feat(structures): add Region/Delegation/Structure schema + seed (ADR-0027 PR 1) (#228)
## Summary
First implementation PR for [ADR-0027](docs/decisions/0027-portal-side-organisational-hierarchy.md) (`Region` / `Delegation` / `Structure` portal-side organisational hierarchy). **Schema + seed + drift-gate extension only** — no consumer code yet (the `PrismaScopeResolver` that dereferences `Structure.code` from `UserScope.value` lives in ADR-0026 PR 2, which depends on this PR landing first).
Independent of ADR-0026 PR 1 at the schema level — both can ship in parallel; ADR-0026 PR 2 depends on both.
## What lands
| File | Change |
| --- | --- |
| `apps/portal-bff/prisma/schema.prisma` | **+3 models**. `Region` (INSEE code PK + name + delegations[]). `Delegation` (dept code PK + name + regionCode FK + structures[]). `Structure` (portal code PK + name + kind discriminator + nullable unique finess/siret/codePaie + nullable delegationCode FK). All in the `public` schema; matches the ADR-0027 schema sketch verbatim. |
| `apps/portal-bff/prisma/migrations/20260526143000_add_org_hierarchy/migration.sql` | **New** hand-written migration. DDL for the 3 tables. `CHECK ("kind" IN (...))` constraint mirroring `STRUCTURE_KINDS`. Indexes (FK columns + kind + uniques). Inline INSERT seed: Région Nouvelle-Aquitaine (75), Délégation Gironde (33), structures `0330800013` + `0330800021` (médico-social, FINESS = code) + `siege` (APF national, no delegation/finess). |
| `apps/portal-bff/src/structures/structure-kind.ts` | **New**. Closed-set catalogue: `STRUCTURE_KINDS = [medico_social, antenne, dispositif, entreprise_adaptee, mouvement, administratif, siege] as const`. `type StructureKind` derived from the union, `isStructureKind` type guard. |
| `apps/portal-bff/src/structures/structure-kind.spec.ts` | **New**. Jest spec — catalogue content, no duplicates, type guard true for catalogue values + false for typos / cascade-only values / empty, type narrowing at call site. |
| `scripts/check-catalogue-drift.mjs` | **Extend**. New `extractStructureKinds(path)` + `findStructureKindViolationsInFile(path, validKinds, sourceText?)`. Property-literal scanner: detects `kind: 'X'` in object literals, restricted to files that import from `structure-kind.ts` (cheap text pre-filter — `kind` is a common property name on unrelated objects and we'd false-positive everywhere otherwise). Integrated into `scanWorkspace`. Error-message formatter switched on callee shape (`@Foo('x')` for decorators, `kind: 'x'` for property literals). Closing hint updated to reference both ADR-0025 and ADR-0027 catalogue locations. |
| `scripts/check-catalogue-drift.spec.mjs` | **Extend**. Fixture writes a synthesised `structure-kind.ts` alongside `authorization.types.ts`. New tests: extract STRUCTURE_KINDS, throw on missing constant, skip files without the import, no-violation on catalogue values, flag off-catalogue values, skip non-literal initialisers, line/column tracking, scanWorkspace aggregation (decorator + Structure.kind together), scanWorkspace exposes the structureKinds set. **22 tests total, all passing.** |
## Defense in depth
Three layers stack for `Structure.kind`, deliberately:
1. **TypeScript type union** `StructureKind` — compile-time check at every typed assignment.
2. **Postgres `CHECK` constraint** in the migration — runtime enforcement at INSERT / UPDATE, defends raw SQL / casts / untrusted API input.
3. **`scripts/check-catalogue-drift.mjs`** — CI gate asserting every `kind: 'X'` literal in structure-context files is in the catalogue.
The `Privilege` / `FunctionalRole` catalogues from ADR-0025 only have layer 1 + layer 3 (no DB enforcement — those values aren't persisted as schema-checked columns). ADR-0027's `Structure.kind` is persisted, so layer 2 was practical to add — bulletproof against any code path that bypasses the type system.
## Seed scope (and what's deliberately NOT in it)
Just what the 19 test-tenant personas reference per `notes/test-tenant-role-assignments.md`:
- `Region` 75 Nouvelle-Aquitaine (only region the personas exercise)
- `Delegation` 33 Gironde (only delegation)
- `Structure` 0330800013 (APF Bordeaux, medico-social, FINESS = code)
- `Structure` 0330800021 (Complexe Mérignac, medico-social)
- `Structure` `siege` (APF national, kind=siege, no FK to a delegation, no FINESS)
**No** placeholder `entreprise_adaptee`, `antenne`, or `dispositif` row — those kinds are valid per the catalogue but the test tenant doesn't exercise them, and adding gold-plate seed data would be misleading ("what is this row used for?"). The full APF inventory lands with [ADR-0029](#)'s cascade sync; this seed is **superseded** (not extended) by that sync.
