269 lines
13 KiB
Python
269 lines
13 KiB
Python
from __future__ import annotations
|
|
|
|
from typing import Any
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, Query, status
|
|
from sqlalchemy.orm import Session
|
|
|
|
from govoplan_access.auth import ApiPrincipal, get_api_principal, has_scope, require_scope
|
|
from govoplan_core.audit.logging import audit_from_principal
|
|
from govoplan_core.core.configuration_control import (
|
|
ConfigurationControlError,
|
|
ensure_configuration_change_allowed,
|
|
record_configuration_change_applied,
|
|
)
|
|
from govoplan_core.core.policy import PolicyDecision, PolicySourceStep
|
|
from govoplan_core.db.session import get_session
|
|
from govoplan_core.privacy.retention import (
|
|
PrivacyPolicyError,
|
|
RETENTION_POLICY_FIELD_KEYS,
|
|
apply_retention_policy,
|
|
effective_privacy_policy,
|
|
effective_privacy_policy_sources,
|
|
get_privacy_policy_for_scope,
|
|
parent_privacy_policy,
|
|
parent_privacy_policy_sources,
|
|
set_privacy_policy_for_scope,
|
|
)
|
|
|
|
from .schemas import (
|
|
PrivacyRetentionPolicyExplainResponse,
|
|
PrivacyRetentionPolicyItem,
|
|
PrivacyRetentionPolicyScopeRequest,
|
|
PrivacyRetentionPolicyScopeResponse,
|
|
RetentionRunRequest,
|
|
RetentionRunResponse,
|
|
)
|
|
|
|
router = APIRouter(prefix="/admin", tags=["admin"])
|
|
|
|
|
|
def _require_permission(principal: ApiPrincipal, scope: str) -> None:
|
|
if not has_scope(principal, scope):
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=f"Missing scope: {scope}")
|
|
|
|
|
|
def _require_privacy_policy_read(principal: ApiPrincipal, scope_type: str) -> None:
|
|
if scope_type == "system":
|
|
_require_permission(principal, "system:settings:read")
|
|
else:
|
|
_require_permission(principal, "admin:policies:read")
|
|
|
|
|
|
def _require_privacy_policy_write(principal: ApiPrincipal, scope_type: str) -> None:
|
|
if scope_type == "system":
|
|
_require_permission(principal, "system:settings:write")
|
|
else:
|
|
_require_permission(principal, "admin:policies:write")
|
|
|
|
|
|
def _configuration_control_http_error(exc: ConfigurationControlError) -> HTTPException:
|
|
return HTTPException(
|
|
status_code=status.HTTP_409_CONFLICT,
|
|
detail={"code": exc.code, "message": str(exc), "plan": exc.plan},
|
|
)
|
|
|
|
|
|
@router.get("/privacy-retention/policies/{scope_type}", response_model=PrivacyRetentionPolicyScopeResponse)
|
|
def read_privacy_retention_policy(
|
|
scope_type: str,
|
|
scope_id: str | None = Query(default=None),
|
|
session: Session = Depends(get_session),
|
|
principal: ApiPrincipal = Depends(get_api_principal),
|
|
):
|
|
clean_scope = scope_type.strip().casefold()
|
|
_require_privacy_policy_read(principal, clean_scope)
|
|
try:
|
|
policy = get_privacy_policy_for_scope(session, tenant_id=principal.tenant_id, scope_type=clean_scope, scope_id=scope_id)
|
|
effective = _effective_privacy_policy_for_response(session, tenant_id=principal.tenant_id, scope_type=clean_scope, scope_id=scope_id)
|
|
parent = _parent_privacy_policy_for_response(session, tenant_id=principal.tenant_id, scope_type=clean_scope, scope_id=scope_id)
|
|
return PrivacyRetentionPolicyScopeResponse(
|
|
scope_type=clean_scope,
|
|
scope_id=scope_id,
|
|
policy=policy,
|
|
effective_policy=PrivacyRetentionPolicyItem.model_validate(effective.model_dump(mode="json")),
|
|
parent_policy=PrivacyRetentionPolicyItem.model_validate(parent.model_dump(mode="json")) if parent else None,
|
|
effective_policy_sources=_effective_privacy_policy_sources_for_response(session, tenant_id=principal.tenant_id, scope_type=clean_scope, scope_id=scope_id),
|
|
parent_policy_sources=_parent_privacy_policy_sources_for_response(session, tenant_id=principal.tenant_id, scope_type=clean_scope, scope_id=scope_id),
|
|
)
|
|
except PrivacyPolicyError as exc:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(exc)) from exc
|
|
|
|
|
|
@router.put("/privacy-retention/policies/{scope_type}", response_model=PrivacyRetentionPolicyScopeResponse)
|
|
def write_privacy_retention_policy(
|
|
scope_type: str,
|
|
payload: PrivacyRetentionPolicyScopeRequest,
|
|
scope_id: str | None = Query(default=None),
