dodil/erp-brick-fixed-assets

DODIL ERP brick: fixed assets

src/brick_fixed_assets/roles.yaml

# The default roles this brick recommends: module.yaml's actors, permission for permission. A starting point, not a rule. The
# brick checks PERMISSIONS only, never a role's name; a composition maps its own pool roles to these permissions in its role
# catalogue.
#
# The controls (fa:settings:controls: areas and their ledgers, keys, account determination per class, the capitalisation
# threshold, number formats, whether a depreciation posting needs a second person) are the OWNER's alone and are never held by
# whoever they control: an asset_accountant, finance_approver or tax_preparer holding fa:settings:controls is a configuration
# error the use cases refuse. The machine permissions (system) are exact grants to ONE service client each: fa:acquisition:intake
# to purchasing's client, fa:depreciation:read (and fa:asset:read for GET /assets/balances) to gl's client, the rest to this
# module's own. No wildcard such as fa:*:* reaches them.
roles:
  asset_accountant:        # fills: the person who keeps the asset register
    [fa:asset:write, fa:asset:read, fa:acquisition:write, fa:auc:settle, fa:depreciation:simulate, fa:depreciation:run,
     fa:transaction:write, fa:count:manage, fa:report:read, fa:capital_allowance:read]
  finance_approver:        # fills: the financial controller
    [fa:asset:read, fa:depreciation:approve, fa:transaction:approve, fa:capital_allowance:approve, fa:capital_allowance:read,
     fa:year:close, fa:report:read, fa:settings:write, fa:migration:read]
  tax_preparer:            # fills: whoever prepares the corporation tax computation
    [fa:asset:read, fa:capital_allowance:write, fa:capital_allowance:read, fa:report:read]
  asset_custodian:         # fills: whoever looks after the assets on a site or in a department
    [fa:asset:read_own, fa:usage:write, fa:count:write]
  owner:                   # fills: the owner; holds the controls on the people who value assets, signs the migration
    [fa:asset:read, fa:report:read, fa:settings:controls, fa:migration:read, fa:migration:sign]
  system:                  # fills: a machine (client_credentials), never a person
    [fa:number_series:claim, fa:acquisition:intake, fa:journal:post, fa:depreciation:read, fa:asset:ai_suggest,
     fa:migration:load, fa:migration:reconcile]
service_clients: [system]