Implement governed function assignment workflows

2026-07-31 19:40:27 +02:00
parent f025b0c25b
commit c14719d55a
16 changed files with 4079 additions and 27 deletions
@@ -65,6 +65,10 @@ class OrganizationFunctionAssignmentCreateRequest(BaseModel):
    is_active: bool = True
    settings: dict[str, Any] = Field(default_factory=dict)
    change_request_id: str | None = None
+    governance_override_reason: str | None = Field(default=None, max_length=4_000)
+    governance_override_evidence: list[str] = Field(
+        default_factory=list, max_length=100
+    )


 class OrganizationFunctionAssignmentUpdateRequest(BaseModel):
@@ -80,6 +84,10 @@ class OrganizationFunctionAssignmentUpdateRequest(BaseModel):
    is_active: bool | None = None
    settings: dict[str, Any] | None = None
    change_request_id: str | None = None
+    governance_override_reason: str | None = Field(default=None, max_length=4_000)
+    governance_override_evidence: list[str] = Field(
+        default_factory=list, max_length=100
+    )


 class IdmSettingsItem(BaseModel):
@@ -97,3 +105,120 @@ class IdmSettingsUpdateRequest(BaseModel):
    audit_detail_level: AuditDetailLevel | None = None
    change_retention_days: int | None = Field(default=None, ge=0)
    settings: dict[str, Any] | None = None
+
+
+FunctionAssignmentChangeKind = Literal["request", "grant"]
+FunctionAssignmentChangeAction = Literal[
+    "approve",
+    "reject",
+    "accept",
+    "request_changes",
+    "respond",
+    "withdraw",
+    "recover",
+]
+
+
+class FunctionAssignmentChangeCreateRequest(BaseModel):
+    kind: FunctionAssignmentChangeKind
+    function_id: str = Field(min_length=1, max_length=36)
+    candidate_identity_id: str = Field(min_length=1, max_length=36)
+    candidate_account_id: str | None = Field(default=None, max_length=36)
+    justification: str = Field(min_length=1, max_length=8_000)
+    evidence: list[str] = Field(default_factory=list, max_length=100)
+    requested_valid_from: datetime | None = None
+    requested_valid_until: datetime | None = None
+    applies_to_subunits: bool = False
+    assignment_source: Literal["governance", "delegated"] = "governance"
+    represented_assignment_id: str | None = Field(default=None, max_length=36)
+    idempotency_key: str = Field(min_length=1, max_length=255)
+    metadata: dict[str, Any] = Field(default_factory=dict)
+
+
+class FunctionAssignmentChangeActionRequest(BaseModel):
+    action: FunctionAssignmentChangeAction
+    base_revision: int = Field(ge=1)
+    comment: str | None = Field(default=None, max_length=4_000)
+    evidence: list[str] = Field(default_factory=list, max_length=100)
+
+
+class FunctionAssignmentChangeEventItem(BaseModel):
+    id: str
+    sequence: int
+    action: str
+    from_state: str | None = None
+    to_state: str
+    actor_account_id: str | None = None
+    actor_identity_id: str | None = None
+    actor_assignment_id: str | None = None
+    comment: str | None = None
+    evidence: list[str]
+    policy_decision: dict[str, Any]
+    workflow_step_id: str | None = None
+    details: dict[str, Any]
+    created_at: datetime
+
+
+class FunctionAssignmentChangeItem(BaseModel):
+    id: str
+    tenant_id: str
+    kind: FunctionAssignmentChangeKind
+    state: str
+    profile: str
+    function_id: str
+    organization_unit_id: str
+    candidate_identity_id: str
+    candidate_account_id: str | None = None
+    initiator_account_id: str
+    initiator_identity_id: str | None = None
+    represented_assignment_id: str | None = None
+    justification: str
+    evidence: list[str]
+    requested_valid_from: datetime | None = None
+    requested_valid_until: datetime | None = None
+    applies_to_subunits: bool
+    assignment_source: str
+    required_steps: list[str]
+    completed_steps: list[str]
+    policy_decision: dict[str, Any]
+    workflow_definition_id: str | None = None
+    workflow_definition_revision_id: str | None = None
+    workflow_definition_revision: int | None = None
+    workflow_definition_hash: str | None = None
+    workflow_instance_id: str | None = None
+    workflow_current_step_id: str | None = None
+    resulting_assignment_id: str | None = None
+    expires_at: datetime | None = None
+    outcome_reason: str | None = None
+    resource_revision: int
+    etag: str
+    metadata: dict[str, Any]
+    events: list[FunctionAssignmentChangeEventItem] = Field(default_factory=list)
+    available_actions: list[str] = Field(default_factory=list)
+    availability_reason: str | None = None
+    created_at: datetime
+    updated_at: datetime
+
+
+class FunctionAssignmentChangeList(BaseModel):
+    changes: list[FunctionAssignmentChangeItem]
+    total: int
+    page: int
+    page_size: int
+    pages: int
+
+
+class FunctionAssignmentCapabilityItem(BaseModel):
+    kind: FunctionAssignmentChangeKind
+    function_id: str
+    available: bool
+    reason: str | None = None
+    profile: str = "unavailable"
+    required_steps: list[str] = Field(default_factory=list)
+    requirements: list[str] = Field(default_factory=list)
+    authority_function_id: str | None = None
+    evidence_required: bool = False
+    recipient_acceptance_required: bool = False
+    maximum_validity_days: int | None = None
+    workflow_available: bool = False
+    policy_available: bool = False