Initialize governed Views module
This commit is contained in:
@@ -0,0 +1,282 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from pathlib import Path
|
||||
|
||||
from govoplan_core.core.access import (
|
||||
CAPABILITY_AUTH_PERMISSION_EVALUATOR,
|
||||
CAPABILITY_AUTH_PRINCIPAL_RESOLVER,
|
||||
)
|
||||
from govoplan_core.core.module_guards import (
|
||||
drop_table_retirement_provider,
|
||||
persistent_table_uninstall_guard,
|
||||
)
|
||||
from govoplan_core.core.modules import (
|
||||
DocumentationTopic,
|
||||
FrontendModule,
|
||||
MigrationSpec,
|
||||
ModuleContext,
|
||||
ModuleInterfaceProvider,
|
||||
ModuleManifest,
|
||||
PermissionDefinition,
|
||||
RoleTemplate,
|
||||
)
|
||||
from govoplan_core.core.views import CAPABILITY_VIEWS_RESOLVER, ViewSurface
|
||||
from govoplan_core.db.base import Base
|
||||
from govoplan_views.backend.db import models as view_models
|
||||
|
||||
|
||||
MODULE_ID = "views"
|
||||
MODULE_NAME = "Views"
|
||||
MODULE_VERSION = "0.1.0"
|
||||
|
||||
DEFINITION_READ_SCOPE = "views:definition:read"
|
||||
DEFINITION_WRITE_SCOPE = "views:definition:write"
|
||||
ASSIGNMENT_READ_SCOPE = "views:assignment:read"
|
||||
ASSIGNMENT_WRITE_SCOPE = "views:assignment:write"
|
||||
SELECTION_READ_SCOPE = "views:selection:read"
|
||||
SELECTION_WRITE_SCOPE = "views:selection:write"
|
||||
SYSTEM_DEFINITION_READ_SCOPE = "views:system_definition:read"
|
||||
SYSTEM_DEFINITION_WRITE_SCOPE = "views:system_definition:write"
|
||||
SYSTEM_ASSIGNMENT_READ_SCOPE = "views:system_assignment:read"
|
||||
SYSTEM_ASSIGNMENT_WRITE_SCOPE = "views:system_assignment:write"
|
||||
|
||||
|
||||
def _permission(
|
||||
scope: str,
|
||||
label: str,
|
||||
description: str,
|
||||
*,
|
||||
level: str = "tenant",
|
||||
) -> PermissionDefinition:
|
||||
module_id, resource, action = scope.split(":", 2)
|
||||
return PermissionDefinition(
|
||||
scope=scope,
|
||||
label=label,
|
||||
description=description,
|
||||
category="Views",
|
||||
level=level,
|
||||
module_id=module_id,
|
||||
resource=resource,
|
||||
action=action,
|
||||
)
|
||||
|
||||
|
||||
PERMISSIONS = (
|
||||
_permission(
|
||||
DEFINITION_READ_SCOPE,
|
||||
"View tenant Views",
|
||||
"Read tenant and inherited View definitions and immutable revisions.",
|
||||
),
|
||||
_permission(
|
||||
DEFINITION_WRITE_SCOPE,
|
||||
"Manage tenant Views",
|
||||
"Create, revise, publish, and archive tenant View definitions.",
|
||||
),
|
||||
_permission(
|
||||
ASSIGNMENT_READ_SCOPE,
|
||||
"View tenant View assignments",
|
||||
"Read tenant, group, and user View assignments.",
|
||||
),
|
||||
_permission(
|
||||
ASSIGNMENT_WRITE_SCOPE,
|
||||
"Manage tenant View assignments",
|
||||
"Assign available, default, and required Views within a tenant.",
|
||||
),
|
||||
_permission(
|
||||
SELECTION_READ_SCOPE,
|
||||
"View effective View",
|
||||
"Read the effective View projection for the current account.",
|
||||
),
|
||||
_permission(
|
||||
SELECTION_WRITE_SCOPE,
|
||||
"Select available Views",
|
||||
