dodil/erp-brick-timesheets

DODIL ERP brick: timesheets

src/brick_timesheets/roles.yaml

# The default roles this brick recommends: module.yaml's actors, permission for permission. A starting point, not a
# rule. The brick checks PERMISSIONS only, never a role's name; a composition maps its own pool roles to these.
#
# ts:settings:controls is the owner's alone (never the finance user it controls). The machine permissions are exact
# grants to a service client, one client per neighbour:
#   payroll_client   payroll's service client: ts:hours:read_approved, and nothing else
#   timeoff_client   time-off's service client: ts:hours:read_approved, and nothing else
#   system           timesheets' own worker: drains the outbox (posts the journals, reports the deliveries), reminds, bills, migrates
roles:
  employee:
    [ts:sheet:read_own, ts:sheet:write_own, ts:sheet:submit]
  manager:
    [ts:sheet:read_own, ts:sheet:write_own, ts:sheet:submit, ts:sheet:read_team, ts:sheet:approve]
  project_lead:
    [ts:sheet:read_own, ts:sheet:write_own, ts:sheet:submit, ts:line:approve_project, ts:project_hours:read]
  finance:
    [ts:sheet:read_all, ts:sheet:reopen, ts:cost_rate:write, ts:billing_run:release, ts:project_hours:read, ts:activity:write, ts:migration:read]
  owner:
    [ts:sheet:read_all, ts:settings:controls, ts:migration:read, ts:migration:sign]
  system:
    [ts:sheet:open_auto, ts:cost:post_auto, ts:delivery:report, ts:billing_run:create, ts:reminder:tick, ts:migration:load, ts:migration:reconcile]
  payroll_client:
    [ts:hours:read_approved]
  timeoff_client:
    [ts:hours:read_approved]
service_clients: [system, payroll_client, timeoff_client]