feat: enhance manual lifecycle transitions with filtering support

- Added optional filter functionality to manual transition rules in lifecycle configuration, allowing for more granular control based on identity attributes.
- Updated related components and services to accommodate the new filter field, ensuring backward compatibility.
- Enhanced validation to prevent duplicate source/filter combinations in manual transitions.
- Improved export functionality in the identities page to support dynamic column selection for better user experience.

Author: tacxou

Makefile

@@ -126,6 +126,7 @@ dev: ## Start development environment
 		--name $(APP_NAME) \
 		-e SESAME_SENTRY_DSN=$(SESAME_SENTRY_DSN) \
 		-e SESAME_CRON_LOG_ROTATE_MAX_SIZE_BYTES=10485760 \
+		-e SESAME_WEB_HMR_CLIENT_PORT=$(APP_WEB_PORT) \
 		-p $(APP_WEB_PORT):3000 \
 		-p $(APP_WEB_PORT_SECURE):3443 \
 		-p $(APP_API_PORT):4000 \
@@ -148,6 +149,7 @@ debug: ## Start debug environment
 		--network dev \
 		--name $(APP_NAME) \
 		-e SESAME_SENTRY_DSN=$(SESAME_SENTRY_DSN) \
+		-e SESAME_WEB_HMR_CLIENT_PORT=$(APP_WEB_PORT) \
 		-p $(APP_WEB_PORT):3000 \
 		-p $(APP_WEB_PORT_SECURE):3443 \
 		-p $(APP_API_PORT):4000 \

apps/api/defaults/lifecycle/manual-transitions.yml

@@ -1,16 +1,37 @@
 # Transitions manuelles uniquement (changement via l'interface identité).
 # N'affecte pas les règles automatiques (cron, fichiers rules/*.yml).
-# Si un état source n'est pas listé ici, toutes les destinations restent autorisées.
+#
+# Comportement permissif :
+# - Si un état source n'est pas listé ici, toutes les destinations restent autorisées.
+# - Plusieurs règles peuvent partager le même état source si leurs filtres diffèrent.
+# - Pour un état source donné, la première règle dont le filtre correspond à l'identité est appliquée.
+# - Si aucune règle filtrée ne correspond, la règle sans filtre pour cet état source est utilisée.
+# - Si seules des règles filtrées existent et qu'aucune ne correspond, toutes les destinations restent autorisées.
+#
+# Le champ `filter` est optionnel et utilise la syntaxe d'une requête MongoDB sur le document identité
+# (ex. inetOrgPerson.employeeType, opérateurs $ne, $in, etc.).
 
 # manualTransitions:
-#   # Officiel (O) : activation courante, pas de passage direct vers « A détruire » ou « Caché »
+#   # Officiel (O) — employés TAIGA : pas de passage direct vers « Verrouillé »
+#   - source: O
+#     filter:
+#       inetOrgPerson.employeeType: TAIGA
+#     targets: [I, M, A, P]
+
+#   # Officiel (O) — défaut pour les autres employeeType
 #   - source: O
 #     targets: [I, M, A, P, V]
 
 #   # Inactif (I) : réactivation ou mise en file de suppression
 #   - source: I
 #     targets: [O, M, D]
 
+#   # Inactif (I) — TAIGA : retour officiel uniquement
+#   - source: I
+#     filter:
+#       inetOrgPerson.employeeType: TAIGA
+#     targets: [O]
+
 #   # Manuel (M) : état opérateur, retours usuels
 #   - source: M
 #     targets: [O, I, A, P]

apps/api/src/management/identities/identities-crud.controller.ts

@@ -362,7 +362,7 @@ export class IdentitiesCrudController extends AbstractController {
 
     if (body.lifecycle && body.lifecycle !== identity.lifecycle) {
       const manualTransitions = await loadManualTransitions();
-      if (!isManualLifecycleTransitionAllowed(identity.lifecycle, body.lifecycle, manualTransitions)) {
+      if (!isManualLifecycleTransitionAllowed(identity.lifecycle, body.lifecycle, manualTransitions, identity as Record<string, unknown>)) {
         throw new BadRequestException(
           `Changement manuel de cycle de vie non autorisé : <${identity.lifecycle}> → <${body.lifecycle}>`,
         );

