feat: contribute bounded policy impact subjects

This commit is contained in:
2026-08-20 20:27:17 +02:00
parent e49129c3eb
commit 24dca43e2e
3 changed files with 350 additions and 0 deletions
+14
View File
@@ -22,6 +22,7 @@ from govoplan_core.core.modules import (
RoleTemplate,
)
from govoplan_core.core.provider_governance import declared_module_architecture
from govoplan_core.core.policy import CAPABILITY_POLICY_IMPACT_SUBJECT_PREFIX
from govoplan_core.core.views import CAPABILITY_VIEWS_RESOLVER, ViewSurface
from govoplan_core.db.base import Base
from govoplan_views.backend.db import models as view_models
@@ -207,6 +208,14 @@ def _resolver(context: ModuleContext):
return resolver_capability(context)
def _policy_impact_subjects(context: ModuleContext):
from govoplan_views.backend.impact_subjects import (
ViewsPolicyImpactSubjectProvider,
)
return ViewsPolicyImpactSubjectProvider(context.registry)
manifest = ModuleManifest(
id=MODULE_ID,
name=MODULE_NAME,
@@ -288,6 +297,7 @@ manifest = ModuleManifest(
),
capability_factories={
CAPABILITY_VIEWS_RESOLVER: _resolver,
f"{CAPABILITY_POLICY_IMPACT_SUBJECT_PREFIX}views": _policy_impact_subjects,
},
documentation=(
DocumentationTopic(
@@ -313,6 +323,10 @@ manifest = ModuleManifest(
"While a focus is active, All available tools temporarily restores that same permission-derived "
"rail without changing the View or saving an override. Workflow uses "
"the same behavior by resolving the exact immutable View revision."
" When Policy is enabled, Views contributes a bounded catalogue of "
"View definitions, actions, and registered surfaces to policy-impact "
"previews. The provider is tenant-filtered, honors an explicit limit, "
"and never grants Policy access to View implementation internals."
),
layer="available",
documentation_types=("admin", "user"),