🗃️ [#3967] Add model field to store service restriction (branch number)

src/openforms/authentication/migrations/0003_authinfo_legal_subject_service_restriction_and_more.py

@@ -0,0 +1,39 @@
+# Generated by Django 4.2.11 on 2024-07-03 09:04
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("of_authentication", "0002_add_authentication_context_mandate_fields"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="authinfo",
+            name="legal_subject_service_restriction",
+            field=models.CharField(
+                blank=True,
+                help_text="Optional service restriction information within the bigger legal subject.",
+                max_length=250,
+                verbose_name="legal subject service restriction",
+            ),
+        ),
+        migrations.AddConstraint(
+            model_name="authinfo",
+            constraint=models.CheckConstraint(
+                check=models.Q(
+                    models.Q(
+                        models.Q(
+                            ("legal_subject_service_restriction", ""), _negated=True
+                        ),
+                        models.Q(("legal_subject_identifier_value", ""), _negated=True),
+                    ),
+                    ("legal_subject_service_restriction", ""),
+                    _connector="OR",
+                ),
+                name="legal_subject_restriction",
+            ),
+        ),
+    ]

src/openforms/authentication/models.py

@@ -183,6 +183,16 @@ class AuthInfo(BaseAuthInfo):
         max_length=250,
         blank=True,
     )
+    # generic field for "service restriction", but in practice this means
+    # vestiging/branch number for eHerkenning.
+    legal_subject_service_restriction = models.CharField(
+        verbose_name=_("legal subject service restriction"),
+        help_text=_(
+            "Optional service restriction information within the bigger legal subject."
+        ),
+        max_length=250,  # the 250 is quite arbitrary, branch number is 12 chars
+        blank=True,
+    )
 
     mandate_context = models.JSONField(
         verbose_name=_("mandate context"),
@@ -230,7 +240,7 @@ class Meta:
                     "legal_subject_identifier_value",
                 ),
             ),
-            # presence of a legal subject implies a mandata context
+            # presence of a legal subject implies a mandate context
             models.CheckConstraint(
                 name="mandate_context_not_null",
                 check=(
@@ -241,6 +251,19 @@ class Meta:
                     )
                 ),
             ),
+            # a service restriction without legal subject does not make sense
+            models.CheckConstraint(
+                name="legal_subject_restriction",
+                check=(
+                    # if a service restriction is set, an identifier value must be set
+                    (
+                        ~Q(legal_subject_service_restriction="")
+                        & ~Q(legal_subject_identifier_value="")
+                    )
+                    # If no service restriction is set, anything goes
+                    | Q(legal_subject_service_restriction="")
+                ),
+            ),
             # TODO: add constraints matching the json schema for the identifier types
         ]