dodil/erp-brick-gl

DODIL ERP brick: general ledger

tests/scenarios/roles.yaml

# The default roles this brick recommends: module.yaml's actors, permission for permission. A starting point, not a
# rule. The brick checks PERMISSIONS only, never a role's name; a composition maps its own pool roles to these
# permissions (or grants gl:*:* to an owner) in its role catalogue.
#
# gl:settings:controls (the owner's) is held by neither the bookkeeper nor the accountant: a configuration that gives
# it to someone it controls is refused by the access test. The machine permissions are held by `system` only, and
# each is an EXACT grant to one service client: a wildcard such as gl:*:* never reaches them. In a composition the
# `system` role is split per posting module (ar, payments, tax, purchasing, inventory, fixed-assets each hold only
# gl:journal:post and gl:period:read; consolidation only gl:group_data:extract, gl:company:read, gl:fx:read,
# gl:period:read).
roles:
  bookkeeper:
    [gl:journal:read, gl:journal:write, gl:period:read, gl:fx:read, gl:reconcile:run, gl:report:read, gl:company:read,
     gl:close:task]
  accountant:
    [gl:journal:read, gl:journal:write, gl:journal:approve, gl:reversal:approve, gl:account:write, gl:company:read,
     gl:company:write, gl:fsv:write, gl:period:read, gl:period:close, gl:period:reopen, gl:adjustment:post, gl:fx:read,
     gl:fx:write, gl:reval:run, gl:reconcile:run, gl:report:read, gl:recurring:write, gl:recurring:approve,
     gl:recurring:run, gl:accrual:write, gl:accrual:approve, gl:accrual:run, gl:allocation:approve, gl:allocation:run,
     gl:budget:approve, gl:close:manage, gl:close:task, gl:close:signoff, gl:audit:export, gl:settings:write,
     gl:migration:read]
  controller:
    [gl:journal:read, gl:period:read, gl:company:read, gl:report:read, gl:allocation:write, gl:allocation:simulate,
     gl:allocation:run, gl:keyfigure:write, gl:budget:write, gl:close:task]
  auditor:
    [gl:journal:read, gl:period:read, gl:fx:read, gl:report:read, gl:company:read, gl:audit:export, gl:audit:verify,
     gl:migration:read]
  owner:
    [gl:journal:read, gl:report:read, gl:company:read, gl:settings:controls, gl:migration:read, gl:migration:sign]
  system:
    [gl:journal:read, gl:period:read, gl:fx:read, gl:company:read, gl:journal:post, gl:balance:derive,
     gl:carry_forward:derive, gl:resplit:post, gl:close:check, gl:group_data:extract, gl:statement:materialise,
     gl:journal:check, gl:number_series:claim, gl:migration:load, gl:migration:reconcile, gl:cost_centre:read]
service_clients: [system]