feat(core): add authenticated baseline role templates

tests/test_module_system.py

@@ -101,7 +101,7 @@ from govoplan_core.core.module_package_catalog import (
 )
 from govoplan_core.core.modules import FrontendModule, FrontendRoute, MigrationRetirementPlan, ModuleCompatibility, ModuleMigrationTask, ModuleMigrationTaskContext, ModuleMigrationTaskResult, ModuleUninstallGuardResult
 from govoplan_core.core.module_guards import drop_table_retirement_provider
-from govoplan_core.core.modules import MigrationSpec, ModuleInterfaceProvider, ModuleInterfaceRequirement, ModuleManifest
+from govoplan_core.core.modules import MigrationSpec, ModuleInterfaceProvider, ModuleInterfaceRequirement, ModuleManifest, RoleTemplate
 from govoplan_core.core.registry import PlatformRegistry, RegistryError
 from govoplan_core.admin.models import SystemSettings
 from govoplan_core.db.base import Base
@@ -359,6 +359,88 @@ class ModuleSystemTests(unittest.TestCase):
         with self.assertRaisesRegex(RegistryError, "unsupported manifest contract version"):
             registry.validate()
 
+    def test_default_authenticated_role_templates_are_managed_tenant_roles(self) -> None:
+        for template, message in (
+            (
+                RoleTemplate(
+                    slug="invalid-system-default",
+                    name="Invalid",
+                    description="Invalid system default.",
+                    permissions=("system:*",),
+                    level="system",
+                    default_authenticated=True,
+                ),
+                "must be tenant-level",
+            ),
+            (
+                RoleTemplate(
+                    slug="invalid-unmanaged-default",
+                    name="Invalid",
+                    description="Invalid unmanaged default.",
+                    permissions=("tenant:*",),
+                    managed=False,
+                    default_authenticated=True,
+                ),
+                "must be managed",
+            ),
+        ):
+            with self.subTest(template=template.slug):
+                registry = PlatformRegistry()
+                registry.register(
+                    ModuleManifest(
+                        id="example",
+                        name="Example",
+                        version="test",
+                        role_templates=(template,),
+                    )
+                )
+                with self.assertRaisesRegex(RegistryError, message):
+                    registry.validate()
+
+    def test_default_authenticated_role_templates_reject_wildcard_permissions(self) -> None:
+        registry = PlatformRegistry()
+        registry.register(
+            ModuleManifest(
+                id="example",
+                name="Example",
+                version="test",
+                role_templates=(
+                    RoleTemplate(
+                        slug="unsafe-default",
+                        name="Unsafe default",
+                        description="Must not grant broad authority automatically.",
+                        permissions=("tenant:*",),
+                        default_authenticated=True,
+                    ),
+                ),
+            )
+        )
+
+        with self.assertRaisesRegex(RegistryError, "must use explicit permissions"):
+            registry.validate()
+
+    def test_role_template_slugs_are_unique_per_level_across_modules(self) -> None:
+        registry = PlatformRegistry()
+        for module_id in ("first", "second"):
+            registry.register(
+                ModuleManifest(
+                    id=module_id,
+                    name=module_id.title(),
+                    version="test",
+                    role_templates=(
+                        RoleTemplate(
+                            slug="shared-reader",
+                            name="Shared reader",
+                            description="A colliding role template.",
+                            permissions=(),
+                        ),
+                    ),
+                )
+            )
+
+        with self.assertRaisesRegex(RegistryError, "Duplicate tenant role template slug"):
+            registry.validate()
+
     def test_registry_rejects_invalid_frontend_manifest_shape(self) -> None:
         registry = PlatformRegistry()
         registry.register(ModuleManifest(