dodil/erp-brick-time-off

DODIL ERP brick: time off

src/brick_time_off/roles.yaml

# The default roles this brick recommends: module.yaml's actors, permission for permission. A starting point, not a rule. The brick checks
# PERMISSIONS only, never a role's name; a composition maps its own pool roles to these.
#
# tof:settings:controls is the owner's alone (never the HR user it controls). The machine permissions are exact grants to a service client,
# one client per neighbour (spec: tof:leaver:intake to hr's client alone; tof:balance:read_for_payroll to payroll's alone):
#   hr_client       hr's service client: tof:leaver:intake, and nothing else
#   payroll_client  payroll's service client: tof:balance:read_for_payroll and tof:absence:read_for_payroll
#   system          time-off's own worker: accruals, the year end, reminders, the migration
roles:
  employee:
    [tof:request:read_own, tof:request:write_own, tof:sickness:record_own, tof:calendar:read_team]
  manager:
    [tof:request:read_own, tof:request:write_own, tof:sickness:record_own, tof:calendar:read_team,
     tof:request:read_team, tof:request:approve, tof:sickness:record_team]
  hr_admin:
    [tof:request:read_all, tof:request:approve, tof:sickness:record_team, tof:sickness:read_detail, tof:absence:record,
     tof:balance:adjust, tof:policy:write, tof:leave_type:write, tof:closure:write, tof:report:read, tof:migration:read,
     tof:request:read_own, tof:request:write_own, tof:sickness:record_own, tof:calendar:read_team]
  owner:
    [tof:request:read_all, tof:settings:controls, tof:migration:read, tof:migration:sign]
  system:
    [tof:balance:accrue, tof:year_end:run, tof:reminder:tick, tof:migration:load, tof:migration:reconcile]
  hr_client:
    [tof:leaver:intake]
  payroll_client:
    [tof:balance:read_for_payroll, tof:absence:read_for_payroll]
service_clients: [system, hr_client, payroll_client]