rootandClaude Sonnet 5
e70c87332c
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (push) Canceled after 0s
CI / Core-Modul (Build/Vet/Test) (push) Canceled after 0s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (push) Canceled after 0s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (push) Canceled after 0s
CI / Web (dms-browser) (push) Canceled after 0s
CI / Web (pdf-viewer) (push) Canceled after 0s
CI / Web (shl) (push) Canceled after 0s
Supply-Chain-Scan (Go) / govulncheck (push) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (push) Canceled after 0s
Neue Migration 0018_module_policy_rules: 28 echte, granulare Rechte fuer Mail/Workflow/AI/Connect/Core-Admin (bisher nur DMS befuellt). Echte Durchsetzung verdrahtet fuer Mail (GET /messages, hat Rolle+Mandant aus Modul-Token) und Connect (GET /connectors/status, Mandant aus Header, Rolle mangels eigenem Rollenkonzept fest user). Workflow/AI/Core-Admin erhalten nur den Rechte-Katalog-Eintrag (AK1/2) -- echte Durchsetzung dort wuerde deren Identitaetsschicht um Rolle/Mandant erweitern muessen, das ist eine groessere, separate Aenderung je Modul, nicht Teil dieser Kachel (siehe Bericht). Migration real geprueft: 28 Zeilen nach Erstlauf, idempotent (0 neue beim Zweitlauf), sauberer Rollback (0 nach DELETE), dms.*-Rechte unveraendert (38 vorher/nachher). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
50 lines
2.1 KiB
SQL
50 lines
2.1 KiB
SQL
-- RBAC-12: echte Modulrechte fuer Mail/Workflow/AI/Connect/Core-Admin
|
|
-- (Namensraum <modul>.*), analog zu 0011_dms_policy_rules. Portal (SHL-02)
|
|
-- nutzte bislang erfundene Platzhalter, die real nirgends existierten.
|
|
-- Rollen 'user' und 'tenant_admin' wie beim bestehenden dms.*-Muster.
|
|
WITH grants(role, permission) AS (
|
|
VALUES
|
|
('user', 'mail.message.read'),
|
|
('user', 'mail.rule.read'),
|
|
('user', 'mail.rule.write'),
|
|
('tenant_admin', 'mail.message.read'),
|
|
('tenant_admin', 'mail.rule.read'),
|
|
('tenant_admin', 'mail.rule.write'),
|
|
|
|
('user', 'workflow.approval.read'),
|
|
('user', 'workflow.approval.write'),
|
|
('user', 'workflow.case.read'),
|
|
('user', 'workflow.routingrule.read'),
|
|
('tenant_admin', 'workflow.approval.read'),
|
|
('tenant_admin', 'workflow.approval.write'),
|
|
('tenant_admin', 'workflow.case.read'),
|
|
('tenant_admin', 'workflow.routingrule.read'),
|
|
('tenant_admin', 'workflow.routingrule.write'),
|
|
|
|
('user', 'ai.summary.read'),
|
|
('user', 'ai.search.read'),
|
|
('user', 'ai.extraction.read'),
|
|
('tenant_admin', 'ai.summary.read'),
|
|
('tenant_admin', 'ai.search.read'),
|
|
('tenant_admin', 'ai.extraction.read'),
|
|
|
|
('user', 'connect.status.read'),
|
|
('user', 'connect.datev.read'),
|
|
('tenant_admin', 'connect.status.read'),
|
|
('tenant_admin', 'connect.datev.read'),
|
|
('tenant_admin', 'connect.datev.write'),
|
|
|
|
('tenant_admin', 'core.tenant.read'),
|
|
('tenant_admin', 'core.tenant.admin')
|
|
),
|
|
ins AS (
|
|
INSERT INTO policy_rules (role, permission, granted_by)
|
|
SELECT role, permission, 'migration:0018_module_policy_rules' FROM grants
|
|
ON CONFLICT (role, permission) DO NOTHING
|
|
RETURNING role, permission
|
|
)
|
|
INSERT INTO policy_rule_changes (role, permission, action, actor, version)
|
|
SELECT i.role, i.permission, 'grant', 'migration:0018_module_policy_rules',
|
|
COALESCE((SELECT MAX(c.version) FROM policy_rule_changes c WHERE c.role = i.role AND c.permission = i.permission), 0) + 1
|
|
FROM ins i;
|