feat(approval): add task workflow and waiver decisions

server/src/app/api/v1/endpoints/risk_observations.py

@@ -20,11 +20,13 @@ from app.schemas.risk_observation import (
     RiskObservationListRead,
     RiskObservationRead,
 )
+from app.services.risk_disposition_read_projection import RiskDispositionReadProjection
 from app.services.risk_dispositions import (
     RiskDispositionConflictError,
     RiskDispositionPermissionError,
     RiskDispositionService,
     RiskDispositionVersionConflictError,
+    RiskWaiverDecisionPermissionError,
 )
 from app.services.risk_observation_access_policy import RiskObservationAccessPolicy
 from app.services.risk_observations import RiskObservationService
@@ -69,7 +71,16 @@ def list_risk_observations(
         limit=limit,
         offset=offset,
     )
-    return RiskObservationListRead(items=items, total=total, limit=limit, offset=offset)
+    projected_items = RiskDispositionReadProjection(db).observation_list_read(
+        items,
+        current_user,
+    )
+    return RiskObservationListRead(
+        items=projected_items,
+        total=total,
+        limit=limit,
+        offset=offset,
+    )
 
 
 @router.get(
@@ -105,10 +116,14 @@ def list_claim_risk_observations(
 ) -> list[RiskObservationRead]:
     if not RiskObservationAccessPolicy(db).can_read_claim_risks(claim_id, current_user):
         raise _not_found()
-    return RiskObservationService(db).list_claim_observations(
+    observations = RiskObservationService(db).list_claim_observations(
         claim_id,
         tenant_id=current_user.tenant_id,
     )
+    return RiskDispositionReadProjection(db).observation_list_read(
+        observations,
+        current_user,
+    )
 
 
 @router.get(
@@ -123,10 +138,14 @@ def list_execution_log_risk_observations(
     current_user: CurrentUser,
 ) -> list[RiskObservationRead]:
     _require_pool_access(db, current_user)
-    return RiskObservationService(db).list_execution_log_observations(
+    observations = RiskObservationService(db).list_execution_log_observations(
         execution_log_id,
         tenant_id=current_user.tenant_id,
     )
+    return RiskDispositionReadProjection(db).observation_list_read(
+        observations,
+        current_user,
+    )
 
 
 @router.get(
@@ -156,7 +175,10 @@ def get_risk_observation(
             status_code=status.HTTP_404_NOT_FOUND,
             detail="Risk observation not found",
         )
-    return observation
+    return RiskDispositionReadProjection(db).observation_read(
+        observation,
+        current_user,
+    )
 
 
 @router.get(
@@ -178,7 +200,11 @@ def get_risk_observation_disposition(
     )
     if disposition is None:
         raise _not_found("Risk disposition not found")
-    return disposition
+    return RiskDispositionReadProjection(db).disposition_read(
+        disposition,
+        observation,
+        current_user,
+    )
 
 
 @router.post(
@@ -199,7 +225,19 @@ def execute_risk_disposition_action(
         observation_key_or_id,
         payload,
     )
-    return mutation.response
+    observation = _get_observation_or_404(
+        db,
+        current_user,
+        observation_key_or_id,
+    )
+    projected_disposition = RiskDispositionReadProjection(db).disposition_snapshot_read(
+        mutation.response.disposition,
+        observation,
+        current_user,
+    )
+    return mutation.response.model_copy(
+        update={"disposition": projected_disposition},
+    )
 
 
 @router.post(
@@ -303,6 +341,14 @@ def _execute_action(
                 "message": "风险处置状态已更新，请刷新证据链后重试。",
             },
         ) from None
+    except RiskWaiverDecisionPermissionError as error:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail={
+                "code": "RISK_WAIVER_DECISION_FORBIDDEN",
+                "message": str(error),
+            },
+        ) from None
     except RiskDispositionPermissionError as error:
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,