feat: add access module boundary migrations

src/govoplan_access/backend/auth/dependencies.py

@@ -17,8 +17,15 @@ from govoplan_core.core.registry import PlatformRegistry
 from govoplan_core.core.maintenance import MAINTENANCE_ACCESS_SCOPE, maintenance_response_detail, saved_maintenance_mode
 from govoplan_core.db.session import get_database, get_session
 from govoplan_access.backend.db.models import Account, ApiKey, AuthSession, User
+from govoplan_access.backend.semantic import collect_function_assignment_ids, collect_function_delegation_ids, identity_id_for_account
 from govoplan_access.backend.security.api_keys import authenticate_api_key
-from govoplan_access.backend.security.sessions import authenticate_session_token, collect_user_groups, collect_user_scopes, verify_auth_session_csrf
+from govoplan_access.backend.security.sessions import (
+    authenticate_session_token,
+    collect_user_groups,
+    collect_user_roles,
+    collect_user_scopes,
+    verify_auth_session_csrf,
+)
 from govoplan_tenancy.backend.db.models import Tenant
 from govoplan_core.security.module_permissions import scopes_grant_compatible
 from govoplan_core.security.permissions import intersect_api_key_scopes
@@ -63,6 +70,26 @@ class ApiPrincipal:
     def group_ids(self) -> frozenset[str]:
         return self.principal.group_ids
 
+    @property
+    def role_ids(self) -> frozenset[str]:
+        return self.principal.role_ids
+
+    @property
+    def function_assignment_ids(self) -> frozenset[str]:
+        return self.principal.function_assignment_ids
+
+    @property
+    def delegation_ids(self) -> frozenset[str]:
+        return self.principal.delegation_ids
+
+    @property
+    def identity_id(self) -> str | None:
+        return self.principal.identity_id
+
+    @property
+    def acting_for_account_id(self) -> str | None:
+        return self.principal.acting_for_account_id
+
     @property
     def auth_method(self) -> str:
         return self.principal.auth_method
@@ -128,8 +155,12 @@ def _build_principal_ref(
         account_id=account.id,
         membership_id=user.id,
         tenant_id=tenant_id,
+        identity_id=identity_id_for_account(session, account.id),
         scopes=frozenset(scopes),
         group_ids=_principal_group_ids(session, user),
+        role_ids=frozenset(role.id for role in collect_user_roles(session, user)),
+        function_assignment_ids=frozenset(collect_function_assignment_ids(session, user)),
+        delegation_ids=frozenset(collect_function_delegation_ids(session, user)),
         auth_method=auth_method,  # type: ignore[arg-type]
         api_key_id=api_key.id if api_key else None,
         session_id=auth_session.id if auth_session else None,