feat(rbac): add roles and permissions

backend/hermes/app/api/auth.py

@@ -6,8 +6,11 @@ from app.core.security import (
     get_access_token_expire_seconds,
     verify_password,
 )
+from app.core.rbac import get_current_active_user, get_user_permission_names
 from app.db.database import get_db
 from app.models.user import User
+from app.repositories.user_repository import UserRepository
+from app.schemas.rbac import CurrentUserResponse
 from app.schemas.user import LoginRequest, LoginResponse
 
 router = APIRouter(
@@ -21,7 +24,7 @@ def login(
     login: LoginRequest,
     db: Session = Depends(get_db),
 ):
-    user = db.query(User).filter(User.username == login.username).first()
+    user = UserRepository.get_by_username(db, login.username)
 
     if not user:
         raise HTTPException(
@@ -43,3 +46,14 @@ def login(
         "expires_in": get_access_token_expire_seconds(),
         "user": user,
     }
+
+
+@router.get("/me", response_model=CurrentUserResponse)
+def me(current_user: User = Depends(get_current_active_user)):
+    return {
+        "id": current_user.id,
+        "username": current_user.username,
+        "email": current_user.email,
+        "role": current_user.primary_role.name,
+        "permissions": sorted(get_user_permission_names(current_user)),
+    }

backend/hermes/app/api/permissions.py

@@ -0,0 +1,27 @@
+import logging
+
+from fastapi import APIRouter, Depends
+from sqlalchemy.orm import Session
+
+from app.core.rbac import require_permission
+from app.db.database import get_db
+from app.models.user import User
+from app.repositories.rbac_repository import RbacRepository
+from app.schemas.rbac import PermissionResponse
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(
+    prefix="/permissions",
+    tags=["Permissions"],
+)
+
+
+@router.get("", response_model=list[PermissionResponse])
+@router.get("/", response_model=list[PermissionResponse], include_in_schema=False)
+def get_permissions(
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_permission("roles.read")),
+):
+    logger.info("permissions.list", extra={"actor_user_id": current_user.id})
+    return RbacRepository.get_permissions(db)

backend/hermes/app/api/roles.py

@@ -0,0 +1,153 @@
+import logging
+
+from fastapi import APIRouter, Depends, HTTPException, Response, status
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.core.rbac import require_permission
+from app.db.database import get_db
+from app.models.user import User
+from app.repositories.rbac_repository import RbacRepository
+from app.schemas.rbac import RoleCreate, RolePermissionUpdate, RoleResponse, RoleUpdate
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(
+    prefix="/roles",
+    tags=["Roles"],
+)
+
+
+def get_role_or_404(db: Session, role_id: int):
+    role = RbacRepository.get_role_by_id(db, role_id)
+
+    if role is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Rolle nicht gefunden",
+        )
+
+    return role
+
+
+def ensure_unique_role_name(db: Session, name: str, role_id: int | None = None) -> None:
+    role = RbacRepository.get_role_by_name(db, name)
+    if role is not None and role.id != role_id:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Rollenname ist bereits vergeben",
+        )
+
+
+def ensure_permission_ids_exist(db: Session, permission_ids: list[int]) -> None:
+    permissions = RbacRepository.get_permissions_by_ids(db, permission_ids)
+    if len(permissions) != len(set(permission_ids)):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Mindestens eine Berechtigung existiert nicht",
+        )
+
+
+@router.get("", response_model=list[RoleResponse])
+@router.get("/", response_model=list[RoleResponse], include_in_schema=False)
+def get_roles(
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_permission("roles.read")),
+):
+    logger.info("roles.list", extra={"actor_user_id": current_user.id})
+    return RbacRepository.get_roles(db)
+
+
+@router.get("/{role_id}", response_model=RoleResponse)
+def get_role(
+    role_id: int,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_permission("roles.read")),
+):
+    logger.info(
+        "roles.detail",
+        extra={"actor_user_id": current_user.id, "target_role_id": role_id},
+    )
+    return get_role_or_404(db, role_id)
+
+
+@router.post("", response_model=RoleResponse, status_code=status.HTTP_201_CREATED)
+@router.post(
+    "/",
+    response_model=RoleResponse,
+    status_code=status.HTTP_201_CREATED,
+    include_in_schema=False,
+)
+def create_role(
+    role: RoleCreate,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_permission("roles.create")),
+):
+    ensure_unique_role_name(db, role.name)
+    ensure_permission_ids_exist(db, role.permission_ids)
+
+    logger.info("roles.create", extra={"actor_user_id": current_user.id})
+    return RbacRepository.create_role(db, role)
+
+
+@router.put("/{role_id}", response_model=RoleResponse)
+def update_role(
+    role_id: int,
+    role: RoleUpdate,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_permission("roles.update")),
+):
+    db_role = get_role_or_404(db, role_id)
+    ensure_unique_role_name(db, role.name, role_id)
+    ensure_permission_ids_exist(db, role.permission_ids)
+
+    logger.info(
+        "roles.update",
+        extra={"actor_user_id": current_user.id, "target_role_id": role_id},
+    )
+    return RbacRepository.update_role(db, db_role, role)
+
+
+@router.delete("/{role_id}", status_code=status.HTTP_204_NO_CONTENT)
+def delete_role(
+    role_id: int,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_permission("roles.delete")),
+):
+    db_role = get_role_or_404(db, role_id)
+    if db_role.is_system:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Systemrollen dürfen nicht gelöscht werden",
+        )
+
+    assigned_user_id = db.scalar(select(User.id).where(User.role_id == role_id).limit(1))
+    if assigned_user_id is not None:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Rolle ist Benutzern zugewiesen und kann nicht gelöscht werden",
+        )
+
+    logger.info(
+        "roles.delete",
+        extra={"actor_user_id": current_user.id, "target_role_id": role_id},
+    )
+    RbacRepository.delete_role(db, db_role)
+    return Response(status_code=status.HTTP_204_NO_CONTENT)
+
+
+@router.put("/{role_id}/permissions", response_model=RoleResponse)
+def update_role_permissions(
+    role_id: int,
+    permission_update: RolePermissionUpdate,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_permission("roles.assign")),
+):
+    db_role = get_role_or_404(db, role_id)
+    ensure_permission_ids_exist(db, permission_update.permission_ids)
+
+    logger.info(
+        "roles.permissions_update",
+        extra={"actor_user_id": current_user.id, "target_role_id": role_id},
+    )
+    return RbacRepository.update_role_permissions(db, db_role, permission_update)

