Add tenant module entitlement administration

src/govoplan_admin/backend/manifest.py

@@ -3,7 +3,15 @@ from __future__ import annotations
 from govoplan_admin.backend.db import models as admin_models  # noqa: F401 - populate Admin ORM metadata
 from govoplan_core.core.access import CAPABILITY_AUTH_PERMISSION_EVALUATOR, CAPABILITY_AUTH_PRINCIPAL_RESOLVER
 from govoplan_core.core.module_guards import persistent_table_uninstall_guard
-from govoplan_core.core.modules import DocumentationTopic, FrontendModule, MigrationSpec, ModuleContext, ModuleManifest
+from govoplan_core.core.modules import (
+    DocumentationTopic,
+    FrontendModule,
+    MigrationSpec,
+    ModuleContext,
+    ModuleManifest,
+    PermissionDefinition,
+    RoleTemplate,
+)
 from govoplan_core.core.provider_governance import declared_module_architecture
 from govoplan_core.core.views import ViewSurface
 from govoplan_core.db.base import Base
@@ -16,10 +24,49 @@ def _route_factory(context: ModuleContext):
     return router
 
 
+ADMIN_PERMISSIONS = (
+    PermissionDefinition(
+        scope="admin:module:read",
+        module_id="admin",
+        resource="module",
+        action="read",
+        label="View tenant modules",
+        description="Inspect module availability, requirements, and effective state for the active tenant.",
+        category="Administration",
+        level="tenant",
+    ),
+    PermissionDefinition(
+        scope="admin:module:write",
+        module_id="admin",
+        resource="module",
+        action="write",
+        label="Manage tenant modules",
+        description="Enable or disable modules for the active tenant within system policy.",
+        category="Administration",
+        level="tenant",
+    ),
+)
+
+
+ADMIN_ROLE_TEMPLATES = (
+    RoleTemplate(
+        slug="module_admin",
+        name="Module administrator",
+        description="Manage the active tenant's module selection within system policy.",
+        permissions=("admin:module:read", "admin:module:write"),
+        level="tenant",
+        managed=True,
+        protected=False,
+    ),
+)
+
+
 manifest = ModuleManifest(
     id="admin",
     name="Admin",
     version="0.1.8",
+    permissions=ADMIN_PERMISSIONS,
+    role_templates=ADMIN_ROLE_TEMPLATES,
     required_capabilities=(CAPABILITY_AUTH_PRINCIPAL_RESOLVER, CAPABILITY_AUTH_PERMISSION_EVALUATOR),
     route_factory=_route_factory,
     documentation=(
@@ -39,6 +86,25 @@ manifest = ModuleManifest(
                 ],
             },
         ),
+        DocumentationTopic(
+            id="admin.tenant-module-entitlements",
+            title="Govern modules per tenant",
+            summary="System administrators set each tenant's module ceiling and forced modules; tenant module administrators choose within that ceiling.",
+            body=(
+                "Deployment activation installs and loads module code for the whole instance. Tenant module governance is a separate entitlement layer: system administrators mark modules unavailable, available, or forced for a tenant and may also change that tenant's selection. A tenant module administrator can only enable or disable available modules; forced modules and required dependencies remain effective. Module entitlement never grants permissions, and malformed policy fails closed to protected administration modules. Enabling a capability module such as Encryption only makes its services available; data encryption remains an explicit owning-module policy or migration decision."
+            ),
+            layer="configured",
+            documentation_types=("admin",),
+            audience=("system_admin", "module_admin", "tenant_admin"),
+            related_modules=("access", "policy", "views", "encryption"),
+            metadata={
+                "kind": "workflow",
+                "help_contexts": [
+                    "admin.system-tenant-modules",
+                    "admin.tenant-modules",
+                ],
+            },
+        ),
         DocumentationTopic(
             id="admin.governance-and-module-lifecycle",
             title="Govern configuration and module lifecycle",
@@ -96,6 +162,8 @@ manifest = ModuleManifest(
             ViewSurface(id="admin.section.system-role-templates", module_id="admin", kind="section", label="Role templates", order=40),
             ViewSurface(id="admin.section.system-groups", module_id="admin", kind="section", label="Group templates", order=50),
             ViewSurface(id="admin.section.system-modules", module_id="admin", kind="section", label="Modules", order=85),
+            ViewSurface(id="admin.section.system-tenant-modules", module_id="admin", kind="section", label="Tenant modules", order=86),
+            ViewSurface(id="admin.section.tenant-modules", module_id="admin", kind="section", label="Modules", order=60),
         ),
     ),
     migration_spec=MigrationSpec(module_id="admin", metadata=Base.metadata),