Release v0.1.5

src/govoplan_files/backend/storage/access.py

@@ -2,33 +2,50 @@ from __future__ import annotations
 
 from sqlalchemy.orm import Session
 
-from govoplan_core.db.models import Group, UserGroupMembership
+from govoplan_core.core.access import (
+    CAPABILITY_ACCESS_DIRECTORY,
+    AccessDirectory,
+    GroupRef,
+)
+from govoplan_core.core.runtime import get_registry
 from govoplan_files.backend.storage.common import FileStorageError
 
 
+def _access_directory() -> AccessDirectory:
+    registry = get_registry()
+    if registry is None or not hasattr(registry, "has_capability") or not registry.has_capability(CAPABILITY_ACCESS_DIRECTORY):
+        raise FileStorageError("Access directory capability is not configured")
+    capability = registry.require_capability(CAPABILITY_ACCESS_DIRECTORY)
+    if not isinstance(capability, AccessDirectory):
+        raise FileStorageError("Access directory capability is invalid")
+    return capability
+
+
+def group_refs_for_ids(*, tenant_id: str, group_ids: list[str]) -> list[GroupRef]:
+    if not group_ids:
+        return []
+    groups = _access_directory().get_groups(group_ids)
+    return sorted(
+        [group for group in groups.values() if group.tenant_id == tenant_id],
+        key=lambda group: group.name.casefold(),
+    )
+
+
 def user_group_ids(session: Session, *, tenant_id: str, user_id: str, include_admin_groups: bool = False) -> list[str]:
+    del session
+    directory = _access_directory()
     if include_admin_groups:
-        return [row.id for row in session.query(Group).filter(Group.tenant_id == tenant_id).order_by(Group.name.asc()).all()]
-    return [
-        row.group_id
-        for row in session.query(UserGroupMembership)
-        .filter(UserGroupMembership.tenant_id == tenant_id, UserGroupMembership.user_id == user_id)
-        .all()
-    ]
+        return [group.id for group in directory.groups_for_tenant(tenant_id)]
+    return [group.id for group in directory.groups_for_user(user_id, tenant_id=tenant_id)]
 
 
 def ensure_group_access(session: Session, *, tenant_id: str, group_id: str, user_id: str, is_admin: bool = False) -> None:
-    group = session.get(Group, group_id)
+    group = _access_directory().get_group(group_id)
     if not group or group.tenant_id != tenant_id:
         raise FileStorageError("Group not found")
     if is_admin:
         return
-    membership = (
-        session.query(UserGroupMembership)
-        .filter(UserGroupMembership.tenant_id == tenant_id, UserGroupMembership.user_id == user_id, UserGroupMembership.group_id == group_id)
-        .one_or_none()
-    )
-    if membership is None:
+    if group_id not in user_group_ids(session, tenant_id=tenant_id, user_id=user_id):
         raise FileStorageError("No access to this group file space")
 
 
@@ -42,3 +59,21 @@ def ensure_owner_access(session: Session, *, tenant_id: str, owner_type: str, ow
         ensure_group_access(session, tenant_id=tenant_id, group_id=owner_id, user_id=user_id, is_admin=is_admin)
         return
     raise FileStorageError("Files must be owned by a user or group")
+
+
+def ensure_share_target_exists(*, tenant_id: str, target_type: str, target_id: str) -> None:
+    target_type = target_type.lower().strip()
+    if target_type == "user":
+        user = _access_directory().get_user(target_id)
+        if not user or user.tenant_id != tenant_id or user.status != "active":
+            raise FileStorageError("User not found")
+        return
+    if target_type == "group":
+        group = _access_directory().get_group(target_id)
+        if not group or group.tenant_id != tenant_id or group.status != "active":
+            raise FileStorageError("Group not found")
+        return
+    if target_type == "tenant":
+        if target_id != tenant_id:
+            raise FileStorageError("Tenant not found")
+        return

src/govoplan_files/backend/storage/campaign_usage.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 from collections import defaultdict
 from pathlib import PurePosixPath
-from typing import TYPE_CHECKING, Iterable
+from typing import Any, Iterable
 
 from sqlalchemy.orm import Session
 
@@ -10,8 +10,7 @@ from govoplan_files.backend.db.models import CampaignAttachmentUse, FileAsset, F
 from govoplan_files.backend.storage.common import utcnow
 from govoplan_files.backend.storage.files import current_versions_and_blobs, list_assets_for_user
 
