[DTP-Worker] Sprint 8 · buffer L75 · Reproductibilité checkout propre : hand-off out/ des 4 générateurs RBAC était .gitignore-é (gate rouge en CI, vert local seulement) + durcissement check_artifacts (build produit ⇒ DOIT être suivi par git)

Défaut réel (même classe que le bug regression_run.json corrigé plus tôt) :
les 4 générateurs RBAC (fixtures_gen/userperm_gen/roleprofile_gen/apply_plan)
.gitignore-aient leur out/, alors qu'ils sont audités en archétype `generator`
(critère HANDOFF). En checkout PROPRE (git archive HEAD = ce que voit le runner
Gitea) leur out/ est absent → qa/audit_4big (dont le build relit le out/ de
CHAQUE module) les note 80<95 ⇒ INV7 ⇒ build refusé ⇒ check-artifacts ET
check-regression ROUGES. Ça ne passait qu'en local via les out/ non suivis
laissés par des build manuels.

Fix : committer le out/ des 4 générateurs (build byte-déterministe prouvé ;
apply_plan lit ses frères en process, pas via out/) → alignement sur les 15
autres générateurs ; audit 100/100 en checkout propre.

Durcissement : check_artifacts.sh exige désormais `git ls-files --error-unmatch`
sur chaque fichier produit → un out/ ignoré/non commité devient une erreur
LOCALE honnête au lieu d'une surprise en CI. Bite-proof : git rm --cached d'un
artefact (laissé sur disque) ⇒ exit 1 ; re-add ⇒ exit 0.

Régénéré : quality_report.json (dérive DOC = taille des 4 README édités).
Vérifs : 6 gates verts sur git archive propre ; 534/21 inchangé ; suites OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Code DTP Worker
2026-07-31 01:42:14 +00:00
parent 59542e8f3c
commit a30ff937f0
21 changed files with 4509 additions and 24 deletions
@@ -150,7 +150,7 @@
"criterion": "DOC",
"weight": 20,
"passed": true,
"evidence": "README.md (5249 octets)"
"evidence": "README.md (5267 octets)"
},
{
"criterion": "CONTRAT",
@@ -192,7 +192,7 @@
"criterion": "DOC",
"weight": 20,
"passed": true,
"evidence": "README.md (3858 octets)"
"evidence": "README.md (3876 octets)"
},
{
"criterion": "CONTRAT",
@@ -234,7 +234,7 @@
"criterion": "DOC",
"weight": 20,
"passed": true,
"evidence": "README.md (5358 octets)"
"evidence": "README.md (5376 octets)"
},
{
"criterion": "CONTRAT",
@@ -276,7 +276,7 @@
"criterion": "DOC",
"weight": 20,
"passed": true,
"evidence": "README.md (5241 octets)"
"evidence": "README.md (5259 octets)"
},
{
"criterion": "CONTRAT",
@@ -1,4 +1,7 @@
# Sortie re-générable à la demande (déterministe) — non commitée.
out/
# Artefacts Python (jamais commit — reproductibles).
__pycache__/
*.pyc
# NB : out/ EST commité (hand-off audité · archétype `generator` · critère
# HANDOFF · CLAUDE.md #5). `build` est byte-déterministe → out/ se régénère à
# l'identique par `python3 rbac_apply_plan.py build -o out` et est gardé par
# ci/check_artifacts.sh (build frais == commité).
@@ -27,7 +27,7 @@ de portée `equipe`). L'agrégateur matérialise ce **graphe de dépendances** e
**recoupe la cohérence** des trois volets (même contrat, même cible 50 rôles,
couverture bijective) — un seul artefact à lire pour l'agent ERPNext.
