feat: preview governed policy impact

src/govoplan_policy/backend/view_policy_service.py

@@ -85,6 +85,43 @@ def save_view_policy(
     policy: object,
     actor_id: str | None,
 ) -> ViewPolicyState:
+    clean_policy, _before = validate_view_policy_change(
+        session,
+        tenant_id=tenant_id,
+        scope_type=scope_type,
+        scope_id=scope_id,
+        policy=policy,
+    )
+    set_policy_override(
+        session,
+        policy_family="view",
+        target_key="*",
+        tenant_id=tenant_id,
+        scope_type=scope_type,
+        scope_id=scope_id,
+        policy={
+            key: list(value) if isinstance(value, tuple) else value
+            for key, value in clean_policy.items()
+        },
+        actor_id=actor_id,
+    )
+    _clear_resolution_cache(session)
+    return view_policy_state(
+        session,
+        tenant_id=tenant_id,
+        scope_type=scope_type,
+        scope_id=scope_id,
+    )
+
+
+def validate_view_policy_change(
+    session: Session,
+    *,
+    tenant_id: str,
+    scope_type: str,
+    scope_id: str | None,
+    policy: object,
+) -> tuple[dict[str, bool | tuple[str, ...]], ViewPolicyState]:
     clean_policy, malformed = validate_view_policy(policy)
     if malformed:
         raise ViewPolicyError("View policy fields have invalid names or values")
@@ -115,26 +152,7 @@ def save_view_policy(
             "Lower-scope View policy cannot broaden parent restrictions: "
             + ", ".join(broadened)
         )
-    set_policy_override(
-        session,
-        policy_family="view",
-        target_key="*",
-        tenant_id=tenant_id,
-        scope_type=scope_type,
-        scope_id=scope_id,
-        policy={
-            key: list(value) if isinstance(value, tuple) else value
-            for key, value in clean_policy.items()
-        },
-        actor_id=actor_id,
-    )
-    _clear_resolution_cache(session)
-    return view_policy_state(
-        session,
-        tenant_id=tenant_id,
-        scope_type=scope_type,
-        scope_id=scope_id,
-    )
+    return clean_policy, before
 
 
 def remove_view_policy(
@@ -239,6 +257,7 @@ __all__ = [
     "ViewPolicyState",
     "remove_view_policy",
     "save_view_policy",
+    "validate_view_policy_change",
     "view_policy_response_payload",
     "view_policy_state",
 ]