Problem 3/4: Add GET /api/v1/roles/permissions endpoint returning system + plugin permissions

app/routes/roles.py

@@ -6,16 +6,78 @@ import uuid
 
 from fastapi import APIRouter, Depends, HTTPException, Response, status
 from fastapi.responses import JSONResponse
+from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
 from app.deps import get_current_user, require_admin
+from app.models.plugin import Plugin as PluginModel
+from app.plugins.registry import get_registry
 from app.schemas.role import RoleCreate, RoleUpdate
 from app.services.role_service import role_service
 
 router = APIRouter(prefix="/api/v1/roles", tags=["roles"])
 
 
+SYSTEM_PERMISSIONS: list[dict[str, str]] = [
+    {"key": "companies:read", "label": "Companies: Read", "category": "system"},
+    {"key": "companies:write", "label": "Companies: Write", "category": "system"},
+    {"key": "contacts:read", "label": "Contacts: Read", "category": "system"},
+    {"key": "contacts:write", "label": "Contacts: Write", "category": "system"},
+    {"key": "users:read", "label": "Users: Read", "category": "system"},
+    {"key": "users:write", "label": "Users: Write", "category": "system"},
+    {"key": "audit:read", "label": "Audit Log: Read", "category": "system"},
+    {"key": "settings:write", "label": "Settings: Write", "category": "system"},
+    {"key": "plugins:install", "label": "Plugins: Install", "category": "system"},
+    {"key": "plugins:configure", "label": "Plugins: Configure", "category": "system"},
+    {"key": "roles:read", "label": "Roles: Read", "category": "system"},
+    {"key": "roles:write", "label": "Roles: Write", "category": "system"},
+]
+
+
+@router.get("/permissions")
+async def list_permissions(
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(require_admin),
+):
+    """List all available permissions (system + active plugin permissions).
+
+    Returns permissions grouped by category:
+    - ``system``: built-in CRM permissions
+    - ``plugins``: permissions from active plugin manifests
+    """
+    registry = get_registry()
+    plugin_perms: list[dict[str, str]] = []
+
+    # Fetch active plugin records from DB
+    result = await db.execute(
+        select(PluginModel).where(PluginModel.active == True)  # noqa: E712
+    )
+    active_records = {row.name: row for row in result.scalars().all()}
+
+    # Collect permissions from active plugins' manifests
+    seen_keys: set[str] = set()
+    for name, plugin in registry._plugins.items():
+        if name not in active_records:
+            continue
+        for perm in plugin.manifest.permissions:
+            if perm in seen_keys:
+                continue
+            seen_keys.add(perm)
+            plugin_perms.append({
+                "key": perm,
+                "label": perm.replace("_", " ").replace(":", ": ").title(),
+                "category": "plugins",
+                "plugin_name": name,
+            })
+
+    return {
+        "system": SYSTEM_PERMISSIONS,
+        "plugins": plugin_perms,
+        "all": SYSTEM_PERMISSIONS + plugin_perms,
+    }
+
+
 @router.get("")
 async def list_roles(
     db: AsyncSession = Depends(get_db),