## Notes for the reviewer
- **Naming conflict with the existing `User` model.** The current `schema.prisma` already has a `User` model — but it's the ADR-0020 user-directory cache (Entra `oid` as PK, written by `UserDirectoryService.recordSignIn`). ADR-0026 PR 1 introduces a different `User` (UUID PK, FK to `Person`, `lastSignInAt`). **Out of scope here** — ADR-0027 PR 1 doesn't touch `User`. Flagging now so ADR-0026 PR 1 can plan the migration path (likely: rename the existing `User` to `UserDirectoryEntry` or fold it into the new Person + User pair).
- **Migration is hand-written**, matching the style of the two existing migrations (`init_audit_schema`, `users_directory`). Timestamp `20260526143000` chosen so it sorts after the existing `20260514192014_users_directory`.
- **`@@schema("public")`** required on every new model because the audit log uses `multiSchema` (per ADR-0013) — the public/audit split is configured at the datasource.
- **Drift gate error-message formatter** now switches on callee shape — decorator violations still print as `@Foo('x')`, property-literal violations print as `kind: 'x'` to match the offending code shape.
- **No `pnpm ci:check` impact expected** at the bff level beyond the new spec; `pnpm ci:catalogue-drift` continues to report clean (`catalogues: 4 privileges, 24 roles, 7 structure kinds`).
## Test plan
- [x] `node scripts/check-catalogue-drift.mjs` — clean (4 / 24 / 7).
- [x] `node --test scripts/check-catalogue-drift.spec.mjs` — 22 tests passing.
- [x] `pnpm exec prettier --check` clean on the touched files.
- [ ] **On the dev VM**: `pnpm prisma migrate dev` applies the migration cleanly against a fresh `infra/local/dev.compose.yml` postgres. `pnpm prisma studio` shows the seeded Region / Delegation / Structure rows.
- [ ] **On the dev VM**: `pnpm exec nx test portal-bff` runs the new `structure-kind.spec.ts` green.
- [ ] **Review focus** — the `Structure` model shape (kind discriminator, nullable unique columns, FK to Delegation), the inline seed values vs `notes/test-tenant-role-assignments.md`, the drift-gate property-literal scanner's restriction to files importing from `structure-kind.ts`.
## What's next
Per [ADR-0027 §"Phasing"](docs/decisions/0027-portal-side-organisational-hierarchy.md):
1. **This PR** — Region / Delegation / Structure schema + seed + drift gate. ✅
2. **ADR-0026 PR 1** — `Person` / `User` / `UserScope` schema + `PersonAndUserProvisioner` + drift gate extension for `Person.source` + updated `PrincipalBuilder`. Independent of (1), can ship in parallel. **Needs to resolve the existing-`User`-name collision.**
3. **ADR-0026 PR 2** — `PrismaScopeResolver` replacing `StubScopeResolver` + `/admin/users/:id/scopes` admin screen + `prisma/seed.ts` populating the 19 personas' `user_scopes` rows pointing at this PR's `Structure.code` values. **Depends on both (1) and (2).**
4. **ADR-0029** (future) — Pléiades + Acteurs+ + cascade syncs + facet schemas + `Pole` / `Service` / per-source enrichment extensions to this PR's hierarchy.
---------
Co-authored-by: Julien Gautier <julien.gautier@apf.asso.fr>
Reviewed-on: #228
This commit was merged in pull request #228.
This commit is contained in:
@@ -0,0 +1,117 @@
|
||||
-- Organisational hierarchy (per ADR-0027).
|
||||
--
|
||||
-- Region → Delegation → Structure. The portal's ADR-0025 scope-axis
|
||||
-- dereferences these three layers — the BFF guard
|
||||
-- `principalCoversResource` walks etablissement → delegation → region
|
||||
-- to decide whether a scope covers a resource. The schema lives in
|
||||
-- the public schema; ADR-0029 will populate the full APF inventory
|
||||
-- via the cascade sync, additively into the columns defined here.
|
||||
--
|
||||
-- Inline seed at the bottom of this file: just the codes the
|
||||
-- test tenant exercises (Région Nouvelle-Aquitaine, Délégation
|
||||
-- Gironde, two médico-social structures + the APF national siège).
