refactor(reporting): reuse exact principal projection contract

Release v0.1.22. Coordinated integrity review: GovOPlaN/govoplan-core#298.

README.md

@@ -67,3 +67,21 @@ are covered by [docs/USER_GUIDE.md](docs/USER_GUIDE.md) and
 The Reporting route, workspace, state, consequence, and accessibility mapping
 is recorded in
 [docs/INTERFACE_PATTERN_MIGRATION.md](docs/INTERFACE_PATTERN_MIGRATION.md).
+
+## Git-source WebUI package
+
+The repository root exposes `@govoplan/reporting-webui` for Git-tagged release
+dependencies. It mirrors the owning `webui/package.json` version, public
+TypeScript/CSS exports and peer requirements, with entry paths under
+`webui/src`. Consumers provide the shared Core/React peers; the facade runs no
+development or install scripts. The source archive contains `webui/src`, this
+README and any repository license file. Run module development checks from `webui/`; Python
+installation remains governed by `pyproject.toml`.
+
+Das Repository stellt `@govoplan/reporting-webui` am Wurzelpfad für versionierte
+Git-Abhängigkeiten bereit. Version, öffentliche TypeScript-/CSS-Exporte und
+Peer-Anforderungen entsprechen `webui/package.json`; die Einstiegspfade liegen
+unter `webui/src`. Gemeinsame Core-/React-Peers stellt die einbindende Anwendung
+bereit. Die Fassade führt keine Entwicklungs- oder Installationsskripte aus.
+Entwicklungsprüfungen bleiben in `webui/`, die Python-Installation weiterhin in
+`pyproject.toml` definiert.

package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@govoplan/reporting-webui",
+  "version": "0.1.22",
+  "private": true,
+  "type": "module",
+  "main": "webui/src/index.ts",
+  "module": "webui/src/index.ts",
+  "types": "webui/src/index.ts",
+  "exports": {
+    ".": {
+      "types": "./webui/src/index.ts",
+      "import": "./webui/src/index.ts"
+    },
+    "./styles/reporting.css": "./webui/src/styles/reporting.css"
+  },
+  "peerDependencies": {
+    "@govoplan/core-webui": "^0.1.45",
+    "lucide-react": "^1.23.0",
+    "react": ">=19.2.7 <20",
+    "react-dom": ">=19.2.7 <20",
+    "react-router": ">=8.3.0 <9"
+  },
+  "peerDependenciesMeta": {
+    "@govoplan/core-webui": {
+      "optional": true
+    }
+  },
+  "files": [
+    "webui/src",
+    "README.md",
+    "LICENSE"
+  ]
+}

pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "govoplan-reporting"
-version = "0.1.20"
+version = "0.1.22"
 description = "GovOPlaN governed reporting and semantic BI module."
 readme = "README.md"
 requires-python = ">=3.12"
 license = { text = "AGPL-3.0-or-later" }
 authors = [{ name = "GovOPlaN" }]
 dependencies = [
-  "govoplan-core>=0.1.37",
+  "govoplan-core>=0.1.46",
   "govoplan-access>=0.1.18",
 ]
 

src/govoplan_reporting/__init__.py

@@ -1,3 +1,3 @@
 """GovOPlaN Reporting module."""
 
-__version__ = "0.1.20"
+__version__ = "0.1.22"

src/govoplan_reporting/backend/definitions.py

@@ -10,6 +10,7 @@ import uuid
 from sqlalchemy import and_, exists, func, or_
 from sqlalchemy.orm import Query, Session
 
+from govoplan_core.core.principal_helpers import principal_actor_ids as _actor_ids
 from govoplan_core.core.events import (
     EventActorRef,
     EventObjectRef,
@@ -884,22 +885,6 @@ def _actor(principal: object) -> str | None:
     return None
 
 
-def _actor_ids(principal: object) -> tuple[str, ...]:
-    user = getattr(principal, "user", None)
-    return tuple(
-        dict.fromkeys(
-            str(value)
-            for value in (
-                getattr(principal, "account_id", None),
-                getattr(principal, "identity_id", None),
-                getattr(principal, "membership_id", None),
-                getattr(user, "id", None),
-            )
-            if str(value or "").strip()
-        )
-    )
-
-
 def _principal_tenant(principal: object) -> str:
     tenant_id = str(getattr(principal, "tenant_id", "") or "").strip()
     if not tenant_id:

src/govoplan_reporting/backend/manifest.py

@@ -83,7 +83,7 @@ from govoplan_reporting.backend.search_source import create_reporting_search_sou
 
