trueppm-api 0.4.0b2__py3-none-any.whl

trueppm_api/apps/projects/asset_views.py

@@ -0,0 +1,317 @@
+"""Unified Assets endpoints — project, program, and workspace scope (ADR-0215; ADR-0428).
+
+Read-only aggregation of every task's files (``TaskAttachment``) and external
+links (``TaskLink``) into one paginated, filterable ``AssetItem`` feed:
+
+- ``GET /api/v1/projects/{project_pk}/assets/`` — any project member (Viewer+).
+- ``GET /api/v1/programs/{program_pk}/assets/`` — any program member, narrowed to
+  the caller's *readable* member projects (the audited ``task_search`` pattern),
+  so a program member with no readable child projects gets an empty list, never a
+  403 leak.
+- ``GET /api/v1/assets/`` — the workspace tier (ADR-0428): the caller's *own*
+  visible-assets collection across **every** project they can read, narrowed by
+  the same ``ProjectMembership`` pattern extended from program- to instance-scope.
+  Adds a ``mine`` filter (assets on the caller's assigned tasks) and a ``program``
+  filter. Strictly RBAC-identical — it returns nothing the caller cannot already
+  read per-project, so it is OSS convenience aggregation, **not** portfolio
+  governance (no health/comparison analytics, no actor dimension, no audit trail —
+  those remain the Enterprise asset register; see ADR-0428).
+
+The two nested views are dedicated ``APIView``\\s (not ``@action``\\s) — matching the
+closest precedent, the unified changelog (``history/views.py``): both are read-only
+cross-table keyset merges wired under a ``{scope}_pk`` nested path. The nested-path
+kwarg lets ``IsProjectMember`` / ``IsProgramMember`` gate membership at
+``has_permission`` (a non-member gets 403 before the query runs), and
+``check_object_permissions`` re-enforces it on the resolved object for defense in
+depth. The workspace view has no path pk, so RBAC lives entirely in the readable-
+projects narrowing rather than an object permission.
+"""
+
+from __future__ import annotations
+
+import uuid
+from typing import Any
+
+from django.shortcuts import get_object_or_404
+from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
+from rest_framework.exceptions import ValidationError as DRFValidationError
+from rest_framework.permissions import IsAuthenticated
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from trueppm_api.apps.access.models import ProjectMembership
+from trueppm_api.apps.access.permissions import (
+    IsProgramMember,
+    IsProjectMember,
+    McpReadableViewMixin,
+    McpScope,
+)
+from trueppm_api.apps.projects import asset_feed
+from trueppm_api.apps.projects.asset_feed import AssetFeedResponseSerializer, build_asset_feed
+from trueppm_api.apps.projects.models import Program, Project
+
+_ASSET_PARAMS = [
+    OpenApiParameter(
+        "kind", str, description="Restrict to a single kind: 'file' or 'link'. Default: both."
+    ),
+    OpenApiParameter(
+        "label", str, description="Restrict to links carrying this exact label (link-only)."
+    ),
+    OpenApiParameter(
+        "provider", str, description="Restrict to links from this provider (link-only)."
+    ),
+    OpenApiParameter(
+        "q",
+        str,
+        description="Case-insensitive substring matched against title/url on both sources.",
+    ),
+    OpenApiParameter(
+        "cursor",
+        str,
+        description=(
+            "Opaque keyset cursor from a prior response's next_cursor. Stable across "
+            "concurrent writes; persistable; 400 if malformed."
+        ),
+    ),
+    OpenApiParameter("page_size", int, description="Page size (1..100, default 50)."),
+]
+
+
+def _parse_asset_params(request: Request) -> dict[str, Any]:
+    """Validate + normalize the shared Assets query params into feed kwargs."""
