feat(idm): administer typed identity relationships

tests/test_interface_documentation_contract.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import unittest
 
 from govoplan_idm.backend.manifest import manifest
+from govoplan_idm.backend.api.v1.routes import ORGANIZATION_IDENTITY_READ_SCOPES
 
 
 class IdmInterfaceDocumentationContractTests(unittest.TestCase):
@@ -24,6 +25,7 @@ class IdmInterfaceDocumentationContractTests(unittest.TestCase):
         self.assertIn("idm.workflow.assign-function-to-identity", topics)
         self.assertIn("idm.reference.assignment-governance", topics)
         self.assertIn("idm.reference.fields-and-consequences", topics)
+        self.assertIn("idm.reference.typed-relationships", topics)
 
         workflow = topics["idm.workflow.assign-function-to-identity"]
         self.assertIn("idm.blocker.permission", workflow.metadata["help_contexts"])
@@ -33,7 +35,30 @@ class IdmInterfaceDocumentationContractTests(unittest.TestCase):
         self.assertIn("idm.field.acting-for", reference.metadata["help_contexts"])
         self.assertIn("deactivate_or_expire", reference.metadata["consequence_classes"])
 
+        relationships = topics["idm.reference.typed-relationships"]
+        self.assertEqual(
+            {
+                "title",
+                "summary",
+                "body",
+            },
+            set(relationships.translations["de"]),
+        )
+        self.assertIn(
+            "idm.relationships.field.revocation-reason",
+            relationships.metadata["help_contexts"],
+        )
+        self.assertIn(
+            "idm.typed-groups.action.resolve-memberships",
+            relationships.metadata["help_contexts"],
+        )
+        self.assertIn("Revocation immediately", relationships.metadata["consequences"][2])
+        self.assertIn("Access permissions remain unchanged", relationships.metadata["verification"])
+
+    def test_relationship_writers_may_use_identity_search_selectors(self) -> None:
+        self.assertIn("idm:relationship:write", ORGANIZATION_IDENTITY_READ_SCOPES)
+        self.assertNotIn("idm:relationship:read", ORGANIZATION_IDENTITY_READ_SCOPES)
+
 
 if __name__ == "__main__":
     unittest.main()
-