329 lines
11 KiB
Python
329 lines
11 KiB
Python
from __future__ import annotations
|
|
|
|
|
|
from typing import Literal
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, Query, status
|
|
from sqlalchemy.orm import Session
|
|
|
|
from govoplan_core.api.v1.schemas import (
|
|
ReferenceOptionListResponse,
|
|
ReferenceOptionResponse,
|
|
)
|
|
from govoplan_campaign.backend.schemas import (
|
|
CampaignShareItem,
|
|
CampaignShareListResponse,
|
|
CampaignShareTargetItem,
|
|
CampaignShareTargetsResponse,
|
|
CampaignShareUpsertRequest,
|
|
CampaignOwnerUpdateRequest,
|
|
CampaignResponse,
|
|
)
|
|
from govoplan_core.auth import ApiPrincipal, require_scope
|
|
from govoplan_core.audit.logging import audit_from_principal
|
|
from govoplan_campaign.backend.db.models import (
|
|
CampaignShare,
|
|
)
|
|
from govoplan_core.db.session import get_session
|
|
from govoplan_core.core.references import (
|
|
access_scope_reference_page,
|
|
access_scope_reference_provider_available,
|
|
)
|
|
from govoplan_core.core.runtime import get_registry
|
|
from govoplan_core.security.time import utc_now
|
|
|
|
|
|
from govoplan_campaign.backend.route_support import (
|
|
_access_directory,
|
|
_clear_current_version_mail_profile_for_owner_transfer,
|
|
_get_campaign_for_principal,
|
|
)
|
|
|
|
router = APIRouter(prefix="/campaigns", tags=["campaigns"])
|
|
|
|
|
|
@router.get(
|
|
"/{campaign_id}/share-target-options",
|
|
response_model=ReferenceOptionListResponse,
|
|
)
|
|
def search_campaign_share_targets(
|
|
campaign_id: str,
|
|
target_type: Literal["user", "group"],
|
|
q: str = "",
|
|
selected: list[str] = Query(default=[]),
|
|
limit: int = Query(default=50, ge=1, le=200),
|
|
cursor: str | None = None,
|
|
session: Session = Depends(get_session),
|
|
principal: ApiPrincipal = Depends(require_scope("campaigns:campaign:share")),
|
|
) -> ReferenceOptionListResponse:
|
|
_get_campaign_for_principal(session, campaign_id, principal, write=True)
|
|
registry = get_registry()
|
|
try:
|
|
page = access_scope_reference_page(
|
|
registry,
|
|
principal,
|
|
scope_type=target_type,
|
|
reference_kind="membership" if target_type == "user" else "group",
|
|
query=q,
|
|
selected_values=selected,
|
|
limit=limit,
|
|
cursor=cursor,
|
|
administrative=True,
|
|
session=session,
|
|
)
|
|
except ValueError as exc:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
|
|
detail=str(exc),
|
|
) from exc
|
|
return ReferenceOptionListResponse(
|
|
options=[
|
|
ReferenceOptionResponse(**option.to_dict())
|
|
for option in page.options
|
|
],
|
|
provider_available=access_scope_reference_provider_available(registry),
|
|
next_cursor=page.next_cursor,
|
|
has_more=page.has_more,
|
|
)
|
|
|
|
|
|
@router.get("/{campaign_id}/share-targets", response_model=CampaignShareTargetsResponse)
|
|
def list_campaign_share_targets(
|
|
campaign_id: str,
|
|
limit: int = Query(default=500, ge=1, le=1000),
|
|
session: Session = Depends(get_session),
|
|
principal: ApiPrincipal = Depends(require_scope("campaigns:campaign:share")),
|
|
):
|
|
_get_campaign_for_principal(session, campaign_id, principal, write=True)
|
|
directory = _access_directory()
|
|
users = [
|
|
user
|
|
for user in directory.users_for_tenant(principal.tenant_id)
|
|
if user.status == "active"
|
|
]
|
|
groups = [
|
|
group
|
|
for group in directory.groups_for_tenant(principal.tenant_id)
|
|
if group.status == "active"
|
|
]
|
|
if len(users) > limit or len(groups) > limit:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_413_CONTENT_TOO_LARGE,
|
|
detail=(
|
|
f"Campaign share targets exceed the maximum response size of {limit} "
|
|
"users or groups. Use a searchable directory selector."