+    params = request.query_params
+
+    kind = params.get("kind")
+    if kind is not None and kind not in asset_feed.KINDS:
+        raise DRFValidationError({"kind": "Must be 'file' or 'link'."})
+
+    page_size_raw = params.get("page_size")
+    if page_size_raw:
+        try:
+            page_size = int(page_size_raw)
+        except (TypeError, ValueError) as err:
+            raise DRFValidationError({"page_size": "Must be an integer."}) from err
+    else:
+        page_size = asset_feed.DEFAULT_PAGE_SIZE
+
+    cursor_raw = params.get("cursor")
+    cursor = asset_feed.AssetCursor.decode(cursor_raw) if cursor_raw else None
+
+    return {
+        "kind": kind,
+        "label": params.get("label"),
+        "provider": params.get("provider"),
+        "q": params.get("q"),
+        "cursor": cursor,
+        "page_size": page_size,
+    }
+
+
+def _asset_response(entries: list[dict[str, Any]], next_cursor: Any) -> Response:
+    serializer = AssetFeedResponseSerializer(
+        {
+            "results": entries,
+            "next_cursor": next_cursor.encode() if next_cursor is not None else None,
+        }
+    )
+    return Response(serializer.data)
+
+
+class ProjectAssetsView(APIView):
+    """Unified Assets feed for a single project (ADR-0215).
+
+    ``GET /api/v1/projects/{project_pk}/assets/?kind=&label=&provider=&q=&cursor=&page_size=``
+
+    Any project member (Viewer+) may read; a non-member gets 403 (membership is
+    checked at ``has_permission`` via the ``project_pk`` kwarg). Archived projects
+    stay readable — this is a read-only browse surface (``IsProjectNotArchived`` is
+    deliberately omitted, matching the history/changelog reads).
+    """
+
+    permission_classes = [IsAuthenticated, IsProjectMember]  # noqa: RUF012
+
+    @extend_schema(
+        summary="Unified Assets feed for a project (files + external links, cursor-paginated)",
+        parameters=_ASSET_PARAMS,
+        responses={200: OpenApiResponse(AssetFeedResponseSerializer)},
+    )
+    def get(self, request: Request, project_pk: str) -> Response:
+        project = get_object_or_404(Project, pk=project_pk, is_deleted=False)
+        self.check_object_permissions(request, project)
+        params = _parse_asset_params(request)
+        entries, next_cursor = build_asset_feed([project.pk], **params)
+        return _asset_response(entries, next_cursor)
+
+
+class ProgramAssetsView(APIView):
+    """Unified Assets feed across a program's member projects (ADR-0215).
+
+    ``GET /api/v1/programs/{program_pk}/assets/?kind=&label=&provider=&q=&cursor=&page_size=``
+
+    Any program member reaches the endpoint; results are narrowed to the caller's
+    **readable** member projects (the audited ``ProgramViewSet.task_search``
+    pattern) so no asset from a project the caller cannot read leaks through. A
+    program member with no readable child projects gets an empty list, never a
+    403. Cross-program / portfolio rollups are Enterprise and out of scope.
+    """
+
+    permission_classes = [IsAuthenticated, IsProgramMember]  # noqa: RUF012
+
+    @extend_schema(
+        summary="Unified Assets feed for a program (files + external links across member projects)",
+        parameters=_ASSET_PARAMS,
+        responses={200: OpenApiResponse(AssetFeedResponseSerializer)},
+    )
+    def get(self, request: Request, program_pk: str) -> Response:
+        program = get_object_or_404(Program, pk=program_pk, is_deleted=False)
+        self.check_object_permissions(request, program)
+
+        # Readable member projects only (ADR-0120 D5 / task_search): a single
+        # ProjectMembership query resolves the whole program's readable set; a
+        # member project the caller cannot read is simply not aggregated.
+        #
+        # Draft projects are deliberately KEPT (#3144; reasoning recorded in
+        # projects.lifecycle). These rows are the member's own browse list, which
+        # the exclusion list exempts: the feed emits no count, health band or
+        # ranking, and nothing downstream of an asset row moves a schedule. The
+        # workspace tier below answers the same, because it is this feed at a wider
+        # scope. Note this view is NOT MCP-readable — the MCP carve-out justifies
+        # only the workspace tier; the browse-list argument is what carries this one.
+        readable_ids = list(
+            ProjectMembership.objects.filter(
+                project__program=program,
+                project__is_deleted=False,
+                # IsProgramMember has already established an authenticated user.
