Complete governed reporting execution and publication

src/govoplan_reporting/backend/db/models.py

@@ -484,6 +484,50 @@ class ReportingPublication(Base, TimestampMixin):
     )
 
 
+class ReportingDrillContext(Base, TimestampMixin):
+    __tablename__ = "reporting_drill_contexts"
+    __table_args__ = (
+        UniqueConstraint(
+            "tenant_id", "drill_context_id", name="uq_reporting_drill_context"
+        ),
+        Index(
+            "ix_reporting_drill_context_expiry",
+            "tenant_id",
+            "expires_at",
+        ),
+        Index(
+            "ix_reporting_drill_context_execution",
+            "tenant_id",
+            "execution_id",
+        ),
+    )
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=new_uuid)
+    tenant_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
+    drill_context_id: Mapped[str] = mapped_column(
+        String(36), nullable=False, index=True
+    )
+    execution_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
+    token_sha256: Mapped[str] = mapped_column(String(64), nullable=False)
+    context_sha256: Mapped[str] = mapped_column(String(64), nullable=False)
+    actor_id: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
+    dimension_path: Mapped[list[dict[str, Any]]] = mapped_column(
+        JSON, default=list, nullable=False
+    )
+    source_fingerprints: Mapped[list[dict[str, Any]]] = mapped_column(
+        JSON, default=list, nullable=False
+    )
+    policy_provenance: Mapped[dict[str, Any]] = mapped_column(
+        JSON, default=dict, nullable=False
+    )
+    expires_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, index=True
+    )
+    last_accessed_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+
+
 class ReportingQualityResult(Base, TimestampMixin):
     __tablename__ = "reporting_quality_results"
     __table_args__ = (
@@ -551,6 +595,7 @@ __all__ = [
     "ReportingDefinitionGrant",
     "ReportingDefinitionIdentity",
     "ReportingDefinitionRevision",
+    "ReportingDrillContext",
     "ReportingExecution",
     "ReportingImportAssessment",
     "ReportingPublication",