|
||||
-- Superseded — not extended — by ADR-0029's cascade sync once it
|
||||
-- ships.
|
||||
|
||||
-- CreateTable
|
||||
CREATE TABLE "regions" (
|
||||
"code" TEXT NOT NULL,
|
||||
"name" TEXT NOT NULL,
|
||||
|
||||
CONSTRAINT "regions_pkey" PRIMARY KEY ("code")
|
||||
);
|
||||
|
||||
-- CreateTable
|
||||
CREATE TABLE "delegations" (
|
||||
"code" TEXT NOT NULL,
|
||||
"name" TEXT NOT NULL,
|
||||
"region_code" TEXT NOT NULL,
|
||||
|
||||
CONSTRAINT "delegations_pkey" PRIMARY KEY ("code")
|
||||
);
|
||||
|
||||
-- Closed-set CHECK on Structure.kind. Mirrors STRUCTURE_KINDS in
|
||||
-- apps/portal-bff/src/structures/structure-kind.ts. The CI drift gate
|
||||
-- (scripts/check-catalogue-drift.mjs) asserts the TS constant matches
|
||||
-- the values used in code; this CHECK constraint provides the
|
||||
-- equivalent guarantee at the DB layer for any code path that
|
||||
-- bypasses the type system.
|
||||
CREATE TABLE "structures" (
|
||||
"code" TEXT NOT NULL,
|
||||
"name" TEXT NOT NULL,
|
||||
"kind" TEXT NOT NULL,
|
||||
"finess" TEXT,
|
||||
"siret" TEXT,
|
||||
"code_paie" TEXT,
|
||||
"delegation_code" TEXT,
|
||||
|
||||
CONSTRAINT "structures_pkey" PRIMARY KEY ("code"),
|
||||
CONSTRAINT "structures_kind_check" CHECK (
|
||||
"kind" IN (
|
||||
'medico_social',
|
||||
'antenne',
|
||||
'dispositif',
|
||||
'entreprise_adaptee',
|
||||
'mouvement',
|
||||
'administratif',
|
||||
'siege'
|
||||
)
|
||||
)
|
||||
);
|
||||
|
||||
-- CreateIndex
|
||||
CREATE INDEX "delegations_region_code_idx" ON "delegations"("region_code");
|
||||
|
||||
-- CreateIndex
|
||||
CREATE UNIQUE INDEX "structures_finess_key" ON "structures"("finess");
|
||||
|
||||
-- CreateIndex
|
||||
CREATE UNIQUE INDEX "structures_siret_key" ON "structures"("siret");
|
||||
|
||||
-- CreateIndex
|
||||
CREATE UNIQUE INDEX "structures_code_paie_key" ON "structures"("code_paie");
|
||||
|
||||
-- CreateIndex
|
||||
CREATE INDEX "structures_kind_idx" ON "structures"("kind");
|
||||
|
||||
-- CreateIndex
|
||||
CREATE INDEX "structures_delegation_code_idx" ON "structures"("delegation_code");
|
||||
|
||||
-- AddForeignKey
|
||||
ALTER TABLE "delegations" ADD CONSTRAINT "delegations_region_code_fkey"
|
||||
FOREIGN KEY ("region_code") REFERENCES "regions"("code")
|
||||
ON DELETE RESTRICT ON UPDATE CASCADE;
|
||||
|
||||
-- AddForeignKey
|
||||
ALTER TABLE "structures" ADD CONSTRAINT "structures_delegation_code_fkey"
|
||||
FOREIGN KEY ("delegation_code") REFERENCES "delegations"("code")
|
||||
ON DELETE RESTRICT ON UPDATE CASCADE;
|
||||
|
||||
-- ------------------------------------------------------------------
|
||||
-- Test-tenant reference seed (per ADR-0027 §"Seeding posture").
|
||||
--
|
||||
-- Region Nouvelle-Aquitaine + Délégation Gironde + the structures
|
||||
-- referenced by the 19 personas in notes/test-tenant-role-assignments.md:
|
||||
-- - 0330800013 (APF Bordeaux, FINESS = code)
|
||||
-- - 0330800021 (Complexe Mérignac, FINESS = code)
|
||||
-- - 'siege' (APF national headquarters)
|
||||
--
|
||||
-- Cascade-sync (ADR-0029) supersedes this seed entirely when it
|
||||
-- ships — the cleanup migration responsible for that truncates and
|
||||
-- repopulates from cascade's authoritative inventory.
