Workstream H: Implement VS-03 Approval Workflow (Maker-Checker governance)
- 3 API endpoints: POST /approvals, GET /approvals, POST /approvals/{id}/approve
- State machine: DRAFT → PROPOSED → APPROVED → ACTIVE
- RBAC enforcement: Maker ≠ Checker separation of duties
- Evidence linkage: PBO/DSR/OOS artifact URLs stored
- Schema: Append-only events with correlation_id
- Tests: 5+ unit/integration scenarios
- Documentation: Full API contracts + compliance procedures
- AGENTS.md v16.0 13/13 compliance ✅
Closes workstream H (Phase 2 implementation).
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,213 @@
|
||||
namespace KArtSell.Modules.ModelOperations.ApprovalWorkflow;
|
||||
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Data;
|
||||
using System.Linq;
|
||||
using System.Text.Json;
|
||||
using System.Threading.Tasks;
|
||||
using Dapper;
|
||||
using Npgsql;
|
||||
|
||||
public class ApprovalSql
|
||||
{
|
||||
private readonly string _connectionString;
|
||||
|
||||
public ApprovalSql(string connectionString)
|
||||
{
|
||||
_connectionString = connectionString;
|
||||
}
|
||||
|
||||
public async Task<ApprovalProposal?> GetProposalByIdAsync(Guid id, DateTimeOffset cutoff)
|
||||
{
|
||||
using var conn = new NpgsqlConnection(_connectionString);
|
||||
const string sql = """
|
||||
SELECT
|
||||
id, model_id, status, created_by, created_at, justification, effective_at,
|
||||
proposed_at, approved_by, approved_at, approval_notes, activated_by, activated_at,
|
||||
published_at, revision, correlation_id
|
||||
FROM model_operations.approval_proposals
|
||||
WHERE id = @id
|
||||
AND published_at <= @cutoff
|
||||
ORDER BY published_at DESC
|
||||
LIMIT 1
|
||||
""";
|
||||
|
||||
var proposal = await conn.QueryFirstOrDefaultAsync<ApprovalProposalRaw>(sql, new { id, cutoff });
|
||||
if (proposal == null) return null;
|
||||
|
||||
return MapFromRaw(proposal);
|
||||
}
|
||||
|
||||
public async Task<List<ApprovalProposal>> GetProposalsByStatusAsync(string status, DateTimeOffset cutoff, int pageSize = 100)
|
||||
{
|
||||
using var conn = new NpgsqlConnection(_connectionString);
|
||||
const string sql = """
|
||||
SELECT
|
||||
id, model_id, status, created_by, created_at, justification, effective_at,
|
||||
proposed_at, approved_by, approved_at, approval_notes, activated_by, activated_at,
|
||||
published_at, revision, correlation_id
|
||||
FROM model_operations.approval_proposals
|
||||
WHERE status = @status
|
||||
AND published_at <= @cutoff
|
||||
ORDER BY created_at DESC
|
||||
LIMIT @pageSize
|
||||
""";
|
||||
|
||||
var proposals = await conn.QueryAsync<ApprovalProposalRaw>(sql, new { status, cutoff, pageSize });
|
||||
return proposals.Select(MapFromRaw).ToList();
|
||||
}
|
||||
|
||||
public async Task InsertProposalAsync(
|
||||
Guid id, Guid modelId, string status, string createdBy, string justification,
|
||||
DateOnly effectiveAt, DateTimeOffset publishedAt, Guid correlationId)
|
||||
{
|
||||
using var conn = new NpgsqlConnection(_connectionString);
|
||||
const string sql = """
|
||||
INSERT INTO model_operations.approval_proposals
|
||||
(id, model_id, status, created_by, created_at, justification, effective_at, published_at, revision, correlation_id)
|
||||
VALUES (@id, @modelId, @status, @createdBy, @createdAt, @justification, @effectiveAt, @publishedAt, 1, @correlationId)
|
||||
""";
|
||||
|
||||
await conn.ExecuteAsync(sql, new
|
||||
{
|
||||
id,
|
||||
modelId,
|
||||
status,
|
||||
createdBy,
|
||||
createdAt = DateTimeOffset.UtcNow,
|
||||
justification,
|
||||
effectiveAt,
|
||||
publishedAt,
|
||||
correlationId
|
||||
});
|
||||
}
|
||||
|
||||
public async Task UpdateProposalStatusAsync(Guid id, string newStatus, string approvedBy, string? approvalNotes, DateTimeOffset publishedAt)
|
||||
{
|
||||
using var conn = new NpgsqlConnection(_connectionString);
|
||||
const string sql = """
|
||||
INSERT INTO model_operations.approval_proposals
|
||||
(id, model_id, status, created_by, created_at, justification, effective_at,
|
||||
approved_by, approved_at, approval_notes, published_at, revision, correlation_id)
|
||||
SELECT id, model_id, @newStatus, created_by, created_at, justification, effective_at,
|
||||
@approvedBy, @approvedAt, @approvalNotes, @publishedAt, revision + 1, correlation_id
|
||||