## Ce qui est généré (`out/`, non commité)
## Ce qui est généré (`out/`, commité · byte-déterministe)
| Fichier | Rôle |
|---|---|
@@ -0,0 +1,42 @@
{
"generated_from": "rbac_50_roles.json",
"source_version": "1.0.0",
"cible_rbac_roles": 50,
"counts": {
"roles": 50,
"custom_docperm": 116,
"doctypes_uniques": 45,
"user_permission_templates": 28,
"role_profiles": 6
},
"confirmations_vps": {
"custom_doctypes": [
"API Access",
"CONFOTUR Application",
"Faisabilité",
"Publiciste Log"
],
"companies": [
"AC Arias Cuevas",
"Consortium ECR DR",
"Helios RD",
"Ploutos",
"WA SRL"
],
"roles_scope_equipe": [
"OTO Construction Chef Projet",
"OTO Construction Ingénieur",
"OTO Construction Sous-traitants",
"OTO Ventes Chef Équipe"
]
},
"consistency": {
"sources_coherentes": true,
"source_version": "1.0.0",
"cible_rbac_roles": 50,
"roles_fixtures": 50,
"userperm_plan_entries": 50,
"roleprofile_roles_couverts": 50,
"couverture_bijective": true
}
}
@@ -0,0 +1,98 @@
[
{
"order": 1,
"id": "fixtures-generate",
"titre": "Générer les fixtures Role + Custom DocPerm",
"responsable": "worker",
"statut": "livré",
"commande": "python3 fixtures_gen/rbac_fixtures_gen.py build",
"produces": [
"role.json",
"custom_docperm.json"
],
"depends_on": [],
"confirmations": [],
"doc": "../fixtures_gen/README.md"
},
{
"order": 2,
"id": "custom-doctypes-create",
"titre": "Créer les DocTypes DTP custom manquants (après confirmation)",
"responsable": "vps",
"statut": "à faire VPS",
"commande": null,
"produces": [],
"depends_on": [
"fixtures-generate"
],
"confirmations": [
"custom_doctypes"
],
"doc": "../RBAC_50_ROLES_SPEC.md"
},
{
"order": 3,
"id": "fixtures-migrate",
"titre": "Déposer role.json + custom_docperm.json dans fixtures/ puis bench migrate",
"responsable": "vps",
"statut": "à faire VPS",
"commande": null,
"produces": [],
"depends_on": [
"fixtures-generate",
"custom-doctypes-create"
],
"confirmations": [],
"doc": "../fixtures_gen/README.md"
},
{
"order": 4,
"id": "userperm-apply",
"titre": "Matérialiser les User Permission row-level par utilisateur",
"responsable": "worker+vps",
"statut": "plan livré · matérialisation VPS",
"commande": "python3 userperm_gen/userperm_gen.py build",
"produces": [
"user_permission_plan.json"
],
"depends_on": [
"fixtures-migrate"
],
"confirmations": [
"companies",
"roles_scope_equipe"
],
"doc": "../userperm_gen/README.md"
},
{
"order": 5,
"id": "roleprofile-apply",
"titre": "Importer les Role Profile (après les Role) puis affecter User.role_profile_name",
"responsable": "worker+vps",
"statut": "bundle livré · affectation VPS",
"commande": "python3 roleprofile_gen/roleprofile_gen.py build",
"produces": [
"role_profile.json"
],
"depends_on": [
"fixtures-migrate"
],
"confirmations": [],
"doc": "../roleprofile_gen/README.md"
},
{
"order": 6,
"id": "verify-http-qa",
"titre": "Vérification HTTP post-déploiement + audit QA 4Big",
"responsable": "vps",
"statut": "à faire VPS",
"commande": null,
"produces": [],
"depends_on": [
"userperm-apply",
"roleprofile-apply"
],
"confirmations": [],
"doc": "../RBAC_50_ROLES_SPEC.md"
}
]
@@ -1,5 +1,7 @@
# Artefacts de génération locale (jamais commités — produits à la demande par
# `python3 rbac_fixtures_gen.py build`, re-générables en CI).
# Artefacts Python (jamais commit — reproductibles).
__pycache__/
*.pyc
out/
# NB : out/ EST commité (hand-off audité · archétype `generator` · critère
# HANDOFF · CLAUDE.md #5). `build` est byte-déterministe → out/ se régénère à
# l'identique par `python3 rbac_fixtures_gen.py build -o out` et est gardé par
# ci/check_artifacts.sh (build frais == commité).
@@ -9,7 +9,7 @@ incrément » annoncé au §7 de [`../RBAC_50_ROLES_SPEC.md`](../RBAC_50_ROLES_S
> Ce worker **n'écrit jamais sur le VPS** (contrainte #8). Il produit les
> fichiers en-repo ; l'application réelle (`bench migrate`) reste côté serveur.
