Add governed reusable workflow definitions

src/govoplan_workflow/backend/schemas.py

@@ -8,6 +8,8 @@ from pydantic import BaseModel, Field, field_validator
 
 
 WorkflowDefinitionStatus = Literal["draft", "active", "archived"]
+DefinitionScopeType = Literal["system", "tenant", "group", "user"]
+DefinitionKind = Literal["flow", "template"]
 
 
 class WorkflowPosition(BaseModel):
@@ -110,9 +112,34 @@ class WorkflowDefinitionRevisionResponse(BaseModel):
     created_at: datetime
 
 
+class WorkflowActionDecisionResponse(BaseModel):
+    allowed: bool
+    reason: str | None = None
+    source_path: list[dict[str, Any]] = Field(default_factory=list)
+    requirements: list[str] = Field(default_factory=list)
+    details: dict[str, Any] = Field(default_factory=dict)
+
+
+class WorkflowGovernanceResponse(BaseModel):
+    scope_type: DefinitionScopeType
+    scope_id: str | None
+    definition_kind: DefinitionKind
+    inherit_to_lower_scopes: bool
+    allow_start: bool
+    allow_reuse: bool
+    allow_automation: bool
+    derived_from_definition_id: str | None
+    derived_from_revision: int | None
+    derived_from_hash: str | None
+    derivation_provenance: dict[str, Any] = Field(default_factory=dict)
+    actions: dict[str, WorkflowActionDecisionResponse]
+    automation_runtime_available: bool = False
+    automation_runtime_reason: str | None = None
+
+
 class WorkflowDefinitionResponse(BaseModel):
     id: str
-    tenant_id: str
+    tenant_id: str | None
     key: str
     name: str
     description: str | None
@@ -125,6 +152,7 @@ class WorkflowDefinitionResponse(BaseModel):
     created_at: datetime
     updated_at: datetime
     revision: WorkflowDefinitionRevisionResponse
+    governance: WorkflowGovernanceResponse
 
 
 class WorkflowDefinitionListResponse(BaseModel):
@@ -146,6 +174,13 @@ class WorkflowDefinitionCreateRequest(BaseModel):
     description: str | None = Field(default=None, max_length=4_000)
     graph: WorkflowGraph
     metadata: dict[str, Any] = Field(default_factory=dict)
+    scope_type: DefinitionScopeType = "tenant"
+    scope_id: str | None = Field(default=None, max_length=36)
+    definition_kind: DefinitionKind = "flow"
+    inherit_to_lower_scopes: bool = False
+    allow_start: bool = True
+    allow_reuse: bool = False
+    allow_automation: bool = False
 
 
 class WorkflowDefinitionUpdateRequest(BaseModel):
@@ -154,6 +189,33 @@ class WorkflowDefinitionUpdateRequest(BaseModel):
     graph: WorkflowGraph
     metadata: dict[str, Any] = Field(default_factory=dict)
     expected_revision: int = Field(ge=1)
+    scope_type: DefinitionScopeType = "tenant"
+    scope_id: str | None = Field(default=None, max_length=36)
+    definition_kind: DefinitionKind = "flow"
+    inherit_to_lower_scopes: bool = False
+    allow_start: bool = True
+    allow_reuse: bool = False
+    allow_automation: bool = False
+
+
+class WorkflowDefinitionDeriveRequest(BaseModel):
+    key: str | None = Field(
+        default=None,
+        min_length=1,
+        max_length=120,
+        pattern=r"^[A-Za-z0-9][A-Za-z0-9_-]*$",
+    )
+    name: str = Field(min_length=1, max_length=300)
+    description: str | None = Field(default=None, max_length=4_000)
+    source_revision: int | None = Field(default=None, ge=1)
+    metadata: dict[str, Any] = Field(default_factory=dict)
+    scope_type: DefinitionScopeType = "tenant"
+    scope_id: str | None = Field(default=None, max_length=36)
+    definition_kind: DefinitionKind = "flow"
+    inherit_to_lower_scopes: bool = False
+    allow_start: bool = True
+    allow_reuse: bool = False
+    allow_automation: bool = False
 
 
 class WorkflowDefinitionActivateRequest(BaseModel):