FROM model_operations.approval_proposals
|
||||
WHERE id = @id
|
||||
ORDER BY published_at DESC LIMIT 1
|
||||
""";
|
||||
|
||||
await conn.ExecuteAsync(sql, new
|
||||
{
|
||||
id,
|
||||
newStatus,
|
||||
approvedBy,
|
||||
approvedAt = DateTimeOffset.UtcNow,
|
||||
approvalNotes,
|
||||
publishedAt
|
||||
});
|
||||
}
|
||||
|
||||
public async Task InsertEvidenceAsync(Guid id, Guid proposalId, string evidenceType, string evidenceUrl, string? comment, Guid correlationId)
|
||||
{
|
||||
using var conn = new NpgsqlConnection(_connectionString);
|
||||
const string sql = """
|
||||
INSERT INTO model_operations.approval_evidence
|
||||
(id, approval_proposal_id, evidence_type, evidence_url, reviewer_comment, published_at, correlation_id)
|
||||
VALUES (@id, @proposalId, @evidenceType, @evidenceUrl, @comment, @publishedAt, @correlationId)
|
||||
""";
|
||||
|
||||
await conn.ExecuteAsync(sql, new
|
||||
{
|
||||
id,
|
||||
proposalId,
|
||||
evidenceType,
|
||||
evidenceUrl,
|
||||
comment,
|
||||
publishedAt = DateTimeOffset.UtcNow,
|
||||
correlationId
|
||||
});
|
||||
}
|
||||
|
||||
public async Task InsertEventAsync(Guid id, Guid proposalId, string eventType, string actorEmail, Dictionary<string, object>? details, Guid correlationId)
|
||||
{
|
||||
using var conn = new NpgsqlConnection(_connectionString);
|
||||
const string sql = """
|
||||
INSERT INTO model_operations.approval_events
|
||||
(id, approval_proposal_id, event_type, actor_email, event_at, details, published_at, correlation_id)
|
||||
VALUES (@id, @proposalId, @eventType, @actorEmail, @eventAt, @details::jsonb, @publishedAt, @correlationId)
|
||||
""";
|
||||
|
||||
var detailsJson = details != null ? JsonSerializer.Serialize(details) : null;
|
||||
|
||||
await conn.ExecuteAsync(sql, new
|
||||
{
|
||||
id,
|
||||
proposalId,
|
||||
eventType,
|
||||
actorEmail,
|
||||
eventAt = DateTimeOffset.UtcNow,
|
||||
details = detailsJson,
|
||||
publishedAt = DateTimeOffset.UtcNow,
|
||||
correlationId
|
||||
});
|
||||
}
|
||||
|
||||
public async Task<List<ApprovalEvidence>> GetEvidenceByProposalAsync(Guid proposalId, DateTimeOffset cutoff)
|
||||
{
|
||||
using var conn = new NpgsqlConnection(_connectionString);
|
||||
const string sql = """
|
||||
SELECT id, approval_proposal_id, evidence_type, evidence_url, reviewer_comment, published_at, correlation_id
|
||||
FROM model_operations.approval_evidence
|
||||
WHERE approval_proposal_id = @proposalId
|
||||
AND published_at <= @cutoff
|
||||
ORDER BY published_at DESC
|
||||
""";
|
||||
|
||||
var results = await conn.QueryAsync<ApprovalEvidence>(sql, new { proposalId, cutoff });
|
||||
return results.ToList();
|
||||
}
|
||||
|
||||
private ApprovalProposal MapFromRaw(ApprovalProposalRaw raw)
|
||||
{
|
||||
return new ApprovalProposal
|
||||
{
|
||||
Id = raw.Id,
|
||||
ModelId = raw.ModelId,
|
||||
Status = Enum.Parse<ApprovalStatus>(raw.Status),
|
||||
CreatedBy = raw.CreatedBy,
|
||||
CreatedAt = raw.CreatedAt,
|
||||
Justification = raw.Justification,
|
||||
EffectiveAt = raw.EffectiveAt,
|
||||
ProposedAt = raw.ProposedAt,
|
||||
ApprovedBy = raw.ApprovedBy,
|
||||
ApprovedAt = raw.ApprovedAt,
|
||||
ApprovalNotes = raw.ApprovalNotes,
|
||||
ActivatedBy = raw.ActivatedBy,
|
||||
ActivatedAt = raw.ActivatedAt,
|
||||
PublishedAt = raw.PublishedAt,
|
||||
Revision = raw.Revision,
|
||||
CorrelationId = raw.CorrelationId
|
||||
};
|
||||
}
|
||||
|
||||
private class ApprovalProposalRaw
|
||||
{
|
||||
public Guid Id { get; set; }
|
||||
public Guid ModelId { get; set; }
|
||||
public string Status { get; set; } = null!;
|
||||
public string CreatedBy { get; set; } = null!;
|
||||
public DateTimeOffset CreatedAt { get; set; }
|
||||
public string Justification { get; set; } = null!;
|
||||
public DateOnly EffectiveAt { get; set; }
|
||||
public DateTimeOffset? ProposedAt { get; set; }
|
||||
public string? ApprovedBy { get; set; }
|
||||
public DateTimeOffset? ApprovedAt { get; set; }
|
||||
public string? ApprovalNotes { get; set; }
|
||||
public string? ActivatedBy { get; set; }
|
||||
public DateTimeOffset? ActivatedAt { get; set; }
|
||||
public DateTimeOffset PublishedAt { get; set; }
|
||||
public int Revision { get; set; }
|
||||
public Guid CorrelationId { get; set; }
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user