Coverage for src / lexigram / contracts / auth / roles.py: 100%

1"""The single role model shared by lexigram-auth and lexigram-admin.""" 

2 

3from __future__ import annotations 

4 

5from dataclasses import dataclass, field 

6 

7 

8@dataclass(frozen=True) 

9class RoleDefinition: 

10 """A named collection of permissions. 

11 

12 The one role model in the framework (spec D2). Permission entries are 

13 strings in ``"resource.action"`` form, optionally scoped as 

14 ``"resource.action:scope"`` (``scope`` in {"self", "team", "all"}, 

15 carried forward from the former ``rbac.Permission.scope`` field — 

16 evaluation of scope by the PDP is deferred, spec §7). 

17 """ 

18 

19 name: str 

20 description: str = "" 

21 permissions: list[str] = field(default_factory=list) 

22 inherits: list[str] = field(default_factory=list) 

23 is_system: bool = False