feat: granular RBAC system with user groups, deny-list, permission registry, system-admin, self-mod prevention

app/models/role.py

@@ -6,7 +6,7 @@ import uuid
 from datetime import datetime
 from typing import Any
 
-from sqlalchemy import DateTime, String, func
+from sqlalchemy import DateTime, Integer, String, func
 from sqlalchemy.dialects.postgresql import JSONB
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
@@ -24,7 +24,13 @@ class Role(Base, TenantMixin):
     )
     name: Mapped[str] = mapped_column(String(100), nullable=False)
     permissions: Mapped[dict[str, Any]] = mapped_column(JSONB, nullable=False)
+    denied_permissions: Mapped[list[str]] = mapped_column(
+        JSONB, nullable=False, default=list
+    )
     field_permissions: Mapped[dict[str, Any]] = mapped_column(JSONB, default=dict, nullable=False)
+    permission_version: Mapped[int] = mapped_column(
+        Integer, nullable=False, default=1, server_default="1"
+    )
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), nullable=False, server_default=func.now()
     )