|
|
),
|
|
)
|
|
return CampaignShareTargetsResponse(
|
|
users=[
|
|
CampaignShareTargetItem(
|
|
id=item.id, name=item.display_name or item.email, secondary=item.email
|
|
)
|
|
for item in users
|
|
],
|
|
groups=[
|
|
CampaignShareTargetItem(id=item.id, name=item.name, secondary=None)
|
|
for item in groups
|
|
],
|
|
)
|
|
|
|
|
|
@router.get("/{campaign_id}/shares", response_model=CampaignShareListResponse)
|
|
def list_campaign_shares(
|
|
campaign_id: str,
|
|
page: int = Query(default=1, ge=1),
|
|
page_size: int = Query(default=500, ge=1, le=1000),
|
|
session: Session = Depends(get_session),
|
|
principal: ApiPrincipal = Depends(require_scope("campaigns:campaign:share")),
|
|
):
|
|
campaign = _get_campaign_for_principal(session, campaign_id, principal, write=True)
|
|
query = session.query(CampaignShare).filter(
|
|
CampaignShare.tenant_id == principal.tenant_id,
|
|
CampaignShare.campaign_id == campaign.id,
|
|
CampaignShare.revoked_at.is_(None),
|
|
)
|
|
total = query.order_by(None).count()
|
|
pages = max(1, (total + page_size - 1) // page_size)
|
|
shares = (
|
|
query.order_by(
|
|
CampaignShare.target_type.asc(),
|
|
CampaignShare.target_id.asc(),
|
|
CampaignShare.id.asc(),
|
|
)
|
|
.offset((page - 1) * page_size)
|
|
.limit(page_size)
|
|
.all()
|
|
)
|
|
return CampaignShareListResponse(
|
|
shares=[CampaignShareItem.model_validate(item) for item in shares],
|
|
total=total,
|
|
page=page,
|
|
page_size=page_size,
|
|
pages=pages,
|
|
)
|
|
|
|
|
|
@router.put("/{campaign_id}/owner", response_model=CampaignResponse)
|
|
def update_campaign_owner(
|
|
campaign_id: str,
|
|
payload: CampaignOwnerUpdateRequest,
|
|
session: Session = Depends(get_session),
|
|
principal: ApiPrincipal = Depends(require_scope("campaigns:campaign:share")),
|
|
):
|
|
campaign = _get_campaign_for_principal(session, campaign_id, principal, write=True)
|
|
if payload.owner_user_id and payload.owner_group_id:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
|
|
detail="Choose either a user owner or a group owner, not both",
|
|
)
|
|
directory = _access_directory()
|
|
if payload.owner_user_id:
|
|
owner = directory.get_user(payload.owner_user_id)
|
|
if owner is not None and (
|
|
owner.tenant_id != principal.tenant_id or owner.status != "active"
|
|
):
|
|
owner = None
|
|
if owner is None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND, detail="Owner user not found"
|
|
)
|
|
if payload.owner_group_id:
|
|
group = directory.get_group(payload.owner_group_id)
|
|
if group is not None and (
|
|
group.tenant_id != principal.tenant_id or group.status != "active"
|
|
):
|
|
group = None
|
|
if group is None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND, detail="Owner group not found"
|
|
)
|
|
owner_changed = (
|
|
campaign.owner_user_id != payload.owner_user_id
|
|
or campaign.owner_group_id != payload.owner_group_id
|
|
)
|
|
mail_profile_reselection_required = False
|
|
if owner_changed:
|
|
mail_profile_reselection_required = (
|
|
_clear_current_version_mail_profile_for_owner_transfer(session, campaign)
|
|
)
|
|
|
|
campaign.owner_user_id = payload.owner_user_id
|
|
campaign.owner_group_id = payload.owner_group_id
|
|
session.add(campaign)
|
|
audit_from_principal(
|
|
session,
|
|
principal,
|
|
