phase5: workspace backend — models, service, routes, migration 0072

app/models/workspace.py

@@ -0,0 +1,174 @@
+"""Workspace models — UI/navigation context only.
+
+Workspaces control which modules, menu items, calendar views, contact folders,
+saved views, and dashboard widgets are visible to a user. They NEVER affect
+RBAC, ABAC, entity permissions, owner/sharing rights, tenant memberships,
+RLS policies, or actual data access rights.
+
+See: docs/security_kernel.md for the permission intersection rule.
+"""
+
+from __future__ import annotations
+
+import uuid
+from datetime import datetime
+
+from sqlalchemy import (
+    Boolean,
+    CheckConstraint,
+    DateTime,
+    ForeignKey,
+    Index,
+    Integer,
+    String,
+    UniqueConstraint,
+    func,
+)
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.dialects.postgresql import UUID as PGUUID
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.core.db import Base, TenantMixin
+
+
+class Workspace(Base, TenantMixin):
+    """A workspace is a UI/navigation context for a user.
+
+    It defines which modules are visible, which dashboard widgets appear,
+    and how the sidebar is configured. It does NOT affect data access rights.
+    """
+
+    __tablename__ = "workspaces"
+    __table_args__ = (
+        UniqueConstraint("tenant_id", "name", name="uq_workspaces_tenant_name"),
+        # Only one default workspace per tenant
+        Index(
+            "uq_workspace_default_per_tenant",
+            "tenant_id",
+            unique=True,
+            postgresql_where=func.text("is_default = true"),
+        ),
+        Index("ix_workspaces_tenant", "tenant_id"),
+    )
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    name: Mapped[str] = mapped_column(String(100), nullable=False)
+    icon: Mapped[str] = mapped_column(String(50), nullable=False, default="LayoutGrid")
+    description: Mapped[str | None] = mapped_column(String(500), nullable=True)
+    is_default: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
+    is_active: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
+    created_by: Mapped[uuid.UUID | None] = mapped_column(
+        PGUUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True
+    )
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now()
+    )
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now(),
+        onupdate=func.now(),
+    )
+
+
+class WorkspaceModule(Base, TenantMixin):
+    """Which modules are visible in a workspace and their configuration."""
+
+    __tablename__ = "workspace_modules"
+    __table_args__ = (
+        UniqueConstraint(
+            "tenant_id", "workspace_id", "module_key", name="uq_wm_tenant_workspace_module"
+        ),
+        Index("ix_wm_workspace", "tenant_id", "workspace_id", "menu_order"),
+    )
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    workspace_id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True),
+        ForeignKey("workspaces.id", ondelete="CASCADE"),
+        nullable=False,
+    )
+    module_key: Mapped[str] = mapped_column(String(100), nullable=False)
+    is_visible: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
+    menu_order: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    config: Mapped[dict] = mapped_column(JSONB, nullable=False, default=dict)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now()
+    )
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now(),
+        onupdate=func.now(),
+    )
+
+
+class WorkspaceUser(Base, TenantMixin):
+    """User assignment to a workspace with role (member or manager)."""
+
+    __tablename__ = "workspace_users"
+    __table_args__ = (
+        UniqueConstraint(
+            "tenant_id", "workspace_id", "user_id", name="uq_wu_tenant_workspace_user"
+        ),
+        CheckConstraint("role IN ('member', 'manager')", name="ck_wu_role"),
+        Index("ix_wu_workspace", "tenant_id", "workspace_id"),
+        Index("ix_wu_user", "tenant_id", "user_id"),
+    )
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    workspace_id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True),
+        ForeignKey("workspaces.id", ondelete="CASCADE"),
+        nullable=False,
+    )
+    user_id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True),
+        ForeignKey("users.id", ondelete="CASCADE"),
+        nullable=False,
+    )
+    role: Mapped[str] = mapped_column(String(20), nullable=False, default="member")
+    is_default: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
+    assigned_by: Mapped[uuid.UUID | None] = mapped_column(
+        PGUUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True
+    )
+    assigned_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now()
+    )
+
+
+class WorkspaceWidget(Base, TenantMixin):
+    """Dashboard widget configuration per workspace.
+
+    Multiple instances of the same widget type can exist in the same workspace.
+    No UNIQUE constraint on (workspace_id, widget_key) — allows duplicates.
+    """
+
+    __tablename__ = "workspace_widgets"
+    __table_args__ = (
+        Index("ix_ww_workspace", "tenant_id", "workspace_id"),
+    )
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    workspace_id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True),
+        ForeignKey("workspaces.id", ondelete="CASCADE"),
+        nullable=False,
+    )
+    widget_key: Mapped[str] = mapped_column(String(100), nullable=False)
+    position_x: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    position_y: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    width: Mapped[int] = mapped_column(Integer, nullable=False, default=1)
+    height: Mapped[int] = mapped_column(Integer, nullable=False, default=1)
+    config: Mapped[dict] = mapped_column(JSONB, nullable=False, default=dict)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now()
+    )
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now(),
+        onupdate=func.now(),
+    )