dodil/erp-brick-payments

DODIL ERP brick: payments

src/brick_payments/roles.yaml

# The default roles this brick recommends: module.yaml's actors, permission for permission. A starting point, not a
# rule. The brick checks PERMISSIONS only, never a role's name; a composition maps its own pool roles to these
# permissions (or grants pay:*:* to an owner) in its role catalogue.
#
# pay:credit:read is an addition to the spec's catalog: it is what lets sales (sales-order, crm) ask credit_status and
# credit_ok - a customer's hold, reason and balance - without seeing a single receipt.
# pay:settings:controls (the tolerance, auto-matching, credit-hold rule, time zone, import cut-over) is held by the
# approver ONLY, never by the cashier it controls.
roles:
  cashier:
    [pay:receipt:read, pay:receipt:write, pay:receipt:import, pay:allocation:write, pay:refund:request,
     pay:statement_line:reconcile, pay:remittance:import, pay:mandate:write, pay:dd_run:write, pay:cash_journal:write,
     pay:deposit_batch:write, pay:payout:export]
  collector:
    [pay:receipt:read, pay:collection:write, pay:collection_event:write, pay:reminder:send, pay:statement:write]
  approver:
    [pay:receipt:read, pay:refund:approve, pay:credit:write, pay:credit:read, pay:settings:write, pay:settings:controls,
     pay:migration:sign, pay:bank_account:write, pay:reconciliation_rule:write, pay:dd_run:approve, pay:cash_journal:approve,
     pay:forecast:read, pay:payout:approve]
  sales:
    [pay:credit:read]
  system:
    [pay:receipt:read, pay:receipt:ingest, pay:receipt:match, pay:collection:tick, pay:allocation:from_source,
     pay:migration:import, pay:statement:ingest, pay:statement_line:suggest, pay:dd:collect, pay:bank_account:read_unmasked, pay:deposit_batch:intake, pay:card_settlement:intake,
     pay:payout:intake]
service_clients: [system]
# pay:receipt:ingest, pay:receipt:match, pay:collection:tick, pay:allocation:from_source, pay:migration:import,
# pay:statement:ingest, pay:statement_line:suggest, pay:dd:collect and pay:bank_account:read_unmasked (purchasing's
# machine identity reads OUR paying account unmasked for its bank file, every read audited) are
# machine permissions: grant them only to the system's service client (one per job, each with only its exact grants).
# A wildcard such as pay:*:* never reaches them.