Expose identity lookup API

src/govoplan_identity/backend/manifest.py

@@ -1,12 +1,48 @@
 from __future__ import annotations
 
+from govoplan_core.core.access import CAPABILITY_AUTH_PERMISSION_EVALUATOR, CAPABILITY_AUTH_PRINCIPAL_RESOLVER
 from govoplan_core.core.identity import CAPABILITY_IDENTITY_DIRECTORY
 from govoplan_core.core.module_guards import persistent_table_uninstall_guard
-from govoplan_core.core.modules import DocumentationTopic, MigrationSpec, ModuleContext, ModuleManifest
+from govoplan_core.core.modules import DocumentationTopic, MigrationSpec, ModuleContext, ModuleManifest, PermissionDefinition, RoleTemplate
 from govoplan_core.db.base import Base
 from govoplan_identity.backend.db import models as identity_models  # noqa: F401 - populate metadata
 
 
+def _permission(scope: str, label: str, description: str) -> PermissionDefinition:
+    module_id, resource, action = scope.split(":", 2)
+    return PermissionDefinition(
+        scope=scope,
+        label=label,
+        description=description,
+        category="Identity",
+        level="tenant",
+        module_id=module_id,
+        resource=resource,
+        action=action,
+    )
+
+
+PERMISSIONS = (
+    _permission("identity:identity:read", "View identities", "Search and read normalized identities and their account links."),
+)
+
+ROLE_TEMPLATES = (
+    RoleTemplate(
+        slug="identity_viewer",
+        name="Identity viewer",
+        description="Read normalized identities and account links.",
+        permissions=("identity:identity:read",),
+    ),
+)
+
+
+def _route_factory(context: ModuleContext):
+    del context
+    from govoplan_identity.backend.api.v1.routes import router
+
+    return router
+
+
 def _identity_directory(context: ModuleContext) -> object:
     del context
     from govoplan_identity.backend.directory import SqlIdentityDirectory
@@ -17,7 +53,11 @@ def _identity_directory(context: ModuleContext) -> object:
 manifest = ModuleManifest(
     id="identity",
     name="Identity",
-    version="0.1.6",
+    version="0.1.7",
+    required_capabilities=(CAPABILITY_AUTH_PRINCIPAL_RESOLVER, CAPABILITY_AUTH_PERMISSION_EVALUATOR),
+    permissions=PERMISSIONS,
+    role_templates=ROLE_TEMPLATES,
+    route_factory=_route_factory,
     migration_spec=MigrationSpec(module_id="identity", metadata=Base.metadata),
     uninstall_guard_providers=(
         persistent_table_uninstall_guard(