|
|
session: Session = Depends(get_session),
|
|
principal: ApiPrincipal = Depends(get_api_principal),
|
|
):
|
|
clean_scope = scope_type.strip().casefold()
|
|
_require_privacy_policy_write(principal, clean_scope)
|
|
policy_value = payload.policy.model_dump(mode="json", exclude_none=True)
|
|
before_value: dict[str, Any] | None = None
|
|
if clean_scope == "system":
|
|
before_value = get_privacy_policy_for_scope(session, tenant_id=principal.tenant_id, scope_type=clean_scope, scope_id=scope_id)
|
|
try:
|
|
approval = ensure_configuration_change_allowed(
|
|
session,
|
|
key="privacy_retention_policy",
|
|
value=policy_value,
|
|
actor_user_id=principal.user.id,
|
|
actor_scopes=tuple(principal.scopes),
|
|
change_request_id=payload.change_request_id,
|
|
target={"scope_type": clean_scope, "scope_id": scope_id},
|
|
)
|
|
except ConfigurationControlError as exc:
|
|
raise _configuration_control_http_error(exc) from exc
|
|
else:
|
|
approval = None
|
|
try:
|
|
policy = set_privacy_policy_for_scope(
|
|
session,
|
|
tenant_id=principal.tenant_id,
|
|
scope_type=clean_scope,
|
|
scope_id=scope_id,
|
|
policy=policy_value,
|
|
)
|
|
if clean_scope == "system":
|
|
record_configuration_change_applied(
|
|
session,
|
|
key="privacy_retention_policy",
|
|
before_value=before_value,
|
|
after_value=policy,
|
|
actor_user_id=principal.user.id,
|
|
approval=approval,
|
|
target={"scope_type": clean_scope, "scope_id": scope_id},
|
|
audit_event="privacy_retention.policy_updated",
|
|
)
|
|
audit_from_principal(
|
|
session,
|
|
principal,
|
|
action="privacy_retention.policy_updated",
|
|
scope="system" if clean_scope == "system" else "tenant",
|
|
object_type="privacy_retention_policy",
|
|
object_id=clean_scope if scope_id is None else f"{clean_scope}:{scope_id}",
|
|
details={"scope_type": clean_scope, "scope_id": scope_id},
|
|
)
|
|
session.commit()
|
|
effective = _effective_privacy_policy_for_response(session, tenant_id=principal.tenant_id, scope_type=clean_scope, scope_id=scope_id)
|
|
parent = _parent_privacy_policy_for_response(session, tenant_id=principal.tenant_id, scope_type=clean_scope, scope_id=scope_id)
|
|
return PrivacyRetentionPolicyScopeResponse(
|
|
scope_type=clean_scope,
|
|
scope_id=scope_id,
|
|
policy=policy,
|
|
effective_policy=PrivacyRetentionPolicyItem.model_validate(effective.model_dump(mode="json")),
|
|
parent_policy=PrivacyRetentionPolicyItem.model_validate(parent.model_dump(mode="json")) if parent else None,
|
|
effective_policy_sources=_effective_privacy_policy_sources_for_response(session, tenant_id=principal.tenant_id, scope_type=clean_scope, scope_id=scope_id),
|
|
parent_policy_sources=_parent_privacy_policy_sources_for_response(session, tenant_id=principal.tenant_id, scope_type=clean_scope, scope_id=scope_id),
|
|
)
|
|
except PrivacyPolicyError as exc:
|
|
session.rollback()
|
|
raise HTTPException(status_code=status.HTTP_422_UNPROCESSABLE_CONTENT, detail=str(exc)) from exc
|
|
|
|
|
|
@router.get("/privacy-retention/policies/{scope_type}/explain", response_model=PrivacyRetentionPolicyExplainResponse)
|
|
def explain_privacy_retention_policy(
|
|
scope_type: str,
|
|
scope_id: str | None = Query(default=None),
|
|
session: Session = Depends(get_session),
|
|
principal: ApiPrincipal = Depends(get_api_principal),
|
|
):
|
|
clean_scope = scope_type.strip().casefold()
|
|
_require_privacy_policy_read(principal, clean_scope)
|
|
try:
|
|
effective = _effective_privacy_policy_for_response(session, tenant_id=principal.tenant_id, scope_type=clean_scope, scope_id=scope_id)
|
|
parent = _parent_privacy_policy_for_response(session, tenant_id=principal.tenant_id, scope_type=clean_scope, scope_id=scope_id)
|
|
effective_sources = _effective_privacy_policy_sources_for_response(session, tenant_id=principal.tenant_id, scope_type=clean_scope, scope_id=scope_id)
|
|
parent_sources = _parent_privacy_policy_sources_for_response(session, tenant_id=principal.tenant_id, scope_type=clean_scope, scope_id=scope_id)
|
|
blocked_fields = _blocked_privacy_retention_fields(parent)
|
|
decision_sources = parent_sources or effective_sources
|
|
decision = PolicyDecision(
