feat(postbox): add governed content protection profiles

2026-08-20 03:42:58 +02:00
parent 15d93aaa25
commit 174ee97719
16 changed files with 3917 additions and 383 deletions
@@ -0,0 +1,112 @@
+"""v0.1.18 governed Postbox protection transitions.
+
+Revision ID: a7c1e4f8b2d6
+Revises: f2a5c8e1b4d7
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "a7c1e4f8b2d6"
+down_revision = "f2a5c8e1b4d7"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "postbox_protection_transitions",
+        sa.Column("id", sa.String(36), nullable=False),
+        sa.Column("tenant_id", sa.String(36), nullable=False),
+        sa.Column("postbox_id", sa.String(36), nullable=False),
+        sa.Column("idempotency_key", sa.String(255), nullable=False),
+        sa.Column("source_profile", sa.String(80), nullable=False),
+        sa.Column("target_profile", sa.String(80), nullable=False),
+        sa.Column("source_vault_id", sa.String(255), nullable=True),
+        sa.Column("target_vault_id", sa.String(255), nullable=True),
+        sa.Column("history_mode", sa.String(30), nullable=False),
+        sa.Column("authority_mode", sa.String(40), nullable=False),
+        sa.Column("required_quorum", sa.Integer(), nullable=False),
+        sa.Column("evidence_refs", sa.JSON(), nullable=False),
+        sa.Column("reason", sa.Text(), nullable=False),
+        sa.Column("state", sa.String(30), nullable=False),
+        sa.Column("message_count", sa.Integer(), nullable=False),
+        sa.Column("completed_count", sa.Integer(), nullable=False),
+        sa.Column("failed_count", sa.Integer(), nullable=False),
+        sa.Column("requested_by", sa.String(255), nullable=True),
+        sa.Column("activated_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("completed_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("resource_revision", sa.Integer(), nullable=False),
+        sa.Column("configuration_snapshot", sa.JSON(), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
+        sa.ForeignKeyConstraint(["postbox_id"], ["postboxes.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint(
+            "tenant_id",
+            "postbox_id",
+            "idempotency_key",
+            name="uq_postbox_protection_transition_idem",
+        ),
+    )
+    op.create_index(
+        "ix_postbox_protection_transition_state",
+        "postbox_protection_transitions",
+        ["tenant_id", "postbox_id", "state"],
+    )
+    for column in ("tenant_id", "postbox_id", "state"):
+        op.create_index(
+            f"ix_postbox_protection_transitions_{column}",
+            "postbox_protection_transitions",
+            [column],
+        )
+
+    op.create_table(
+        "postbox_protection_transition_items",
+        sa.Column("id", sa.String(36), nullable=False),
+        sa.Column("tenant_id", sa.String(36), nullable=False),
+        sa.Column("transition_id", sa.String(36), nullable=False),
+        sa.Column("message_id", sa.String(36), nullable=False),
+        sa.Column("source_profile", sa.String(80), nullable=False),
+        sa.Column("target_profile", sa.String(80), nullable=False),
+        sa.Column("state", sa.String(30), nullable=False),
+        sa.Column("source_digest", sa.String(255), nullable=True),
+        sa.Column("target_digest", sa.String(255), nullable=True),
+        sa.Column("completed_by", sa.String(255), nullable=True),
+        sa.Column("completed_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("error_code", sa.String(100), nullable=True),
+        sa.Column("evidence", sa.JSON(), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
+        sa.ForeignKeyConstraint(
+            ["transition_id"],
+            ["postbox_protection_transitions.id"],
+            ondelete="CASCADE",
+        ),
+        sa.ForeignKeyConstraint(
+            ["message_id"], ["postbox_messages.id"], ondelete="CASCADE"
+        ),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint(
+            "transition_id",
+            "message_id",
+            name="uq_postbox_protection_transition_message",
+        ),
+    )
+    op.create_index(
+        "ix_postbox_protection_transition_item_state",
+        "postbox_protection_transition_items",
+        ["tenant_id", "transition_id", "state"],
+    )
+    for column in ("tenant_id", "transition_id", "message_id", "state"):
+        op.create_index(
+            f"ix_postbox_protection_transition_items_{column}",
+            "postbox_protection_transition_items",
+            [column],
+        )
+
+
+def downgrade() -> None:
+    op.drop_table("postbox_protection_transition_items")
+    op.drop_table("postbox_protection_transitions")