.. This page is generated by scripts/generate_dataclass_docs.py. Do not edit manually. Models / Rights =============== .. automodule:: teksi_hooks.models.rights AttributeDefaultDefinition -------------------------- .. autoclass:: teksi_hooks.models.rights.AttributeDefaultDefinition :members: Fields ~~~~~~ ``pattern`` Type: ``str`` Attribute-name pattern used to match source or canonical attributes. Usually a simple wildcard pattern such as `ag64_*`. ``update_privileges`` Type: ``frozenset[PrivilegeId]`` Default update privileges applied to attributes matching the pattern. AttributeDefinition ------------------- .. autoclass:: teksi_hooks.models.rights.AttributeDefinition :members: Fields ~~~~~~ ``update_privileges`` Type: ``frozenset[PrivilegeId]`` Privileges allowed to update this attribute. If empty, the attribute has no explicit attribute-level update privilege. ``validations`` Type: ``list[AttributeValidation]`` Attribute-level validation rules, for example freshness or data-quality checks. ``transitions`` Type: ``list[TransitionValidation]`` Transition validations for state-like attributes. These define which value transitions are allowed and under which privileges. CanonicalDerivedRights ---------------------- .. autoclass:: teksi_hooks.models.rights.CanonicalDerivedRights :members: Fields ~~~~~~ ``local_objects`` Type: ``tuple[CanonicalObjectIdentity, ...]`` Canonical local objects participating in the resolved rights-derivation relationship. ``remote_objects`` Type: ``tuple[CanonicalObjectIdentity, ...]`` Canonical remote objects from which rights may be derived. ClassDefinition --------------- .. autoclass:: teksi_hooks.models.rights.ClassDefinition :members: Fields ~~~~~~ ``id`` Type: ``str`` Canonical class identifier. Usually corresponds to a TEKSI semantic class or table identifier. ``superclass_id`` Type: ``str | None`` Optional canonical class identifier of the superclass from which this class inherits rights and attributes. ``rights_from_subclass`` Type: ``bool`` Whether rights should be evaluated from subclass definitions. This is mainly used for abstract or inheritance-root classes whose concrete rights are defined on subclasses. ``derive_rights_from`` Type: ``tuple[DerivedRights, ...]`` Optional relations from which rights can be derived. Derived rights are resolved against related objects and combined with local rights according to resolver semantics. ``crud_rules`` Type: ``CrudRules`` Parsed CRUD rules for this class. These may include direct rules, ownership rules and inheritance references. ``attributes`` Type: ``dict[str, AttributeDefinition]`` Attribute definitions keyed by canonical attribute identifier. DefaultDefinitions ------------------ .. autoclass:: teksi_hooks.models.rights.DefaultDefinitions :members: Fields ~~~~~~ ``crud_rules`` Type: ``CrudRules`` Default CRUD rules applied to classes that do not explicitly define their own rules. ``attribute_defaults`` Type: ``tuple[AttributeDefaultDefinition, ...]`` Default attribute-level rights applied by attribute-name pattern. These defaults are resolved against concrete attributes by the resolver. Example: `ag64_*` may grant `DBW_WI`, while `ag96_*` may grant `DBW_GEP`. ``attribute_validation_rules`` Type: ``Mapping[str, tuple[AttributeValidation, ...]]`` Default attribute validation rules keyed by canonical attribute identifier. The resolver copies matching rules into AttributeDefinition.validations. ``object_validation_rules`` Type: ``Mapping[str, ObjectValidation]`` Named object-level validation definitions. The resolver applies a definition to classes containing all canonical value names required by its rules. DerivedRights ------------- .. autoclass:: teksi_hooks.models.rights.DerivedRights :members: Fields ~~~~~~ ``class_id`` Type: ``str`` Canonical class identifier from which rights may be derived. ``local_attribute`` Type: ``str`` Local attribute participating in the rights-derivation join. Defaults to `obj_id`. ``remote_attribute`` Type: ``str`` Attribute on the related canonical class participating in the rights-derivation join. Defaults to `obj_id`. PermissionFinding ----------------- .. autoclass:: teksi_hooks.models.rights.PermissionFinding :members: Base class: ``Finding`` Fields ~~~~~~ ``severity`` Type: ``Severity`` Severity level assigned to the finding. ``message`` Type: ``str`` Human-readable description of the validation issue. ``code`` Type: ``str`` Stable permission finding code. Examples: 'permission_denied', 'missing_privilege', 'provider_not_authorized'. ``attribute_name`` Type: ``str | None`` Canonical attribute involved in the permission finding, or None if the finding applies to the whole object/change. ``rule_id`` Type: ``str | None`` Identifier of the rights rule or condition that denied the change, if available. ``provider_oid`` Type: ``Oid | None`` Provider organisation oid used during rights evaluation, if relevant. ``dataowner_oid`` Type: ``Oid | None`` Data owner organisation oid used during rights evaluation, if relevant. ``required_privilege`` Type: ``PrivilegeId | None`` Privilege required for the attempted operation, if known. ``available_privileges`` Type: ``tuple[PrivilegeId, ...]