feat(F): F-PERM permissions, F-APPR approval, F-AIUSE metadata, F-TRANS transparency, F-DATA-POL data policy, F-OVERSIGHT decision record, F-DRY dry-run, F-AUDIT audit log
Check Cross-Plugin Imports / check (push) Has been cancelled
Check Cross-Plugin Imports / check (push) Has been cancelled
- F-PERM: app/ai/agent_permissions.py (230 lines) — AgentPermissionContext, resolve_agent_permissions(), filter_visible_agents(), check_agent_execute_permission(), optimistic locking - F-APPR: app/core/approval.py (160 lines) + app/routes/approvals.py (305 lines) + migration 0123 — ApprovalRequest model, CRUD API, approve/reject/expire - F-AIUSE: app/ai/ai_use_case.py (156 lines) — AIUseCaseMetadata Pydantic model, validate_ai_use_case() - F-TRANS: app/ai/transparency.py (60 lines) — mark_as_ai_generated(), is_ai_participant() - F-DATA-POL: app/ai/data_policy.py (210 lines) — enforce_data_policy() with SENSITIVE_FIELDS + provider compliance - F-OVERSIGHT: app/ai/oversight.py (108 lines) — DecisionRecord, create_decision_record() - F-DRY: agent_loop.py updated with dry_run parameter - F-AUDIT: agent_loop.py updated with audit log for tool calls - agent_routes.py: AI use case metadata endpoints added - main.py: approval routes registered - All Python compile checks pass
This commit is contained in:
Agent Zero
@@ -0,0 +1,305 @@
|
||||
"""API routes for approval requests — /api/v1/approvals.
|
||||
|
||||
Endpoints: create, list (filterable), get detail, approve, reject, expire.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import logging
|
||||
import uuid
|
||||
from datetime import UTC, datetime
|
||||
from typing import Any
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, Query
|
||||
from pydantic import BaseModel, Field
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.core.approval import (
|
||||
APPROVAL_STATUSES,
|
||||
ApprovalRequest,
|
||||
create_approval_request,
|
||||
expire_approval_request,
|
||||
resolve_approval_request,
|
||||
)
|
||||
from app.core.db import get_db
|
||||
from app.deps import get_current_user, require_permission
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
router = APIRouter(prefix="/api/v1/approvals", tags=["approvals"])
|
||||
|
||||
|
||||
# ─── Schemas ───
|
||||
|
||||
|
||||
class ApprovalCreate(BaseModel):
|
||||
"""Create an approval request."""
|
||||
|
||||
entity_type: str = Field(..., min_length=1, max_length=80)
|
||||
entity_id: str = Field(..., min_length=1)
|
||||
action: str = Field(..., min_length=1, max_length=120)
|
||||
requested_by: str | None = None
|
||||
requested_by_type: str = Field("agent", pattern="^(user|agent|system)$")
|
||||
approver_id: str | None = None
|
||||
approver_group: str | None = Field(None, max_length=120)
|
||||
expires_at: str | None = None
|
||||
metadata: dict[str, Any] = Field(default_factory=dict)
|
||||
|
||||
|
||||
class ApprovalResolve(BaseModel):
|
||||
"""Approve or reject an approval request."""
|
||||
|
||||
comment: str | None = Field(None, max_length=2000)
|
||||
|
||||
|
||||
class ApprovalResponse(BaseModel):
|
||||
"""Approval request response."""
|
||||
|
||||
id: str
|
||||
tenant_id: str
|
||||
entity_type: str
|
||||
entity_id: str
|
||||
action: str
|
||||
requested_by: str
|
||||
requested_by_type: str
|
||||
approver_id: str | None = None
|
||||
approver_group: str | None = None
|
||||
status: str
|
||||
comment: str | None = None
|
||||
created_at: str | None = None
|
||||
resolved_at: str | None = None
|
||||
expires_at: str | None = None
|
||||
metadata: dict[str, Any] = Field(default_factory=dict)
|
||||
|
||||
|
||||
class ApprovalListResponse(BaseModel):
|
||||
"""Paginated approval request list."""
