feat: implement permission-aware search baseline

2026-07-29 15:50:11 +02:00
parent 89a4fd0874
commit c60ca2776e
27 changed files with 2282 additions and 0 deletions
@@ -0,0 +1,103 @@
+from __future__ import annotations
+
+import uuid
+from datetime import datetime
+from typing import Any
+
+from sqlalchemy import (
+    DateTime,
+    ForeignKey,
+    Index,
+    JSON,
+    String,
+    Text,
+    UniqueConstraint,
+)
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from govoplan_core.db.base import Base, TimestampMixin
+
+
+def new_uuid() -> str:
+    return str(uuid.uuid4())
+
+
+class SearchIndexDocument(Base, TimestampMixin):
+    __tablename__ = "search_index_documents"
+    __table_args__ = (
+        UniqueConstraint(
+            "tenant_id",
+            "module_id",
+            "resource_type",
+            "resource_id",
+            name="uq_search_document_resource",
+        ),
+        Index(
+            "ix_search_document_scope",
+            "tenant_id",
+            "module_id",
+            "resource_type",
+        ),
+        Index("ix_search_document_visibility", "tenant_id", "visibility"),
+    )
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=new_uuid)
+    tenant_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
+    module_id: Mapped[str] = mapped_column(String(100), nullable=False, index=True)
+    resource_type: Mapped[str] = mapped_column(
+        String(100), nullable=False, index=True
+    )
+    resource_id: Mapped[str] = mapped_column(
+        String(255), nullable=False, index=True
+    )
+    title: Mapped[str] = mapped_column(String(500), nullable=False)
+    summary: Mapped[str | None] = mapped_column(Text, nullable=True)
+    body: Mapped[str | None] = mapped_column(Text, nullable=True)
+    keywords: Mapped[list[str]] = mapped_column(JSON, default=list, nullable=False)
+    search_text: Mapped[str] = mapped_column(Text, nullable=False)
+    url: Mapped[str] = mapped_column(String(1500), nullable=False)
+    visibility: Mapped[str] = mapped_column(
+        String(20), default="restricted", nullable=False
+    )
+    external_reference: Mapped[dict[str, Any] | None] = mapped_column(
+        JSON, nullable=True
+    )
+    metadata_: Mapped[dict[str, Any]] = mapped_column(
+        "metadata", JSON, default=dict, nullable=False
+    )
+    content_hash: Mapped[str] = mapped_column(String(64), nullable=False)
+    indexed_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False
+    )
+
+    acl_tokens: Mapped[list["SearchIndexAclToken"]] = relationship(
+        back_populates="document",
+        cascade="all, delete-orphan",
+    )
+
+
+class SearchIndexAclToken(Base):
+    __tablename__ = "search_index_acl_tokens"
+    __table_args__ = (
+        UniqueConstraint(
+            "document_id",
+            "token",
+            name="uq_search_index_acl_document_token",
+        ),
+        Index("ix_search_index_acl_token", "token", "document_id"),
+    )
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=new_uuid)
+    document_id: Mapped[str] = mapped_column(
+        ForeignKey("search_index_documents.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True,
+    )
+    token: Mapped[str] = mapped_column(String(500), nullable=False, index=True)
+
+    document: Mapped[SearchIndexDocument] = relationship(
+        back_populates="acl_tokens"
+    )
+
+
+__all__ = ["SearchIndexAclToken", "SearchIndexDocument", "new_uuid"]