
title="Explain access to Campaign child evidence",
|
||||
@@ -1313,6 +1381,7 @@ manifest = ModuleManifest(
|
||||
"govoplan_campaign.backend.reports.provider",
|
||||
fromlist=["CampaignAggregateReportProvider"],
|
||||
).CampaignAggregateReportProvider(),
|
||||
CAMPAIGN_DSAR_CAPABILITY: _dsar_provider,
|
||||
},
|
||||
capability_documentation={
|
||||
REPORT_PROVIDER_CAPABILITY_PREFIX + "campaigns": CapabilityDocumentation(
|
||||
@@ -1325,6 +1394,13 @@ manifest = ModuleManifest(
|
||||
documentation_types=("admin", "user"),
|
||||
audience=("user", "reporting_analyst", "privacy_officer"),
|
||||
),
|
||||
CAMPAIGN_DSAR_CAPABILITY: CapabilityDocumentation(
|
||||
label="Campaign data-subject request provider",
|
||||
summary="Finds isolated recipient and Campaign evidence metadata and classifies governed erasure actions.",
|
||||
contract_version="0.1.0",
|
||||
documentation_types=("admin",),
|
||||
audience=("privacy_officer", "campaign_manager", "records_manager"),
|
||||
),
|
||||
},
|
||||
operational_check_providers=(
|
||||
OperationalCheckProviderRegistration(
|
||||
|
||||
Reference in New Issue
Block a user