backend/hermes/app/api/users.py

@@ -1,12 +1,12 @@
 import logging
 
 from fastapi import APIRouter, Depends, HTTPException, Response, status
-from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 from sqlalchemy.orm import Session
 
-from app.core.security import verify_access_token
+from app.core.rbac import get_user_permission_names, require_permission
 from app.db.database import get_db
 from app.models.user import User
+from app.repositories.rbac_repository import RbacRepository
 from app.repositories.user_repository import UserRepository
 from app.schemas.user import UserCreate, UserPasswordUpdate, UserResponse, UserUpdate
 
@@ -17,45 +17,6 @@ router = APIRouter(
     tags=["Users"],
 )
 
-bearer_scheme = HTTPBearer(auto_error=False)
-
-
-def get_current_user(
-    credentials: HTTPAuthorizationCredentials | None = Depends(bearer_scheme),
-    db: Session = Depends(get_db),
-) -> User:
-    if credentials is None:
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Nicht authentifiziert",
-            headers={"WWW-Authenticate": "Bearer"},
-        )
-
-    username = verify_access_token(credentials.credentials)
-    user = UserRepository.get_by_username(db, username)
-
-    if user is None or not user.is_active:
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Nicht authentifiziert",
-            headers={"WWW-Authenticate": "Bearer"},
-        )
-
-    return user
-
-
-def require_role(*allowed_roles: str):
-    def dependency(current_user: User = Depends(get_current_user)) -> User:
-        if current_user.role not in allowed_roles:
-            raise HTTPException(
-                status_code=status.HTTP_403_FORBIDDEN,
-                detail="Keine Berechtigung",
-            )
-        return current_user
-
-    return dependency
-
-
 def get_user_or_404(db: Session, user_id: int) -> User:
     db_user = UserRepository.get_by_id(db, user_id)
 
@@ -80,11 +41,36 @@ def raise_conflict(field: str) -> None:
     )
 
 
+def require_actor_permission(current_user: User, permission: str) -> None:
+    if permission not in get_user_permission_names(current_user):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Keine Berechtigung",
+        )
+
+
+def apply_role(db: Session, user: UserCreate | UserUpdate) -> None:
+    role = None
+    if user.role_id is not None:
+        role = RbacRepository.get_role_by_id(db, user.role_id)
+    else:
+        role = RbacRepository.get_role_by_name(db, user.role)
+
+    if role is None:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Rolle nicht gefunden",
+        )
+
+    user.role_id = role.id
+    user.role = role.name
+
+
 @router.get("", response_model=list[UserResponse])
 @router.get("/", response_model=list[UserResponse], include_in_schema=False)
 def get_users(
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(require_permission("users.read")),
 ):
     logger.info("users.list", extra={"actor_user_id": current_user.id})
     return UserRepository.get_all(db)
@@ -94,7 +80,7 @@ def get_users(
 def get_user(
     user_id: int,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(require_permission("users.read")),
 ):
     logger.info(
         "users.detail",
@@ -113,8 +99,10 @@ def get_user(
 def create_user(
     user: UserCreate,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(require_permission("users.create")),
 ):
+    require_actor_permission(current_user, "roles.assign")
+    apply_role(db, user)
     conflict = UserRepository.find_conflict(
         db,
         username=user.username,
@@ -133,9 +121,12 @@ def update_user(
     user_id: int,
     user: UserUpdate,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(require_permission("users.update")),
 ):
     db_user = get_user_or_404(db, user_id)
+    apply_role(db, user)
+    if user.role_id != db_user.role_id:
+        require_actor_permission(current_user, "roles.assign")
     conflict = UserRepository.find_conflict(
         db,
         username=user.username,
@@ -158,7 +149,7 @@ def update_user_password(
     user_id: int,
     password_update: UserPasswordUpdate,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(require_permission("users.password.update")),
 ):
     db_user = get_user_or_404(db, user_id)
 
@@ -173,7 +164,7 @@ def update_user_password(
 def delete_user(
     user_id: int,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(require_permission("users.delete")),
 ):
     if current_user.id == user_id:
         raise HTTPException(