intermittent commit

src/govoplan_idm/backend/api/v1/routes.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+from collections.abc import Callable
 from typing import Any, TypeVar
 
 from fastapi import APIRouter, Depends, HTTPException, Query, status
@@ -158,6 +159,18 @@ def _ensure_assignment_workflow(
     *,
     tenant_id: str,
 ) -> None:
+    _ensure_assignment_shape(item)
+    function = _get_tenant_row(session, OrganizationFunction, item.function_id, tenant_id, "Organization function")
+    base = _assignment_source_assignment(session, item, tenant_id=tenant_id)
+    _ensure_assignment_source_rules(
+        item,
+        function=function,
+        base=base,
+        account_linked_to_identity=lambda identity_id, account_id: _account_linked_to_identity(session, identity_id, account_id),
+    )
+
+
+def _ensure_assignment_shape(item: IdmOrganizationFunctionAssignment) -> None:
     if item.source not in ASSIGNMENT_SOURCES:
         raise _invalid("Assignment source is not supported.")
     if item.valid_from is not None and item.valid_until is not None and item.valid_until <= item.valid_from:
@@ -165,43 +178,81 @@ def _ensure_assignment_workflow(
     if item.delegated_from_assignment_id is not None and item.delegated_from_assignment_id == item.id:
         raise _invalid("A function assignment cannot delegate from itself.")
 
-    function = _get_tenant_row(session, OrganizationFunction, item.function_id, tenant_id, "Organization function")
-    base: IdmOrganizationFunctionAssignment | None = None
-    if item.delegated_from_assignment_id is not None:
-        base = _get_tenant_row(session, IdmOrganizationFunctionAssignment, item.delegated_from_assignment_id, tenant_id, "Delegated function assignment")
-        if not base.is_active:
-            raise _invalid("Delegation source assignment must be active.")
-        if base.function_id != item.function_id:
-            raise _invalid("Delegated and acting-for assignments must use the same organization function as the source assignment.")
 
+def _assignment_source_assignment(
+    session: Session,
+    item: IdmOrganizationFunctionAssignment,
+    *,
+    tenant_id: str,
+) -> IdmOrganizationFunctionAssignment | None:
+    if item.delegated_from_assignment_id is None:
+        return None
+    base = _get_tenant_row(session, IdmOrganizationFunctionAssignment, item.delegated_from_assignment_id, tenant_id, "Delegated function assignment")
+    if not base.is_active:
+        raise _invalid("Delegation source assignment must be active.")
+    if base.function_id != item.function_id:
+        raise _invalid("Delegated and acting-for assignments must use the same organization function as the source assignment.")
+    return base
+
+
+def _ensure_assignment_source_rules(
+    item: IdmOrganizationFunctionAssignment,
+    *,
+    function: OrganizationFunction,
+    base: IdmOrganizationFunctionAssignment | None,
+    account_linked_to_identity: Callable[[str, str], bool],
+) -> None:
     if item.source == "delegated":
-        if base is None:
-            raise _invalid("Delegated assignments require a source assignment.")
-        if not function.delegable:
-            raise _invalid("This organization function does not allow delegation.")
-        if item.acting_for_account_id is not None:
-            raise _invalid("Delegated assignments cannot set an acting-for account.")
-        if item.identity_id == base.identity_id and (item.account_id or "") == (base.account_id or ""):
-            raise _invalid("A delegated assignment must target another identity or account.")
-    elif item.source == "acting_for":
-        if base is None:
-            raise _invalid("Acting-for assignments require a source assignment.")
-        if not function.act_in_place_allowed:
-            raise _invalid("This organization function does not allow acting in place.")
-        if item.acting_for_account_id is None:
-            raise _invalid("Acting-for assignments require an acting-for account.")
-        if base.account_id is not None:
-            if item.acting_for_account_id != base.account_id:
-                raise _invalid("Acting-for account must match the source assignment account.")
-        elif not _account_linked_to_identity(session, base.identity_id, item.acting_for_account_id):
-            raise _invalid("Acting-for account must belong to the source assignment identity.")
-        if item.account_id == item.acting_for_account_id:
-            raise _invalid("The acting account and acting-for account must be different.")
-    else:
-        if item.delegated_from_assignment_id is not None:
-            raise _invalid("Only delegated or acting-for assignments can reference a source assignment.")
-        if item.acting_for_account_id is not None:
-            raise _invalid("Only acting-for assignments can set an acting-for account.")
+        _ensure_delegated_assignment(item, function=function, base=base)
+        return
+    if item.source == "acting_for":
+        _ensure_acting_for_assignment(item, function=function, base=base, account_linked_to_identity=account_linked_to_identity)
+        return
+    _ensure_direct_assignment_shape(item)
+
+
+def _ensure_delegated_assignment(
+    item: IdmOrganizationFunctionAssignment,
+    *,
+    function: OrganizationFunction,
+    base: IdmOrganizationFunctionAssignment | None,
+) -> None:
+    if base is None:
+        raise _invalid("Delegated assignments require a source assignment.")
+    if not function.delegable:
+        raise _invalid("This organization function does not allow delegation.")
+    if item.acting_for_account_id is not None:
+        raise _invalid("Delegated assignments cannot set an acting-for account.")
+    if item.identity_id == base.identity_id and (item.account_id or "") == (base.account_id or ""):
+        raise _invalid("A delegated assignment must target another identity or account.")
+
+
+def _ensure_acting_for_assignment(
+    item: IdmOrganizationFunctionAssignment,
+    *,
+    function: OrganizationFunction,
+    base: IdmOrganizationFunctionAssignment | None,
+    account_linked_to_identity: Callable[[str, str], bool],
+) -> None:
+    if base is None:
+        raise _invalid("Acting-for assignments require a source assignment.")
+    if not function.act_in_place_allowed:
+        raise _invalid("This organization function does not allow acting in place.")
+    if item.acting_for_account_id is None:
+        raise _invalid("Acting-for assignments require an acting-for account.")
+    if base.account_id is not None and item.acting_for_account_id != base.account_id:
+        raise _invalid("Acting-for account must match the source assignment account.")
+    if base.account_id is None and not account_linked_to_identity(base.identity_id, item.acting_for_account_id):
+        raise _invalid("Acting-for account must belong to the source assignment identity.")
+    if item.account_id == item.acting_for_account_id:
+        raise _invalid("The acting account and acting-for account must be different.")
+
+
+def _ensure_direct_assignment_shape(item: IdmOrganizationFunctionAssignment) -> None:
+    if item.delegated_from_assignment_id is not None:
+        raise _invalid("Only delegated or acting-for assignments can reference a source assignment.")
+    if item.acting_for_account_id is not None:
+        raise _invalid("Only acting-for assignments can set an acting-for account.")
 
 
 def _requires_assignment_change_request(session: Session, tenant_id: str) -> bool: