feat: govern campaign archive encryption

2026-08-20 12:12:14 +02:00
parent 8fcc12dbb2
commit be5e3a7d72
11 changed files with 1070 additions and 5 deletions
@@ -34,6 +34,11 @@ from govoplan_policy.backend.definition_policy_service import (
    save_definition_policy,
 )
 from govoplan_policy.backend.policy_overrides import PolicyOverrideError
+from govoplan_policy.backend.campaign_archive_encryption import (
+    CampaignArchiveEncryptionPolicyError,
+    campaign_archive_encryption_policy_state,
+    save_campaign_archive_encryption_policy,
+)
 from govoplan_policy.backend.view_policy_service import (
    ViewPolicyError,
    remove_view_policy,
@@ -43,6 +48,8 @@ from govoplan_policy.backend.view_policy_service import (
 )

 from .schemas import (
+    CampaignArchiveEncryptionPolicyScopeRequest,
+    CampaignArchiveEncryptionPolicyScopeResponse,
    DefinitionPolicyScopeRequest,
    DefinitionPolicyScopeResponse,
    PrivacyRetentionPolicyExplainResponse,
@@ -87,6 +94,150 @@ def _configuration_control_http_error(exc: ConfigurationControlError) -> HTTPExc
    )


+def _archive_encryption_policy_response(
+    *,
+    scope_type: str,
+    scope_id: str | None,
+    state,
+) -> CampaignArchiveEncryptionPolicyScopeResponse:
+    row = state.row
+    return CampaignArchiveEncryptionPolicyScopeResponse(
+        scope_type=scope_type,
+        scope_id=scope_id,
+        id=row.id if row else None,
+        revision=row.revision if row else None,
+        policy=dict(row.policy) if row and isinstance(row.policy, dict) else {},
+        effective_policy=state.effective.to_dict(),
+        parent_policy=state.parent.to_dict(),
+    )
+
+
+@router.get(
+    "/campaign-archive-encryption/policies/{scope_type}",
+    response_model=CampaignArchiveEncryptionPolicyScopeResponse,
+)
+def read_campaign_archive_encryption_policy(
+    scope_type: str,
+    scope_id: str | None = Query(default=None),
+    owner_type: str | None = Query(default=None),
+    owner_id: str | None = Query(default=None),
+    session: Session = Depends(get_session),
+    principal: ApiPrincipal = Depends(get_api_principal),
+):
+    _require_permission(principal, "admin:policies:read")
+    clean_scope = scope_type.strip().casefold()
+    try:
+        state = campaign_archive_encryption_policy_state(
+            session,
+            tenant_id=principal.tenant_id,
+            scope_type=clean_scope,
+            scope_id=scope_id,
+            owner_type=owner_type,
+            owner_id=owner_id,
+        )
+        return _archive_encryption_policy_response(
+            scope_type=clean_scope,
+            scope_id=scope_id,
+            state=state,
+        )
+    except (CampaignArchiveEncryptionPolicyError, PolicyOverrideError) as exc:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail=str(exc),
+        ) from exc
+
+
+@router.put(
+    "/campaign-archive-encryption/policies/{scope_type}",
+    response_model=CampaignArchiveEncryptionPolicyScopeResponse,
+)
+def write_campaign_archive_encryption_policy(
+    scope_type: str,
+    payload: CampaignArchiveEncryptionPolicyScopeRequest,
+    scope_id: str | None = Query(default=None),
+    owner_type: str | None = Query(default=None),
+    owner_id: str | None = Query(default=None),
+    session: Session = Depends(get_session),
+    principal: ApiPrincipal = Depends(get_api_principal),
+):
+    _require_permission(principal, "admin:policies:write")
+    clean_scope = scope_type.strip().casefold()
+    policy_value = payload.policy.model_dump(mode="json", exclude_none=True)
+    try:
+        before = campaign_archive_encryption_policy_state(
+            session,
+            tenant_id=principal.tenant_id,
+            scope_type=clean_scope,
+            scope_id=scope_id,
+            owner_type=owner_type,
+            owner_id=owner_id,
+        )
+        if clean_scope == "system":
+            approval = ensure_configuration_change_allowed(
+                session,
+                key="campaign_archive_encryption_policy",
+                value=policy_value,
+                actor_user_id=principal.user.id,
+                actor_scopes=tuple(principal.scopes),
+                change_request_id=payload.change_request_id,
+                target={"scope_type": clean_scope},
+            )
+        else:
+            approval = None
+        state = save_campaign_archive_encryption_policy(
+            session,
+            tenant_id=principal.tenant_id,
+            scope_type=clean_scope,
+            scope_id=scope_id,
+            owner_type=owner_type,
+            owner_id=owner_id,
+            policy=policy_value,
+            actor_id=principal.user.id,
+        )
+        if clean_scope == "system":
+            record_configuration_change_applied(
+                session,
+                key="campaign_archive_encryption_policy",
+                before_value=(dict(before.row.policy) if before.row else {}),
+                after_value=policy_value,
+                actor_user_id=principal.user.id,
+                approval=approval,
+                target={"scope_type": clean_scope},
+                audit_event="campaign_archive_encryption_policy.updated",
+            )
+        audit_from_principal(
+            session,
+            principal,
+            action="campaign_archive_encryption_policy.updated",
+            scope="system" if clean_scope == "system" else "tenant",
+            object_type="campaign_archive_encryption_policy",
+            object_id=f"{clean_scope}:{scope_id or ''}",
+            details={
+                "scope_type": clean_scope,
+                "scope_id": scope_id,
+                "owner_type": owner_type,
+                "owner_id": owner_id,
+                "policy_hash": state.effective.policy_hash,
+                "fields": sorted(policy_value),
+            },
+        )
+        session.commit()
+        return _archive_encryption_policy_response(
+            scope_type=clean_scope,
+            scope_id=scope_id,
+            state=state,
+        )
+    except ConfigurationControlError as exc:
+        session.rollback()
+        raise _configuration_control_http_error(exc) from exc
+    except (CampaignArchiveEncryptionPolicyError, PolicyOverrideError) as exc:
+        session.rollback()
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail=str(exc),
+        ) from exc
+
+
 def _definition_policy_response(
    *,
    module_id: str,