Implement typed effective identity relationships

2026-08-02 14:44:42 +02:00
parent 820ea5eeab
commit 6f6c45f6e2
13 changed files with 1901 additions and 3 deletions
@@ -107,6 +107,141 @@ class IdmSettingsUpdateRequest(BaseModel):
    settings: dict[str, Any] | None = None


+class TypedGroupItem(BaseModel):
+    id: str
+    tenant_id: str
+    key: str
+    name: str
+    group_type: str
+    description: str | None = None
+    status: Literal["active", "inactive"]
+    source_provider: str
+    source_resource_type: str | None = None
+    source_resource_id: str | None = None
+    source_revision: str | None = None
+    properties: dict[str, Any]
+    provenance: dict[str, Any]
+    revision: int
+    created_at: datetime | None = None
+    updated_at: datetime | None = None
+
+
+class TypedGroupList(BaseModel):
+    groups: list[TypedGroupItem]
+    total: int
+
+
+class TypedGroupCreateRequest(BaseModel):
+    key: str = Field(min_length=1, max_length=120)
+    name: str = Field(min_length=1, max_length=255)
+    group_type: str = Field(min_length=1, max_length=80)
+    description: str | None = Field(default=None, max_length=8_000)
+    source_provider: str = Field(default="local", min_length=1, max_length=80)
+    source_resource_type: str | None = Field(default=None, max_length=120)
+    source_resource_id: str | None = Field(default=None, max_length=255)
+    source_revision: str | None = Field(default=None, max_length=255)
+    properties: dict[str, Any] = Field(default_factory=dict)
+    provenance: dict[str, Any] = Field(default_factory=dict)
+
+
+class TypedGroupUpdateRequest(BaseModel):
+    base_revision: int = Field(ge=1)
+    key: str | None = Field(default=None, min_length=1, max_length=120)
+    name: str | None = Field(default=None, min_length=1, max_length=255)
+    group_type: str | None = Field(default=None, min_length=1, max_length=80)
+    description: str | None = Field(default=None, max_length=8_000)
+    status: Literal["active", "inactive"] | None = None
+    source_provider: str | None = Field(default=None, min_length=1, max_length=80)
+    source_resource_type: str | None = Field(default=None, max_length=120)
+    source_resource_id: str | None = Field(default=None, max_length=255)
+    source_revision: str | None = Field(default=None, max_length=255)
+    properties: dict[str, Any] | None = None
+    provenance: dict[str, Any] | None = None
+
+
+class IdentityRelationshipItem(BaseModel):
+    id: str
+    tenant_id: str
+    relationship_kind: str
+    subject_identity_id: str
+    target_group_id: str | None = None
+    related_identity_id: str | None = None
+    role: str | None = None
+    valid_from: datetime | None = None
+    valid_until: datetime | None = None
+    status: Literal["active", "revoked"]
+    revoked_at: datetime | None = None
+    revoked_by: str | None = None
+    revocation_reason: str | None = None
+    expired_event_at: datetime | None = None
+    source_provider: str
+    source_resource_type: str | None = None
+    source_resource_id: str | None = None
+    source_revision: str | None = None
+    properties: dict[str, Any]
+    provenance: dict[str, Any]
+    revision: int
+    created_at: datetime | None = None
+    updated_at: datetime | None = None
+
+
+class IdentityRelationshipList(BaseModel):
+    relationships: list[IdentityRelationshipItem]
+    total: int
+
+
+class IdentityRelationshipCreateRequest(BaseModel):
+    relationship_kind: str = Field(min_length=1, max_length=80)
+    subject_identity_id: str = Field(min_length=1, max_length=36)
+    target_group_id: str | None = Field(default=None, max_length=36)
+    related_identity_id: str | None = Field(default=None, max_length=36)
+    role: str | None = Field(default=None, max_length=120)
+    valid_from: datetime | None = None
+    valid_until: datetime | None = None
+    source_provider: str = Field(default="local", min_length=1, max_length=80)
+    source_resource_type: str | None = Field(default=None, max_length=120)
+    source_resource_id: str | None = Field(default=None, max_length=255)
+    source_revision: str | None = Field(default=None, max_length=255)
+    properties: dict[str, Any] = Field(default_factory=dict)
+    provenance: dict[str, Any] = Field(default_factory=dict)
+
+
+class IdentityRelationshipUpdateRequest(BaseModel):
+    base_revision: int = Field(ge=1)
+    relationship_kind: str | None = Field(default=None, min_length=1, max_length=80)
+    target_group_id: str | None = Field(default=None, max_length=36)
+    related_identity_id: str | None = Field(default=None, max_length=36)
+    role: str | None = Field(default=None, max_length=120)
+    valid_from: datetime | None = None
+    valid_until: datetime | None = None
+    source_provider: str | None = Field(default=None, min_length=1, max_length=80)
+    source_resource_type: str | None = Field(default=None, max_length=120)
+    source_resource_id: str | None = Field(default=None, max_length=255)
+    source_revision: str | None = Field(default=None, max_length=255)
+    properties: dict[str, Any] | None = None
+    provenance: dict[str, Any] | None = None
+
+
+class IdentityRelationshipRevokeRequest(BaseModel):
+    base_revision: int = Field(ge=1)
+    reason: str = Field(min_length=1, max_length=8_000)
+
+
+class IdentityRelationshipDecisionItem(BaseModel):
+    relationship: IdentityRelationshipItem
+    included: bool
+    code: str
+    explanation: str
+    identity_status: str | None = None
+
+
+class TypedGroupMembershipResolutionItem(BaseModel):
+    group: TypedGroupItem
+    effective_at: datetime
+    decisions: list[IdentityRelationshipDecisionItem]
+    identity_ids: list[str]
+
+
 FunctionAssignmentChangeKind = Literal["request", "grant"]
 FunctionAssignmentChangeAction = Literal[
    "approve",