## Ce qui est généré (`out/`, non commité)
## Ce qui est généré (`out/`, commité · byte-déterministe)
| Fichier | DocType Frappe | Rôle |
|---|---|---|
@@ -0,0 +1,16 @@
{
"generated_from": "rbac_50_roles.json",
"source_version": "1.0.0",
"cible_rbac_roles": 50,
"counts": {
"role": 50,
"custom_docperm": 116,
"doctypes_uniques": 45
},
"custom_doctypes_a_confirmer": [
"API Access",
"CONFOTUR Application",
"Faisabilité",
"Publiciste Log"
]
}
File diff suppressed because it is too large Load Diff
@@ -0,0 +1,452 @@
[
{
"doctype": "Role",
"name": "OTO Achat Acheteur",
"role_name": "OTO Achat Acheteur",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Achat Directeur",
"role_name": "OTO Achat Directeur",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Achat Fournisseurs",
"role_name": "OTO Achat Fournisseurs",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Achat Magasinier",
"role_name": "OTO Achat Magasinier",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Achat Réception",
"role_name": "OTO Achat Réception",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Compta Audit UAF",
"role_name": "OTO Compta Audit UAF",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Compta Clients AR",
"role_name": "OTO Compta Clients AR",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Compta Contrôle Gestion",
"role_name": "OTO Compta Contrôle Gestion",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Compta Fiscaliste eCF",
"role_name": "OTO Compta Fiscaliste eCF",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Compta Fournisseurs AP",
"role_name": "OTO Compta Fournisseurs AP",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Compta Général",
"role_name": "OTO Compta Général",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Compta Paie",
"role_name": "OTO Compta Paie",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Compta Trésorier",
"role_name": "OTO Compta Trésorier",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Conseil Administration",
"role_name": "OTO Conseil Administration",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Construction Architecte",
"role_name": "OTO Construction Architecte",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Construction BIM",
"role_name": "OTO Construction BIM",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Construction Chef Projet",
"role_name": "OTO Construction Chef Projet",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Construction Directeur",
"role_name": "OTO Construction Directeur",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Construction Ingénieur",
"role_name": "OTO Construction Ingénieur",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Construction QAQC",
"role_name": "OTO Construction QAQC",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Construction Sous-traitants",
"role_name": "OTO Construction Sous-traitants",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Direction Commerciale",
"role_name": "OTO Direction Commerciale",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Direction Financière",
"role_name": "OTO Direction Financière",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Direction Générale",
"role_name": "OTO Direction Générale",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Direction Opérations",
"role_name": "OTO Direction Opérations",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Direction Président",
"role_name": "OTO Direction Président",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Faisabilité Analyste",
"role_name": "OTO Faisabilité Analyste",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Faisabilité IFC Speckle",
"role_name": "OTO Faisabilité IFC Speckle",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Faisabilité Rendu 3D",
"role_name": "OTO Faisabilité Rendu 3D",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Faisabilité Économiste",
"role_name": "OTO Faisabilité Économiste",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Legal Directeur",
"role_name": "OTO Legal Directeur",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Legal ONAPI",
"role_name": "OTO Legal ONAPI",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Marketing Directeur",
"role_name": "OTO Marketing Directeur",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Marketing Publiciste",
"role_name": "OTO Marketing Publiciste",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Marketing SEO",
"role_name": "OTO Marketing SEO",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Marketing Social",
"role_name": "OTO Marketing Social",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Plateforme BI",
"role_name": "OTO Plateforme BI",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Plateforme DevOps",
"role_name": "OTO Plateforme DevOps",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Plateforme Mobile",
"role_name": "OTO Plateforme Mobile",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Plateforme OTOIA",
"role_name": "OTO Plateforme OTOIA",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Plateforme QA",
"role_name": "OTO Plateforme QA",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Plateforme RBAC Admin",
"role_name": "OTO Plateforme RBAC Admin",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Ventes Après-Vente",
"role_name": "OTO Ventes Après-Vente",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Ventes CONFOTUR",
"role_name": "OTO Ventes CONFOTUR",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Ventes Chef Équipe",
"role_name": "OTO Ventes Chef Équipe",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Ventes Conseiller",
"role_name": "OTO Ventes Conseiller",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Ventes Contrats",
"role_name": "OTO Ventes Contrats",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Ventes Courtier Externe",
"role_name": "OTO Ventes Courtier Externe",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Ventes Directeur",
"role_name": "OTO Ventes Directeur",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
},
{
"doctype": "Role",
"name": "OTO Ventes Réservations",
"role_name": "OTO Ventes Réservations",
"desk_access": 1,
"disabled": 0,
"two_factor_auth": 0,
"restrict_to_domain": null
}
]