+                user=request.user,  # type: ignore[misc]
+                is_deleted=False,
+            ).values_list("project_id", flat=True)
+        )
+        params = _parse_asset_params(request)
+        entries, next_cursor = build_asset_feed(readable_ids, **params)
+        return _asset_response(entries, next_cursor)
+
+
+_TRUE_VALUES = frozenset({"true", "1", "yes"})
+_FALSE_VALUES = frozenset({"false", "0", "no", ""})
+
+_WORKSPACE_ASSET_PARAMS = [
+    *_ASSET_PARAMS,
+    OpenApiParameter(
+        "mine",
+        bool,
+        description=(
+            "When true, restrict to assets on tasks assigned to the requesting user "
+            "(the 'My Assets' view). Scoped to the caller only — there is no way to "
+            "query another user's assets. Default: false (all readable assets)."
+        ),
+    ),
+    OpenApiParameter(
+        "program",
+        str,
+        description=(
+            "Restrict to assets in one program's projects (UUID). Still narrowed to "
+            "the caller's readable projects, so an unknown or unreadable program "
+            "yields an empty page, never a 403."
+        ),
+    ),
+]
+
+
+def _parse_mine(request: Request) -> bool:
+    """Parse the ``mine`` flag; reject anything that is not an explicit boolean."""
+    raw = request.query_params.get("mine")
+    if raw is None:
+        return False
+    lowered = raw.strip().lower()
+    if lowered in _TRUE_VALUES:
+        return True
+    if lowered in _FALSE_VALUES:
+        return False
+    raise DRFValidationError({"mine": "Must be a boolean ('true' or 'false')."})
+
+
+def _parse_program(request: Request) -> uuid.UUID | None:
+    """Parse the optional ``program`` UUID filter; 400 on a malformed value."""
+    raw = request.query_params.get("program")
+    if not raw:
+        return None
+    try:
+        return uuid.UUID(raw)
+    except (TypeError, ValueError) as err:
+        raise DRFValidationError({"program": "Must be a valid UUID."}) from err
+
+
+class WorkspaceAssetsView(McpReadableViewMixin, APIView):
+    """Unified Assets feed across every project the caller can read (ADR-0428).
+
+    ``GET /api/v1/assets/?mine=&program=&kind=&label=&provider=&q=&cursor=&page_size=``
+
+    The workspace tier of the Assets surface. Any authenticated user reaches the
+    endpoint; results are narrowed to the caller's **readable** projects via the
+    same ``ProjectMembership`` pattern the program view uses, extended from a single
+    program to the whole instance. A user with no readable projects gets an empty
+    list, never a 403 — and the feed can never surface an asset from a project the
+    caller cannot already open, so it grants **no new reach** (this is what keeps it
+    OSS rather than portfolio governance; ADR-0428).
+
+    **RBAC contract (mirrors ``MeWorkView``)**: with ``mine=true`` the feed is
+    hard-scoped to ``task.assignee = request.user``; there is no ``?user=`` escape
+    hatch, so it can never be used as a cross-team surveillance surface (Morgan's
+    boundary). ``McpReadableViewMixin`` additionally exposes the read to ``mcp:read``
+    tokens with a per-token throttle (the agent asset-index use case) while leaving
+    human traffic on the default ``user`` throttle.
+    """
+
+    # ADR-0678 (#2482): workspace-wide asset roll-up; scoped explicitly.
+    mcp_scope = McpScope.AGGREGATE
+
+    permission_classes = [IsAuthenticated]  # noqa: RUF012
+
+    @extend_schema(
+        summary="Unified Assets feed across all readable projects (workspace scope)",
+        parameters=_WORKSPACE_ASSET_PARAMS,
+        responses={200: OpenApiResponse(AssetFeedResponseSerializer)},
+    )
+    def get(self, request: Request) -> Response:
+        mine = _parse_mine(request)
+        program_id = _parse_program(request)
+
+        # Readable projects across the whole instance (the program view's narrowing
+        # with the ``project__program=`` clause dropped). ``program`` re-applies a
+        # single-program narrowing on top when present. IsAuthenticated guarantees a
+        # concrete user; filter on ``user.pk`` so mypy sees a concrete id.
+        #
+        # Draft projects are deliberately KEPT (#3144), the same answer as the
+        # program tier because this is that feed with the program clause dropped.
+        # Excluding would create a visibility discontinuity at the commit moment: a
+        # file you attached to your own draft vanishes from the surface built to
+        # find it and returns when somebody else commits the plan.
