dodil/erp-brick-sales-order

DODIL ERP brick: sales order

src/brick_sales_order/roles.yaml

# The default roles this brick recommends: module.yaml's actors, permission for permission. A starting point, not a
# rule. The brick checks PERMISSIONS only, never a role's name; a composition maps its own pool roles to these
# permissions (or grants so:*:* to an owner) in its role catalogue.
#
# so:settings:controls is held by neither the rep nor the order admin: it changes the controls on order takers
# (confirm_on_acceptance, amendment_needs_approval, lock_done_orders, business_timezone, AI step modes). The machine
# permissions (so:order:intake, :suggest, :finish, :import, so:number_series:claim) belong to the system's service
# client only; a wildcard such as so:*:* never reaches them.
roles:
  sales_rep:              # fills: sales_rep
    [so:order:read, so:order:write, so:order:confirm]
  order_admin:            # fills: order_admin (sales operations / the owner)
    [so:order:read, so:sales_order:read_all, so:order:approve, so:order:cancel, so:settings:write, so:pricing:write, so:rebate:write, so:order:block]
  sales_controller:       # fills: sales_controller — approves money going back (a rebate settlement, a credit or debit memo), never the one who asked
    [so:order:read, so:sales_order:read_all, so:rebate:approve, so:memo:approve]
  owner:                  # fills: owner — the owner or a finance controller; sets the controls on order takers
    [so:order:read, so:sales_order:read_all, so:settings:controls]
  fulfiller:              # fills: fulfiller — sees confirmed orders, never prices
    [so:order:read, so:order:deliver]
  biller:                 # fills: biller
    [so:order:read, so:sales_order:read_all, so:order:invoice]
  system:                 # fills: system — a machine (client_credentials), never a person
    [so:order:read, so:order:intake, so:order:suggest, so:order:finish, so:number_series:claim, so:order:import, so:order:reschedule, so:rebate:accrue, so:return:inspect, so:demand:read]
service_clients: [system]