GovOPlaN/govoplan-core
1
0
Fork 0
Code Issues 37 Pull Requests Actions Packages Projects Releases Wiki Activity

Release v0.1.6

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-07 16:00:38 +02:00
parent a2053518d1
commit 150b720f12
149 changed files with 14311 additions and 8005 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/govoplan_core/security/permissions.py
View File

@@ -86,6 +86,7 @@ SYSTEM_PERMISSIONS: tuple[PermissionDefinition, ...] = (
PermissionDefinition("system:audit:read", "View system audit", "Read audit records across tenants.", "System administration", "system"),
PermissionDefinition("system:settings:read", "View system settings", "Read instance defaults and tenant-governance defaults.", "System administration", "system"),
PermissionDefinition("system:settings:write", "Manage system settings", "Change instance defaults and tenant-governance defaults.", "System administration", "system"),
PermissionDefinition("system:maintenance:access", "Access during maintenance", "Use the system while maintenance mode is active.", "System administration", "system"),
PermissionDefinition("system:governance:read", "View governance templates", "Inspect centrally managed group and role definitions.", "System administration", "system"),
PermissionDefinition("system:governance:write", "Manage governance templates", "Create and assign centrally managed group and role definitions.", "System administration", "system"),
)
@@ -174,6 +175,14 @@ DEFAULT_SYSTEM_ROLES: dict[str, dict[str, object]] = {
"is_assignable": True,
"managed": False,
},
"maintenance_operator": {
"name": "Maintenance operator",
"description": "Access the system while maintenance mode is active.",
"permissions": ["system:settings:read", "system:maintenance:access"],
"is_builtin": False,
"is_assignable": True,
"managed": False,
},
}
@@ -186,8 +195,10 @@ def scope_grants(granted: str, required: str) -> bool:
return True
if required in LEGACY_SCOPE_ALIASES.get(granted, frozenset()):
return True
if granted in {"*", "tenant:*"}:
return required in {"*", "tenant:*"} or (required in TENANT_SCOPES) or required in {"attachments:read", "attachments:write"}
if granted == "*":
return True
if granted == "tenant:*":
return required == "tenant:*" or not required.startswith("system:")
if granted == "system:*":
return required.startswith("system:")
if granted.endswith(":*") and required.startswith(granted[:-1]):