"Select or leave an available View unless an administrator requires it.",
|
||||
),
|
||||
_permission(
|
||||
SYSTEM_DEFINITION_READ_SCOPE,
|
||||
"View system Views",
|
||||
"Read system-wide View definitions and immutable revisions.",
|
||||
level="system",
|
||||
),
|
||||
_permission(
|
||||
SYSTEM_DEFINITION_WRITE_SCOPE,
|
||||
"Manage system Views",
|
||||
"Create, revise, publish, and archive system-wide View definitions.",
|
||||
level="system",
|
||||
),
|
||||
_permission(
|
||||
SYSTEM_ASSIGNMENT_READ_SCOPE,
|
||||
"View system View assignments",
|
||||
"Read system-wide View assignments.",
|
||||
level="system",
|
||||
),
|
||||
_permission(
|
||||
SYSTEM_ASSIGNMENT_WRITE_SCOPE,
|
||||
"Manage system View assignments",
|
||||
"Assign available, default, and required Views system-wide.",
|
||||
level="system",
|
||||
),
|
||||
)
|
||||
|
||||
ROLE_TEMPLATES = (
|
||||
RoleTemplate(
|
||||
slug="view_manager",
|
||||
name="View manager",
|
||||
description="Design tenant Views and manage their assignments.",
|
||||
permissions=(
|
||||
DEFINITION_READ_SCOPE,
|
||||
DEFINITION_WRITE_SCOPE,
|
||||
ASSIGNMENT_READ_SCOPE,
|
||||
ASSIGNMENT_WRITE_SCOPE,
|
||||
SELECTION_READ_SCOPE,
|
||||
SELECTION_WRITE_SCOPE,
|
||||
),
|
||||
),
|
||||
RoleTemplate(
|
||||
slug="view_user",
|
||||
name="View user",
|
||||
description="Use and select Views made available to the account.",
|
||||
permissions=(SELECTION_READ_SCOPE, SELECTION_WRITE_SCOPE),
|
||||
default_authenticated=True,
|
||||
),
|
||||
)
|
||||
|
||||
|
||||
def _router(context: ModuleContext):
|
||||
from govoplan_views.backend.runtime import configure_runtime
|
||||
|
||||
configure_runtime(registry=context.registry)
|
||||
from govoplan_views.backend.router import router
|
||||
|
||||
return router
|
||||
|
||||
|
||||
def _resolver(context: ModuleContext):
|
||||
from govoplan_views.backend.capabilities import resolver_capability
|
||||
from govoplan_views.backend.runtime import configure_runtime
|
||||
|
||||
configure_runtime(registry=context.registry)
|
||||
return resolver_capability(context)
|
||||
|
||||
|
||||
manifest = ModuleManifest(
|
||||
id=MODULE_ID,
|
||||
name=MODULE_NAME,
|
||||
version=MODULE_VERSION,
|
||||
optional_dependencies=("access", "admin", "policy", "workflow"),
|
||||
required_capabilities=(
|
||||
CAPABILITY_AUTH_PRINCIPAL_RESOLVER,
|
||||
CAPABILITY_AUTH_PERMISSION_EVALUATOR,
|
||||
),
|
||||
provides_interfaces=(
|
||||
ModuleInterfaceProvider(name="views.surface_contract", version="1.0.0"),
|
||||
ModuleInterfaceProvider(name="views.resolver", version="0.1.0"),
|
||||
),
|
||||
permissions=PERMISSIONS,
|
||||
role_templates=ROLE_TEMPLATES,
|
||||
frontend=FrontendModule(
|
||||
module_id=MODULE_ID,
|
||||
package_name="@govoplan/views-webui",
|
||||
view_surfaces=(
|
||||
ViewSurface(
|
||||
id="views.selector",
|
||||
module_id=MODULE_ID,
|
||||
kind="selector",
|
||||
label="View selector",
|
||||
description="Always-available selector for leaving optional Views.",
|
||||
order=1,
|
||||
required=True,
|
||||
),
|
||||
ViewSurface(
|
||||
