197 lines
8.9 KiB
Python
197 lines
8.9 KiB
Python
"""Request pipeline for requests created on the site.
|
|
|
|
Each workflow has an ordered chain of approvers. A request moves through the
|
|
chain one approver at a time:
|
|
|
|
- DENY at any step -> the workflow STOPS; everyone involved so far gets
|
|
the denied notice.
|
|
- APPROVE -> the request moves to the next approver in the chain.
|
|
- APPROVE (last) -> the request is fully approved; everyone involved so
|
|
far gets the approved notice.
|
|
|
|
Each step gets a fresh secret token, so an earlier approver's links cannot
|
|
decide later steps.
|
|
"""
|
|
import json
|
|
import os
|
|
import secrets
|
|
|
|
import db
|
|
from mailer import render, send_mail
|
|
|
|
BASE_URL = os.environ.get("BASE_URL", "http://localhost:8000").rstrip("/")
|
|
|
|
|
|
def approver_chain(wf):
|
|
try:
|
|
chain = json.loads(wf["approvers"])
|
|
except Exception:
|
|
chain = []
|
|
return [a.strip() for a in chain if a and a.strip()]
|
|
|
|
|
|
def _vars(wf, req, **extra):
|
|
chain = approver_chain(wf)
|
|
v = {
|
|
"workflow": wf["name"],
|
|
"requester": req["requester"],
|
|
"subject": req["subject"],
|
|
"body": req["body"],
|
|
"request_id": req["id"],
|
|
"created_at": req["created_at"],
|
|
"step": min(req["current_step"], max(len(chain) - 1, 0)) + 1,
|
|
"total_steps": len(chain),
|
|
"approve_url": f"{BASE_URL}/decision/{req['token']}/approve",
|
|
"deny_url": f"{BASE_URL}/decision/{req['token']}/deny",
|
|
}
|
|
v.update(extra)
|
|
return v
|
|
|
|
|
|
def _record_decision(con, request_id, step, decided_by, decision):
|
|
con.execute("INSERT INTO decisions (request_id, step, decided_by, decision, at) VALUES (?,?,?,?,?)",
|
|
(request_id, step, decided_by, decision, db.now()))
|
|
|
|
|
|
def build_summary(con, req, total_steps):
|
|
"""Human-readable history: when the request was created and who
|
|
approved (or denied) each step, with timestamps."""
|
|
lines = [f" Created {req['created_at']} by {req['requester']}"]
|
|
for d in con.execute("SELECT * FROM decisions WHERE request_id=? ORDER BY id", (req["id"],)):
|
|
verb = "Approved" if d["decision"] == "approved" else "DENIED"
|
|
lines.append(f" Step {d['step']}/{total_steps} {verb} {d['at']} by {d['decided_by']}")
|
|
return "\n".join(lines)
|
|
|
|
|
|
def current_approver(wf, req):
|
|
chain = approver_chain(wf)
|
|
if not chain:
|
|
return None
|
|
return chain[min(req["current_step"], len(chain) - 1)]
|
|
|
|
|
|
def send_approval_request(request_id):
|
|
"""Send the approval request to the approver of the CURRENT step."""
|
|
con = db.get_db()
|
|
try:
|
|
req = con.execute("SELECT * FROM requests WHERE id=?", (request_id,)).fetchone()
|
|
wf = con.execute("SELECT * FROM workflows WHERE id=?", (req["workflow_id"],)).fetchone()
|
|
chain = approver_chain(wf)
|
|
approver = current_approver(wf, req)
|
|
if approver is None:
|
|
db.log(con, request_id, "error", f"Workflow '{wf['name']}' has no approvers configured")
|
|
con.commit()
|
|
return False
|
|
con.commit() # release any pending writes before slow mail I/O
|
|
v = _vars(wf, req)
|
|
body_t = wf["approval_body"]
|
|
if "{created_at}" not in body_t: # creation time is mandatory in every mail
|
|
body_t = "Request created: {created_at}\n\n" + body_t
|
|
ok, detail = send_mail(approver,
|
|
render(wf["approval_subject"], **v),
|
|
render(body_t, **v),
|
|
request_id=request_id)
|
|
db.add_participants(con, request_id, [approver])
|
|
db.log(con, request_id,
|
|
"approval requested" if ok else "mail error",
|
|
f"Step {req['current_step'] + 1}/{len(chain)}: approval request to {approver} — {detail}")
|
|
con.commit()
|
|
return ok
|
|
finally:
|
|
con.close()
|
|
|
|
|
|
def _notify_outcome(con, wf, req, new_status, decided_by):
|
|
participants = db.add_participants(con, req["id"], [decided_by])
|
|
summary = build_summary(con, req, len(approver_chain(wf)))
|
|
con.commit() # release the write lock before slow mail I/O (mail_log uses its own connection)
|
|
v = _vars(wf, req, decided_by=decided_by, decision=new_status.upper(),
|
|
summary=summary, deny_reason=req["deny_reason"])
|
|
subj_t = wf["approved_subject"] if new_status == "approved" else wf["denied_subject"]
|
|
body_t = wf["approved_body"] if new_status == "approved" else wf["denied_body"]
