velocity-python 0.4.0__py3-none-any.whl → 0.4.1__py3-none-any.whl

velocity/__init__.py

@@ -1,4 +1,4 @@
-__version__ = version = "0.4.0"
+__version__ = version = "0.4.1"
 
 import importlib as _importlib
 

velocity/workflow/access.py

@@ -288,8 +288,15 @@ def act_relations(
         if kind == "hold":
             hold = tx.table(engine.HOLD).find({"sys_id": ident})
             if hold is not None and hold["docket_id"] == docket["sys_id"]:
+                # the relation only; the engine decides the hold's own
+                # release_permission with the actor's bound authz
                 if engine.hold_owner_of(
-                    actor, route, dict(hold.to_dict()), docket.get("entity")
+                    actor,
+                    route,
+                    dict(hold.to_dict()),
+                    docket.get("entity"),
+                    docket=docket,
+                    check_permission=False,
                 ):
                     out.add(HOLD_OWNER)
             return frozenset(out)

velocity/workflow/engine.py

@@ -891,10 +891,15 @@ def may_release(actor: Actor, route: Route, hold, docket, effect) -> bool:
         return False
     if actor.kind != "person" or not in_scope(actor, docket.get("entity")):
         return False
+    held = hold.get("release_permission")
+    if held and not actor.may(HOLD_RELEASE, held, docket):
+        return False  # the hold's own permission binds every way out
     permission = effect.get("release_permission")
     if permission:
         return actor.may(HOLD_RELEASE, permission, docket)
-    return hold_owner_of(actor, route, hold, docket.get("entity"))
+    return hold_owner_of(
+        actor, route, hold, docket.get("entity"), docket=docket, direct=False
+    )
 
 
 def _release_effects(item: Pass):
@@ -1659,16 +1664,43 @@ def problem_owner_of(actor: Actor, route: Route, position) -> bool:
     )
 
 
-def hold_owner_of(actor: Actor, route: Route, hold, entity) -> bool:
+RELEASE_ANY, RELEASE_VIA_EFFECT = "any", "effect"
+
+
+def hold_owner_of(
+    actor: Actor,
+    route: Route,
+    hold,
+    entity,
+    *,
+    docket=None,
+    direct=True,
+    check_permission=True,
+) -> bool:
     """Who may release a manual hold on a docket of ``entity``: its owner
-    role, its placer, a route owner — inside their entities."""
+    role, its placer, a route owner, an authorized override — inside their
+    entities, and subject to the hold's own release controls:
+
+    * ``release_via="effect"``: never released directly (the
+      ``hold:<id>:release`` action, ``direct=True``), only by a pass effect;
+    * ``release_permission``: whoever releases it must also be allowed that
+      permission through authz (:data:`HOLD_RELEASE`, with the docket's
+      entity scope) — a route owner or an override included. Needs
+      ``docket``; ``check_permission=False`` is only for computing an authz
+      relation, the engine then decides with the actor's own ``allows``."""
     if actor.kind != "person" or str(hold.get("release_rule") or "") not in (
         "",
         "manual",
     ):
         return False
+    if direct and (hold.get("release_via") or RELEASE_ANY) == RELEASE_VIA_EFFECT:
+        return False
     if not in_scope(actor, entity):
         return False
+    permission = hold.get("release_permission")
+    if permission and check_permission:
+        if docket is None or not actor.may(HOLD_RELEASE, permission, docket):
+            return False
     if actor.override:
         return True
     return (
@@ -1777,7 +1809,7 @@ def actions_for(tx, docket, route: Route, actor: Actor, *, positions=None, now=N
                 }
             )
     for hold in holds_of(tx, docket["sys_id"]):
-        if hold_owner_of(actor, route, hold, docket.get("entity")):
+        if hold_owner_of(actor, route, hold, docket.get("entity"), docket=docket):
             out.append(
                 _action(
                     f"hold:{hold['sys_id']}:release",
@@ -2217,11 +2249,28 @@ def place_hold(
     blocks=None,
     releases_when=None,
     label=None,
+    release_permission=None,
+    release_via=RELEASE_ANY,
     now=None,
 ) -> int:
     """Place a manual hold; returns its id. ``blocks``: the pass codes it
-    blocks (default every forward, branch and rejoin pass)."""
+    blocks (default every forward, branch and rejoin pass).
+
+    Release controls: ``release_permission`` — whoever releases it (owner,
+    route owner, override, or a pass effect) must be allowed that permission
+    through authz (``workflow.hold.release``); ``release_via="effect"`` —
+    only a pass's ``release_hold`` effect releases it, so its pass's guards
+    always apply: the direct ``hold:<id>:release`` action is never offered
+    and is refused if sent."""
     hooks.check_code(kind, "hold kind")
+    if release_via not in (RELEASE_ANY, RELEASE_VIA_EFFECT):
+        raise WorkflowError(
+            f"release_via must be {RELEASE_ANY!r} or {RELEASE_VIA_EFFECT!r}"
+        )
+    if release_permission is not None and (
+        not isinstance(release_permission, str) or not release_permission.strip()
+    ):
+        raise WorkflowError("release_permission must be a permission name")
     ctx = _Ctx(tx, now)
     docket = _docket(tx, docket_id, lock=True)
     row = tx.table(HOLD).new(
@@ -2236,6 +2285,8 @@ def place_hold(
             "release_rule": "manual",
             "releases_when": releases_when,
             "blocks": list(blocks) if blocks else None,
+            "release_permission": release_permission,
+            "release_via": release_via,
         }
     )
     _mark(ctx, docket, actor, "hold", outcome=kind, note=str(reason or kind))

velocity/workflow/schema.py

@@ -317,6 +317,10 @@ SCHEMA = {
             "released_by": "TEXT",
             "released_at": TS,
             "blocks": "JSONB",
+            # release controls: a permission any release needs, and
+            # "effect" = only a pass effect may release it (no direct action)
+            "release_permission": "TEXT",
+            "release_via": "TEXT",
             "link_id": "BIGINT",
             "rule_pack": "TEXT",
             "rule_version": "INTEGER",

