290 lines
9.0 KiB
Python
290 lines
9.0 KiB
Python
from __future__ import annotations
|
|
|
|
from collections.abc import Mapping, Sequence
|
|
from urllib.parse import quote
|
|
|
|
from sqlalchemy import func, select
|
|
from sqlalchemy.orm import Session
|
|
|
|
from govoplan_core.auth import ApiPrincipal
|
|
from govoplan_core.core.events import PlatformEvent
|
|
from govoplan_core.core.modules import ModuleContext
|
|
from govoplan_core.core.search import (
|
|
SearchAuthorizationRequest,
|
|
SearchBackfillPage,
|
|
SearchBackfillRequest,
|
|
SearchDocument,
|
|
SearchIndexChange,
|
|
SearchResourceReference,
|
|
SearchResourceType,
|
|
)
|
|
from govoplan_cases.backend.db.models import (
|
|
CaseAccessGrant,
|
|
CaseIdentity,
|
|
CaseRecordRevision,
|
|
)
|
|
from govoplan_cases.backend.service import can_access_case
|
|
|
|
|
|
PROVIDER_ID = "cases.cases"
|
|
RESOURCE_TYPE = "case"
|
|
READ_SCOPE = "cases:case:read"
|
|
ADMIN_SCOPE = "cases:case:admin"
|
|
SEARCH_ACCESS_PURPOSE = "cases.search"
|
|
|
|
|
|
class CasesSearchSource:
|
|
def resource_types(self) -> Sequence[SearchResourceType]:
|
|
return (
|
|
SearchResourceType(
|
|
provider_id=PROVIDER_ID,
|
|
module_id="cases",
|
|
resource_type=RESOURCE_TYPE,
|
|
label="Cases",
|
|
requires_authorization_recheck=True,
|
|
),
|
|
)
|
|
|
|
def backfill(
|
|
self,
|
|
session: object,
|
|
*,
|
|
request: SearchBackfillRequest,
|
|
) -> SearchBackfillPage:
|
|
_assert_source(request.provider_id, request.resource_type)
|
|
db = _session(session)
|
|
statement = (
|
|
select(CaseRecordRevision, CaseIdentity)
|
|
.join(CaseIdentity, CaseIdentity.id == CaseRecordRevision.identity_id)
|
|
.where(
|
|
CaseRecordRevision.tenant_id == request.tenant_id,
|
|
CaseRecordRevision.superseded_at.is_(None),
|
|
)
|
|
)
|
|
if request.cursor:
|
|
statement = statement.where(CaseRecordRevision.case_id > request.cursor)
|
|
rows = list(
|
|
db.execute(
|
|
statement.order_by(CaseRecordRevision.case_id).limit(request.limit + 1)
|
|
).all()
|
|
)
|
|
has_more = len(rows) > request.limit
|
|
selected = rows[: request.limit]
|
|
grants = _grants_by_case(
|
|
db,
|
|
request.tenant_id,
|
|
[row.case_id for row, _identity in selected],
|
|
)
|
|
high_watermark = db.scalar(
|
|
select(func.max(CaseRecordRevision.recorded_at)).where(
|
|
CaseRecordRevision.tenant_id == request.tenant_id,
|
|
CaseRecordRevision.superseded_at.is_(None),
|
|
)
|
|
)
|
|
return SearchBackfillPage(
|
|
documents=tuple(
|
|
_document(
|
|
row,
|
|
identity=identity,
|
|
grants=grants.get(row.case_id, ()),
|
|
)
|
|
for row, identity in selected
|
|
),
|
|
next_cursor=selected[-1][0].case_id if has_more and selected else None,
|
|
complete=not has_more,
|
|
high_watermark=high_watermark.isoformat() if high_watermark else None,
|
|
)
|
|
|
|
def authorize(
|
|
self,
|
|
session: object,
|
|
principal: object,
|
|
*,
|
|
requests: Sequence[SearchAuthorizationRequest],
|
|
) -> Mapping[str, bool]:
|
|
decisions = {item.reference.key: False for item in requests}
|
|
if not isinstance(principal, ApiPrincipal) or not principal.has(READ_SCOPE):
|
|
return decisions
|
|
db = _session(session)
|
|
for request in requests:
|
|
reference = request.reference
|
|
if (
|
|
reference.tenant_id != principal.tenant_id
|
|
or reference.module_id != "cases"
|
|
or reference.resource_type != RESOURCE_TYPE
|
|
):
|
|
continue
|
|
decisions[reference.key] = can_access_case(
|
|
db,
|
|
principal,
|
|
case_id=reference.resource_id,
|
|
permission="read",
|
|
purpose=SEARCH_ACCESS_PURPOSE,
|
|
)
|
|
return decisions
|
|
|
|
def index_changes_for_event(
|
|
self,
|
|
session: object,
|
|
*,
|
|
event: PlatformEvent,
|
|
delivery_key: str,
|
|
) -> Sequence[SearchIndexChange]:
|
|
if (
|
|
event.module_id != "cases"
|
|
or event.tenant is None
|
|
or event.resource is None
|
|
or event.resource.type != RESOURCE_TYPE
|
|
or event.resource.id is None
|
|
):
|
|
return ()
|
|
db = _session(session)
|
|
row = db.scalar(
|
|
select(CaseRecordRevision).where(
|
|
