feat: add configurable application status access

2026-08-19 12:33:34 +02:00
parent d83bb92ec8
commit 87d12519b7
17 changed files with 2073 additions and 9 deletions
@@ -342,6 +342,148 @@ class FormAssistedConfirmation(Base, TimestampMixin):
    )


+class FormStatusAccessPolicy(Base, TimestampMixin):
+    __tablename__ = "form_status_access_policies"
+    __table_args__ = (
+        UniqueConstraint(
+            "tenant_id",
+            "policy_id",
+            name="uq_form_status_access_policy",
+        ),
+        UniqueConstraint(
+            "tenant_id",
+            "definition_id",
+            "definition_revision",
+            name="uq_form_status_access_definition",
+        ),
+    )
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=new_uuid)
+    tenant_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
+    policy_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
+    definition_id: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
+    definition_revision: Mapped[str] = mapped_column(
+        String(255), nullable=False, index=True
+    )
+    mode: Mapped[str] = mapped_column(String(30), nullable=False, index=True)
+    enabled: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)
+    revision: Mapped[int] = mapped_column(Integer, default=1, nullable=False)
+    email_field_key: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    token_ttl_seconds: Mapped[int] = mapped_column(Integer, nullable=False)
+    request_limit_per_hour: Mapped[int] = mapped_column(Integer, nullable=False)
+    created_by: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
+    updated_by: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
+    details: Mapped[dict[str, Any]] = mapped_column(
+        "metadata", JSON, default=dict, nullable=False
+    )
+
+
+class FormStatusAccessGrant(Base, TimestampMixin):
+    __tablename__ = "form_status_access_grants"
+    __table_args__ = (
+        UniqueConstraint(
+            "tenant_id",
+            "grant_id",
+            name="uq_form_status_access_grant",
+        ),
+        UniqueConstraint("tracking_id", name="uq_form_status_tracking_id"),
+        UniqueConstraint(
+            "tenant_id",
+            "instance_id",
+            name="uq_form_status_access_instance",
+        ),
+        Index(
+            "ix_form_status_access_policy_state",
+            "tenant_id",
+            "policy_id",
+            "revoked_at",
+        ),
+    )
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=new_uuid)
+    tenant_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
+    grant_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
+    policy_id: Mapped[str] = mapped_column(
+        ForeignKey("form_status_access_policies.id", ondelete="RESTRICT"),
+        nullable=False,
+        index=True,
+    )
+    instance_id: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
+    tracking_id: Mapped[str] = mapped_column(String(64), nullable=False, index=True)
+    mode: Mapped[str] = mapped_column(String(30), nullable=False, index=True)
+    applicant_actor_id: Mapped[str | None] = mapped_column(
+        String(255), nullable=True, index=True
+    )
+    recipient_email_sha256: Mapped[str | None] = mapped_column(
+        String(64), nullable=True
+    )
+    token_ttl_seconds: Mapped[int] = mapped_column(Integer, nullable=False)
+    request_limit_per_hour: Mapped[int] = mapped_column(Integer, nullable=False)
+    request_window_started_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+    request_window_count: Mapped[int] = mapped_column(
+        Integer, default=0, nullable=False
+    )
+    issued_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, index=True
+    )
+    last_accessed_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+    revoked_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True, index=True
+    )
+    details: Mapped[dict[str, Any]] = mapped_column(
+        "metadata", JSON, default=dict, nullable=False
+    )
+
+
+class FormStatusAccessToken(Base, TimestampMixin):
+    __tablename__ = "form_status_access_tokens"
+    __table_args__ = (
+        UniqueConstraint(
+            "tenant_id",
+            "token_id",
+            name="uq_form_status_access_token",
+        ),
+        UniqueConstraint("token_sha256", name="uq_form_status_access_token_digest"),
+        Index(
+            "ix_form_status_access_token_state",
+            "tenant_id",
+            "grant_id",
+            "expires_at",
+            "revoked_at",
+        ),
+    )
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=new_uuid)
+    tenant_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
+    token_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
+    grant_id: Mapped[str] = mapped_column(
+        ForeignKey("form_status_access_grants.id", ondelete="RESTRICT"),
+        nullable=False,
+        index=True,
+    )
+    token_sha256: Mapped[str] = mapped_column(String(64), nullable=False, index=True)
+    issued_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, index=True
+    )
+    expires_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, index=True
+    )
+    revoked_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True, index=True
+    )
+    last_used_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+    notification_id: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    details: Mapped[dict[str, Any]] = mapped_column(
+        "metadata", JSON, default=dict, nullable=False
+    )
+
+
 class FormAcknowledgement(Base, TimestampMixin):
    __tablename__ = "form_acknowledgements"
    __table_args__ = (
@@ -393,4 +535,7 @@ __all__ = [
    "FormIntakeSession",
    "FormInstanceIdentity",
    "FormInstanceRevision",
+    "FormStatusAccessGrant",
+    "FormStatusAccessPolicy",
+    "FormStatusAccessToken",
 ]