GovOPlaN/govoplan-templates
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(templates): add governed DSAR coverage

Browse Source
This commit is contained in:
zemion
2026-08-21 13:24:13 +02:00
parent 5de54ccd2e
commit 80001bbe98
3 changed files with 705 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/govoplan_templates/backend/manifest.py
+145 -20
View File
@@ -8,6 +8,7 @@ from govoplan_core.core.module_guards import (
persistent_table_uninstall_guard,
)
from govoplan_core.core.modules import (
CapabilityDocumentation,
DocumentationTopic,
FrontendModule,
FrontendRoute,
@@ -30,6 +31,10 @@ from govoplan_core.core.templates import (
from govoplan_core.core.views import ViewSurface
from govoplan_core.db.base import Base
from govoplan_templates.backend.db import models as template_models
from govoplan_templates.backend.dsar_provider import (
TEMPLATES_DSAR_CAPABILITY,
TemplatesDsarProvider,
)
MODULE_ID = "templates"
@@ -58,11 +63,29 @@ def _permission(scope: str, label: str, description: str) -> PermissionDefinitio
PERMISSIONS = (
_permission(READ_SCOPE, "View templates", "Read template definitions, revisions, and render evidence."),
_permission(WRITE_SCOPE, "Manage templates", "Create and revise reusable templates."),
_permission(PUBLISH_SCOPE, "Publish templates", "Publish immutable template revisions for final output."),
_permission(RENDER_SCOPE, "Render templates", "Preview and render governed output from supplied snapshots."),
_permission(ADMIN_SCOPE, "Administer templates", "Manage all tenant, group, and user templates."),
_permission(
READ_SCOPE,
"View templates",
"Read template definitions, revisions, and render evidence.",
),
_permission(
WRITE_SCOPE, "Manage templates", "Create and revise reusable templates."
),
_permission(
PUBLISH_SCOPE,
"Publish templates",
"Publish immutable template revisions for final output.",
),
_permission(
RENDER_SCOPE,
"Render templates",
"Preview and render governed output from supplied snapshots.",
),
_permission(
ADMIN_SCOPE,
"Administer templates",
"Manage all tenant, group, and user templates.",
),
)
ROLE_TEMPLATES = (
@@ -221,15 +244,23 @@ def _content_library(context: ModuleContext):
return content_library_capability(context)
def _dsar_provider(_context: ModuleContext) -> TemplatesDsarProvider:
return TemplatesDsarProvider()
def _tenant_summary(session, tenant_id: str) -> dict[str, int]:
return {
"templates": session.query(template_models.TemplateDefinition).filter(
"templates": session.query(template_models.TemplateDefinition)
.filter(
template_models.TemplateDefinition.tenant_id == tenant_id,
template_models.TemplateDefinition.deleted_at.is_(None),
).count(),
"template_renders": session.query(template_models.TemplateRender).filter(
)
.count(),
"template_renders": session.query(template_models.TemplateRender)
.filter(
template_models.TemplateRender.tenant_id == tenant_id,
).count(),
)
.count(),
}
@@ -241,12 +272,17 @@ manifest = ModuleManifest(
optional_dependencies=("files", "dist_lists", "campaigns", "audit"),
optional_capabilities=(CAPABILITY_FILES_ARTIFACT_STORE,),
provides_interfaces=(
ModuleInterfaceProvider(name=CAPABILITY_TEMPLATE_CATALOG, version=MODULE_VERSION),
ModuleInterfaceProvider(
name=CAPABILITY_TEMPLATE_CATALOG, version=MODULE_VERSION
),
ModuleInterfaceProvider(
name=CAPABILITY_TEMPLATE_CONTENT_LIBRARY,
version=MODULE_VERSION,
),
ModuleInterfaceProvider(name=CAPABILITY_TEMPLATE_RENDERER, version=MODULE_VERSION),
ModuleInterfaceProvider(
name=CAPABILITY_TEMPLATE_RENDERER, version=MODULE_VERSION
),
ModuleInterfaceProvider(name=TEMPLATES_DSAR_CAPABILITY, version="0.1.0"),
),
requires_interfaces=(
ModuleInterfaceRequirement(
@@ -263,7 +299,13 @@ manifest = ModuleManifest(
path="/templates",
label=MODULE_NAME,
icon="layout-template",
required_any=(READ_SCOPE, WRITE_SCOPE, PUBLISH_SCOPE, RENDER_SCOPE, ADMIN_SCOPE),
required_any=(
READ_SCOPE,
WRITE_SCOPE,
PUBLISH_SCOPE,
RENDER_SCOPE,
ADMIN_SCOPE,
),
order=75,
),
),
@@ -274,7 +316,13 @@ manifest = ModuleManifest(
FrontendRoute(
path="/templates",
component="TemplatesPage",
required_any=(READ_SCOPE, WRITE_SCOPE, PUBLISH_SCOPE, RENDER_SCOPE, ADMIN_SCOPE),