`` Privileges available to the evaluated provider/data owner context. ``evaluation_path`` Type: ``tuple[str, ...]`` Optional rights evaluation path. Useful for derived or recursive rights, for example ('reach_point', 'reach', 'wastewater_structure'). ``transitive_evaluation_enabled`` Type: ``bool | None`` Whether transitive or recursive rights evaluation was enabled when this permission finding was produced. ``details`` Type: ``dict[str, Any]`` Additional permission finding details that are useful for debugging, reporting or future rule types. ResolutionInfo -------------- .. autoclass:: teksi_hooks.models.rights.ResolutionInfo :members: Fields ~~~~~~ ``superclass_id`` Type: ``str | None`` Identifier of the superclass used during resolution, if any. ``derived_from`` Type: ``tuple[DerivedRights, ...]`` Derived-rights declarations that contributed to the resolved definition. ``inherited_attributes`` Type: ``frozenset[str]`` Attribute identifiers inherited from superclass definitions. ``inherited_rules`` Type: ``frozenset[str]`` Rule-set identifiers inherited or expanded during resolution. ResolvedAttributeDefinition --------------------------- .. autoclass:: teksi_hooks.models.rights.ResolvedAttributeDefinition :members: Fields ~~~~~~ ``update_privileges`` Type: ``frozenset[PrivilegeId]`` Effective privileges allowed to update this attribute after all defaults and inheritance have been resolved. ``validations`` Type: ``tuple[AttributeValidation, ...]`` Effective validation rules for this attribute after resolution. ``transitions`` Type: ``tuple[TransitionValidation, ...]`` Effective transition validations for this attribute after resolution. ResolvedClassDefinition ----------------------- .. autoclass:: teksi_hooks.models.rights.ResolvedClassDefinition :members: Fields ~~~~~~ ``id`` Type: ``str`` Canonical class identifier of the resolved class. ``crud_rules`` Type: ``ResolvedCrudRules`` Fully resolved immutable CRUD rules for this class. ``attributes`` Type: ``Mapping[str, ResolvedAttributeDefinition]`` Resolved attribute definitions keyed by canonical attribute identifier. ``transition_rules`` Type: ``Mapping[str, StateTransitionRule]`` Resolved state transition rules keyed by canonical attribute identifier. ``object_validations`` Type: ``tuple[ObjectValidation, ...]`` Resolved object-level validation rules for this canonical class. ``mandatory_attributes`` Type: ``frozenset[str]`` Effective canonical attributes that require a value. Class-specific declarations extend the validation defaults. ResolvedRights -------------- .. autoclass:: teksi_hooks.models.rights.ResolvedRights :members: Fields ~~~~~~ ``classes`` Type: ``Mapping[str, ResolvedClassDefinition]`` Resolved class definitions keyed by canonical class identifier. ``derived_rights`` Type: ``Mapping[str, tuple[DerivedRights, ...]]`` Rights derivation definitions keyed by canonical class identifier. ``subclass_rights`` Type: ``Mapping[str, tuple[str, ...]]`` Subclass rights mappings keyed by canonical parent class identifier. ``allow_transitive_transitions`` Type: ``bool`` Whether rights mappings allow for transitive transitions. Defaults to True. RightsDefinition ---------------- .. autoclass:: teksi_hooks.models.rights.RightsDefinition :members: Fields ~~~~~~ ``privileges`` Type: ``Mapping[PrivilegeId, PrivilegeMetadata]`` Privilege definitions keyed by privilege identifier. These definitions provide metadata such as localized labels and descriptions for privilege references used throughout the rights configuration. ``defaults`` Type: ``DefaultDefinitions`` Global default definitions applied by the resolver when class-level rules are missing. ``classes`` Type: ``Mapping[str, ClassDefinition]`` Parsed class definitions keyed by canonical class identifier. ``validation_rules`` Type: ``Mapping[str, tuple[AttributeValidation, ...]]`` Global attribute validation rules keyed by attribute name. Example: `last_modification`. ``allow_transitive_transitions`` Type: ``bool`` Whether transition validation may accept transitive paths through the configured transition graph. RightsProfile ------------- .. autoclass:: teksi_hooks.models.rights.RightsProfile :members: Fields ~~~~~~ ``identifier`` Type: ``str`` Unique identifier of the entity to which the rights profile applies. If None, defaults to the template path. ``provider_rights_path`` Type: ``Path`` Path to the provider rights yaml. If None, defaults to the template path. ``provider_privileges_path`` Type: ``Path`` Path to the provider privilege yaml. If None, defaults to the template path.