GovOPlaN/govoplan-policy
1
0
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity

Clarify policy hierarchy traversal

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-21 03:16:24 +02:00
parent b68c3f0473
commit 2bf9e15f0f
1 changed files with 17 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
src/govoplan_policy/backend/hierarchy.py
View File

@@ -66,21 +66,27 @@ def validate_hierarchical_policy_patch(
relock_message: Callable[[str], str] | None = None, relock_message: Callable[[str], str] | None = None,
) -> tuple[PolicyValidationIssue, ...]: ) -> tuple[PolicyValidationIssue, ...]:
issues: list[PolicyValidationIssue] = [] issues: list[PolicyValidationIssue] = []
lock_message = locked_field_message or (lambda field: f"{field} is locked by the parent policy.") lock_message = locked_field_message or (lambda field_name: f"{field_name} is locked by the parent policy.")
reenable_message = relock_message or (lambda field: f"{field} limiting cannot be re-enabled below a parent policy lock.") reenable_message = relock_message or (
lambda field_name: f"{field_name} limiting cannot be re-enabled below a parent policy lock."
)
for field in field_keys: for field_name in field_keys:
if field in patch and patch.get(field) is not None and not parent_allow_lower_level_limits.get(field, True): if (
field_name in patch
and patch.get(field_name) is not None
and not parent_allow_lower_level_limits.get(field_name, True)
):
issues.append(PolicyValidationIssue( issues.append(PolicyValidationIssue(
code="field_locked_by_parent", code="field_locked_by_parent",
field=field, field=field_name,
message=lock_message(field), message=lock_message(field_name),
)) ))
patch_allow = patch.get("allow_lower_level_limits") patch_allow = patch.get("allow_lower_level_limits")
if isinstance(patch_allow, Mapping): if isinstance(patch_allow, Mapping):
for field, allowed in patch_allow.items(): for field_name, allowed in patch_allow.items():
clean_field = str(field) clean_field = str(field_name)
if bool(allowed) and not parent_allow_lower_level_limits.get(clean_field, True): if bool(allowed) and not parent_allow_lower_level_limits.get(clean_field, True):
issues.append(PolicyValidationIssue( issues.append(PolicyValidationIssue(
code="lower_level_limit_locked_by_parent", code="lower_level_limit_locked_by_parent",
@@ -125,9 +131,9 @@ def simulate_hierarchical_policy_change(
relock_message=relock_message, relock_message=relock_message,
) )
changed_fields = tuple( changed_fields = tuple(
field field_name
for field in (*field_keys, "allow_lower_level_limits") for field_name in (*field_keys, "allow_lower_level_limits")
if field in patch and current_policy.get(field) != patch.get(field) if field_name in patch and current_policy.get(field_name) != patch.get(field_name)
) )
allowed = not any(issue.severity == "blocker" for issue in issues) allowed = not any(issue.severity == "blocker" for issue in issues)
decision = PolicyDecision( decision = PolicyDecision(