sprint14-19: ABAC UI rule editor + permission templates + bulk share + analytics + delegation + resolution strategies + migrations 0056-0058

app/models/permission_delegation.py

@@ -0,0 +1,78 @@
+"""Permission delegation model — temporary permission handover between users.
+
+Allows a user to delegate their permissions to another user for a specified
+time period and scope.
+"""
+
+from __future__ import annotations
+
+import uuid
+from datetime import datetime
+
+from sqlalchemy import (
+    Boolean,
+    CheckConstraint,
+    DateTime,
+    ForeignKey,
+    String,
+    func,
+)
+from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.core.db import Base, TenantMixin
+
+
+class PermissionDelegation(Base, TenantMixin):
+    """Permission delegation — temporary handover of permissions.
+
+    from_user_id delegates their permissions to to_user_id
+    for the duration [start_at, end_at].
+
+    scope: JSONB defining which permissions are delegated.
+    Examples:
+    - {"all": true} — all permissions
+    - {"entity_types": ["contact", "document"]} — specific entity types
+    - {"permissions": ["contacts:read", "contacts:write"]} — specific permissions
+    """
+
+    __tablename__ = "permission_delegations"
+    __table_args__ = (
+        CheckConstraint(
+            "end_at > start_at",
+            name="ck_pd_end_after_start",
+        ),
+    )
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    from_user_id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True),
+        ForeignKey("users.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True,
+    )
+    to_user_id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True),
+        ForeignKey("users.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True,
+    )
+    start_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False
+    )
+    end_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False
+    )
+    scope: Mapped[dict | None] = mapped_column(JSONB, nullable=True, default=None)
+    active: Mapped[bool] = mapped_column(
+        Boolean, nullable=False, default=True
+    )
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now()
+    )
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now(),
+        onupdate=func.now(),
+    )