fix(arch-008,arch-009): canonical 2-segment permission schema enforced; fix dead role wildcard patterns

app/routes/delegations.py

@@ -19,7 +19,7 @@ router = APIRouter(prefix="/api/v1/delegations", tags=["delegations"])
 async def list_delegations(
     direction: str = Query("all", pattern="^(from|to|all)$"),
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_permission("permissions:delegations:read")),
+    current_user: dict = Depends(require_permission("delegations:read")),
 ):
     """List delegations for the current user."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -32,7 +32,7 @@ async def list_delegations(
 async def create_delegation(
     body: DelegationCreate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_permission("permissions:delegations:write")),
+    current_user: dict = Depends(require_permission("delegations:write")),
 ):
     """Create a new permission delegation."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -56,7 +56,7 @@ async def update_delegation(
     delegation_id: str,
     body: DelegationUpdate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_permission("permissions:delegations:write")),
+    current_user: dict = Depends(require_permission("delegations:write")),
 ):
     """Update an existing delegation."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -78,7 +78,7 @@ async def update_delegation(
 async def delete_delegation(
     delegation_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_permission("permissions:delegations:write")),
+    current_user: dict = Depends(require_permission("delegations:write")),
 ):
     """Delete a delegation."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -91,7 +91,7 @@ async def delete_delegation(
 @router.get("/active")
 async def check_active_delegation(
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_permission("permissions:delegations:read")),
+    current_user: dict = Depends(require_permission("delegations:read")),
 ):
     """Check if the current user has any active delegations."""
     tenant_id = uuid.UUID(current_user["tenant_id"])