apps/api/src/management/lifecycle/_dto/manual-transitions.dto.ts

@@ -1,6 +1,6 @@
 import { ApiProperty } from '@nestjs/swagger';
 import { Type } from 'class-transformer';
-import { IsArray, IsNotEmpty, IsString, ValidateNested } from 'class-validator';
+import { IsArray, IsNotEmpty, IsObject, IsOptional, IsString, ValidateNested } from 'class-validator';
 
 export class ManualTransitionRuleDto {
   @IsString()
@@ -23,6 +23,17 @@ export class ManualTransitionRuleDto {
     required: true,
   })
   targets: string[];
+
+  @IsOptional()
+  @IsObject()
+  @ApiProperty({
+    type: Object,
+    description:
+      "Filtre optionnel sur l'identité (syntaxe requête MongoDB). Si absent, la règle s'applique par défaut pour l'état source.",
+    example: { 'inetOrgPerson.employeeType': 'TAIGA' },
+    required: false,
+  })
+  filter?: object;
 }
 
 export class ManualTransitionsSchemaDto {

apps/api/src/management/lifecycle/_functions/find-manual-transition-rule.function.ts

@@ -0,0 +1,28 @@
+import { ManualTransitionRuleDto } from '../_dto/manual-transitions.dto';
+import { isEmptyManualTransitionFilter, matchesIdentityFilter } from './matches-identity-filter.function';
+
+export function findManualTransitionRule(
+  source: string,
+  rules: ManualTransitionRuleDto[],
+  identity?: Record<string, unknown>,
+): ManualTransitionRuleDto | undefined {
+  const sourceRules = rules.filter((rule) => rule.source === source);
+  if (sourceRules.length === 0) {
+    return undefined;
+  }
+
+  if (identity) {
+    for (const rule of sourceRules) {
+      if (!isEmptyManualTransitionFilter(rule.filter) && matchesIdentityFilter(identity, rule.filter!)) {
+        return rule;
+      }
+    }
+  }
+
+  return sourceRules.find((rule) => isEmptyManualTransitionFilter(rule.filter));
+}
+
+export function getManualTransitionRuleKey(rule: ManualTransitionRuleDto): string {
+  const filterKey = rule.filter ? JSON.stringify(rule.filter) : '';
+  return `${rule.source}::${filterKey}`;
+}

apps/api/src/management/lifecycle/_functions/is-manual-lifecycle-transition-allowed.function.ts

@@ -1,10 +1,12 @@
 import { ManualTransitionRuleDto } from '../_dto/manual-transitions.dto';
+import { findManualTransitionRule } from './find-manual-transition-rule.function';
 
 export function getAllowedManualLifecycleTargets(
   source: string,
   rules: ManualTransitionRuleDto[],
+  identity?: Record<string, unknown>,
 ): string[] | null {
-  const rule = rules.find((item) => item.source === source);
+  const rule = findManualTransitionRule(source, rules, identity);
   if (!rule) {
     return null;
   }
@@ -16,12 +18,13 @@ export function isManualLifecycleTransitionAllowed(
   from: string,
   to: string,
   rules: ManualTransitionRuleDto[],
+  identity?: Record<string, unknown>,
 ): boolean {
   if (!from || !to || from === to) {
     return true;
   }
 
-  const allowedTargets = getAllowedManualLifecycleTargets(from, rules);
+  const allowedTargets = getAllowedManualLifecycleTargets(from, rules, identity);
   if (allowedTargets === null) {
     return true;
   }

apps/api/src/management/lifecycle/_functions/load-manual-transitions.function.ts

@@ -5,6 +5,7 @@ import { validateOrReject } from 'class-validator';
 import { Logger } from '@nestjs/common';
 import { formatValidationErrors } from '../../../_common/functions/format-validation-errors.function';
 import { ManualTransitionRuleDto, ManualTransitionsSchemaDto } from '../_dto/manual-transitions.dto';
+import { getManualTransitionRuleKey } from './find-manual-transition-rule.function';
 
 let __manualTransitionsCache: ManualTransitionRuleDto[] | null = null;
 let __manualTransitionsCacheMtime: number | null = null;
@@ -45,12 +46,13 @@ export async function loadManualTransitions(): Promise<ManualTransitionRuleDto[]
 
     await validateOrReject(schema, { whitelist: true });
 