|
||||
|
||||
items: list[ApprovalResponse]
|
||||
total: int
|
||||
|
||||
|
||||
# ─── Helpers ───
|
||||
|
||||
|
||||
def _to_response(r: ApprovalRequest) -> ApprovalResponse:
|
||||
return ApprovalResponse(
|
||||
id=str(r.id),
|
||||
tenant_id=str(r.tenant_id),
|
||||
entity_type=r.entity_type,
|
||||
entity_id=str(r.entity_id),
|
||||
action=r.action,
|
||||
requested_by=str(r.requested_by),
|
||||
requested_by_type=r.requested_by_type,
|
||||
approver_id=str(r.approver_id) if r.approver_id else None,
|
||||
approver_group=r.approver_group,
|
||||
status=r.status,
|
||||
comment=r.comment,
|
||||
created_at=r.created_at.isoformat() if r.created_at else None,
|
||||
resolved_at=r.resolved_at.isoformat() if r.resolved_at else None,
|
||||
expires_at=r.expires_at.isoformat() if r.expires_at else None,
|
||||
metadata=r.metadata or {},
|
||||
)
|
||||
|
||||
|
||||
def _parse_uuid(value: str, field: str) -> uuid.UUID:
|
||||
try:
|
||||
return uuid.UUID(value)
|
||||
except (ValueError, TypeError):
|
||||
raise HTTPException(status_code=400, detail=f"Invalid {field}") from None
|
||||
|
||||
|
||||
# ─── Endpoints ───
|
||||
|
||||
|
||||
@router.post(
|
||||
"",
|
||||
dependencies=[Depends(require_permission("approvals:write"))],
|
||||
response_model=ApprovalResponse,
|
||||
status_code=201,
|
||||
)
|
||||
async def create_approval(
|
||||
data: ApprovalCreate,
|
||||
current_user: dict[str, Any] = Depends(get_current_user),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Create a new approval request."""
|
||||
tenant_id = uuid.UUID(current_user["tenant_id"])
|
||||
entity_id = _parse_uuid(data.entity_id, "entity_id")
|
||||
requested_by = (
|
||||
_parse_uuid(data.requested_by, "requested_by")
|
||||
if data.requested_by
|
||||
else uuid.UUID(current_user["user_id"])
|
||||
)
|
||||
approver_id = _parse_uuid(data.approver_id, "approver_id") if data.approver_id else None
|
||||
expires_at = None
|
||||
if data.expires_at:
|
||||
try:
|
||||
expires_at = datetime.fromisoformat(data.expires_at.replace("Z", "+00:00"))
|
||||
except ValueError:
|
||||
raise HTTPException(status_code=400, detail="Invalid expires_at") from None
|
||||
|
||||
req = await create_approval_request(
|
||||
db,
|
||||
tenant_id,
|
||||
entity_type=data.entity_type,
|
||||
entity_id=entity_id,
|
||||
action=data.action,
|
||||
requested_by=requested_by,
|
||||
requested_by_type=data.requested_by_type,
|
||||
approver_id=approver_id,
|
||||
approver_group=data.approver_group,
|
||||
expires_at=expires_at,
|
||||
metadata=data.metadata,
|
||||
)
|
||||
await db.commit()
|
||||
return _to_response(req)
|
||||
|
||||
|
||||
@router.get(
|
||||
"",
|
||||
dependencies=[Depends(require_permission("approvals:read"))],
|
||||
response_model=ApprovalListResponse,
|
||||
)
|
||||
async def list_approvals(
|
||||
status: str | None = Query(None),
|
||||
entity_type: str | None = Query(None),
|
||||
entity_id: str | None = Query(None),
|
||||
requested_by: str | None = Query(None),
|
||||
limit: int = Query(50, ge=1, le=200),
|
||||
offset: int = Query(0, ge=0),
|
||||
current_user: dict[str, Any] = Depends(get_current_user),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""List approval requests with optional filters."""
|
||||
tenant_id = uuid.UUID(current_user["tenant_id"])
|
||||
query = select(ApprovalRequest).where(ApprovalRequest.tenant_id == tenant_id)
|
||||
count_query = (
|
||||
select(__import__("sqlalchemy").func.count())
|
||||
.select_from(ApprovalRequest)
|
||||
.where(ApprovalRequest.tenant_id == tenant_id)
|
||||
)
|
||||
|
||||
if status:
|
||||
query = query.where(ApprovalRequest.status == status)
|
||||
count_query = count_query.where(ApprovalRequest.status == status)
|
||||
if entity_type:
|
||||
query = query.where(ApprovalRequest.entity_type == entity_type)
|
||||
count_query = count_query.where(ApprovalRequest.entity_type == entity_type)
|
||||
if entity_id:
|
||||
eid = _parse_uuid(entity_id, "entity_id")
|
||||
query = query.where(ApprovalRequest.entity_id == eid)
|
||||
count_query = count_query.where(ApprovalRequest.entity_id == eid)
|
||||
if requested_by:
|
||||
rid = _parse_uuid(requested_by, "requested_by")
|
||||
query = query.where(ApprovalRequest.requested_by == rid)
|
||||
count_query = count_query.where(ApprovalRequest.requested_by == rid)
|
||||
|
||||
total = (await db.execute(count_query)).scalar() or 0
|
||||
result = await db.execute(
|
||||
query.order_by(ApprovalRequest.created_at.desc()).limit(limit).offset(offset)
|
||||
)
|
||||
items = list(result.scalars().all())
|
||||
return ApprovalListResponse(items=[_to_response(r) for r in items], total=total)
|
||||
|
||||
|
||||
@router.get(
|
||||
"/{request_id}",
|
||||
dependencies=[Depends(require_permission("approvals:read"))],
|
||||
response_model=ApprovalResponse,
|
||||
)
|
||||
async def get_approval(
|
||||
request_id: str,
|
||||
current_user: dict[str, Any] = Depends(get_current_user),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Get a single approval request by ID."""
