feat(classification): org data classification scheme, tactic-based initial default, operator edit rights

2026-07-07 11:16:35 +02:00
parent 949e5d42c4
commit a66fefa30b
12 changed files with 205 additions and 29 deletions
@@ -0,0 +1,41 @@
+"""Rename data_classification values to match the org's real scheme.
+
+public -> public_release, internal -> general_use, sensitive -> confidential.
+restricted is unchanged. Applies to tests, campaigns, and evidences tables
+(all plain String(20) columns — no native enum type to alter).
+
+Revision ID: b059
+Revises: b058
+Create Date: 2026-07-07
+"""
+
+from alembic import op
+
+revision = "b059"
+down_revision = "b058"
+branch_labels = None
+depends_on = None
+
+_TABLES = ("tests", "campaigns", "evidences")
+
+_RENAMES_UP = {
+    "public": "public_release",
+    "internal": "general_use",
+    "sensitive": "confidential",
+}
+
+_RENAMES_DOWN = {v: k for k, v in _RENAMES_UP.items()}
+
+
+def upgrade() -> None:
+    for table in _TABLES:
+        for old, new in _RENAMES_UP.items():
+            op.execute(f"UPDATE {table} SET data_classification = '{new}' WHERE data_classification = '{old}'")
+        op.alter_column(table, "data_classification", server_default="confidential")
+
+
+def downgrade() -> None:
+    for table in _TABLES:
+        for new, old in _RENAMES_DOWN.items():
+            op.execute(f"UPDATE {table} SET data_classification = '{old}' WHERE data_classification = '{new}'")
+        op.alter_column(table, "data_classification", server_default="internal")