sprint12+13: zentrale rechte settings page + ABAC engine backend (model, migration 0055, service, routes)

2026-07-29 02:42:16 +02:00
parent 2c14368b90
commit e0003b9384
13 changed files with 1075 additions and 0 deletions
@@ -0,0 +1,55 @@
+"""Create entity_policies table for ABAC engine.
+
+Revision ID: 0055
+Revises: 0054
+Create Date: 2026-07-29
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
+
+revision = "0055"
+down_revision = "0054"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "entity_policies",
+        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("name", sa.String(200), nullable=False),
+        sa.Column("entity_type", sa.String(50), nullable=False),
+        sa.Column("principal_type", sa.String(10), nullable=False),
+        sa.Column("principal_id", PGUUID(as_uuid=True), nullable=False),
+        sa.Column("effect", sa.String(10), nullable=False, server_default=sa.text("'allow'")),
+        sa.Column("conditions", JSONB, nullable=True),
+        sa.Column("priority", sa.Integer, nullable=False, server_default=sa.text("0")),
+        sa.Column("tenant_id", PGUUID(as_uuid=True), nullable=False),
+        sa.Column("enabled", sa.Boolean, nullable=False, server_default=sa.text("true")),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
+        sa.CheckConstraint(
+            "principal_type IN ('user', 'group', 'role')",
+            name="ck_epol_principal_type",
+        ),
+        sa.CheckConstraint(
+            "effect IN ('allow', 'deny')",
+            name="ck_epol_effect",
+        ),
+    )
+    op.create_index("ix_epol_entity_type", "entity_policies", ["entity_type"])
+    op.create_index("ix_epol_principal", "entity_policies", ["principal_type", "principal_id"])
+    op.create_index("ix_epol_tenant", "entity_policies", ["tenant_id"])
+    op.create_index("ix_epol_priority", "entity_policies", ["priority"])
+    op.create_index("ix_epol_enabled", "entity_policies", ["enabled"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_epol_enabled", table_name="entity_policies")
+    op.drop_index("ix_epol_priority", table_name="entity_policies")
+    op.drop_index("ix_epol_tenant", table_name="entity_policies")
+    op.drop_index("ix_epol_principal", table_name="entity_policies")
+    op.drop_index("ix_epol_entity_type", table_name="entity_policies")
+    op.drop_table("entity_policies")