+        # ``McpScope.AGGREGATE`` is an ADR-0678 token-scope declaration, not a claim
+        # that this is a statistical aggregate; the MCP read surface is exempt from
+        # the draft exclusion list outright (projects.lifecycle), and an operator
+        # who wants a project out of an agent's index uses the opt-out below.
+        user_pk = request.user.pk or -1
+        memberships = ProjectMembership.objects.filter(
+            user_id=user_pk,
+            is_deleted=False,
+            project__is_deleted=False,
+        )
+        if program_id is not None:
+            memberships = memberships.filter(project__program_id=program_id)
+        # ADR-0678 (#2482): McpScope.AGGREGATE — this feed spans every project the
+        # caller belongs to and is assembled by hand, so the mixin's row filter
+        # cannot reach it. An agent token never sees assets from an opted-out
+        # project; a human caller is unaffected (helper returns None).
+        from trueppm_api.apps.projects.mcp_settings import mcp_excluded_project_ids
+
+        mcp_excluded = mcp_excluded_project_ids(request)
+        if mcp_excluded is not None:
+            memberships = memberships.exclude(project_id__in=mcp_excluded)
+        readable_ids = list(memberships.values_list("project_id", flat=True))
+
+        params = _parse_asset_params(request)
+        if mine:
+            params["assignee_id"] = user_pk
+        entries, next_cursor = build_asset_feed(readable_ids, **params)
+        return _asset_response(entries, next_cursor)

trueppm_api/apps/projects/attachment_policy.py

@@ -0,0 +1,278 @@
+"""Workspace → Program → Project attachment-policy resolution (ADR-0153, #976).
+
+Two inheritable settings govern task file attachments:
+
+* ``attachments_enabled`` — whether file uploads are permitted at all. NULL on a
+  program/project means "inherit"; the Workspace root is non-null (default True).
+* ``allowed_attachment_types`` — the per-scope MIME allow-list. On a
+  program/project it is tri-state: ``None`` = inherit the parent's effective set,
+  ``[]`` = an explicit *empty* allow-list (attachments on, but no type permitted),
+  ``[...]`` = an explicit set. The resolver therefore tests ``is None``, never
+  truthiness — an empty list is a deliberate value, not "inherit".
+
+Both are resolved computed-on-read (ADR-0108) — there is no denormalized effective
+column to keep in sync. Clients (web, mobile, MCP) read the serializer's
+``effective_*`` / ``inherited_*`` fields and never re-implement this precedence.
+
+Precedence: project override → program override → workspace value → (for the
+type-list, the workspace seed, which itself defaults to
+:data:`SYSTEM_DEFAULT_ATTACHMENT_TYPES`).
+
+:data:`SYSTEM_ATTACHMENT_DENYLIST` is a non-overridable security floor: types in
+it (``text/html`` etc., active stored-XSS vectors) are subtracted from every
+resolved allow-list, so a workspace admin "widening" the policy can never
+re-admit them, in any edition.
+
+``ENFORCE`` (a workspace admin *locking* the policy so lower scopes cannot change
+it) is an Enterprise capability. OSS ships the neutral provider hook below and
+registers nothing, so ``ENFORCE`` degrades to ``SUGGEST`` (no lock). trueppm-
+enterprise registers a provider in its ``AppConfig.ready()`` — the same
+integrations-registry idiom as ``sharing_settings`` (ADR-0029/0030/0135). OSS
+never imports enterprise.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable, Iterable
+from typing import TYPE_CHECKING
+
+from trueppm_api.core.extension_providers import guard_single_provider
+
+if TYPE_CHECKING:
+    from trueppm_api.apps.projects.models import Program, Project
+    from trueppm_api.apps.workspace.models import Workspace
+
+#: The system seed allow-list — the floor of the inheritance chain and the
+#: Workspace column default (see ``Workspace._default_allowed_attachment_types``).
+#: This is the single source of truth for the historic hardcoded set; the
+#: attachment serializer aliases it as ``ALLOWED_ATTACHMENT_MIMES`` so the seed
+#: and the live default can never drift.
