Files
KArtSell.Aegis/src/KArtSell.Modules.ModelOperations/ApprovalWorkflow/ApprovalSql.cs
T
kjh2064 a2e742c78d Workstream H: Implement VS-03 Approval Workflow (Maker-Checker governance)
- 3 API endpoints: POST /approvals, GET /approvals, POST /approvals/{id}/approve
- State machine: DRAFT → PROPOSED → APPROVED → ACTIVE
- RBAC enforcement: Maker ≠ Checker separation of duties
- Evidence linkage: PBO/DSR/OOS artifact URLs stored
- Schema: Append-only events with correlation_id
- Tests: 5+ unit/integration scenarios
- Documentation: Full API contracts + compliance procedures
- AGENTS.md v16.0 13/13 compliance 

Closes workstream H (Phase 2 implementation).

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
2026-08-07 16:38:14 +09:00

214 lines
8.1 KiB
C#

namespace KArtSell.Modules.ModelOperations.ApprovalWorkflow;
using System;
using System.Collections.Generic;
using System.Data;
using System.Linq;
using System.Text.Json;
using System.Threading.Tasks;
using Dapper;
using Npgsql;
public class ApprovalSql
{
private readonly string _connectionString;
public ApprovalSql(string connectionString)
{
_connectionString = connectionString;
}
public async Task<ApprovalProposal?> GetProposalByIdAsync(Guid id, DateTimeOffset cutoff)
{
using var conn = new NpgsqlConnection(_connectionString);
const string sql = """
SELECT
id, model_id, status, created_by, created_at, justification, effective_at,
proposed_at, approved_by, approved_at, approval_notes, activated_by, activated_at,
published_at, revision, correlation_id
FROM model_operations.approval_proposals
WHERE id = @id
AND published_at <= @cutoff
ORDER BY published_at DESC
LIMIT 1
""";
var proposal = await conn.QueryFirstOrDefaultAsync<ApprovalProposalRaw>(sql, new { id, cutoff });
if (proposal == null) return null;
return MapFromRaw(proposal);
}
public async Task<List<ApprovalProposal>> GetProposalsByStatusAsync(string status, DateTimeOffset cutoff, int pageSize = 100)
{
using var conn = new NpgsqlConnection(_connectionString);
const string sql = """
SELECT
id, model_id, status, created_by, created_at, justification, effective_at,
proposed_at, approved_by, approved_at, approval_notes, activated_by, activated_at,
published_at, revision, correlation_id
FROM model_operations.approval_proposals
WHERE status = @status
AND published_at <= @cutoff
ORDER BY created_at DESC
LIMIT @pageSize
""";
var proposals = await conn.QueryAsync<ApprovalProposalRaw>(sql, new { status, cutoff, pageSize });
return proposals.Select(MapFromRaw).ToList();
}
public async Task InsertProposalAsync(
Guid id, Guid modelId, string status, string createdBy, string justification,
DateOnly effectiveAt, DateTimeOffset publishedAt, Guid correlationId)
{
using var conn = new NpgsqlConnection(_connectionString);
const string sql = """
INSERT INTO model_operations.approval_proposals
(id, model_id, status, created_by, created_at, justification, effective_at, published_at, revision, correlation_id)
VALUES (@id, @modelId, @status, @createdBy, @createdAt, @justification, @effectiveAt, @publishedAt, 1, @correlationId)
""";
await conn.ExecuteAsync(sql, new
{
id,
modelId,
status,
createdBy,
createdAt = DateTimeOffset.UtcNow,
justification,
effectiveAt,
publishedAt,
correlationId
});
}
public async Task UpdateProposalStatusAsync(Guid id, string newStatus, string approvedBy, string? approvalNotes, DateTimeOffset publishedAt)
{
using var conn = new NpgsqlConnection(_connectionString);
const string sql = """
INSERT INTO model_operations.approval_proposals
(id, model_id, status, created_by, created_at, justification, effective_at,
approved_by, approved_at, approval_notes, published_at, revision, correlation_id)
