dodil/erp-brick-tax

DODIL ERP brick: tax

src/brick_tax/roles.yaml

# The default roles this brick recommends: module.yaml's actors, permission for permission. A starting point, not a rule.
# The brick checks PERMISSIONS only, never a role's name; a composition maps its own pool roles to these permissions (or
# grants tax:*:* to an owner) in its role catalogue.
#
# A rate, rule or registration change waits for a second holder of tax:code:approve where the owner's control
# (tax_changes_need_second_person) asks for it; an override that lowers a line's tax waits for a holder of
# tax:document_tax:approve_override who is not its author (override_approval: second_person, the default).
roles:
  tax_admin:      # fills: tax_admin (the owner, the bookkeeper, the accountant)
    [tax:code:read, tax:code:write, tax:code:approve, tax:category:write, tax:registration:write, tax:party_tax:write,
     tax:document_tax:approve_override, tax:settings:write, tax:vat_return:read, tax:vat_return:prepare, tax:vat_return:submit,
     tax:vat_adjustment:write, tax:bad_debt:claim, tax:cis:write, tax:trade_declaration:write, tax:import_vat:write,
     tax:partial_exemption:write]
  owner:          # fills: owner — the owner or a finance controller; sets the controls on whoever keeps VAT
    [tax:code:read, tax:code:approve, tax:settings:controls, tax:hmrc:connect, tax:vat_return:read, tax:vat_return:submit,
     tax:cis_return:submit]
  biller:         # fills: biller (whoever raises orders and invoices)
    [tax:code:read, tax:party_tax:write, tax:document_tax:override]
  system:         # fills: system — a machine (client_credentials), never a person
    [tax:code:read, tax:code:seed, tax:document_tax:compute, tax:document_tax:suggest, tax:history:import, tax:obligation:sync,
     tax:tax_point:read, tax:bad_debt:suggest, tax:migration:read, tax:vat_number:check, tax:cis:deduct,
     tax:cis:record_suffered, tax:import_vat:record, tax:cis:read]
service_clients: [system]
# tax:settings:controls is held by neither the tax admin nor the biller: it changes who must approve a change and an override
# and the business time zone, the controls on the people who keep VAT. tax:code:seed, tax:document_tax:compute,
# tax:document_tax:suggest and tax:history:import are machine permissions: grant them only to the system's service client.
# A wildcard such as tax:*:* never reaches them.