feat: govern selected-user access diagnostics

tests/test_access_explanation_subjects.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+import unittest
+
+from govoplan_core.core.access import PrincipalRef
+from govoplan_policy.backend.access_explanation_subjects import (
+    ACCESS_EXPLANATION_SUBJECT_SCOPE,
+    AccessExplanationSubjectPolicyProvider,
+)
+
+
+class AccessExplanationSubjectPolicyTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.provider = AccessExplanationSubjectPolicyProvider()
+
+    def test_defaults_to_current_user_without_permission(self) -> None:
+        decision = self.provider.decide_subject_selection(
+            object(),
+            PrincipalRef(
+                account_id="account-1",
+                membership_id="user-1",
+                tenant_id="tenant-1",
+            ),
+            tenant_id="tenant-1",
+        )
+
+        self.assertFalse(decision.allow_other_users)
+        self.assertEqual(ACCESS_EXPLANATION_SUBJECT_SCOPE, decision.required_scope)
+        self.assertEqual("current_user", decision.provenance["mode"])
+
+    def test_permission_enables_cross_user_diagnostics(self) -> None:
+        decision = self.provider.decide_subject_selection(
+            object(),
+            PrincipalRef(
+                account_id="account-1",
+                membership_id="user-1",
+                tenant_id="tenant-1",
+                scopes=frozenset({ACCESS_EXPLANATION_SUBJECT_SCOPE}),
+            ),
+            tenant_id="tenant-1",
+        )
+
+        self.assertTrue(decision.allow_other_users)
+        self.assertEqual("cross_user", decision.provenance["mode"])
+
+    def test_never_crosses_the_active_tenant(self) -> None:
+        decision = self.provider.decide_subject_selection(
+            object(),
+            PrincipalRef(
+                account_id="account-1",
+                membership_id="user-1",
+                tenant_id="tenant-1",
+                scopes=frozenset({ACCESS_EXPLANATION_SUBJECT_SCOPE}),
+            ),
+            tenant_id="tenant-2",
+        )
+
+        self.assertFalse(decision.allow_other_users)
+        self.assertEqual("policy.tenant_boundary", decision.source)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_policy_module_contract.py

@@ -11,6 +11,7 @@ from govoplan_core.core.policy import (
     CAPABILITY_POLICY_SCHEDULING_PARTICIPANT_PRIVACY,
     CAPABILITY_POLICY_VIEW_GOVERNANCE,
 )
+from govoplan_core.core.access import CAPABILITY_POLICY_ACCESS_EXPLANATION_SUBJECTS
 from govoplan_core.core.distribution_lists import (
     CAPABILITY_POLICY_DISTRIBUTION_CHANNELS,
 )
@@ -54,6 +55,7 @@ class PolicyModuleContractTests(unittest.TestCase):
                 CAPABILITY_POLICY_REPORTING_GOVERNANCE,
                 CAPABILITY_POLICY_SCHEDULING_PARTICIPANT_PRIVACY,
                 CAPABILITY_POLICY_VIEW_GOVERNANCE,
+                CAPABILITY_POLICY_ACCESS_EXPLANATION_SUBJECTS,
             },
             set(manifest.capability_factories),
         )