feat: implement governed project portfolio

src/govoplan_projects/backend/acl.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from govoplan_core.auth import has_scope
+from govoplan_core.core.modules import AccessDecision
+
+
+class ProjectScopeAclProvider:
+    """Expose coarse scope checks; the Projects registry rechecks object grants."""
+
+    def __init__(self, resource_type: str) -> None:
+        self.resource_type = resource_type
+
+    def can_read(self, principal: object, resource_id: str) -> bool:
+        del resource_id
+        return has_scope(principal, "projects:project:read")
+
+    def can_write(self, principal: object, resource_id: str) -> bool:
+        del resource_id
+        return has_scope(principal, "projects:project:write")
+
+    def explain(self, principal: object, resource_id: str) -> AccessDecision:
+        del resource_id
+        allowed = self.can_read(principal, "")
+        return AccessDecision(
+            allowed=allowed,
+            reason=None if allowed else "Missing scope: projects:project:read",
+            requirements=("projects:project:read",),
+        )
+
+
+__all__ = ["ProjectScopeAclProvider"]