id="views.admin.system",
|
||||
module_id=MODULE_ID,
|
||||
kind="section",
|
||||
label="System Views administration",
|
||||
description="Edit system-wide Views and assignments.",
|
||||
order=20,
|
||||
),
|
||||
ViewSurface(
|
||||
id="views.admin.tenant",
|
||||
module_id=MODULE_ID,
|
||||
kind="section",
|
||||
label="Tenant Views administration",
|
||||
description="Edit tenant, group, and user Views and assignments.",
|
||||
order=30,
|
||||
),
|
||||
),
|
||||
),
|
||||
route_factory=_router,
|
||||
migration_spec=MigrationSpec(
|
||||
module_id=MODULE_ID,
|
||||
metadata=Base.metadata,
|
||||
script_location=str(Path(__file__).with_name("migrations") / "versions"),
|
||||
retirement_supported=True,
|
||||
retirement_provider=drop_table_retirement_provider(
|
||||
view_models.ViewPreference,
|
||||
view_models.ViewAssignment,
|
||||
view_models.ViewRevision,
|
||||
view_models.ViewDefinition,
|
||||
label="Views",
|
||||
),
|
||||
retirement_notes=(
|
||||
"Destructive retirement removes View definitions, revisions, "
|
||||
"assignments, and user selections after a database snapshot."
|
||||
),
|
||||
),
|
||||
uninstall_guard_providers=(
|
||||
persistent_table_uninstall_guard(
|
||||
view_models.ViewDefinition,
|
||||
view_models.ViewAssignment,
|
||||
label="Views",
|
||||
),
|
||||
),
|
||||
capability_factories={
|
||||
CAPABILITY_VIEWS_RESOLVER: _resolver,
|
||||
},
|
||||
documentation=(
|
||||
DocumentationTopic(
|
||||
id="views.interface-projections",
|
||||
title="Task-focused Views",
|
||||
summary=(
|
||||
"Reduce the visible interface to the modules and functions needed "
|
||||
"for a task without changing authorization."
|
||||
),
|
||||
body=(
|
||||
"Views are versioned presentation projections. Modules announce "
|
||||
"their selectable surfaces through the platform contract. System "
|
||||
"and tenant administrators can publish Views and make them "
|
||||
"available, default, or required at system, tenant, group, and "
|
||||
"user scope. Required Views retain administration escape surfaces "
|
||||
"so they can always be inspected and changed. Hidden functions "
|
||||
"remain protected by their normal permission checks."
|
||||
),
|
||||
layer="available",
|
||||
documentation_types=("admin", "user"),
|
||||
audience=("administrator", "power_user", "workflow_designer"),
|
||||
related_modules=("access", "admin", "policy", "workflow"),
|
||||
order=18,
|
||||
),
|
||||
),
|
||||
)
|
||||
|
||||
|
||||
def get_manifest() -> ModuleManifest:
|
||||
return manifest
|
||||
|
||||
|
||||
__all__ = [
|
||||
"ASSIGNMENT_READ_SCOPE",
|
||||
"ASSIGNMENT_WRITE_SCOPE",
|
||||
"DEFINITION_READ_SCOPE",
|
||||
"DEFINITION_WRITE_SCOPE",
|
||||
"MODULE_ID",
|
||||
"MODULE_VERSION",
|
||||
"SELECTION_READ_SCOPE",
|
||||
"SELECTION_WRITE_SCOPE",
|
||||
"SYSTEM_ASSIGNMENT_READ_SCOPE",
|
||||
"SYSTEM_ASSIGNMENT_WRITE_SCOPE",
|
||||
"SYSTEM_DEFINITION_READ_SCOPE",
|
||||
"SYSTEM_DEFINITION_WRITE_SCOPE",
|
||||
"get_manifest",
|
||||
"manifest",
|
||||
]
|
||||
Reference in New Issue
Block a user