feat(rbac): add roles and permissions

backend/hermes/app/rbac/defaults.py

@@ -0,0 +1,112 @@
+STANDARD_ROLES = [
+    {
+        "name": "administrator",
+        "display_name": "Administrator",
+        "description": "Vollzugriff auf Olympus CRM",
+        "is_system": True,
+    },
+    {
+        "name": "management",
+        "display_name": "Management",
+        "description": "Lesender Zugriff auf operative Kernmodule",
+        "is_system": True,
+    },
+    {
+        "name": "sales",
+        "display_name": "Vertrieb",
+        "description": "Zugriff auf Kunden und Projekte",
+        "is_system": True,
+    },
+    {
+        "name": "technician",
+        "display_name": "Technik",
+        "description": "Zugriff auf Tickets und Projekte",
+        "is_system": True,
+    },
+    {
+        "name": "support",
+        "display_name": "Support",
+        "description": "Operativer Support-Zugriff",
+        "is_system": True,
+    },
+    {
+        "name": "warehouse",
+        "display_name": "Lager",
+        "description": "Zugriff auf lagernahe Prozesse",
+        "is_system": True,
+    },
+    {
+        "name": "guest",
+        "display_name": "Gast",
+        "description": "Minimaler Zugriff",
+        "is_system": True,
+    },
+]
+
+STANDARD_PERMISSIONS = [
+    ("users.read", "Benutzer lesen", "Benutzer anzeigen", "users"),
+    ("users.create", "Benutzer erstellen", "Benutzer anlegen", "users"),
+    ("users.update", "Benutzer bearbeiten", "Benutzer aktualisieren", "users"),
+    ("users.delete", "Benutzer loeschen", "Benutzer entfernen", "users"),
+    ("users.password.update", "Passwort aendern", "Benutzerpasswort aendern", "users"),
+    ("roles.read", "Rollen lesen", "Rollen anzeigen", "roles"),
+    ("roles.create", "Rollen erstellen", "Rollen anlegen", "roles"),
+    ("roles.update", "Rollen bearbeiten", "Rollen aktualisieren", "roles"),
+    ("roles.delete", "Rollen loeschen", "Rollen entfernen", "roles"),
+    ("roles.assign", "Rollen zuweisen", "Berechtigungen Rollen zuweisen", "roles"),
+    ("customers.read", "Kunden lesen", "Kunden anzeigen", "customers"),
+    ("customers.create", "Kunden erstellen", "Kunden anlegen", "customers"),
+    ("customers.update", "Kunden bearbeiten", "Kunden aktualisieren", "customers"),
+    ("customers.delete", "Kunden loeschen", "Kunden entfernen", "customers"),
+    ("projects.read", "Projekte lesen", "Projekte anzeigen", "projects"),
+    ("projects.create", "Projekte erstellen", "Projekte anlegen", "projects"),
+    ("projects.update", "Projekte bearbeiten", "Projekte aktualisieren", "projects"),
+    ("projects.delete", "Projekte loeschen", "Projekte entfernen", "projects"),
+    ("tickets.read", "Tickets lesen", "Tickets anzeigen", "tickets"),
+    ("tickets.create", "Tickets erstellen", "Tickets anlegen", "tickets"),
+    ("tickets.update", "Tickets bearbeiten", "Tickets aktualisieren", "tickets"),
+    ("tickets.delete", "Tickets loeschen", "Tickets entfernen", "tickets"),
+    ("dashboard.read", "Dashboard lesen", "Dashboard anzeigen", "dashboard"),
+    ("system.settings.read", "Einstellungen lesen", "Systemeinstellungen anzeigen", "system"),
+    ("system.settings.update", "Einstellungen bearbeiten", "Systemeinstellungen aktualisieren", "system"),
+]
+
+ROLE_PERMISSION_NAMES = {
+    "administrator": "*",
+    "management": {
+        "dashboard.read",
+        "users.read",
+        "customers.read",
+        "projects.read",
+        "tickets.read",
+    },
+    "sales": {
+        "dashboard.read",
+        "customers.read",
+        "customers.create",
+        "customers.update",
+        "projects.read",
+        "tickets.read",
+    },
+    "technician": {
+        "dashboard.read",
+        "projects.read",
+        "tickets.read",
+        "tickets.create",
+        "tickets.update",
+    },
+    "support": {
+        "dashboard.read",
+        "users.read",
+        "customers.read",
+        "tickets.read",
+        "tickets.create",
+        "tickets.update",
+    },
+    "warehouse": {
+        "dashboard.read",
+    },
+    "guest": {
+        "dashboard.read",
+    },
+}

backend/hermes/app/rbac/seed.py

@@ -0,0 +1,63 @@
+import logging
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.models.rbac import Permission, Role
+from app.rbac.defaults import ROLE_PERMISSION_NAMES, STANDARD_PERMISSIONS, STANDARD_ROLES
+
+logger = logging.getLogger(__name__)
+
+
+def seed_rbac(db: Session) -> None:
+    roles_by_name = {
+        role.name: role
+        for role in db.scalars(select(Role)).all()
+    }
+    permissions_by_name = {
+        permission.name: permission
+        for permission in db.scalars(select(Permission)).all()
+    }
+
+    for role_data in STANDARD_ROLES:
+        role = roles_by_name.get(role_data["name"])
+        if role is None:
+            role = Role(**role_data)
+            db.add(role)
+            roles_by_name[role.name] = role
+        else:
+            role.display_name = role_data["display_name"]
+            role.description = role_data["description"]
+            role.is_system = role_data["is_system"]
+
+    for name, display_name, description, module in STANDARD_PERMISSIONS:
+        permission = permissions_by_name.get(name)
+        if permission is None:
+            permission = Permission(
+                name=name,
+                display_name=display_name,
+                description=description,
+                module=module,
+            )
+            db.add(permission)
+            permissions_by_name[name] = permission
+        else:
+            permission.display_name = display_name
+            permission.description = description
+            permission.module = module
+
+    db.flush()
+
+    all_permissions = set(permissions_by_name.values())
+    for role_name, permission_names in ROLE_PERMISSION_NAMES.items():
+        role = roles_by_name[role_name]
+        if permission_names == "*":
+            role.permissions = list(all_permissions)
+        else:
+            role.permissions = [
+                permissions_by_name[permission_name]
+                for permission_name in permission_names
+            ]
+
+    db.commit()
+    logger.info("rbac.seeded")