initial commit after split

2026-06-24 01:43:10 +02:00
parent b1d6c0150f
commit 30c11a6dcf
173 changed files with 25380 additions and 0 deletions
--- a/src/govoplan_core/access/manifest.py
+++ b/src/govoplan_core/access/manifest.py
@@ -0,0 +1,119 @@
+from __future__ import annotations
+
+from govoplan_core.access.db.base import AccessBase
+from govoplan_core.access.db import models as access_models  # noqa: F401 - populate access metadata
+from govoplan_core.core.modules import MigrationSpec, ModuleManifest, PermissionDefinition, RoleTemplate
+
+
+def _permission(scope: str, label: str, description: str, category: str, level: str) -> PermissionDefinition:
+    module_id, resource, action = scope.split(":", 2)
+    return PermissionDefinition(
+        scope=scope,
+        label=label,
+        description=description,
+        category=category,
+        level=level,  # type: ignore[arg-type]
+        module_id=module_id,
+        resource=resource,
+        action=action,
+    )
+
+
+ACCESS_PERMISSIONS: tuple[PermissionDefinition, ...] = (
+    _permission("access:tenant:read", "View tenants", "List and inspect tenant registry entries.", "Access", "system"),
+    _permission("access:tenant:create", "Create tenants", "Create tenant registry entries.", "Access", "system"),
+    _permission("access:tenant:update", "Update tenants", "Update tenant metadata and activation state.", "Access", "system"),
+    _permission("access:account:read", "View accounts", "List and inspect global login accounts.", "Access", "system"),
+    _permission("access:account:create", "Create accounts", "Create global login accounts.", "Access", "system"),
+    _permission("access:account:update", "Update accounts", "Update or suspend global login accounts.", "Access", "system"),
+    _permission("access:membership:read", "View memberships", "List tenant memberships and effective access.", "Tenant access", "tenant"),
+    _permission("access:membership:create", "Create memberships", "Create tenant-local account memberships.", "Tenant access", "tenant"),
+    _permission("access:membership:update", "Update memberships", "Update or suspend tenant memberships.", "Tenant access", "tenant"),
+    _permission("access:group:read", "View groups", "List tenant groups and members.", "Tenant access", "tenant"),
+    _permission("access:group:write", "Manage groups", "Create and update tenant groups.", "Tenant access", "tenant"),
+    _permission("access:group:manage_members", "Manage group members", "Add and remove memberships from groups.", "Tenant access", "tenant"),
+    _permission("access:role:read", "View roles", "Inspect tenant and system role definitions.", "Tenant access", "tenant"),
+    _permission("access:role:write", "Manage roles", "Create and update assignable roles.", "Tenant access", "tenant"),
+    _permission("access:role:assign", "Assign roles", "Bind roles to memberships, groups, accounts or services.", "Tenant access", "tenant"),
+    _permission("access:api_key:read", "View API keys", "List API keys without revealing secrets.", "Tenant access", "tenant"),
+    _permission("access:api_key:create", "Create API keys", "Create tenant API keys within delegation limits.", "Tenant access", "tenant"),
+    _permission("access:api_key:revoke", "Revoke API keys", "Revoke tenant API keys.", "Tenant access", "tenant"),
+    _permission("access:setting:read", "View settings", "Read access and governance settings.", "Tenant access", "tenant"),
+    _permission("access:setting:write", "Manage settings", "Update access and governance settings.", "Tenant access", "tenant"),
+    _permission("access:governance:read", "View governance", "Inspect managed role and group templates.", "Access", "system"),
+    _permission("access:governance:write", "Manage governance", "Create and assign managed role and group templates.", "Access", "system"),
+)
+
+ACCESS_ROLE_TEMPLATES: tuple[RoleTemplate, ...] = (
+    RoleTemplate(
+        slug="system_owner",
+        name="System owner",
+        description="Protected full instance-wide administration.",
+        permissions=("system:*",),
+        level="system",
+        managed=True,
+        protected=True,
+    ),
+    RoleTemplate(
+        slug="system_admin",
+        name="System administrator",
+        description="Manage tenants, accounts, settings, and governance without protected owner status.",
+        permissions=(
+            "access:tenant:read",
+            "access:tenant:create",
+            "access:tenant:update",
+            "access:account:read",
+            "access:account:create",
+            "access:account:update",
+            "access:governance:read",
+            "access:governance:write",
+        ),
+        level="system",
+        managed=True,
+        protected=False,
+    ),
+    RoleTemplate(
+        slug="tenant_owner",
+        name="Tenant owner",
+        description="Protected full tenant administration and module access.",
+        permissions=("tenant:*",),
+        level="tenant",
+        managed=True,
+        protected=True,
+    ),
+    RoleTemplate(
+        slug="access_admin",
+        name="Access administrator",
+        description="Manage memberships, groups, roles, and API keys within delegation limits.",
+        permissions=(
+            "access:membership:read",
+            "access:membership:create",
+            "access:membership:update",
+            "access:group:read",
+            "access:group:write",
+            "access:group:manage_members",
+            "access:role:read",
+            "access:role:assign",
+            "access:api_key:read",
+            "access:api_key:create",
+            "access:api_key:revoke",
+        ),
+        level="tenant",
+        managed=True,
+        protected=False,
+    ),
+)
+
+manifest = ModuleManifest(
+    id="access",
+    name="Access",
+    version="1.0.0",
+    permissions=ACCESS_PERMISSIONS,
+    role_templates=ACCESS_ROLE_TEMPLATES,
+    migration_spec=MigrationSpec(module_id="access", metadata=AccessBase.metadata),
+)
+
+
+def get_manifest() -> ModuleManifest:
+    return manifest
+