feat: classify audit evidence export scope

src/govoplan_core/security/module_permissions.py

@@ -37,6 +37,7 @@ LEGACY_TO_MODULE_SCOPES: dict[str, str] = {
     "system:access:read": "access:system_role:read",
     "system:access:assign": "access:system_role:assign",
     "system:audit:read": "access:audit:read",
+    "system:audit:evidence:export": "audit:system_evidence:export",
     "system:settings:read": "access:system_setting:read",
     "system:settings:write": "access:system_setting:write",
     "system:maintenance:access": "access:maintenance:access",

tests/test_module_system.py

@@ -342,7 +342,25 @@ class ModuleSystemTests(unittest.TestCase):
         self.assertTrue(scopes_grant_compatible(["admin:users:read"], "access:membership:read"))
         self.assertTrue(scopes_grant_compatible(["access:tenant:read"], "system:tenants:read"))
         self.assertTrue(scopes_grant_compatible(["system:*"], "access:tenant:read"))
+        self.assertTrue(
+            scopes_grant_compatible(
+                ["system:*"],
+                "audit:system_evidence:export",
+            )
+        )
+        self.assertTrue(
+            scopes_grant_compatible(
+                ["system:audit:evidence:export"],
+                "audit:system_evidence:export",
+            )
+        )
         self.assertFalse(scopes_grant_compatible(["tenant:*"], "system:tenants:read"))
+        self.assertFalse(
+            scopes_grant_compatible(
+                ["tenant:*"],
+                "audit:system_evidence:export",
+            )
+        )
         self.assertFalse(scopes_grant_compatible(["tenant:*"], "access:tenant:read"))
 
     def test_core_webui_retired_legacy_admin_api_surface(self) -> None:

webui/src/utils/permissions.ts

@@ -32,6 +32,7 @@ const legacyToModuleScopes: Record<string, string> = {
   "system:access:read": "access:system_role:read",
   "system:access:assign": "access:system_role:assign",
   "system:audit:read": "access:audit:read",
+  "system:audit:evidence:export": "audit:system_evidence:export",
   "system:settings:read": "access:system_setting:read",
   "system:settings:write": "access:system_setting:write",
   "system:maintenance:access": "access:maintenance:access",