{velocity_python-0.4.0.dist-info → velocity_python-0.4.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.4.0
+Version: 0.4.1
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.4.0.dist-info → velocity_python-0.4.1.dist-info}/RECORD

@@ -1,4 +1,4 @@
-velocity/__init__.py,sha256=MxII3QHZeqUP7s3RLjEAxRW17ILOJ6d5n8RiVCGfUsw,362
+velocity/__init__.py,sha256=cKKghorIQ6KmDenkl1684EwlR7g6o3H-aBxwT9VLk5o,362
 velocity/cache.py,sha256=pthvw7gDVEXRzkTcQtA5YVf4Q1IxAamWsba4UReT0RE,8933
 velocity/hooks.py,sha256=jY_qtAapNHvptmryFSD-Zc7RvLhV6e5nJEH3x2xTgCw,20575
 velocity/logging.py,sha256=MAsZap1cDSdOBNRc_9ezQxup5dHOS0ARxU9NI_-UK3E,4037
@@ -239,18 +239,18 @@ velocity/rules/storage.py,sha256=dCWhN6g5_kQCTWy66CgpyNmIwrTY1VsVsMPXKoaiO6U,130
 velocity/testing/__init__.py,sha256=WtYMDHgCLxOq6mlemcOYV5Y9HqF_2QQgSfuAjFRg69Q,731
 velocity/testing/fake_db.py,sha256=phgdulk5owf3noUDpEfI7yFsVcKxRGZ82f2BJPYnaiU,53226
 velocity/workflow/__init__.py,sha256=yVB00hLDhKmQnUGIwEHtwUcwk9MS79M3S0l5SGI9icc,3704
-velocity/workflow/access.py,sha256=GIc5I0McBGpf24cHKAkImKgmlSUGi4dd4a8WKXPemP8,12391
+velocity/workflow/access.py,sha256=OPmcFTKvGP6mQnQTzPZjbPAi6TfrYUu1e4UkI8EqWy4,12668
 velocity/workflow/contract.py,sha256=PoWfQ8lseAZU0WLJiNOvgyJ2ZDDq7e6Ji2r497oap6w,38904
 velocity/workflow/definitions.py,sha256=2UXxd7dQLdBi8X5H0_W1Qo4cmXJVlDpzLhpBdsbbUqs,31979
-velocity/workflow/engine.py,sha256=wOxcceGYZuY3Kwi8hsoIzVhq-f93aQMwPv9WXjN0Rp8,121731
+velocity/workflow/engine.py,sha256=XGnEfBIGKAWMgq5pJsbSoYy86vYj2yaiLqRZq7v-lhg,123922
 velocity/workflow/hooks.py,sha256=0lDMuAE-OwL1_M8wnylU46zBgOooJomVErPUaqdfR1c,14995
 velocity/workflow/notices.py,sha256=hTCVKyZn7ScJNPSgPYaa14QTRxKH5VHwAgNnV6xHW8E,13825
 velocity/workflow/outbox.py,sha256=R-DmdeVETYZc0u__OXxhKyeLgM1Cwq555-RqAFTW7h0,9412
 velocity/workflow/points.py,sha256=g_vQ3cdHdx_JloVCS5dVjo_jJoSolO92K5p3suDzxlE,10654
-velocity/workflow/schema.py,sha256=ZhL7MiKi0zMyH0Uc2qjCGnOS7JIqlFr8X3omWF67_Ko,20238
-velocity_python-0.4.0.dist-info/licenses/LICENSE,sha256=aoN245GG8s9oRUU89KNiGTU4_4OtnNmVi4hQeChg6rM,1076
-velocity_python-0.4.0.dist-info/METADATA,sha256=_u6t02AcR7Dx_mcAwcolHJgrJruVyzkCrt30IOUyE70,17820
-velocity_python-0.4.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
-velocity_python-0.4.0.dist-info/entry_points.txt,sha256=nXUKJHkOGQCSPoagdmMNd_qycrle1LVU-GhYknLGM1M,56
-velocity_python-0.4.0.dist-info/top_level.txt,sha256=JW2vJPmodgdgSz7H6yoZvnxF8S3fTMIv-YJWCT1sNW0,9
-velocity_python-0.4.0.dist-info/RECORD,,
+velocity/workflow/schema.py,sha256=AY1VkRFRuddL9egJHh8-cdrh8-tDsg2MLDs0ihEKskc,20461
+velocity_python-0.4.1.dist-info/licenses/LICENSE,sha256=aoN245GG8s9oRUU89KNiGTU4_4OtnNmVi4hQeChg6rM,1076
+velocity_python-0.4.1.dist-info/METADATA,sha256=1P5cdnKxBa7go3LyXCa-_ywsXyoTOz5W1woGwpeo5Og,17820
+velocity_python-0.4.1.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+velocity_python-0.4.1.dist-info/entry_points.txt,sha256=nXUKJHkOGQCSPoagdmMNd_qycrle1LVU-GhYknLGM1M,56
+velocity_python-0.4.1.dist-info/top_level.txt,sha256=JW2vJPmodgdgSz7H6yoZvnxF8S3fTMIv-YJWCT1sNW0,9
+velocity_python-0.4.1.dist-info/RECORD,,