|
||||
-- ------------------------------------------------------------------
|
||||
|
||||
INSERT INTO "regions" ("code", "name") VALUES
|
||||
('75', 'Nouvelle-Aquitaine');
|
||||
|
||||
INSERT INTO "delegations" ("code", "name", "region_code") VALUES
|
||||
('33', 'Gironde', '75');
|
||||
|
||||
INSERT INTO "structures" ("code", "name", "kind", "finess", "delegation_code") VALUES
|
||||
('0330800013', 'APF Bordeaux', 'medico_social', '0330800013', '33'),
|
||||
('0330800021', 'Complexe Mérignac', 'medico_social', '0330800021', '33');
|
||||
|
||||
-- Siège has no delegation parent and no FINESS/SIRET/codePaie (those
|
||||
-- columns stay NULL — the unique indexes tolerate multiple NULLs).
|
||||
INSERT INTO "structures" ("code", "name", "kind") VALUES
|
||||
('siege', 'Siège APF France handicap', 'siege');
|
||||
@@ -100,6 +100,94 @@ model User {
|
||||
@@index([username])
|
||||
}
|
||||
|
||||
// ============================================================
|
||||
// Organisational hierarchy (per ADR-0027)
|
||||
// ============================================================
|
||||
//
|
||||
// Region → Delegation → Structure. The portal's scope-axis
|
||||
// dereferences these three layers — the BFF guard
|
||||
// `principalCoversResource` walks etablissement → delegation →
|
||||
// region to decide whether a scope covers a resource (per
|
||||
// ADR-0025).
|
||||
//
|
||||
// Population in v1: a small inline seed in the
|
||||
// `add_org_hierarchy` migration (the codes the test tenant
|
||||
// exercises). The full APF inventory ships with ADR-0029's
|
||||
// cascade sync, which writes additively into these columns —
|
||||
// no schema churn at sync time.
|
||||
|
||||
model Region {
|
||||
// INSEE region code (2 digits — '75' Nouvelle-Aquitaine,
|
||||
// '11' Île-de-France). Externally meaningful and stable
|
||||
// across reorgs; doubles as primary key.
|
||||
code String @id
|
||||
name String
|
||||
|
||||
delegations Delegation[]
|
||||
|
||||
@@map("regions")
|
||||
@@schema("public")
|
||||
}
|
||||
|
||||
model Delegation {
|
||||
// French department code (2-3 chars — '33' Gironde, '2A',
|
||||
// '971'). Same rationale as Region.code.
|
||||
code String @id
|
||||
name String
|
||||
|
||||
regionCode String @map("region_code")
|
||||
region Region @relation(fields: [regionCode], references: [code])
|
||||
|
||||
structures Structure[]
|
||||
|
||||
@@map("delegations")
|
||||
@@schema("public")
|
||||
@@index([regionCode])
|
||||
}
|
||||
|
||||
model Structure {
|
||||
// Portal-internal stable code, externally meaningful. For
|
||||
// medico-social structures: code = FINESS (9 digits). For
|
||||
// non-medico-social: APF-internal slug ('siege',
|
||||
// 'apf-bdx-merignac', 'ea-toulouse', …). Opaque at the type
|
||||
// level; matching is string equality, not parsing.
|
||||
code String @id
|
||||
name String
|
||||
|
||||
// Closed set, drift-gated. Legal values are tracked in
|
||||
// `apps/portal-bff/src/structures/structure-kind.ts` and
|
||||
// mirrored by a Postgres CHECK constraint on this column
|
||||
// (see the migration). `scripts/check-catalogue-drift.mjs`
|
||||
// asserts the TS constant matches the values used in code.
|
||||
kind String
|
||||
|
||||
// FINESS (9 digits). NULL for non-medico-social structures.
|
||||
// Unique when present. Cascade's StructureSourceFiness is
|
||||
// the long-term authoritative carrier; the portal denormalises
|
||||
// it inline here for v1 scope-axis checks. ADR-0029's sync
|
||||
// owns the write path.
|
||||
finess String? @unique
|
||||
|
||||
// SIRET (14 chars: 9 SIREN + 5 NIC). NULL when the structure
|
||||
// is not SIRENE-registered (most antennes, dispositifs).
|
||||
// Unique when present.
|
||||
siret String? @unique
|
||||
|
||||
// Pléiades payroll code (6 chars). NULL in v1 — populated by
|
||||
// ADR-0029's Pléiades sync once it ships.
|
||||
codePaie String? @unique @map("code_paie")
|
||||
|
||||
// Parent delegation. NULL for structures not attached to one
|
||||
// (siège, mouvement national, …).