@@ -1,5 +1,7 @@
# Artefacts de génération locale (jamais commités — produits à la demande par
# `python3 roleprofile_gen.py build`, re-générables en CI).
# Artefacts Python (jamais commit — reproductibles).
__pycache__/
*.pyc
out/
# NB : out/ EST commité (hand-off audité · archétype `generator` · critère
# HANDOFF · CLAUDE.md #5). `build` est byte-déterministe → out/ se régénère à
# l'identique par `python3 roleprofile_gen.py build -o out` et est gardé par
# ci/check_artifacts.sh (build frais == commité).
@@ -22,7 +22,7 @@ nommé de rôles (`Has Role`) qu'on affecte en un champ. Les **5 portails métie
donnent **6 profils** couvrant les 50 rôles de façon **bijective** (chaque rôle
dans exactement un profil, puisque chaque rôle a exactement un `portail`).
## Ce qui est généré (`out/`, non commité)
## Ce qui est généré (`out/`, commité · byte-déterministe)
| Fichier | Rôle |
|---|---|
@@ -0,0 +1,49 @@
{
"generated_from": "rbac_50_roles.json",
"source_version": "1.0.0",
"cible_rbac_roles": 50,
"counts": {
"role_profiles": 6,
"portails_metier": 5,
"portails_techniques": 1,
"roles_couverts": 50
},
"profiles": [
{
"portail": "achat",
"role_profile": "OTO Portail Achat",
"metier": true,
"nb_roles": 5
},
{
"portail": "compta",
"role_profile": "OTO Portail Compta",
"metier": true,
"nb_roles": 8
},
{
"portail": "construction",
"role_profile": "OTO Portail Construction",
"metier": true,
"nb_roles": 10
},
{
"portail": "direction",
"role_profile": "OTO Portail Direction",
"metier": true,
"nb_roles": 9
},
{
"portail": "plateforme",
"role_profile": "OTO Portail Plateforme",
"metier": false,
"nb_roles": 6
},
{
"portail": "ventes",
"role_profile": "OTO Portail Ventes",
"metier": true,
"nb_roles": 12
}
]
}
@@ -0,0 +1,344 @@
[
{
"doctype": "Role Profile",
"name": "OTO Portail Achat",
"role_profile": "OTO Portail Achat",
"roles": [
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Achat Acheteur"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Achat Directeur"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Achat Fournisseurs"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Achat Magasinier"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Achat Réception"
}
]
},
{
"doctype": "Role Profile",
"name": "OTO Portail Compta",
"role_profile": "OTO Portail Compta",
"roles": [
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Compta Audit UAF"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Compta Clients AR"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Compta Contrôle Gestion"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Compta Fiscaliste eCF"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Compta Fournisseurs AP"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Compta Général"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Compta Paie"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Compta Trésorier"
}
]
},
{
"doctype": "Role Profile",
"name": "OTO Portail Construction",
"role_profile": "OTO Portail Construction",
"roles": [
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Construction Architecte"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Construction BIM"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Construction Chef Projet"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Construction Directeur"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Construction Ingénieur"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Construction QAQC"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Construction Sous-traitants"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Faisabilité IFC Speckle"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Faisabilité Rendu 3D"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Faisabilité Économiste"
}
]
},
{
"doctype": "Role Profile",
"name": "OTO Portail Direction",
"role_profile": "OTO Portail Direction",
"roles": [
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Conseil Administration"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Direction Commerciale"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Direction Financière"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Direction Générale"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Direction Opérations"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Direction Président"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Faisabilité Analyste"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Legal Directeur"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Legal ONAPI"
}
]
},
{
"doctype": "Role Profile",
"name": "OTO Portail Plateforme",
"role_profile": "OTO Portail Plateforme",
"roles": [
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Plateforme BI"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Plateforme DevOps"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Plateforme Mobile"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Plateforme OTOIA"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Plateforme QA"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Plateforme RBAC Admin"
}
]
},
{
"doctype": "Role Profile",
"name": "OTO Portail Ventes",
"role_profile": "OTO Portail Ventes",
"roles": [
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Marketing Directeur"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Marketing Publiciste"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Marketing SEO"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Marketing Social"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Ventes Après-Vente"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Ventes CONFOTUR"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Ventes Chef Équipe"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Ventes Conseiller"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Ventes Contrats"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Ventes Courtier Externe"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Ventes Directeur"
},
{
"doctype": "Has Role",
"parentfield": "roles",
"parenttype": "Role Profile",
"role": "OTO Ventes Réservations"
}
]
}
]
