Implementation of an export control workflow

As an export control representative for my centre I want to be able to specify export control relevant information for devices. Those information should not be collected on the level of the individual sensor, but for a broader group of them (say all SMT 100). The export control information should be shown as open when there is no export control information at the beginning. The export control information should only be editable by export control representatives - but not by normal users. The export control information should be visible for each individual device. I want to see how many entries need to be checked for export control on my centre, ideally with a link to the most recent ones. GIPP device types should also be integrated, so that I can insert the information in the SMS, and to make the result available for GIPP via the API. The information that I want to insert are: dual use status (yes/no), export control classification number (eccn), customs tariff number (german Zolltarifnummer), a comment field that should be visible for the end users (to mention if there is an american eccn number (some special conditions when sending it to a country with restrictions from the US) and a comment field that should only be visible internally for the export control (to add some note about the process of the decision making). I want to be able to add attachments too. For those attachments I want to be able to restrict their visibility to export control representatives (not for ordinary users).

Acceptance criteria:

• There is a virtual organization to manage export control representatives for the SMS (but maybe a broader context is possible).
• The SMS can extract membership of this virtual organization
• Creation of a ManufacturerModel table (id, manufacturer_name, model)
• With the creation of every device and platform we check to create an entry in a ManufacturerModel table
• We have a migration that creates those entries for existing devices & platforms in the SMS
• With the patch of every device and platform we check to create an entry in the ManufacturerModel table.
• Entries of the ManufacturerModel table that are no longer in use and don't have export control data or linked to an external system can be deleted.
• ExportControl table (id, manufacturrer_model_id, dual_use (null, yes, no), eccn, customs_tariff_number, public_comment, internal_comment)
• Readonly api for ManufacturerModel table
• API for the export control API (only usable for export control representatives)
• Page to list all the ManufacturerModel entries - including text search.
• Page to list all devices and platforms for a ManufacturerModel
• Page to show the current export control for a ManufacturerModel that shows mostly public information, but also internal information if the user is an export control representative
• Page to edit the export control data for ManufacturerModel if the user is an export control representative
• Pages to show the export control data for devices and platforms as extra tabs with just the public data
• Attachments for the export control information that can be created by the export control representatives and can be set to either 1) public visible or 2) only visible for export control representatives
• Mechanism to fetch ManufacturerModel entries from GIPP
• API to let GIPP fetch the export control information from the SMS