Govern hierarchical View projections

2026-07-31 17:55:35 +02:00
parent 798138ef7d
commit 84acc34f08
7 changed files with 1056 additions and 0 deletions
@@ -34,6 +34,13 @@ from govoplan_policy.backend.definition_policy_service import (
    save_definition_policy,
 )
 from govoplan_policy.backend.policy_overrides import PolicyOverrideError
+from govoplan_policy.backend.view_policy_service import (
+    ViewPolicyError,
+    remove_view_policy,
+    save_view_policy,
+    view_policy_response_payload,
+    view_policy_state,
+)

 from .schemas import (
    DefinitionPolicyScopeRequest,
@@ -45,6 +52,8 @@ from .schemas import (
    PrivacyRetentionPolicySimulationResponse,
    RetentionRunRequest,
    RetentionRunResponse,
+    ViewPolicyScopeRequest,
+    ViewPolicyScopeResponse,
 )

 router = APIRouter(prefix="/admin", tags=["admin"])
@@ -305,6 +314,214 @@ def delete_definition_policy_route(
        ) from exc


+def _view_policy_response(
+    *,
+    scope_type: str,
+    scope_id: str | None,
+    state,
+) -> ViewPolicyScopeResponse:
+    return ViewPolicyScopeResponse(
+        scope_type=scope_type,
+        scope_id=scope_id,
+        **view_policy_response_payload(state),
+    )
+
+
+@router.get(
+    "/view-policies/{scope_type}",
+    response_model=ViewPolicyScopeResponse,
+)
+def read_view_policy(
+    scope_type: str,
+    scope_id: str | None = Query(default=None),
+    session: Session = Depends(get_session),
+    principal: ApiPrincipal = Depends(get_api_principal),
+):
+    clean_scope = scope_type.strip().casefold()
+    _require_privacy_policy_read(principal, clean_scope)
+    try:
+        state = view_policy_state(
+            session,
+            tenant_id=principal.tenant_id,
+            scope_type=clean_scope,
+            scope_id=scope_id,
+        )
+        return _view_policy_response(
+            scope_type=clean_scope,
+            scope_id=scope_id,
+            state=state,
+        )
+    except (ViewPolicyError, PolicyOverrideError) as exc:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail=str(exc),
+        ) from exc
+
+
+@router.put(
+    "/view-policies/{scope_type}",
+    response_model=ViewPolicyScopeResponse,
+)
+def write_view_policy(
+    scope_type: str,
+    payload: ViewPolicyScopeRequest,
+    scope_id: str | None = Query(default=None),
+    session: Session = Depends(get_session),
+    principal: ApiPrincipal = Depends(get_api_principal),
+):
+    clean_scope = scope_type.strip().casefold()
+    _require_privacy_policy_write(principal, clean_scope)
+    policy_value = payload.policy.model_dump(mode="json", exclude_none=True)
+    try:
+        before = view_policy_state(
+            session,
+            tenant_id=principal.tenant_id,
+            scope_type=clean_scope,
+            scope_id=scope_id,
+        )
+        if clean_scope == "system":
+            approval = ensure_configuration_change_allowed(
+                session,
+                key="view_policy",
+                value=policy_value,
+                actor_user_id=principal.user.id,
+                actor_scopes=tuple(principal.scopes),
+                change_request_id=payload.change_request_id,
+                target={"scope_type": clean_scope},
+            )
+        else:
+            approval = None
+        state = save_view_policy(
+            session,
+            tenant_id=principal.tenant_id,
+            scope_type=clean_scope,
+            scope_id=scope_id,
+            policy=policy_value,
+            actor_id=principal.user.id,
+        )
+        if clean_scope == "system":
+            record_configuration_change_applied(
+                session,
+                key="view_policy",
+                before_value=view_policy_response_payload(before)["policy"],
+                after_value=policy_value,
+                actor_user_id=principal.user.id,
+                approval=approval,
+                target={"scope_type": clean_scope},
+                audit_event="view_policy.updated",
+            )
+        audit_from_principal(
+            session,
+            principal,
+            action="view_policy.updated",
+            scope="system" if clean_scope == "system" else "tenant",
+            object_type="view_policy",
+            object_id=f"{clean_scope}:{scope_id or ''}",
+            details={
+                "scope_type": clean_scope,
+                "scope_id": scope_id,
+                "fields": sorted(policy_value),
+            },
+        )
+        session.commit()
+        return _view_policy_response(
+            scope_type=clean_scope,
+            scope_id=scope_id,
+            state=state,
+        )
+    except ConfigurationControlError as exc:
+        session.rollback()
+        raise _configuration_control_http_error(exc) from exc
+    except (ViewPolicyError, PolicyOverrideError) as exc:
+        session.rollback()
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail=str(exc),
+        ) from exc
+
+
+@router.delete(
+    "/view-policies/{scope_type}",
+    response_model=ViewPolicyScopeResponse,
+)
+def delete_view_policy_route(
+    scope_type: str,
+    scope_id: str | None = Query(default=None),
+    change_request_id: str | None = Query(default=None),
+    session: Session = Depends(get_session),
+    principal: ApiPrincipal = Depends(get_api_principal),
+):
+    clean_scope = scope_type.strip().casefold()
+    _require_privacy_policy_write(principal, clean_scope)
+    try:
+        before = view_policy_state(
+            session,
+            tenant_id=principal.tenant_id,
+            scope_type=clean_scope,
+            scope_id=scope_id,
+        )
+        if clean_scope == "system":
+            approval = ensure_configuration_change_allowed(
+                session,
+                key="view_policy",
+                value={},
+                actor_user_id=principal.user.id,
+                actor_scopes=tuple(principal.scopes),
+                change_request_id=change_request_id,
+                target={"scope_type": clean_scope},
+            )
+        else:
+            approval = None
+        removed = remove_view_policy(
+            session,
+            tenant_id=principal.tenant_id,
+            scope_type=clean_scope,
+            scope_id=scope_id,
+        )
+        if removed:
+            if clean_scope == "system":
+                record_configuration_change_applied(
+                    session,
+                    key="view_policy",
+                    before_value=view_policy_response_payload(before)["policy"],
+                    after_value={},
+                    actor_user_id=principal.user.id,
+                    approval=approval,
+                    target={"scope_type": clean_scope},
+                    audit_event="view_policy.removed",
+                )
+            audit_from_principal(
+                session,
+                principal,
+                action="view_policy.removed",
+                scope="system" if clean_scope == "system" else "tenant",
+                object_type="view_policy",
+                object_id=f"{clean_scope}:{scope_id or ''}",
+                details={"scope_type": clean_scope, "scope_id": scope_id},
+            )
+        session.commit()
+        state = view_policy_state(
+            session,
+            tenant_id=principal.tenant_id,
+            scope_type=clean_scope,
+            scope_id=scope_id,
+        )
+        return _view_policy_response(
+            scope_type=clean_scope,
+            scope_id=scope_id,
+            state=state,
+        )
+    except ConfigurationControlError as exc:
+        session.rollback()
+        raise _configuration_control_http_error(exc) from exc
+    except (ViewPolicyError, PolicyOverrideError) as exc:
+        session.rollback()
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail=str(exc),
+        ) from exc
+
+
@router.get(
    "/privacy-retention/policies/{scope_type}",
    response_model=PrivacyRetentionPolicyScopeResponse,