feat(core): add authenticated baseline role templates

src/govoplan_core/core/modules.py

@@ -45,6 +45,7 @@ class RoleTemplate:
     level: PermissionLevel = "tenant"
     managed: bool = True
     protected: bool = False
+    default_authenticated: bool = False
 
 
 @dataclass(frozen=True, slots=True)

src/govoplan_core/core/registry.py

@@ -320,9 +320,34 @@ def _validate_role_template_scopes(
     *,
     known_scopes: set[str],
 ) -> None:
+    seen_templates: dict[tuple[str, str], str] = {}
     for manifest in manifests:
         for template in manifest.role_templates:
+            template_key = (template.level, template.slug)
+            previous_module = seen_templates.get(template_key)
+            if previous_module is not None:
+                raise RegistryError(
+                    f"Duplicate {template.level} role template slug {template.slug!r} "
+                    f"in modules {previous_module!r} and {manifest.id!r}"
+                )
+            seen_templates[template_key] = manifest.id
+            if template.default_authenticated and template.level != "tenant":
+                raise RegistryError(
+                    f"Default authenticated role template {template.slug!r} must be tenant-level"
+                )
+            if template.default_authenticated and not template.managed:
+                raise RegistryError(
+                    f"Default authenticated role template {template.slug!r} must be managed"
+                )
             for scope in template.permissions:
+                if template.default_authenticated and (
+                    scope in {"*", "tenant:*", "system:*"}
+                    or _WILDCARD_RE.match(scope)
+                ):
+                    raise RegistryError(
+                        f"Default authenticated role template {template.slug!r} "
+                        "must use explicit permissions, not wildcard scopes"
+                    )
                 if _role_template_scope_known(scope, known_scopes):
                     continue
                 raise RegistryError(f"Role template {template.slug!r} references unknown permission {scope!r}")