 MODULE_ID = "reporting"
 MODULE_NAME = "Reporting"
-MODULE_VERSION = "0.1.20"
+MODULE_VERSION = "0.1.22"
 
 
 def _permission(scope: str, label: str, description: str) -> PermissionDefinition:
@@ -603,8 +603,10 @@ manifest = ModuleManifest(
                 "aggregations, typed expressions, filters, pivots, saved views, chart models, "
                 "schedules, exports, and publication providers replace unchecked SQL in the "
                 "presentation layer. PostgreSQL executes bounded semantic plans when available. "
+                "Calculated measure keys may contain the documented dots and hyphens, including in nested references; generated bind names remain internal and values remain parameters, not SQL fragments. "
                 "Signed drill contexts reauthorize contributor rows, and Files/Mail publication "
                 "adapters retain idempotent evidence. A dataset may pin one successful published Dataflow run, which is read from its exact Datasource materialization after both source boundaries reauthorize the current principal. Dataflow and module read models remain source owners. "
+                "The contributor drill-down action stays in a shared action column at the right edge of horizontally scrolled results; opening it still reauthorizes every contributor."
             ),
             layer="available",
             documentation_types=("admin", "user"),
@@ -663,12 +665,13 @@ manifest = ModuleManifest(
                         "Filter, Pivotierungen, gespeicherte Ansichten, Diagrammmodelle, Zeitpläne, "
                         "Exporte und Veröffentlichungsanbieter ersetzen ungeprüftes SQL in der "
                         "Darstellungsschicht. PostgreSQL führt begrenzte semantische Pläne aus, sofern "
-                        "verfügbar. Signierte Drilldown-Kontexte autorisieren beitragende Zeilen erneut; "
+                        "verfügbar. Kennungen berechneter Kennzahlen dürfen auch in verschachtelten Verweisen die vorgesehenen Punkte und Bindestriche enthalten; "
+                        "erzeugte Bindungsnamen bleiben intern, und Werte bleiben Parameter statt SQL-Fragmente. Signierte Drilldown-Kontexte autorisieren beitragende Zeilen erneut; "
                         "Adapter für Dateien und Mail bewahren idempotente Nachweise. Ein Datensatz kann "
                         "genau eine erfolgreiche veröffentlichte Dataflow-Ausführung fixieren, die nach "
                         "erneuter Autorisierung beider Quellgrenzen aus ihrer exakten Datasource-"
                         "Materialisierung gelesen wird. Dataflow und die Lesemodelle der Module bleiben "
-                        "führende Quellen."
+                        "führende Quellen. Die Aktion zum Aufschlüsseln beitragender Zeilen bleibt in einer gemeinsamen Aktionsspalte am rechten Rand horizontal gescrollter Ergebnisse; beim Öffnen wird jeder Beitrag erneut autorisiert."
                     ),
                 }
             },

src/govoplan_reporting/backend/postgres_planner.py

@@ -344,7 +344,9 @@ def _calculated_sql(
         return _calculated_sql(
             target.expression,
             parameters,
-            prefix + "_" + reference,
+            # The expression position already makes this prefix unique. Model
+            # keys may contain dots or hyphens, which are not SQL bind names.
+            prefix + "_ref",
             measures=measures,
             stack=(*stack, reference),
         )

tests/test_postgres_bind_names.py

@@ -0,0 +1,96 @@
+from __future__ import annotations
+
+import unittest
+
+from sqlalchemy import text
+from sqlalchemy.dialects import postgresql
+
+from govoplan_reporting.backend.postgres_planner import compile_postgres_query
+from govoplan_reporting.backend.schemas import (
+    DatasetDefinition,
+    ReportQuery,
+    SemanticModelDefinition,
+)
+
+
+class PostgresBindNameTests(unittest.TestCase):
+    def test_allowed_measure_key_punctuation_never_becomes_bind_parameter_syntax(
+        self,
+    ) -> None:
+        dataset = DatasetDefinition(
+            source_kind="static",
+            source_ref="fixture",
+            static_rows=[{"value": 10}],
+            purpose="Bound parameter fixture",
+        )
+        semantic = SemanticModelDefinition.model_validate(
+            {
+                "dataset_id": "fixture",
+                "dataset_revision": 1,
+                "measures": [
+                    {
+                        "key": "base",
+                        "label": "Base",
+                        "aggregation": "sum",
+                        "field": "value",
+                    },
+                    {
+                        "key": "extra-cost",
+                        "label": "Extra",
+                        "aggregation": "calculated",
+                        "expression": {
+                            "op": "add",
+                            "args": [
+                                {"op": "measure", "ref": "base"},
+                                {"op": "literal", "value": 5},
+                            ],
+                        },
+                    },
+                    {
+                        "key": "tax.factor",
+                        "label": "Tax",
+                        "aggregation": "calculated",
+                        "expression": {
+                            "op": "multiply",
+                            "args": [
+                                {"op": "measure", "ref": "base"},
+                                {"op": "literal", "value": 9},
+                            ],
+                        },
+                    },
+                    {
+                        "key": "grand-total",
+                        "label": "Total",
+                        "aggregation": "calculated",
+                        "expression": {
+                            "op": "add",
+                            "args": [
+                                {"op": "measure", "ref": "extra-cost"},
+                                {"op": "measure", "ref": "tax.factor"},
+                            ],
+                        },
+                    },
+                ],
+            }
+        )
+        plan = compile_postgres_query(
+            dataset,
+            semantic,
+            ReportQuery(measures=["extra-cost", "tax.factor", "grand-total"]),
+        )
+        binds = text(plan.sql).compile(dialect=postgresql.dialect()).params
+        self.assertEqual(
+            set(plan.parameters) | {"rows_json", "result_limit", "result_offset"},
+            set(binds),
+        )
+        self.assertTrue(
+            all("-" not in name and "." not in name for name in plan.parameters)
+        )
+        self.assertIn('AS "extra-cost"', plan.sql)
+        self.assertIn('AS "tax.factor"', plan.sql)
+        self.assertEqual(2, list(plan.parameters.values()).count(5))
+        self.assertEqual(2, list(plan.parameters.values()).count(9))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_provider_reports.py

