feat(idm): govern delegation chains and timed escalation

2026-08-22 03:12:30 +02:00
parent b0eda35195
commit 21e8f0bc39
21 changed files with 1931 additions and 95 deletions
@@ -0,0 +1,60 @@
+from __future__ import annotations
+
+import unittest
+
+from fastapi import HTTPException
+
+from govoplan_idm.backend.api.v1.routes import (
+    _validate_function_governance_defaults,
+)
+
+
+class FunctionGovernanceSettingsTests(unittest.TestCase):
+    def test_bounded_delegation_and_escalation_defaults_are_accepted(self) -> None:
+        _validate_function_governance_defaults(
+            {
+                "function_assignment_governance_defaults": {
+                    "delegation_allowed": True,
+                    "maximum_delegation_depth": 2,
+                    "maximum_delegated_validity_days": 30,
+                    "escalation": {
+                        "holder": {
+                            "target_function_id": "function-escalation",
+                            "timeout_hours": 24,
+                        }
+                    },
+                }
+            }
+        )
+
+    def test_incomplete_or_unbounded_rules_are_rejected(self) -> None:
+        invalid = (
+            {"maximum_delegation_depth": 0},
+            {"maximum_delegated_validity_days": 3651},
+            {"escalation": {"holder": {"timeout_hours": 24}}},
+            {
+                "escalation": {
+                    "authority": {
+                        "target_function_id": "function-escalation",
+                        "timeout_hours": 0,
+                    }
+                }
+            },
+            {
+                "escalation": {
+                    "unknown": {
+                        "target_function_id": "function-escalation",
+                        "timeout_hours": 24,
+                    }
+                }
+            },
+        )
+        for defaults in invalid:
+            with self.subTest(defaults=defaults), self.assertRaises(HTTPException):
+                _validate_function_governance_defaults(
+                    {"function_assignment_governance_defaults": defaults}
+                )
+
+
+if __name__ == "__main__":
+    unittest.main()