dodil/erp-brick-payroll

DODIL ERP brick: payroll

src/brick_payroll/roles.yaml

# The default roles this brick recommends: module.yaml's actors, permission for permission. A starting point, not a rule:
# the brick checks PERMISSIONS only, never a role's name; a composition maps its own pool roles to these.
#
# prl:settings:controls is the owner's alone. The machine permissions are exact grants to a service client:
#   system           payroll's own worker: drains the outbox (hr's sent, the journal, the payouts)
#   payments_client  payments' service client: prl:payout:mark_paid, and nothing else
roles:
  payroll_admin:
    [prl:employee:read, prl:employee:write, prl:tax_code:write, prl:pay_run:read, prl:pay_run:calculate, prl:pay_run:open,
     prl:document:read, prl:rti:read, prl:pension:write, prl:payslip:read_own, prl:migration:read]
  payroll_manager:
    [prl:employee:read, prl:pay_run:read, prl:pay_run:approve, prl:pay_run:off_cycle, prl:pay_run:cancel, prl:element:write,
     prl:rate:write, prl:scheme:write, prl:document:read, prl:rti:read, prl:liability:read, prl:payslip:read_own, prl:migration:read]
  employee:
    [prl:payslip:read_own, prl:pension:opt_out_own]
  owner:
    [prl:pay_run:read, prl:liability:read, prl:settings:controls, prl:migration:read, prl:migration:sign]
  system:
    [prl:pay_run:open_auto, prl:payslip:derive, prl:journal:post_auto, prl:payout:request, prl:rti:submit, prl:pension:submit,
     prl:document:publish, prl:year_end:run, prl:migration:load, prl:migration:reconcile]
  payments_client:
    [prl:payout:mark_paid]
service_clients: [system, payments_client]