@@ -1,5 +1,7 @@
# Artefacts de génération locale (jamais commités — produits à la demande par
# `python3 userperm_gen.py build`, re-générables en CI).
# Artefacts Python (jamais commit — reproductibles).
__pycache__/
*.pyc
out/
# NB : out/ EST commité (hand-off audité · archétype `generator` · critère
# HANDOFF · CLAUDE.md #5). `build` est byte-déterministe → out/ se régénère à
# l'identique par `python3 userperm_gen.py build -o out` et est gardé par
# ci/check_artifacts.sh (build frais == commité).
@@ -21,7 +21,7 @@ produire qu'un **template par rôle** dont le champ `user` est une sentinelle
(`__ASSIGN_PER_USER__`). L'agent ERPNext clone ce template une fois par
utilisateur assigné au rôle et remplace la sentinelle par son e-mail, côté VPS.
## Ce qui est généré (`out/`, non commité)
## Ce qui est généré (`out/`, commité · byte-déterministe)
| Fichier | Rôle |
|---|---|
@@ -0,0 +1,28 @@
{
"generated_from": "rbac_50_roles.json",
"source_version": "1.0.0",
"cible_rbac_roles": 50,
"counts": {
"plan_entries": 50,
"user_permission_templates": 28,
"by_mechanism": {
"docperm_if_owner": 2,
"user_permission_company": 28,
"none_consolidated": 16,
"vps_confirm_team": 4
}
},
"companies_a_confirmer": [
"AC Arias Cuevas",
"Consortium ECR DR",
"Helios RD",
"Ploutos",
"WA SRL"
],
"roles_scope_equipe_a_confirmer": [
"OTO Construction Chef Projet",
"OTO Construction Ingénieur",
"OTO Construction Sous-traitants",
"OTO Ventes Chef Équipe"
]
}
@@ -0,0 +1,576 @@
[
{
"erpnext_role_name": "OTO Achat Acheteur",
"scope_donnees": "entite",
"entite_principale": "WA SRL",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "WA SRL",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Achat Directeur",
"scope_donnees": "entite",
"entite_principale": "WA SRL",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "WA SRL",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Achat Fournisseurs",
"scope_donnees": "entite",
"entite_principale": "WA SRL",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "WA SRL",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Achat Magasinier",
"scope_donnees": "entite",
"entite_principale": "AC Arias Cuevas",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "AC Arias Cuevas",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Achat Réception",
"scope_donnees": "entite",
"entite_principale": "AC Arias Cuevas",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "AC Arias Cuevas",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Compta Audit UAF",
"scope_donnees": "groupe",
"entite_principale": "Groupe",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Compta Clients AR",
"scope_donnees": "entite",
"entite_principale": "Helios RD",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "Helios RD",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Compta Contrôle Gestion",
"scope_donnees": "groupe",
"entite_principale": "Groupe",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Compta Fiscaliste eCF",
"scope_donnees": "entite",
"entite_principale": "WA SRL",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "WA SRL",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Compta Fournisseurs AP",
"scope_donnees": "entite",
"entite_principale": "WA SRL",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "WA SRL",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Compta Général",
"scope_donnees": "entite",
"entite_principale": "WA SRL",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "WA SRL",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Compta Paie",
"scope_donnees": "entite",
"entite_principale": "Consortium ECR DR",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "Consortium ECR DR",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Compta Trésorier",
"scope_donnees": "entite",
"entite_principale": "Ploutos",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "Ploutos",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Conseil Administration",
"scope_donnees": "groupe",
"entite_principale": "Groupe",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Construction Architecte",
"scope_donnees": "entite",
"entite_principale": "AC Arias Cuevas",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "AC Arias Cuevas",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Construction BIM",
"scope_donnees": "entite",
"entite_principale": "AC Arias Cuevas",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "AC Arias Cuevas",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Construction Chef Projet",
"scope_donnees": "equipe",
"entite_principale": "AC Arias Cuevas",
"mechanism": "vps_confirm_team",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Construction Directeur",
"scope_donnees": "entite",
"entite_principale": "AC Arias Cuevas",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "AC Arias Cuevas",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Construction Ingénieur",
"scope_donnees": "equipe",
"entite_principale": "AC Arias Cuevas",
"mechanism": "vps_confirm_team",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Construction QAQC",
"scope_donnees": "entite",
"entite_principale": "AC Arias Cuevas",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "AC Arias Cuevas",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Construction Sous-traitants",