+SYSTEM_DEFAULT_ATTACHMENT_TYPES: frozenset[str] = frozenset(
+    {
+        "application/pdf",
+        "image/jpeg",
+        "image/png",
+        "image/webp",
+        "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+        "text/csv",
+        "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    }
+)
+
+#: Non-overridable security floor. These types are subtracted from every resolved
+#: allow-list and rejected by :func:`is_attachment_mime_allowed`, regardless of
+#: scope, policy, or edition — an admin "widen" can never re-admit them. They are
+#: active stored-XSS vectors when served same-origin (markup that can carry
+#: <script>). External *links* are served off-origin and are unaffected.
+SYSTEM_ATTACHMENT_DENYLIST: frozenset[str] = frozenset(
+    {
+        "text/html",
+        "application/xhtml+xml",
+        "image/svg+xml",
+    }
+)
+
+#: The two inheritable policy fields. The field name is identical on Workspace
+#: (non-null root), Program, and Project (nullable override).
+ATTACHMENT_POLICY_FIELDS = ("attachments_enabled", "allowed_attachment_types")
+
+# Enterprise registers a zero-arg predicate that returns True when attachment
+# policy enforcement is licensed/active. OSS leaves it None → enforcement
+# inactive, so a workspace ENFORCE policy never locks downstream overrides.
+_ENFORCEMENT_PROVIDER: Callable[[], bool] | None = None
+
+
+def register_attachment_policy_enforcement_provider(
+    provider: Callable[[], bool] | None,
+) -> None:
+    """Register (or clear) the enforcement provider. Enterprise calls this."""
+    global _ENFORCEMENT_PROVIDER
+    _ENFORCEMENT_PROVIDER = guard_single_provider(
+        _ENFORCEMENT_PROVIDER, provider, "attachment policy enforcement"
+    )
+
+
+def attachment_policy_enforcement_active() -> bool:
+    """True only when an enterprise provider is registered AND reports active.
+
+    OSS has no provider → always False, so a workspace ``ENFORCE`` policy never
+    locks downstream attachment overrides in the community edition.
+    """
+    return _ENFORCEMENT_PROVIDER is not None and bool(_ENFORCEMENT_PROVIDER())
+
+
+def _enforced(workspace: Workspace) -> bool:
+    """Whether the workspace value is a hard ceiling (Enterprise lock active)."""
+    from trueppm_api.apps.workspace.models import TermOverridePolicy
+
+    return (
+        workspace.attachments_override_policy == TermOverridePolicy.ENFORCE
+        and attachment_policy_enforcement_active()
+    )
+
+
+def _apply_denylist(types: Iterable[str]) -> list[str]:
+    """Subtract the non-overridable denylist and return a sorted, deduped list."""
+    return sorted({t for t in types} - SYSTEM_ATTACHMENT_DENYLIST)
+
+
+class DeniedAttachmentType(ValueError):
+    """Raised by :func:`clean_attachment_type_list` for a security-denied MIME.
+
+    The offending (normalized) MIME is the first arg, so serializers can surface a
+    clear 400 instead of silently storing a value the resolver would strip on read.
+    """
+
+
+def clean_attachment_type_list(value: Iterable[str]) -> list[str]:
+    """Normalize a write-side allow-list: lowercase, strip ``; charset=`` trailers,
+    drop blanks, de-duplicate, and return sorted.
+
+    Rejects any security-denied type by raising :class:`DeniedAttachmentType` — the
+    write-side mirror of the read-side denylist floor, so a denied MIME never lands
+    in a stored override (which would otherwise vanish on the next resolved read).
+    Shared by the Workspace, Program, and Project settings serializers.
+    """
+    cleaned: list[str] = []
+    for raw in value:
+        mime = (raw or "").split(";", 1)[0].strip().lower()
+        if not mime:
+            continue
+        if mime in SYSTEM_ATTACHMENT_DENYLIST:
+            raise DeniedAttachmentType(mime)
+        if mime not in cleaned:
+            cleaned.append(mime)
+    return sorted(cleaned)
+
+
+def _program_of(obj: Program | Project) -> Program | None:
+    """The program scope above ``obj`` (a Project's program), or None."""
+    from trueppm_api.apps.projects.models import Program
+
+    if not isinstance(obj, Program) and getattr(obj, "program_id", None):
+        return obj.program
+    return None
+
+
+# --- attachments_enabled (boolean) ----------------------------------------
+
+
+def resolve_attachments_enabled(
+    obj: Program | Project,
+    *,
+    workspace: Workspace | None = None,
+) -> bool:
+    """Resolve effective ``attachments_enabled`` for a program or project.
