dodil/erp-brick-inventory

DODIL ERP brick: inventory

tests/scenarios/roles.yaml

# The default roles this brick recommends: module.yaml's actors, permission for permission. A starting point, not a rule.
# The brick checks PERMISSIONS only, never a role's name; a composition maps its own pool roles to these permissions (or
# grants inv:*:* to an owner) in its role catalogue.
#
# Cost and value are seen by inv:valuation:read alone: the floor (stock_operator) and sales never see a cost or a value.
# inv:settings:controls (negative stock, the approval thresholds, lots, the ledger mode, valuation method, the AI step's mode)
# is held by the owner, never by whoever the controls bind. The machine permissions (inv:receipt:intake, :reservation:intake,
# :valuation:post, :number_series:claim, :count:suggest, :migration:import, :migration:read, :return:expect,
# :replenishment:propose, :abc:classify) are held only by a service client; a wildcard such as inv:*:* never reaches them.
roles:
  warehouse_manager:
    [inv:stock:read, inv:warehouse:write, inv:product:write, inv:receipt:validate, inv:delivery:validate, inv:transfer:write,
     inv:count:write, inv:adjustment:apply, inv:reservation:write, inv:move:reverse, inv:issue:write, inv:stock_type:write,
     inv:replenishment:write, inv:settings:write]
  stock_operator:
    [inv:stock:read, inv:receipt:validate, inv:delivery:validate, inv:transfer:write, inv:count:write, inv:issue:write]
  stock_controller:
    [inv:stock:read, inv:valuation:read, inv:adjustment:approve, inv:issue:approve]
  owner:
    [inv:stock:read, inv:valuation:read, inv:settings:controls]
  accountant:
    [inv:stock:read, inv:valuation:read, inv:account_map:write, inv:valuation:write]
  sales_rep:
    [inv:availability:read]
  system:                 # fills: system - a machine (client_credentials), never a person
    [inv:stock:read, inv:availability:read, inv:receipt:intake, inv:reservation:intake, inv:valuation:post,
     inv:number_series:claim, inv:count:suggest, inv:migration:import, inv:migration:read, inv:return:expect,
     inv:replenishment:propose, inv:abc:classify]
service_clients: [system]