SELECT id, model_id, @newStatus, created_by, created_at, justification, effective_at,
@approvedBy, @approvedAt, @approvalNotes, @publishedAt, revision + 1, correlation_id
FROM model_operations.approval_proposals
WHERE id = @id
ORDER BY published_at DESC LIMIT 1
""";
await conn.ExecuteAsync(sql, new
{
id,
newStatus,
approvedBy,
approvedAt = DateTimeOffset.UtcNow,
approvalNotes,
publishedAt
});
}
public async Task InsertEvidenceAsync(Guid id, Guid proposalId, string evidenceType, string evidenceUrl, string? comment, Guid correlationId)
{
using var conn = new NpgsqlConnection(_connectionString);
const string sql = """
INSERT INTO model_operations.approval_evidence
(id, approval_proposal_id, evidence_type, evidence_url, reviewer_comment, published_at, correlation_id)
VALUES (@id, @proposalId, @evidenceType, @evidenceUrl, @comment, @publishedAt, @correlationId)
""";
await conn.ExecuteAsync(sql, new
{
id,
proposalId,
evidenceType,
evidenceUrl,
comment,
publishedAt = DateTimeOffset.UtcNow,
correlationId
});
}
public async Task InsertEventAsync(Guid id, Guid proposalId, string eventType, string actorEmail, Dictionary<string, object>? details, Guid correlationId)
{
using var conn = new NpgsqlConnection(_connectionString);
const string sql = """
INSERT INTO model_operations.approval_events
(id, approval_proposal_id, event_type, actor_email, event_at, details, published_at, correlation_id)
VALUES (@id, @proposalId, @eventType, @actorEmail, @eventAt, @details::jsonb, @publishedAt, @correlationId)
""";
var detailsJson = details != null ? JsonSerializer.Serialize(details) : null;
await conn.ExecuteAsync(sql, new
{
id,
proposalId,
eventType,
actorEmail,
eventAt = DateTimeOffset.UtcNow,
details = detailsJson,
publishedAt = DateTimeOffset.UtcNow,
correlationId
});
}
public async Task<List<ApprovalEvidence>> GetEvidenceByProposalAsync(Guid proposalId, DateTimeOffset cutoff)
{
using var conn = new NpgsqlConnection(_connectionString);
const string sql = """
SELECT id, approval_proposal_id, evidence_type, evidence_url, reviewer_comment, published_at, correlation_id
FROM model_operations.approval_evidence
WHERE approval_proposal_id = @proposalId
AND published_at <= @cutoff
ORDER BY published_at DESC
""";
var results = await conn.QueryAsync<ApprovalEvidence>(sql, new { proposalId, cutoff });
return results.ToList();
}
private ApprovalProposal MapFromRaw(ApprovalProposalRaw raw)
{
return new ApprovalProposal
{
Id = raw.Id,
ModelId = raw.ModelId,
Status = Enum.Parse<ApprovalStatus>(raw.Status),
CreatedBy = raw.CreatedBy,
CreatedAt = raw.CreatedAt,
Justification = raw.Justification,
EffectiveAt = raw.EffectiveAt,
ProposedAt = raw.ProposedAt,
ApprovedBy = raw.ApprovedBy,
ApprovedAt = raw.ApprovedAt,
ApprovalNotes = raw.ApprovalNotes,
ActivatedBy = raw.ActivatedBy,
ActivatedAt = raw.ActivatedAt,
PublishedAt = raw.PublishedAt,
Revision = raw.Revision,
CorrelationId = raw.CorrelationId
};
}
private class ApprovalProposalRaw
{
public Guid Id { get; set; }
public Guid ModelId { get; set; }
public string Status { get; set; } = null!;
public string CreatedBy { get; set; } = null!;
public DateTimeOffset CreatedAt { get; set; }
public string Justification { get; set; } = null!;
public DateOnly EffectiveAt { get; set; }
public DateTimeOffset? ProposedAt { get; set; }
public string? ApprovedBy { get; set; }
public DateTimeOffset? ApprovedAt { get; set; }
public string? ApprovalNotes { get; set; }
public string? ActivatedBy { get; set; }
public DateTimeOffset? ActivatedAt { get; set; }
public DateTimeOffset PublishedAt { get; set; }
public int Revision { get; set; }
public Guid CorrelationId { get; set; }
}
}