feat(cases): enforce purpose-bound case governance

2026-08-24 20:05:31 +02:00
parent 9435116299
commit 17415d8831
28 changed files with 786 additions and 142 deletions
@@ -28,8 +28,12 @@ from govoplan_cases.backend.db.models import (
    CaseTimelineEntry,
    CaseTypeDefinition,
 )
-from govoplan_cases.backend.domain import CaseRecord
-from govoplan_cases.backend.search_source import CasesSearchSource, PROVIDER_ID
+from govoplan_cases.backend.domain import CaseGrant, CaseRecord
+from govoplan_cases.backend.search_source import (
+    SEARCH_ACCESS_PURPOSE,
+    CasesSearchSource,
+    PROVIDER_ID,
+)
 from govoplan_cases.backend.service import (
    create_case,
    upsert_case_status,
@@ -77,6 +81,15 @@ class CasesSearchSourceTests(unittest.TestCase):
                case_type_key="permit",
                status_key="review",
                title="Permit application",
+                access_mode="restricted",
+                access_grants=(
+                    CaseGrant(
+                        "account",
+                        "account-1",
+                        ("read",),
+                        (SEARCH_ACCESS_PURPOSE,),
+                    ),
+                ),
                context=GovernedContextEnvelope(
                    tenant_id="tenant-1",
                    temporal=TemporalRevision(
@@ -112,6 +125,7 @@ class CasesSearchSourceTests(unittest.TestCase):
        )
        self.assertEqual(("case-1",), tuple(item.resource_id for item in page.documents))
        self.assertEqual("PERMIT-1", page.documents[0].metadata["case_number"])
+        self.assertIn("purpose=cases.search", page.documents[0].url)
        reference = SearchResourceReference(
            tenant_id="tenant-1",
            module_id="cases",