-if TYPE_CHECKING:
-    from govoplan_campaign.backend.db.models import CampaignJob
+CampaignJobLike = Any
 
 
 def _candidate_match_keys(raw_match: str) -> set[str]:
@@ -29,7 +28,7 @@ def _attachment_use_key(*, job_id: str, file_version_id: str, filename_used: str
     return job_id, file_version_id, filename_used, stage
 
 
-def _known_use_keys_for_jobs(session: Session, jobs: Iterable[CampaignJob], *, stage: str) -> set[AttachmentUseKey]:
+def _known_use_keys_for_jobs(session: Session, jobs: Iterable[CampaignJobLike], *, stage: str) -> set[AttachmentUseKey]:
     job_ids = {job.id for job in jobs if job.id}
     if not job_ids:
         return set()
@@ -72,13 +71,13 @@ def _known_use_keys_for_jobs(session: Session, jobs: Iterable[CampaignJob], *, s
     return keys
 
 
-def _known_use_keys(session: Session, job: CampaignJob, *, stage: str) -> set[AttachmentUseKey]:
+def _known_use_keys(session: Session, job: CampaignJobLike, *, stage: str) -> set[AttachmentUseKey]:
     return _known_use_keys_for_jobs(session, [job], stage=stage)
 
 
 def _add_use(
     session: Session,
-    job: CampaignJob,
+    job: CampaignJobLike,
     *,
     asset: FileAsset,
     version: FileVersion,
@@ -118,7 +117,7 @@ def _add_use(
 
 def record_campaign_attachment_uses_for_jobs(
     session: Session,
-    jobs: Iterable[CampaignJob],
+    jobs: Iterable[CampaignJobLike],
     *,
     stage: str = "built",
 ) -> None:
@@ -249,13 +248,13 @@ def record_campaign_attachment_uses_for_jobs(
                 )
 
 
-def record_campaign_attachment_uses_for_job(session: Session, job: CampaignJob, *, stage: str = "built") -> None:
+def record_campaign_attachment_uses_for_job(session: Session, job: CampaignJobLike, *, stage: str = "built") -> None:
     """Record immutable managed file versions used by one built/sent job."""
 
     record_campaign_attachment_uses_for_jobs(session, [job], stage=stage)
 
 
-def mark_job_attachment_uses_sent(session: Session, job: CampaignJob) -> None:
+def mark_job_attachment_uses_sent(session: Session, job: CampaignJobLike) -> None:
     record_campaign_attachment_uses_for_job(session, job, stage="built")
     # Sessions use autoflush=False. Flush any compatibility-built evidence so
     # the following query can copy it to the sent stage in the same call.

src/govoplan_files/backend/storage/files.py

@@ -9,23 +9,28 @@ from uuid import uuid4
 from sqlalchemy import or_
 from sqlalchemy.orm import Session
 
-from govoplan_core.db.models import Group, Tenant, User
-from govoplan_core.core.optional import reraise_unless_missing_package
+from govoplan_core.core.campaigns import CAPABILITY_CAMPAIGNS_ACCESS, CampaignAccessProvider
 from govoplan_files.backend.db.models import CampaignAttachmentUse, FileAsset, FileBlob, FileShare, FileVersion
-from govoplan_files.backend.runtime import settings
-from govoplan_files.backend.storage.access import ensure_owner_access, user_group_ids
+from govoplan_files.backend.runtime import get_registry, settings
+from govoplan_files.backend.storage.access import ensure_owner_access, ensure_share_target_exists, user_group_ids
 from govoplan_files.backend.storage.backends import StorageBackendError, get_storage_backend
 from govoplan_files.backend.storage.common import FileConflictResolution, FileStorageError, UploadedStoredFile, utcnow
 from govoplan_files.backend.storage.paths import filename_from_path, join_folder_filename, normalize_folder, normalize_logical_path, safe_storage_component
 
