dodil/erp-brick-purchasing

DODIL ERP brick: purchasing

src/brick_purchasing/roles.yaml

# The default roles this brick recommends: module.yaml's actors, permission for permission. A starting point, not a
# rule. The brick checks PERMISSIONS only, never a role's name; a composition maps its own pool roles to these.
# The machine permissions go to service clients only: purchasing:receipt:hand_over etc. are never reached by a wildcard.
# OUTBOUND grants (what the composition gives PURCHASING's own service client on its neighbours; the Seams in infrastructure/seams.py list them):
# payments: pay:receipt:read and pay:bank_account:read_unmasked (PAY-27: our own account number for the bank file, asked per export, every read
# audited there, never stored here). Without the second, exporting a BACS or pain.001 file is refused with the gate `originator_account`.
# purchasing:settings:controls is held by the owner and by none of the people it controls (a configuration error otherwise).
roles:
  requester:
  - purchasing:request:write
  - purchasing:request:read_own
  spend_approver:
  - purchasing:request:approve
  - purchasing:order:approve
  - purchasing:agreement:approve
  - purchasing:request:write
  - purchasing:request:read
  - purchasing:order:read
  buyer:
  - purchasing:order:write
  - purchasing:order:confirm
  - purchasing:order:send
  - purchasing:request:read
  - purchasing:order:read
  - purchasing:supplier:write
  - purchasing:supplier:read
  - purchasing:supplier_price:write
  - purchasing:receipt:read
  - purchasing:rfq:write
  - purchasing:agreement:write
  - purchasing:source:write
  - purchasing:evaluation:write
  - purchasing:down_payment:request
  receiver:
  - purchasing:receipt:write
  - purchasing:receipt:read
  - purchasing:order:read_expected
  - purchasing:subcontract:provide
  payables_clerk:
  - purchasing:bill:write
  - purchasing:bill:read
  - purchasing:payment:write
  - purchasing:payment:read
  - purchasing:order:read
  - purchasing:receipt:read
  - purchasing:supplier:read
  - purchasing:supplier_bank:write
  - purchasing:down_payment:clear
  - purchasing:self_billing:write
  - purchasing:ers:run
  - purchasing:consignment:settle
  payables_approver:
  - purchasing:bill:approve
  - purchasing:bill:read
  - purchasing:payment:approve
  - purchasing:payment:read
  - purchasing:supplier_bank:approve
  - purchasing:supplier:read
  - purchasing:settings:write
  - purchasing:migration:read
  - purchasing:down_payment:approve
  - purchasing:self_billing:approve
  owner:
  - purchasing:bill:read
  - purchasing:order:read
  - purchasing:settings:controls
  - purchasing:migration:read
  - purchasing:migration:sign
  system:
  - purchasing:number_series:claim
  - purchasing:receipt:hand_over
  - purchasing:bill:post
  - purchasing:payment:post
  - purchasing:payment:export
  - purchasing:bill:ai_read
  - purchasing:bill:ai_check
  - purchasing:migration:load
  - purchasing:migration:reconcile
  - purchasing:consignment:intake
  - purchasing:source:propose
  - purchasing:asset:hand_over
  - purchasing:cis:record
  - purchasing:request:intake
  - purchasing:payment:confirm
  # service clients of the NEIGHBOURS (exact grants; none of them can write an order or a bill)
  inventory_client:
  - purchasing:receipt:write
  - purchasing:order:read_expected
  - purchasing:consignment:intake
  - purchasing:source:propose
  - purchasing:request:intake
  sales_order_client:
  - purchasing:request:intake
  payments_client:
  - purchasing:payment:confirm
  - purchasing:payment:read
  tax_client:
  - purchasing:payment:read
  gl_client:
  - purchasing:bill:read
  ar_client:
  - purchasing:bill:write
service_clients:
- system
- inventory_client
- sales_order_client
- payments_client
- tax_client
- gl_client
- ar_client