"scope_donnees": "equipe",
"entite_principale": "AC Arias Cuevas",
"mechanism": "vps_confirm_team",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Direction Commerciale",
"scope_donnees": "groupe",
"entite_principale": "Groupe",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Direction Financière",
"scope_donnees": "groupe",
"entite_principale": "Groupe",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Direction Générale",
"scope_donnees": "groupe",
"entite_principale": "Groupe",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Direction Opérations",
"scope_donnees": "groupe",
"entite_principale": "Groupe",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Direction Président",
"scope_donnees": "groupe",
"entite_principale": "WAF",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Faisabilité Analyste",
"scope_donnees": "entite",
"entite_principale": "WA SRL",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "WA SRL",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Faisabilité IFC Speckle",
"scope_donnees": "entite",
"entite_principale": "WA SRL",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "WA SRL",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Faisabilité Rendu 3D",
"scope_donnees": "entite",
"entite_principale": "WA SRL",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "WA SRL",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Faisabilité Économiste",
"scope_donnees": "entite",
"entite_principale": "AC Arias Cuevas",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "AC Arias Cuevas",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Legal Directeur",
"scope_donnees": "groupe",
"entite_principale": "WAF",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Legal ONAPI",
"scope_donnees": "groupe",
"entite_principale": "WAF",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Marketing Directeur",
"scope_donnees": "entite",
"entite_principale": "Helios RD",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "Helios RD",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Marketing Publiciste",
"scope_donnees": "entite",
"entite_principale": "Helios RD",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "Helios RD",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Marketing SEO",
"scope_donnees": "entite",
"entite_principale": "Helios RD",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "Helios RD",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Marketing Social",
"scope_donnees": "entite",
"entite_principale": "Helios RD",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "Helios RD",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Plateforme BI",
"scope_donnees": "groupe",
"entite_principale": "Groupe",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Plateforme DevOps",
"scope_donnees": "groupe",
"entite_principale": "9060 QC",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Plateforme Mobile",
"scope_donnees": "groupe",
"entite_principale": "9060 QC",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Plateforme OTOIA",
"scope_donnees": "groupe",
"entite_principale": "9060 QC",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Plateforme QA",
"scope_donnees": "groupe",
"entite_principale": "9060 QC",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Plateforme RBAC Admin",
"scope_donnees": "groupe",
"entite_principale": "9060 QC",
"mechanism": "none_consolidated",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Ventes Après-Vente",
"scope_donnees": "entite",
"entite_principale": "Helios RD",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "Helios RD",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Ventes CONFOTUR",
"scope_donnees": "entite",
"entite_principale": "WA SRL",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "WA SRL",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Ventes Chef Équipe",
"scope_donnees": "equipe",
"entite_principale": "Helios RD",
"mechanism": "vps_confirm_team",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Ventes Conseiller",
"scope_donnees": "own",
"entite_principale": "Helios RD",
"mechanism": "docperm_if_owner",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Ventes Contrats",
"scope_donnees": "entite",
"entite_principale": "WA SRL",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "WA SRL",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Ventes Courtier Externe",
"scope_donnees": "own",
"entite_principale": "Helios RD",
"mechanism": "docperm_if_owner",
"user_permission_template": null
},
{
"erpnext_role_name": "OTO Ventes Directeur",
"scope_donnees": "entite",
"entite_principale": "Helios RD",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "Helios RD",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
},
{
"erpnext_role_name": "OTO Ventes Réservations",
"scope_donnees": "entite",
"entite_principale": "Helios RD",
"mechanism": "user_permission_company",
"user_permission_template": {
"doctype": "User Permission",
"user": "__ASSIGN_PER_USER__",
"allow": "Company",
"for_value": "Helios RD",
"apply_to_all_doctypes": 1,
"is_default": 0,
"hide_descendants": 0
}
}
]