-    const usedSources = new Set<string>();
+    const usedRuleKeys = new Set<string>();
     for (const rule of schema.manualTransitions) {
-      if (usedSources.has(rule.source)) {
-        throw new Error(`Duplicate manual transition source '${rule.source}' found in manual-transitions.yml`);
+      const ruleKey = getManualTransitionRuleKey(rule);
+      if (usedRuleKeys.has(ruleKey)) {
+        throw new Error(`Duplicate manual transition rule '${ruleKey}' found in manual-transitions.yml`);
       }
-      usedSources.add(rule.source);
+      usedRuleKeys.add(ruleKey);
     }
 
     __manualTransitionsCache = schema.manualTransitions;

apps/api/src/management/lifecycle/_functions/matches-identity-filter.function.ts

@@ -0,0 +1,13 @@
+import sift from 'sift';
+
+export function isEmptyManualTransitionFilter(filter?: object): boolean {
+  return !filter || Object.keys(filter).length === 0;
+}
+
+export function matchesIdentityFilter(identity: Record<string, unknown>, filter: object): boolean {
+  if (isEmptyManualTransitionFilter(filter)) {
+    return true;
+  }
+
+  return sift(filter)(identity);
+}

apps/api/src/management/lifecycle/lifecycle-config.service.ts

@@ -26,6 +26,7 @@ import { LifecycleCrudService } from './lifecycle-crud.service';
 import { LifecycleHooksService } from './lifecycle-hooks.service';
 import { ManualTransitionRuleDto, ManualTransitionsSchemaDto, ManualTransitionsUpdateDto } from './_dto/manual-transitions.dto';
 import { clearManualTransitionsCache, loadManualTransitions } from './_functions/load-manual-transitions.function';
+import { getManualTransitionRuleKey } from './_functions/find-manual-transition-rule.function';
 
 export type LifecycleRuleFileSummary = {
   name: string;
@@ -175,12 +176,13 @@ export class LifecycleConfigService {
       throw new BadRequestException(formatValidationErrors(errors, 'manual-transitions.yml'));
     }
 
-    const usedSources = new Set<string>();
+    const usedRuleKeys = new Set<string>();
     for (const rule of schema.manualTransitions) {
-      if (usedSources.has(rule.source)) {
-        throw new BadRequestException(`La source <${rule.source}> est définie plusieurs fois.`);
+      const ruleKey = getManualTransitionRuleKey(rule);
+      if (usedRuleKeys.has(ruleKey)) {
+        throw new BadRequestException(`La combinaison source/filtre <${rule.source}> est définie plusieurs fois.`);
       }
-      usedSources.add(rule.source);
+      usedRuleKeys.add(ruleKey);
     }
 
     this.ensureLifecycleDir();

apps/api/tests/unit/management/lifecycle/is-manual-lifecycle-transition-allowed.function.spec.ts

@@ -23,4 +23,25 @@ describe('isManualLifecycleTransitionAllowed', () => {
   it('should always allow staying on the current lifecycle', () => {
     expect(isManualLifecycleTransitionAllowed('I', 'I', rules)).toBe(true);
   });
+
+  it('should apply filtered rules before default rules for the same source', () => {
+    const filteredRules = [
+      { source: 'O', filter: { 'inetOrgPerson.employeeType': 'TAIGA' }, targets: ['I', 'M'] },
+      { source: 'O', targets: ['I', 'M', 'A', 'P', 'V'] },
+    ];
+    const taigaIdentity = { inetOrgPerson: { employeeType: 'TAIGA' } };
+    const otherIdentity = { inetOrgPerson: { employeeType: 'CDI' } };
+
+    expect(getAllowedManualLifecycleTargets('O', filteredRules, taigaIdentity)).toEqual(['I', 'M']);
+    expect(isManualLifecycleTransitionAllowed('O', 'V', filteredRules, taigaIdentity)).toBe(false);
+    expect(isManualLifecycleTransitionAllowed('O', 'V', filteredRules, otherIdentity)).toBe(true);
+  });
+
+  it('should remain permissive when only filtered rules exist and none match', () => {
+    const filteredRules = [{ source: 'O', filter: { 'inetOrgPerson.employeeType': 'TAIGA' }, targets: ['I'] }];
+    const otherIdentity = { inetOrgPerson: { employeeType: 'CDI' } };
+
+    expect(getAllowedManualLifecycleTargets('O', filteredRules, otherIdentity)).toBeNull();
+    expect(isManualLifecycleTransitionAllowed('O', 'V', filteredRules, otherIdentity)).toBe(true);
+  });
 });