action="campaign.owner_updated",
|
|
object_type="campaign",
|
|
object_id=campaign.id,
|
|
details={
|
|
**payload.model_dump(),
|
|
"mail_profile_reselection_required": mail_profile_reselection_required,
|
|
},
|
|
commit=True,
|
|
)
|
|
return CampaignResponse.model_validate(campaign)
|
|
|
|
|
|
@router.post(
|
|
"/{campaign_id}/shares",
|
|
response_model=CampaignShareItem,
|
|
status_code=status.HTTP_201_CREATED,
|
|
)
|
|
def upsert_campaign_share(
|
|
campaign_id: str,
|
|
payload: CampaignShareUpsertRequest,
|
|
session: Session = Depends(get_session),
|
|
principal: ApiPrincipal = Depends(require_scope("campaigns:campaign:share")),
|
|
):
|
|
campaign = _get_campaign_for_principal(session, campaign_id, principal, write=True)
|
|
directory = _access_directory()
|
|
if payload.target_type == "user":
|
|
target = directory.get_user(payload.target_id)
|
|
if target is not None and (
|
|
target.tenant_id != principal.tenant_id or target.status != "active"
|
|
):
|
|
target = None
|
|
else:
|
|
target = directory.get_group(payload.target_id)
|
|
if target is not None and (
|
|
target.tenant_id != principal.tenant_id or target.status != "active"
|
|
):
|
|
target = None
|
|
if target is None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND, detail="Share target not found"
|
|
)
|
|
share = (
|
|
session.query(CampaignShare)
|
|
.filter(
|
|
CampaignShare.campaign_id == campaign.id,
|
|
CampaignShare.target_type == payload.target_type,
|
|
CampaignShare.target_id == payload.target_id,
|
|
)
|
|
.one_or_none()
|
|
)
|
|
if share is None:
|
|
share = CampaignShare(
|
|
tenant_id=principal.tenant_id,
|
|
campaign_id=campaign.id,
|
|
target_type=payload.target_type,
|
|
target_id=payload.target_id,
|
|
permission=payload.permission,
|
|
created_by_user_id=principal.user.id,
|
|
)
|
|
else:
|
|
share.permission = payload.permission
|
|
share.revoked_at = None
|
|
session.add(share)
|
|
audit_from_principal(
|
|
session,
|
|
principal,
|
|
action="campaign.share_upserted",
|
|
object_type="campaign",
|
|
object_id=campaign.id,
|
|
details=payload.model_dump(),
|
|
commit=True,
|
|
)
|
|
return CampaignShareItem.model_validate(share)
|
|
|
|
|
|
@router.delete(
|
|
"/{campaign_id}/shares/{share_id}", status_code=status.HTTP_204_NO_CONTENT
|
|
)
|
|
def revoke_campaign_share(
|
|
campaign_id: str,
|
|
share_id: str,
|
|
session: Session = Depends(get_session),
|
|
principal: ApiPrincipal = Depends(require_scope("campaigns:campaign:share")),
|
|
):
|
|
campaign = _get_campaign_for_principal(session, campaign_id, principal, write=True)
|
|
share = (
|
|
session.query(CampaignShare)
|
|
.filter(
|
|
CampaignShare.id == share_id,
|
|
CampaignShare.campaign_id == campaign.id,
|
|
CampaignShare.tenant_id == principal.tenant_id,
|
|
)
|
|
.one_or_none()
|
|
)
|
|
if share is None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND, detail="Campaign share not found"
|
|
)
|
|
share.revoked_at = utc_now()
|
|
session.add(share)
|
|
audit_from_principal(
|
|
session,
|
|
principal,
|
|
action="campaign.share_revoked",
|
|
object_type="campaign",
|
|
object_id=campaign.id,
|
|
details={"share_id": share_id},
|
|
commit=True,
|
|
)
|
|
return None
|
|
|
|
|
|
# Queue / delivery control -------------------------------------------------
|