feat(modules): show permissions before installation

webui/src/api/admin.ts

@@ -443,6 +443,17 @@ export type ModulePackageArtifactIdentity = {
   source_commit?: string | null;
 };
 
+export type ModulePackagePermissionItem = {
+  scope: string;
+  label: string;
+  description: string;
+  category: string;
+  level: "system" | "tenant";
+  resource: string;
+  action: string;
+  deprecated: boolean;
+};
+
 export type ModulePackageCatalogItem = {
   module_id: string;
   name: string;
@@ -455,6 +466,7 @@ export type ModulePackageCatalogItem = {
   availability: "available" | "withdrawn";
   availability_reason?: string | null;
   configuration_requirements: string[];
+  permissions: ModulePackagePermissionItem[];
   release_notes_url?: string | null;
   source?: ModulePackageCatalogSource | null;
   artifact_integrity: Record<string, ModulePackageArtifactIdentity>;

webui/src/features/admin/ModuleManagementPanel.tsx

@@ -580,6 +580,16 @@ export default function ModuleManagementPanel({ settings, canWrite, canAccessMai
                   </div>)}
                   {item.description && <p className="module-package-catalog-description">{item.description}</p>}
                   {item.configuration_requirements.length > 0 && <p className="module-package-catalog-description">i18n:govoplan-admin.configuration_requirements.7c8f1011 {item.configuration_requirements.join(", ")}</p>}
+                  {item.permissions.length > 0 && <details className="module-package-catalog-description">
+                    <summary>{i18nMessage("i18n:govoplan-admin.declared_permissions.7c8f1015", { value0: item.permissions.length })}</summary>
+                    <p className="muted small-note">i18n:govoplan-admin.installing_does_not_grant_permissions.7c8f1016</p>
+                    <div className="module-management-details">
+                      {permissionCategoryLabels(item).map((label) => <span key={label}>{label}</span>)}
+                    </div>
+                    <div className="module-management-details">
+                      {item.permissions.map((permission) => <span key={permission.scope} title={permission.description}><code>{permission.scope}</code> {permission.label}{permission.deprecated ? " (deprecated)" : ""}</span>)}
+                    </div>
+                  </details>}
                   {item.migration_notes && <p className="module-package-catalog-description">{item.migration_notes}</p>}
                   {item.bridge_notes && <p className="module-package-catalog-description">{item.bridge_notes}</p>}
                   {item.recovery_notes && <p className="module-package-catalog-description">{item.recovery_notes}</p>}
@@ -954,6 +964,17 @@ function requiredInterfacesLabel(item: ModulePackageCatalogItem): string {
   }).join(", ");
 }
 
+function permissionCategoryLabels(item: ModulePackageCatalogItem): string[] {
+  const counts = new Map<string, number>();
+  item.permissions.forEach((permission) => {
+    const key = `${permission.category} · ${permission.level}`;
+    counts.set(key, (counts.get(key) ?? 0) + 1);
+  });
+  return [...counts.entries()]
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([key, count]) => `${key}: ${count}`);
+}
+
 function migrationSafetyLabel(value: ModulePackageCatalogItem["migration_safety"] | ModuleInstallTargetItem["migration_safety"]): string {
   if (value === "requires_review") return "i18n:govoplan-admin.requires_review.8ba0b8c6";
   if (value === "forward_only") return "i18n:govoplan-admin.forward_only.6c107a46";

webui/src/i18n/generatedTranslations.ts

@@ -16,6 +16,8 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-admin.release_notes.7c8f1012": "Release notes",
     "i18n:govoplan-admin.withdrawn.7c8f1013": "Withdrawn",
     "i18n:govoplan-admin.update_available.7c8f1014": "Update available",
+    "i18n:govoplan-admin.declared_permissions.7c8f1015": "Declared permissions ({value0})",
+    "i18n:govoplan-admin.installing_does_not_grant_permissions.7c8f1016": "Installing this module does not grant these permissions.",
     "i18n:govoplan-admin.administration_data_is_loading.6bf3c001": "Administration data is loading.",
     "i18n:govoplan-admin.an_administration_operation_is_in_progress.6bf3c002": "An administration operation is in progress.",
     "i18n:govoplan-admin.system_administration_write_permission_is_required.6bf3c003": "System administration write permission is required.",
@@ -466,6 +468,8 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-admin.release_notes.7c8f1012": "Versionshinweise",
     "i18n:govoplan-admin.withdrawn.7c8f1013": "Zurückgezogen",
     "i18n:govoplan-admin.update_available.7c8f1014": "Aktualisierung verfügbar",
+    "i18n:govoplan-admin.declared_permissions.7c8f1015": "Deklarierte Berechtigungen ({value0})",
+    "i18n:govoplan-admin.installing_does_not_grant_permissions.7c8f1016": "Die Installation dieses Moduls vergibt diese Berechtigungen nicht.",
     "i18n:govoplan-admin.administration_data_is_loading.6bf3c001": "Administrationsdaten werden geladen.",
     "i18n:govoplan-admin.an_administration_operation_is_in_progress.6bf3c002": "Eine Administrationsaktion wird gerade ausgeführt.",
     "i18n:govoplan-admin.system_administration_write_permission_is_required.6bf3c003": "Eine Schreibberechtigung für die Systemadministration ist erforderlich.",