required_any=(
READ_SCOPE,
WRITE_SCOPE,
PUBLISH_SCOPE,
RENDER_SCOPE,
ADMIN_SCOPE,
),
order=75,
),
),
@@ -283,7 +331,13 @@ manifest = ModuleManifest(
path="/templates",
label=MODULE_NAME,
icon="layout-template",
required_any=(READ_SCOPE, WRITE_SCOPE, PUBLISH_SCOPE, RENDER_SCOPE, ADMIN_SCOPE),
required_any=(
READ_SCOPE,
WRITE_SCOPE,
PUBLISH_SCOPE,
RENDER_SCOPE,
ADMIN_SCOPE,
),
order=75,
),
),
@@ -299,10 +353,34 @@ manifest = ModuleManifest(
),
),
view_surfaces=(
ViewSurface(id="templates.page", module_id=MODULE_ID, kind="route", label="Templates", order=75),
ViewSurface(id="templates.library", module_id=MODULE_ID, kind="section", label="Template library", order=10),
ViewSurface(id="templates.editor", module_id=MODULE_ID, kind="section", label="Template editor", order=20),
ViewSurface(id="templates.preview", module_id=MODULE_ID, kind="section", label="Template preview and output", order=30),
ViewSurface(
id="templates.page",
module_id=MODULE_ID,
kind="route",
label="Templates",
order=75,
),
ViewSurface(
id="templates.library",
module_id=MODULE_ID,
kind="section",
label="Template library",
order=10,
),
ViewSurface(
id="templates.editor",
module_id=MODULE_ID,
kind="section",
label="Template editor",
order=20,
),
ViewSurface(
id="templates.preview",
module_id=MODULE_ID,
kind="section",
label="Template preview and output",
order=30,
),
),
),
route_factory=_router,
@@ -310,6 +388,17 @@ manifest = ModuleManifest(
CAPABILITY_TEMPLATE_CATALOG: _catalog,
CAPABILITY_TEMPLATE_CONTENT_LIBRARY: _content_library,
CAPABILITY_TEMPLATE_RENDERER: _renderer,
TEMPLATES_DSAR_CAPABILITY: _dsar_provider,
},
capability_documentation={
TEMPLATES_DSAR_CAPABILITY: CapabilityDocumentation(
label="Templates data-subject request provider",
summary=(
"Exports minimized template-author and render attribution without "
"template, input, or output payloads."
),
contract_version="0.1.0",
),
},
tenant_summary_providers=(_tenant_summary,),
migration_spec=MigrationSpec(
@@ -336,7 +425,39 @@ manifest = ModuleManifest(
label=MODULE_NAME,
),
),
documentation=DOCUMENTATION,
documentation=(
DocumentationTopic(
id="templates.data-subject-requests",
title="Template data-subject requests",
summary=(
"Export template-author and render activity without content or supplied data."
),
body=(
"Templates correlates only an exact tenant account identifier and can "
"narrow an already verified search to one template, revision, or render. "
"It returns minimized definition, publication, and render lifecycle "
"metadata. Template text and HTML, required fields, layouts, metadata, "
"render input snapshots, filenames, diagnostics, artifact references, "
"output bytes, hashes, and idempotency keys are excluded. Rendered "
"business data belongs to the supplying module and is not inferred from "
"opaque Template payloads. Attribution remains retained with immutable "
"definition and render evidence."
),
layer="configured",
documentation_types=("admin", "user"),
audience=("user", "operator", "module_admin", "auditor"),
related_modules=("core", "files", "campaigns", "audit"),
order=90,
metadata={
"help_contexts": ["templates.page", "privacy.data-subject-requests"],
"consequence_classes": {
"export_template_attribution": "Returns minimized author, publication, and render activity.",
"exclude_template_payloads": "Does not return template content or render inputs and outputs.",
},
},
),
*DOCUMENTATION,
),
architecture=declared_module_architecture(
layer="content_records_evidence",
kind="domain",
@@ -347,7 +468,11 @@ manifest = ModuleManifest(
"The baseline emits safe deterministic HTML/text for browser or OS printing; PDF and printer delivery remain connector concerns.",
),
supported_authority_modes=("native_authoritative",),
owned_concepts=("template definition", "template revision", "template render evidence"),
owned_concepts=(
"template definition",
"template revision",
"template render evidence",
),
non_owned_concepts=("recipient", "campaign", "file asset", "printer endpoint"),
recovery_docs=("docs/TEMPLATE_BOUNDARY.md",),
security_docs=("docs/TEMPLATE_BOUNDARY.md",),