 
-def _campaign_model():
-    try:
-        from govoplan_campaign.backend.db.models import Campaign
-    except ModuleNotFoundError as exc:
-        reraise_unless_missing_package(exc, "govoplan_campaign")
-        raise FileStorageError("Campaign module is not installed") from exc
-    return Campaign
+def _campaign_access_provider() -> CampaignAccessProvider:
+    registry = get_registry()
+    if registry is None or not hasattr(registry, "has_capability") or not registry.has_capability(CAPABILITY_CAMPAIGNS_ACCESS):
+        raise FileStorageError("Campaign module is not installed")
+    capability = registry.require_capability(CAPABILITY_CAMPAIGNS_ACCESS)
+    if not isinstance(capability, CampaignAccessProvider):
+        raise FileStorageError("Campaign access capability is invalid")
+    return capability
+
+
+def _ensure_campaign_exists(session: Session, *, tenant_id: str, campaign_id: str) -> None:
+    if not _campaign_access_provider().campaign_exists(session, tenant_id=tenant_id, campaign_id=campaign_id):
+        raise FileStorageError("Campaign not found")
 
 
 def _asset_query_for_owner(session: Session, *, tenant_id: str, owner_type: str, owner_id: str):
@@ -318,23 +323,10 @@ def share_file(
         raise FileStorageError("Unsupported share target")
     if permission not in {"read", "write", "manage"}:
         raise FileStorageError("Unsupported file permission")
-    if target_type == "user":
-        target_user = session.get(User, target_id)
-        if not target_user or target_user.tenant_id != tenant_id or not target_user.is_active:
-            raise FileStorageError("User not found")
-    if target_type == "group":
-        group = session.get(Group, target_id)
-        if not group or group.tenant_id != tenant_id or not group.is_active:
-            raise FileStorageError("Group not found")
-    if target_type == "tenant":
-        tenant = session.get(Tenant, target_id)
-        if target_id != tenant_id or not tenant or not tenant.is_active:
-            raise FileStorageError("Tenant not found")
+    if target_type in {"user", "group", "tenant"}:
+        ensure_share_target_exists(tenant_id=tenant_id, target_type=target_type, target_id=target_id)
     if target_type == "campaign":
-        Campaign = _campaign_model()
-        campaign = session.get(Campaign, target_id)
-        if not campaign or campaign.tenant_id != tenant_id:
-            raise FileStorageError("Campaign not found")
+        _ensure_campaign_exists(session, tenant_id=tenant_id, campaign_id=target_id)
     existing = (
         session.query(FileShare)
         .filter(
@@ -378,23 +370,10 @@ def share_files(
         raise FileStorageError("Unsupported share target")
     if permission not in {"read", "write", "manage"}:
         raise FileStorageError("Unsupported file permission")
-    if target_type == "user":
-        target_user = session.get(User, target_id)
-        if not target_user or target_user.tenant_id != tenant_id or not target_user.is_active:
-            raise FileStorageError("User not found")
-    if target_type == "group":
-        group = session.get(Group, target_id)
-        if not group or group.tenant_id != tenant_id or not group.is_active:
-            raise FileStorageError("Group not found")
-    if target_type == "tenant":
-        tenant = session.get(Tenant, target_id)
-        if target_id != tenant_id or not tenant or not tenant.is_active:
-            raise FileStorageError("Tenant not found")
+    if target_type in {"user", "group", "tenant"}:
+        ensure_share_target_exists(tenant_id=tenant_id, target_type=target_type, target_id=target_id)
     if target_type == "campaign":
-        Campaign = _campaign_model()
-        campaign = session.get(Campaign, target_id)
-        if not campaign or campaign.tenant_id != tenant_id:
-            raise FileStorageError("Campaign not found")
+        _ensure_campaign_exists(session, tenant_id=tenant_id, campaign_id=target_id)
 
     asset_list = list(assets)
     if not asset_list: