feat(cases): enforce purpose-bound case governance

src/govoplan_cases/backend/search_source.py

@@ -30,6 +30,7 @@ PROVIDER_ID = "cases.cases"
 RESOURCE_TYPE = "case"
 READ_SCOPE = "cases:case:read"
 ADMIN_SCOPE = "cases:case:admin"
+SEARCH_ACCESS_PURPOSE = "cases.search"
 
 
 class CasesSearchSource:
@@ -118,6 +119,7 @@ class CasesSearchSource:
                 principal,
                 case_id=reference.resource_id,
                 permission="read",
+                purpose=SEARCH_ACCESS_PURPOSE,
             )
         return decisions
 
@@ -219,7 +221,10 @@ def _document(
         resource_type=RESOURCE_TYPE,
         resource_id=row.case_id,
         title=row.title,
-        url=f"/cases/{quote(row.case_id, safe='')}",
+        url=(
+            f"/cases/{quote(row.case_id, safe='')}"
+            f"?purpose={quote(SEARCH_ACCESS_PURPOSE, safe='')}"
+        ),
         summary=f"{identity.case_number} - {row.status_key}",
         body=row.search_text[:200_000],
         keywords=(
@@ -279,5 +284,6 @@ __all__ = [
     "CasesSearchSource",
     "PROVIDER_ID",
     "RESOURCE_TYPE",
+    "SEARCH_ACCESS_PURPOSE",
     "create_cases_search_source",
 ]