feat: granular RBAC system with user groups, deny-list, permission registry, system-admin, self-mod prevention

2026-07-15 21:59:45 +02:00
parent 905bc9b744
commit b490a62322
17 changed files with 1408 additions and 13 deletions
@@ -0,0 +1,42 @@
+"""Group schemas."""
+
+from __future__ import annotations
+
+from pydantic import BaseModel, Field
+
+
+class GroupCreate(BaseModel):
+    name: str = Field(..., min_length=1, max_length=100)
+    description: str | None = Field(None, max_length=500)
+    permissions: dict = Field(default_factory=dict)
+    denied_permissions: list[str] = Field(default_factory=list)
+    field_permissions: dict = Field(default_factory=dict)
+
+
+class GroupUpdate(BaseModel):
+    name: str | None = Field(None, min_length=1, max_length=100)
+    description: str | None = Field(None, max_length=500)
+    permissions: dict | None = None
+    denied_permissions: list[str] | None = None
+    field_permissions: dict | None = None
+
+
+class GroupResponse(BaseModel):
+    id: str
+    name: str
+    description: str | None = None
+    permissions: dict
+    denied_permissions: list[str]
+    field_permissions: dict
+    permission_version: int
+
+
+class GroupMemberResponse(BaseModel):
+    user_id: str
+    email: str
+    name: str
+    is_active: bool
+
+
+class AddMemberRequest(BaseModel):
+    user_id: str