sprint14-19: ABAC UI rule editor + permission templates + bulk share + analytics + delegation + resolution strategies + migrations 0056-0058

2026-07-29 02:47:03 +02:00
parent e0003b9384
commit ddf73ee42e
21 changed files with 2399 additions and 4 deletions
@@ -0,0 +1,106 @@
+"""Permission delegation routes — CRUD API for temporary permission handovers."""
+
+from __future__ import annotations
+
+import uuid
+from datetime import datetime
+
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.db import get_db
+from app.deps import get_current_user
+from app.schemas.delegation import DelegationCreate, DelegationUpdate
+from app.services import delegation_service
+
+router = APIRouter(prefix="/api/v1/delegations", tags=["delegations"])
+
+
+@router.get("")
+async def list_delegations(
+    direction: str = Query("all", regex="^(from|to|all)$"),
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """List delegations for the current user."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    items = await delegation_service.list_delegations(db, tenant_id, user_id, direction)
+    return {"items": items, "total": len(items)}
+
+
+@router.post("", status_code=status.HTTP_201_CREATED)
+async def create_delegation(
+    body: DelegationCreate,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Create a new permission delegation."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    from_user_id = uuid.UUID(current_user["user_id"])
+    try:
+        return await delegation_service.create_delegation(
+            db,
+            tenant_id,
+            from_user_id=from_user_id,
+            to_user_id=uuid.UUID(body.to_user_id),
+            start_at=body.start_at,
+            end_at=body.end_at,
+            scope=body.scope,
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
+@router.put("/{delegation_id}")
+async def update_delegation(
+    delegation_id: str,
+    body: DelegationUpdate,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Update an existing delegation."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    try:
+        return await delegation_service.update_delegation(
+            db,
+            tenant_id,
+            delegation_id,
+            start_at=body.start_at,
+            end_at=body.end_at,
+            scope=body.scope,
+            active=body.active,
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=404, detail=str(e))
+
+
+@router.delete("/{delegation_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_delegation(
+    delegation_id: str,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Delete a delegation."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    try:
+        await delegation_service.delete_delegation(db, tenant_id, delegation_id)
+    except ValueError as e:
+        raise HTTPException(status_code=404, detail=str(e))
+
+
+@router.get("/active")
+async def check_active_delegation(
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Check if the current user has any active delegations."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_active = await delegation_service.is_delegation_active(db, user_id, tenant_id)
+    active_list = await delegation_service.get_active_delegations(db, user_id, tenant_id)
+    return {
+        "is_active": is_active,
+        "active_delegations": active_list,
+        "count": len(active_list),
+    }
@@ -15,7 +15,7 @@ from app.schemas.entity_permission import (
    EntityPermissionCreate,
    EntityPermissionUpdate,
 )
-from app.services import entity_permission_service
+from app.services import entity_permission_service, bulk_permission_service

 router = APIRouter(prefix="/api/v1/permissions", tags=["entity-permissions"])

@@ -184,3 +184,67 @@ async def list_entity_registry(
        {"entity_type": "ai_conversation", "label": "AI Konversationen", "table": "ai_conversations"},
    ]
    return {"items": entity_types, "total": len(entity_types)}
+
+
+@router.post("/bulk", status_code=status.HTTP_201_CREATED)
+@require_permission("settings:write")
+async def bulk_share_permissions(
+    body: dict,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Bulk share multiple entities with a principal."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    try:
+        result = await bulk_permission_service.bulk_share(
+            db,
+            tenant_id,
+            body["entity_type"],
+            body["entity_ids"],
+            body["principal_type"],
+            body["principal_id"],
+            body["level"],
+            created_by=user_id,
+        )
+        return result
+    except (ValueError, KeyError) as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
+@router.post("/bulk/unshare", status_code=status.HTTP_200_OK)
+@require_permission("settings:write")
+async def bulk_unshare_permissions(
+    body: dict,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Bulk remove permissions for a principal from multiple entities."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    try:
+        result = await bulk_permission_service.bulk_unshare(
+            db,
+            tenant_id,
+            body["entity_type"],
+            body["entity_ids"],
+            body["principal_type"],
+            body["principal_id"],
+        )
+        return result
+    except (ValueError, KeyError) as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
+@router.get("/analytics")
+@require_permission("settings:read")
+async def get_permission_analytics(
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Get permission analytics for the current tenant."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    try:
+        result = await entity_permission_service.get_permission_analytics(db, tenant_id)
+        return result
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
@@ -0,0 +1,114 @@
+"""Permission template routes — CRUD API for reusable permission presets."""
+
+from __future__ import annotations
+
+import uuid
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.db import get_db
+from app.deps import get_current_user
+from app.schemas.permission_template import (
+    PermissionTemplateCreate,
+    PermissionTemplateUpdate,
+    PermissionTemplateApply,
+)
+from app.services import permission_template_service
+
+router = APIRouter(prefix="/api/v1/permission-templates", tags=["permission-templates"])
+
+
+@router.get("")
+async def list_templates(
+    entity_type: str | None = None,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """List all permission templates for the current tenant."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    items = await permission_template_service.list_templates(db, tenant_id, entity_type)
+    return {"items": items, "total": len(items)}
+
+
+@router.post("", status_code=status.HTTP_201_CREATED)
+async def create_template(
+    body: PermissionTemplateCreate,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Create a new permission template."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    try:
+        return await permission_template_service.create_template(
+            db,
+            tenant_id,
+            name=body.name,
+            entity_type=body.entity_type,
+            level=body.level,
+            trigger_condition=body.trigger_condition,
+            auto_share_with=body.auto_share_with,
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
+@router.put("/{template_id}")
+async def update_template(
+    template_id: str,
+    body: PermissionTemplateUpdate,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Update an existing permission template."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    try:
+        return await permission_template_service.update_template(
+            db,
+            tenant_id,
+            template_id,
+            name=body.name,
+            entity_type=body.entity_type,
+            level=body.level,
+            trigger_condition=body.trigger_condition,
+            auto_share_with=body.auto_share_with,
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=404, detail=str(e))
+
+
+@router.delete("/{template_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_template(
+    template_id: str,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Delete a permission template."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    try:
+        await permission_template_service.delete_template(db, tenant_id, template_id)
+    except ValueError as e:
+        raise HTTPException(status_code=404, detail=str(e))
+
+
+@router.post("/apply", status_code=status.HTTP_201_CREATED)
+async def apply_template(
+    body: PermissionTemplateApply,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Apply a permission template to an entity, creating entity_permissions."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    try:
+        result = await permission_template_service.apply_template(
+            db,
+            tenant_id,
+            body.entity_type,
+            body.entity_id,
+            template_id=body.template_id,
+            created_by=user_id,
+        )
+        return {"applied": result, "count": len(result)}
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))