CaseRecordRevision.tenant_id == event.tenant.id,
|
|
CaseRecordRevision.case_id == event.resource.id,
|
|
CaseRecordRevision.superseded_at.is_(None),
|
|
)
|
|
)
|
|
identity = db.scalar(
|
|
select(CaseIdentity).where(
|
|
CaseIdentity.tenant_id == event.tenant.id,
|
|
CaseIdentity.case_id == event.resource.id,
|
|
)
|
|
)
|
|
deleted = row is None or identity is None
|
|
cursor = event.event_id
|
|
document = None
|
|
if not deleted:
|
|
document = _document(
|
|
row,
|
|
identity=identity,
|
|
grants=_grants_by_case(
|
|
db,
|
|
event.tenant.id,
|
|
[row.case_id],
|
|
).get(row.case_id, ()),
|
|
change_cursor=cursor,
|
|
)
|
|
reference = SearchResourceReference(
|
|
tenant_id=event.tenant.id,
|
|
module_id="cases",
|
|
resource_type=RESOURCE_TYPE,
|
|
resource_id=event.resource.id,
|
|
)
|
|
return (
|
|
SearchIndexChange(
|
|
change_id=f"{delivery_key}:{PROVIDER_ID}",
|
|
provider_id=PROVIDER_ID,
|
|
kind="delete" if deleted else "upsert",
|
|
reference=reference,
|
|
source_revision=(document.source_revision if document else cursor),
|
|
cursor=cursor,
|
|
document=document,
|
|
occurred_at=event.occurred_at,
|
|
),
|
|
)
|
|
|
|
|
|
def create_cases_search_source(_context: ModuleContext) -> CasesSearchSource:
|
|
return CasesSearchSource()
|
|
|
|
|
|
def _document(
|
|
row: CaseRecordRevision,
|
|
*,
|
|
identity: CaseIdentity,
|
|
grants: Sequence[CaseAccessGrant],
|
|
change_cursor: str | None = None,
|
|
) -> SearchDocument:
|
|
tokens = [f"scope:{READ_SCOPE}", f"scope:{ADMIN_SCOPE}"]
|
|
if identity.created_by:
|
|
tokens.extend(
|
|
(f"account:{identity.created_by}", f"membership:{identity.created_by}")
|
|
)
|
|
prefixes = {
|
|
"account": "account",
|
|
"identity": "identity",
|
|
"group": "group",
|
|
"role": "role",
|
|
"function": "function",
|
|
"function_assignment": "function",
|
|
}
|
|
for grant in grants:
|
|
prefix = prefixes.get(grant.subject_kind)
|
|
if prefix:
|
|
tokens.append(f"{prefix}:{grant.subject_id}")
|
|
return SearchDocument(
|
|
tenant_id=row.tenant_id,
|
|
module_id="cases",
|
|
provider_id=PROVIDER_ID,
|
|
resource_type=RESOURCE_TYPE,
|
|
resource_id=row.case_id,
|
|
title=row.title,
|
|
url=(
|
|
f"/cases/{quote(row.case_id, safe='')}"
|
|
f"?purpose={quote(SEARCH_ACCESS_PURPOSE, safe='')}"
|
|
),
|
|
summary=f"{identity.case_number} - {row.status_key}",
|
|
body=row.search_text[:200_000],
|
|
keywords=(
|
|
identity.case_number[:200],
|
|
row.case_type_key[:200],
|
|
row.status_key[:200],
|
|
),
|
|
visibility="restricted",
|
|
acl_tokens=tuple(dict.fromkeys(tokens)),
|
|
metadata={
|
|
"case_number": identity.case_number,
|
|
"case_type_key": row.case_type_key,
|
|
"status_key": row.status_key,
|
|
"access_mode": row.access_mode,
|
|
},
|
|
source_revision=str(row.revision),
|
|
change_cursor=change_cursor,
|
|
source_updated_at=row.recorded_at,
|
|
requires_authorization_recheck=True,
|
|
)
|
|
|
|
|
|
def _grants_by_case(
|
|
session: Session,
|
|
tenant_id: str,
|
|
case_ids: Sequence[str],
|
|
) -> dict[str, tuple[CaseAccessGrant, ...]]:
|
|
grouped: dict[str, list[CaseAccessGrant]] = {
|
|
case_id: [] for case_id in case_ids
|
|
}
|
|
if not case_ids:
|
|
return {}
|
|
rows = session.scalars(
|
|
select(CaseAccessGrant).where(
|
|
CaseAccessGrant.tenant_id == tenant_id,
|
|
CaseAccessGrant.case_id.in_(tuple(case_ids)),
|
|
CaseAccessGrant.active.is_(True),
|
|
)
|
|
)
|
|
for row in rows:
|
|
grouped.setdefault(row.case_id, []).append(row)
|
|
return {key: tuple(value) for key, value in grouped.items()}
|
|
|
|
|
|
def _assert_source(provider_id: str, resource_type: str) -> None:
|
|
if provider_id != PROVIDER_ID or resource_type != RESOURCE_TYPE:
|
|
raise ValueError("Unsupported Cases search source.")
|
|
|
|
|
|
def _session(value: object) -> Session:
|
|
if not isinstance(value, Session):
|
|
raise TypeError("Cases search requires a SQLAlchemy session.")
|
|
return value
|
|
|
|
|
|
__all__ = [
|
|
"CasesSearchSource",
|
|
"PROVIDER_ID",
|
|
"RESOURCE_TYPE",
|
|
"SEARCH_ACCESS_PURPOSE",
|
|
"create_cases_search_source",
|
|
]
|