|
||||
tenant_id = uuid.UUID(current_user["tenant_id"])
|
||||
rid = _parse_uuid(request_id, "request_id")
|
||||
result = await db.execute(
|
||||
select(ApprovalRequest).where(
|
||||
ApprovalRequest.id == rid,
|
||||
ApprovalRequest.tenant_id == tenant_id,
|
||||
)
|
||||
)
|
||||
req = result.scalar_one_or_none()
|
||||
if req is None:
|
||||
raise HTTPException(status_code=404, detail="Approval request not found")
|
||||
return _to_response(req)
|
||||
|
||||
|
||||
@router.post(
|
||||
"/{request_id}/approve",
|
||||
dependencies=[Depends(require_permission("approvals:approve"))],
|
||||
response_model=ApprovalResponse,
|
||||
)
|
||||
async def approve_approval(
|
||||
request_id: str,
|
||||
body: ApprovalResolve,
|
||||
current_user: dict[str, Any] = Depends(get_current_user),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Approve a pending approval request."""
|
||||
tenant_id = uuid.UUID(current_user["tenant_id"])
|
||||
rid = _parse_uuid(request_id, "request_id")
|
||||
req = await resolve_approval_request(
|
||||
db,
|
||||
tenant_id,
|
||||
rid,
|
||||
decision="approved",
|
||||
approver_id=uuid.UUID(current_user["user_id"]),
|
||||
comment=body.comment,
|
||||
)
|
||||
if req is None:
|
||||
raise HTTPException(status_code=404, detail="Approval request not found or not pending")
|
||||
await db.commit()
|
||||
return _to_response(req)
|
||||
|
||||
|
||||
@router.post(
|
||||
"/{request_id}/reject",
|
||||
dependencies=[Depends(require_permission("approvals:approve"))],
|
||||
response_model=ApprovalResponse,
|
||||
)
|
||||
async def reject_approval(
|
||||
request_id: str,
|
||||
body: ApprovalResolve,
|
||||
current_user: dict[str, Any] = Depends(get_current_user),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Reject a pending approval request."""
|
||||
tenant_id = uuid.UUID(current_user["tenant_id"])
|
||||
rid = _parse_uuid(request_id, "request_id")
|
||||
req = await resolve_approval_request(
|
||||
db,
|
||||
tenant_id,
|
||||
rid,
|
||||
decision="rejected",
|
||||
approver_id=uuid.UUID(current_user["user_id"]),
|
||||
comment=body.comment,
|
||||
)
|
||||
if req is None:
|
||||
raise HTTPException(status_code=404, detail="Approval request not found or not pending")
|
||||
await db.commit()
|
||||
return _to_response(req)
|
||||
|
||||
|
||||
@router.post(
|
||||
"/{request_id}/expire",
|
||||
dependencies=[Depends(require_permission("approvals:write"))],
|
||||
response_model=ApprovalResponse,
|
||||
)
|
||||
async def expire_approval(
|
||||
request_id: str,
|
||||
current_user: dict[str, Any] = Depends(get_current_user),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Mark a pending approval request as expired (system only)."""
|
||||
tenant_id = uuid.UUID(current_user["tenant_id"])
|
||||
rid = _parse_uuid(request_id, "request_id")
|
||||
req = await expire_approval_request(db, tenant_id, rid)
|
||||
if req is None:
|
||||
raise HTTPException(status_code=404, detail="Approval request not found or not pending")
|
||||
await db.commit()
|
||||
return _to_response(req)
|
||||
Reference in New Issue
Block a user