|
||||
delegationCode String? @map("delegation_code")
|
||||
delegation Delegation? @relation(fields: [delegationCode], references: [code])
|
||||
|
||||
@@map("structures")
|
||||
@@schema("public")
|
||||
@@index([kind])
|
||||
@@index([delegationCode])
|
||||
}
|
||||
|
||||
model AuditEvent {
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz(6)
|
||||
|
||||
@@ -0,0 +1,45 @@
|
||||
import { isStructureKind, STRUCTURE_KINDS, type StructureKind } from './structure-kind';
|
||||
|
||||
describe('STRUCTURE_KINDS', () => {
|
||||
it('contains the seven cascade-aligned kinds per ADR-0027', () => {
|
||||
expect(STRUCTURE_KINDS).toEqual([
|
||||
'medico_social',
|
||||
'antenne',
|
||||
'dispositif',
|
||||
'entreprise_adaptee',
|
||||
'mouvement',
|
||||
'administratif',
|
||||
'siege',
|
||||
]);
|
||||
});
|
||||
|
||||
it('has no duplicate entries', () => {
|
||||
expect(new Set(STRUCTURE_KINDS).size).toBe(STRUCTURE_KINDS.length);
|
||||
});
|
||||
});
|
||||
|
||||
describe('isStructureKind', () => {
|
||||
it('returns true for every catalogue value', () => {
|
||||
for (const kind of STRUCTURE_KINDS) {
|
||||
expect(isStructureKind(kind)).toBe(true);
|
||||
}
|
||||
});
|
||||
|
||||
it('returns false for values outside the catalogue', () => {
|
||||
// common typos / cascade kinds not adopted by the portal
|
||||
expect(isStructureKind('medical_social')).toBe(false);
|
||||
expect(isStructureKind('sanitaire')).toBe(false); // cascade has it, portal doesn't ship it in v1
|
||||
expect(isStructureKind('autre')).toBe(false); // escape hatch deliberately excluded
|
||||
expect(isStructureKind('')).toBe(false);
|
||||
expect(isStructureKind('Medico_Social')).toBe(false); // case-sensitive
|
||||
});
|
||||
|
||||
it('narrows the type at the call site', () => {
|
||||
const candidate: string = 'medico_social';
|
||||
if (!isStructureKind(candidate)) {
|
||||
throw new Error('unreachable — candidate is a known kind');
|
||||
}
|
||||
const narrowed: StructureKind = candidate;
|
||||
expect(narrowed).toBe('medico_social');
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,36 @@
|
||||
/**
|
||||
* Closed-set catalogue for `Structure.kind` per
|
||||
* [ADR-0027 §"Confirmation"](../../../../../docs/decisions/0027-portal-side-organisational-hierarchy.md).
|
||||
*
|
||||
* Three enforcement layers stack here (defense-in-depth, same posture
|
||||
* as ADR-0025's `Privilege` / `FunctionalRole` catalogues):
|
||||
*
|
||||
* 1. TypeScript type union `StructureKind` — compile-time check at
|
||||
* every assignment / function call that uses the typed reference.
|
||||
* 2. Postgres `CHECK` constraint in the `add_org_hierarchy` migration
|
||||
* — runtime enforcement at INSERT / UPDATE time, defends against
|
||||
* any code path that bypasses the type system (raw SQL, casts,
|
||||
* future API endpoints with untrusted input).
|
||||
* 3. `scripts/check-catalogue-drift.mjs` — CI gate asserting every
|
||||
* `kind: 'X'` literal in files that import this module is in the
|
||||
* catalogue.
|
||||
*
|
||||
* Cascade's `Structure.type` discriminator is the source of the
|
||||
* vocabulary; the portal preserves cascade's spelling so the future
|
||||
* cascade sync (ADR-0029) writes additively without translation.
|
||||
*/
|
||||
export const STRUCTURE_KINDS = [
|
||||
'medico_social',
|
||||
'antenne',
|
||||
'dispositif',
|
||||
'entreprise_adaptee',
|
||||
'mouvement',
|
||||
'administratif',
|
||||
'siege',
|
||||
] as const;
|
||||
|
||||
export type StructureKind = (typeof STRUCTURE_KINDS)[number];
|
||||
|
||||
export function isStructureKind(value: string): value is StructureKind {
|
||||
return (STRUCTURE_KINDS as readonly string[]).includes(value);
|
||||
}
|
||||
Reference in New Issue
Block a user