+
+    ``workspace`` may be passed to avoid re-loading the singleton per object when
+    resolving a list (the serializer caches it once); otherwise it is loaded here.
+    """
+    from trueppm_api.apps.workspace.models import Workspace
+
+    if workspace is None:
+        workspace = Workspace.load()
+
+    if _enforced(workspace):
+        return bool(workspace.attachments_enabled)
+
+    own = obj.attachments_enabled  # nullable override
+    if own is not None:
+        return bool(own)
+    return _parent_enabled(obj, workspace)
+
+
+def resolve_inherited_attachments_enabled(
+    obj: Program | Project,
+    *,
+    workspace: Workspace | None = None,
+) -> bool:
+    """Value ``obj`` would inherit if its own override were cleared.
+
+    Drives the settings "Inherit (On/Off)" affordance — it deliberately skips
+    ``obj``'s own override and resolves from the parent up.
+    """
+    from trueppm_api.apps.workspace.models import Workspace
+
+    if workspace is None:
+        workspace = Workspace.load()
+
+    if _enforced(workspace):
+        return bool(workspace.attachments_enabled)
+    return _parent_enabled(obj, workspace)
+
+
+def _parent_enabled(obj: Program | Project, workspace: Workspace) -> bool:
+    program = _program_of(obj)
+    if program is not None and program.attachments_enabled is not None:
+        return bool(program.attachments_enabled)
+    return bool(workspace.attachments_enabled)
+
+
+# --- allowed_attachment_types (list, tri-state on children) ----------------
+
+
+def resolve_effective_attachment_types(
+    obj: Program | Project,
+    *,
+    workspace: Workspace | None = None,
+) -> list[str]:
+    """Resolve the effective allow-list for a program or project (denylist applied).
+
+    Tri-state on children: ``None`` = inherit, ``[]`` = explicit empty (no type
+    allowed), ``[...]`` = explicit set — so the test is ``is not None``, never
+    truthiness.
+    """
+    from trueppm_api.apps.workspace.models import Workspace
+
+    if workspace is None:
+        workspace = Workspace.load()
+
+    if _enforced(workspace):
+        base: Iterable[str] = workspace.allowed_attachment_types or []
+    else:
+        # Tri-state: None = inherit, [] = explicit empty, [...] = explicit set —
+        # so test ``is not None``, never truthiness ([] is a deliberate value).
+        own = obj.allowed_attachment_types
+        base = own if own is not None else _parent_types(obj, workspace)
+    return _apply_denylist(base)
+
+
+def resolve_inherited_attachment_types(
+    obj: Program | Project,
+    *,
+    workspace: Workspace | None = None,
+) -> list[str]:
+    """Allow-list ``obj`` would inherit if its own override were cleared."""
+    from trueppm_api.apps.workspace.models import Workspace
+
+    if workspace is None:
+        workspace = Workspace.load()
+
+    if _enforced(workspace):
+        return _apply_denylist(workspace.allowed_attachment_types or [])
+    return _apply_denylist(_parent_types(obj, workspace))
+
+
+def _parent_types(obj: Program | Project, workspace: Workspace) -> list[str]:
+    program = _program_of(obj)
+    if program is not None and program.allowed_attachment_types is not None:
+        return list(program.allowed_attachment_types)
+    return list(workspace.allowed_attachment_types or [])
+
+
+def is_attachment_mime_allowed(
+    obj: Program | Project,
+    mime: str,
+    *,
+    workspace: Workspace | None = None,
+) -> bool:
+    """The single enforcement predicate: is ``mime`` permitted for ``obj``?
+
+    Normalizes the MIME (drops any ``; charset=`` trailer, lowercases), rejects
+    anything on the security denylist outright, then checks the resolved
+    effective allow-list (which has already had the denylist subtracted).
+    """
+    norm = (mime or "").split(";", 1)[0].strip().lower()
+    if not norm or norm in SYSTEM_ATTACHMENT_DENYLIST:
+        return False
+    return norm in resolve_effective_attachment_types(obj, workspace=workspace)