|
|
allowed=not blocked_fields,
|
|
reason="Parent retention policy locks lower-level changes." if blocked_fields else None,
|
|
source_path=tuple(PolicySourceStep.from_mapping(source) for source in decision_sources),
|
|
requirements=tuple(blocked_fields),
|
|
details={"blocked_fields": blocked_fields},
|
|
)
|
|
return PrivacyRetentionPolicyExplainResponse(
|
|
scope_type=clean_scope,
|
|
scope_id=scope_id,
|
|
decision=decision.to_dict(),
|
|
effective_policy=PrivacyRetentionPolicyItem.model_validate(effective.model_dump(mode="json")),
|
|
parent_policy=PrivacyRetentionPolicyItem.model_validate(parent.model_dump(mode="json")) if parent else None,
|
|
effective_policy_sources=effective_sources,
|
|
parent_policy_sources=parent_sources,
|
|
blocked_fields=blocked_fields,
|
|
)
|
|
except PrivacyPolicyError as exc:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(exc)) from exc
|
|
|
|
|
|
def _blocked_privacy_retention_fields(parent) -> list[str]:
|
|
if parent is None:
|
|
return []
|
|
payload = parent.model_dump(mode="json")
|
|
allow_lower_level_limits = payload.get("allow_lower_level_limits") or {}
|
|
return [key for key in RETENTION_POLICY_FIELD_KEYS if allow_lower_level_limits.get(key) is False]
|
|
|
|
|
|
def _parent_privacy_policy_sources_for_response(session: Session, *, tenant_id: str, scope_type: str, scope_id: str | None):
|
|
if scope_type == "system":
|
|
return []
|
|
return parent_privacy_policy_sources(session, tenant_id=tenant_id, scope_type=scope_type, scope_id=scope_id or (tenant_id if scope_type == "tenant" else None))
|
|
|
|
|
|
def _effective_privacy_policy_sources_for_response(session: Session, *, tenant_id: str, scope_type: str, scope_id: str | None):
|
|
if scope_type == "system":
|
|
return effective_privacy_policy_sources(session)
|
|
if scope_type == "tenant":
|
|
return effective_privacy_policy_sources(session, tenant_id=scope_id or tenant_id)
|
|
if scope_type == "campaign" and scope_id:
|
|
return effective_privacy_policy_sources(session, campaign_id=scope_id)
|
|
if scope_type == "user" and scope_id:
|
|
return effective_privacy_policy_sources(session, tenant_id=tenant_id, owner_user_id=scope_id)
|
|
if scope_type == "group" and scope_id:
|
|
return effective_privacy_policy_sources(session, tenant_id=tenant_id, owner_group_id=scope_id)
|
|
return effective_privacy_policy_sources(session, tenant_id=tenant_id)
|
|
|
|
|
|
def _parent_privacy_policy_for_response(session: Session, *, tenant_id: str, scope_type: str, scope_id: str | None):
|
|
if scope_type == "system":
|
|
return None
|
|
return parent_privacy_policy(session, tenant_id=tenant_id, scope_type=scope_type, scope_id=scope_id or (tenant_id if scope_type == "tenant" else None))
|
|
|
|
|
|
def _effective_privacy_policy_for_response(session: Session, *, tenant_id: str, scope_type: str, scope_id: str | None):
|
|
if scope_type == "system":
|
|
return effective_privacy_policy(session)
|
|
if scope_type == "tenant":
|
|
return effective_privacy_policy(session, tenant_id=scope_id or tenant_id)
|
|
if scope_type == "campaign" and scope_id:
|
|
return effective_privacy_policy(session, campaign_id=scope_id)
|
|
if scope_type == "user" and scope_id:
|
|
return effective_privacy_policy(session, tenant_id=tenant_id, owner_user_id=scope_id)
|
|
if scope_type == "group" and scope_id:
|
|
return effective_privacy_policy(session, tenant_id=tenant_id, owner_group_id=scope_id)
|
|
return effective_privacy_policy(session, tenant_id=tenant_id)
|
|
|
|
|
|
@router.post("/system/retention/run", response_model=RetentionRunResponse)
|
|
def run_retention_policy(
|
|
payload: RetentionRunRequest,
|
|
session: Session = Depends(get_session),
|
|
principal: ApiPrincipal = Depends(require_scope("system:settings:write")),
|
|
):
|
|
result = apply_retention_policy(session, dry_run=payload.dry_run)
|
|
audit_from_principal(
|
|
session,
|
|
principal,
|
|
action="retention_policy.run",
|
|
scope="system",
|
|
object_type="retention_policy",
|
|
object_id="global",
|
|
details={"dry_run": payload.dry_run, "counts": result.get("counts")},
|
|
)
|
|
session.commit()
|
|
return RetentionRunResponse(result=result)
|