feat(modules): validate catalog permission declarations

tests/test_module_system.py

@@ -3504,6 +3504,16 @@ finally:
                 "python_ref": "govoplan-files==0.1.4",
                 "availability": "available",
                 "configuration_requirements": ["Object storage binding"],
+                "permissions": [{
+                    "scope": "files:file:read",
+                    "label": "Read files",
+                    "description": "Read managed files.",
+                    "category": "Files",
+                    "level": "tenant",
+                    "resource": "file",
+                    "action": "read",
+                    "deprecated": False,
+                }],
                 "release_notes_url": "https://git.example.test/modules/files/releases/v0.1.4",
                 "source": {
                     "repository": "govoplan-files",
@@ -3596,6 +3606,8 @@ finally:
         self.assertEqual(123, catalog[0]["artifact_integrity"]["python"]["size"])
         self.assertEqual("available", catalog[0]["availability"])
         self.assertEqual(["Object storage binding"], catalog[0]["configuration_requirements"])
+        self.assertEqual("files:file:read", catalog[0]["permissions"][0]["scope"])
+        self.assertEqual("tenant", catalog[0]["permissions"][0]["level"])
         self.assertEqual("v0.1.4", catalog[0]["source"]["tag"])
         self.assertEqual("a" * 40, catalog[0]["source"]["commit"])
         self.assertEqual(
@@ -3607,6 +3619,35 @@ finally:
         self.assertTrue(validation["valid"])
         self.assertEqual("files", validation["modules"][0]["module_id"])
 
+    def test_module_package_catalog_rejects_duplicate_permission_scopes(self) -> None:
+        root = Path(tempfile.mkdtemp(prefix="govoplan-module-package-permissions-", dir=_TEST_ROOT))
+        catalog_path = root / "catalog.json"
+        permission = {
+            "scope": "files:file:read",
+            "label": "Read files",
+            "description": "Read managed files.",
+            "category": "Files",
+            "level": "tenant",
+            "resource": "file",
+            "action": "read",
+            "deprecated": False,
+        }
+        catalog_path.write_text(
+            json.dumps({
+                "modules": [{
+                    "module_id": "files",
+                    "version": "0.1.4",
+                    "permissions": [permission, permission],
+                }],
+            }),
+            encoding="utf-8",
+        )
+
+        validation = validate_module_package_catalog(catalog_path)
+
+        self.assertFalse(validation["valid"])
+        self.assertIn("more than once", str(validation["error"]))
+
     def test_module_package_catalog_requires_reason_for_withdrawn_release(self) -> None:
         root = Path(tempfile.mkdtemp(prefix="govoplan-module-package-catalog-withdrawn-", dir=_TEST_ROOT))
         catalog_path = root / "catalog.json"