|
|
# These are mandatory in the outcome notice: append them if the workflow's
|
|
# custom template doesn't include the placeholder.
|
|
if new_status == "approved" and "{summary}" not in body_t:
|
|
body_t += "\n\nSummary:\n{summary}\n"
|
|
if new_status == "denied" and "{deny_reason}" not in body_t:
|
|
body_t += "\n\nReason for denial:\n{deny_reason}\n"
|
|
if "{created_at}" not in body_t and "{summary}" not in body_t:
|
|
# creation time is mandatory in every mail ({summary} already includes it)
|
|
body_t = "Request created: {created_at}\n\n" + body_t
|
|
ok, detail = send_mail(participants, render(subj_t, **v), render(body_t, **v),
|
|
request_id=req["id"])
|
|
db.log(con, req["id"],
|
|
"participants notified" if ok else "mail error",
|
|
f"{new_status.capitalize()} notice to {', '.join(participants)} — {detail}")
|
|
|
|
|
|
def decide(token, action, decided_by, reason=""):
|
|
"""Handle a decision at the request's current step.
|
|
|
|
A denial requires a reason (callers enforce it as a mandatory field;
|
|
this is a second line of defense).
|
|
|
|
Returns (status, request_row_or_None, message).
|
|
"""
|
|
assert action in ("approve", "deny")
|
|
reason = (reason or "").strip()
|
|
con = db.get_db()
|
|
try:
|
|
req = con.execute("SELECT * FROM requests WHERE token=?", (token,)).fetchone()
|
|
if req is None:
|
|
return "notfound", None, "This link is not valid — it may belong to a step that was already decided."
|
|
if req["status"] != "pending":
|
|
return "already", req, f"This request was already {req['status']}."
|
|
|
|
wf = con.execute("SELECT * FROM workflows WHERE id=?", (req["workflow_id"],)).fetchone()
|
|
chain = approver_chain(wf)
|
|
step = req["current_step"]
|
|
|
|
if action == "deny":
|
|
if not reason:
|
|
return "needreason", req, "A reason for denial is required."
|
|
# STOP the workflow, notify everyone involved so far.
|
|
con.execute("UPDATE requests SET status='denied', decided_by=?, decided_at=?, deny_reason=? WHERE id=?",
|
|
(decided_by, db.now(), reason, req["id"]))
|
|
_record_decision(con, req["id"], step + 1, decided_by, "denied")
|
|
db.log(con, req["id"], "denied",
|
|
f"Denied at step {step + 1}/{len(chain)} by {decided_by} — workflow stopped. Reason: {reason}")
|
|
req = con.execute("SELECT * FROM requests WHERE id=?", (req["id"],)).fetchone()
|
|
_notify_outcome(con, wf, req, "denied", decided_by)
|
|
con.commit()
|
|
req = con.execute("SELECT * FROM requests WHERE id=?", (req["id"],)).fetchone()
|
|
return "ok", req, (f"Request #{req['id']} denied at step {step + 1} of {len(chain)}. "
|
|
"The workflow has stopped and everyone involved has been notified.")
|
|
|
|
# approve
|
|
_record_decision(con, req["id"], step + 1, decided_by, "approved")
|
|
db.log(con, req["id"], "step approved",
|
|
f"Step {step + 1}/{len(chain)} approved by {decided_by}")
|
|
db.add_participants(con, req["id"], [decided_by])
|
|
con.commit()
|
|
|
|
if step + 1 >= len(chain):
|
|
# Last approver — fully approved.
|
|
con.execute("UPDATE requests SET status='approved', decided_by=?, decided_at=? WHERE id=?",
|
|
(decided_by, db.now(), req["id"]))
|
|
db.log(con, req["id"], "approved",
|
|
f"Final approval ({len(chain)}/{len(chain)}) by {decided_by}")
|
|
req = con.execute("SELECT * FROM requests WHERE id=?", (req["id"],)).fetchone()
|
|
_notify_outcome(con, wf, req, "approved", decided_by)
|
|
con.commit()
|
|
req = con.execute("SELECT * FROM requests WHERE id=?", (req["id"],)).fetchone()
|
|
return "ok", req, (f"Request #{req['id']} fully approved ({len(chain)} of {len(chain)} steps). "
|
|
"Everyone involved has been notified.")
|
|
|
|
# Move to the next approver with a fresh token (old links stop working).
|
|
new_token = secrets.token_urlsafe(32)
|
|
con.execute("UPDATE requests SET current_step=?, token=? WHERE id=?",
|
|
(step + 1, new_token, req["id"]))
|
|
con.commit()
|
|
send_approval_request(req["id"])
|
|
req = db.get_db().execute("SELECT * FROM requests WHERE id=?", (req["id"],)).fetchone()
|
|
return "ok", req, (f"Step {step + 1} of {len(chain)} approved. The request was sent to the "
|
|
f"next approver ({chain[step + 1]}).")
|
|
finally:
|
|
con.close()
|