feat: add personal and group view ownership

tests/test_authorization.py

@@ -0,0 +1,64 @@
+from __future__ import annotations
+
+import unittest
+
+from fastapi import HTTPException
+
+from govoplan_core.auth import ApiPrincipal
+from govoplan_core.core.access import PrincipalRef
+from govoplan_views.backend.router import (
+    _require_definition_read,
+    _require_definition_write,
+)
+
+
+def principal(
+    *,
+    account_id: str = "account-1",
+    scopes: tuple[str, ...],
+    group_ids: tuple[str, ...] = (),
+) -> ApiPrincipal:
+    return ApiPrincipal(
+        principal=PrincipalRef(
+            account_id=account_id,
+            membership_id="membership-1",
+            tenant_id="tenant-1",
+            scopes=frozenset(scopes),
+            group_ids=frozenset(group_ids),
+        ),
+        account=object(),
+        user=object(),
+    )
+
+
+class ViewDefinitionAuthorizationTests(unittest.TestCase):
+    def test_personal_writer_cannot_edit_another_accounts_view(self) -> None:
+        actor = principal(scopes=("views:personal_definition:write",))
+
+        _require_definition_write(actor, "user", "account-1")
+        with self.assertRaises(HTTPException) as caught:
+            _require_definition_write(actor, "user", "account-2")
+
+        self.assertEqual(403, caught.exception.status_code)
+
+    def test_group_reader_is_limited_to_current_memberships(self) -> None:
+        actor = principal(
+            scopes=("views:group_definition:read",),
+            group_ids=("group-1",),
+        )
+
+        _require_definition_read(actor, "group", "group-1")
+        with self.assertRaises(HTTPException) as caught:
+            _require_definition_read(actor, "group", "group-2")
+
+        self.assertEqual(403, caught.exception.status_code)
+
+    def test_tenant_manager_can_manage_owned_views(self) -> None:
+        actor = principal(scopes=("views:definition:write",))
+
+        _require_definition_write(actor, "group", "group-2")
+        _require_definition_write(actor, "user", "account-2")
+
+
+if __name__ == "__main__":
+    unittest.main()