@@ -92,7 +92,7 @@ class _Provider:
         del session
         return ReportProviderResult(
             report_id=request.report_id,
-            generated_at=datetime(2026, 8, 2, 10, 0, tzinfo=UTC),
+            generated_at=datetime.now(UTC),
             payload={"metric": 12},
             source_revisions=(
                 {

webui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govoplan/reporting-webui",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "private": true,
   "type": "module",
   "main": "src/index.ts",
@@ -17,7 +17,7 @@
     "test:interface-pattern": "node scripts/test-interface-pattern.mjs"
   },
   "peerDependencies": {
-    "@govoplan/core-webui": "^0.1.18",
+    "@govoplan/core-webui": "^0.1.45",
     "lucide-react": "^1.23.0",
     "react": ">=19.2.7 <20",
     "react-dom": ">=19.2.7 <20",

webui/scripts/test-interface-pattern.mjs

@@ -10,6 +10,8 @@ assert.ok(page.includes("PageScrollViewport"), "Reporting owns bounded catalogue
 assert.ok(page.includes("DataGrid"), "Tabular report results use the shared grid");
 assert.ok(page.includes("<Dialog"), "Save and schedule operations use shared dialogs");
 assert.ok(page.includes("createDrillContext"), "Aggregate detail uses an actor-bound drill context");
+assert.match(page, /id: "drill",\s*header: "Detail",\s*columnType: "actions",\s*sticky: "end"/, "Result drill-down controls use the shared pinned action-column contract");
+assert.match(page, /<TableActionGroup actions=\{\[\{\s*id: "drill"/, "Drill-down renders the shared measurable action surface");
 assert.ok(page.includes("AccessExplanation"), "Policy-hidden fields, rows, and actions are explained");
 assert.ok(page.includes("PublishDialog"), "Publication targets use the shared dialog surface");
 assert.ok(provider.includes("disabledReason={runDisabledReason}"), "Governed report blockers remain keyboard-explainable");

webui/src/features/reporting/ReportingPage.tsx

@@ -34,6 +34,7 @@ import { FormGrid,
   SelectionListItem,
   SelectionListItemContent,
   StatusBadge,
+  TableActionGroup,
   ToggleSwitch,
   hasScope,
   WorkspaceActionBar,
@@ -543,7 +544,7 @@ function ReportTable({ execution, onDrill }: { execution: ReportExecution; onDri
   const [page, setPage] = useState(0);
   useEffect(() => setPage(0), [execution.execution_id]);
   const columns = useMemo<DataGridColumn<Record<string, unknown>>[]>(() => {
-    const result = execution.schema.map((field) => ({
+    const result: DataGridColumn<Record<string, unknown>>[] = execution.schema.map((field) => ({
       id: field.name,
       header: humanize(field.name),
       width: "1fr",
@@ -559,16 +560,20 @@ function ReportTable({ execution, onDrill }: { execution: ReportExecution; onDri
       result.push({
         id: "drill",
         header: "Detail",
+        columnType: "actions",
+        sticky: "end",
+        resizable: false,
+        align: "right",
         width: 74,
         minWidth: 74,
         maxWidth: 74,
         render: (row) => (
-          <IconButton
+          <TableActionGroup actions={[{
-            label="Show authorized contributing rows"
+            id: "drill",
-            icon={<ChevronRight size={16} />}
+            label: "Show authorized contributing rows",
-            variant="ghost"
+            icon: <ChevronRight size={16} aria-hidden="true" />,
-            onClick={() => onDrill(row)}
+            onClick: () => onDrill(row)
-          />
+          }]} />
         )
       });
     }