dodil/erp-brick-expenses

DODIL ERP brick: expenses

src/brick_expenses/roles.yaml

# The default roles this brick recommends: module.yaml's actors, permission for permission. A starting point, not a
# rule. The brick checks PERMISSIONS only, never a role's name; a composition maps its own pool roles to these.
#
# exp:settings:controls is the owner's alone (never the finance user it controls). The machine permissions are exact
# grants to a service client, one client per neighbour:
#   hr_client        hr's service client: exp:leaver:intake, and nothing else
#   payments_client  payments' service client: exp:report:mark_paid, and nothing else
#   system           expenses' own worker: drains the outbox (posts the journals, asks payments for the payouts)
roles:
  employee:
    [exp:report:read_own, exp:report:write_own, exp:report:submit, exp:card_txn:match_own, exp:ai:consent]
  manager:
    [exp:report:read_own, exp:report:write_own, exp:report:submit, exp:card_txn:match_own, exp:ai:consent,
     exp:report:read_team, exp:report:approve, exp:delegation:write]
  finance:
    [exp:report:read_all, exp:report:finance_approve, exp:report:post, exp:card:write, exp:card_feed:import,
     exp:card_txn:resolve, exp:policy:write, exp:category:write, exp:rate:write, exp:report:read_own,
     exp:report:write_own, exp:report:submit, exp:migration:read]
  owner:
    [exp:report:read_all, exp:settings:controls, exp:migration:read, exp:migration:sign]
  system:
    [exp:ai:read_receipt, exp:report:derive, exp:journal:post_auto, exp:payout:request, exp:card_feed:ingest,
     exp:number_series:claim, exp:migration:load, exp:migration:reconcile]
  hr_client:
    [exp:leaver:intake]
  payments_client:
    [exp:report:mark_paid]
service_clients: [system, hr_client, payments_client]