feat: contribute bounded policy impact subjects
This commit is contained in:
@@ -22,6 +22,7 @@ from govoplan_core.core.modules import (
|
||||
RoleTemplate,
|
||||
)
|
||||
from govoplan_core.core.provider_governance import declared_module_architecture
|
||||
from govoplan_core.core.policy import CAPABILITY_POLICY_IMPACT_SUBJECT_PREFIX
|
||||
from govoplan_core.core.views import CAPABILITY_VIEWS_RESOLVER, ViewSurface
|
||||
from govoplan_core.db.base import Base
|
||||
from govoplan_views.backend.db import models as view_models
|
||||
@@ -207,6 +208,14 @@ def _resolver(context: ModuleContext):
|
||||
return resolver_capability(context)
|
||||
|
||||
|
||||
def _policy_impact_subjects(context: ModuleContext):
|
||||
from govoplan_views.backend.impact_subjects import (
|
||||
ViewsPolicyImpactSubjectProvider,
|
||||
)
|
||||
|
||||
return ViewsPolicyImpactSubjectProvider(context.registry)
|
||||
|
||||
|
||||
manifest = ModuleManifest(
|
||||
id=MODULE_ID,
|
||||
name=MODULE_NAME,
|
||||
@@ -288,6 +297,7 @@ manifest = ModuleManifest(
|
||||
),
|
||||
capability_factories={
|
||||
CAPABILITY_VIEWS_RESOLVER: _resolver,
|
||||
f"{CAPABILITY_POLICY_IMPACT_SUBJECT_PREFIX}views": _policy_impact_subjects,
|
||||
},
|
||||
documentation=(
|
||||
DocumentationTopic(
|
||||
@@ -313,6 +323,10 @@ manifest = ModuleManifest(
|
||||
"While a focus is active, All available tools temporarily restores that same permission-derived "
|
||||
"rail without changing the View or saving an override. Workflow uses "
|
||||
"the same behavior by resolving the exact immutable View revision."
|
||||
" When Policy is enabled, Views contributes a bounded catalogue of "
|
||||
"View definitions, actions, and registered surfaces to policy-impact "
|
||||
"previews. The provider is tenant-filtered, honors an explicit limit, "
|
||||
"and never grants Policy access to View implementation internals."
|
||||
),
|
||||
layer="available",
|
||||
documentation_types=("admin", "user"),
|
||||
|
||||
Reference in New Issue
Block a user