[DTP-Worker] Sprint 2 · Générateur fixtures ERPNext (RBAC 50 rôles → Role + Custom DocPerm)

Transforme rbac_50_roles.json en fixtures Frappe/ERPNext v15 natives, prêtes à appliquer via bench (VPS · agent ERPNext). Réalise le prochain incrément annoncé au §7 de RBAC_50_ROLES_SPEC.md. Zéro pip, zéro VPS, sortie déterministe. - fixturelib/frappe.py : modèle natif (15 flags DocPerm, mapping 1:1 des verbes RBAC, if_owner⇔scope "own"). fixturelib/builder.py : bundle déterministe. - rbac_fixtures_gen.py : CLI build/validate (refuse d'écrire si invariant KO). - fixtures.schema.json : contrat de sortie (validateur maison Publiciste réutilisé). - 11 tests unittest : schéma+oracle, 50 rôles, séparation des pouvoirs, round-trip fidèle au contrat, déterminisme. Job CI rbac-fixtures-tests au gate. - Anti-invention #6 : 100% dérivé du contrat, flags non pilotés à 0, DocTypes custom signalés « à confirmer VPS ». Vérif : 11/11 verts + gate CI local vert (exit 0) + régression 60 tests OK. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-30 03:03:12 +00:00
parent 911f70b9ab
commit d815c7ab63
11 changed files with 869 additions and 7 deletions
@@ -0,0 +1,122 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://oto-enterprise-os-dtp/rbac/fixtures.schema.json",
+  "title": "Bundle de fixtures ERPNext généré depuis rbac_50_roles.json",
+  "description": "Contrat de sortie du générateur rbac_fixtures_gen.py. Validé par le validateur maison Publiciste (zéro pip) dans le job CI rbac-fixtures-tests.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["manifest", "role", "custom_docperm"],
+  "properties": {
+    "manifest": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "generated_from",
+        "source_version",
+        "cible_rbac_roles",
+        "counts",
+        "custom_doctypes_a_confirmer"
+      ],
+      "properties": {
+        "generated_from": { "type": "string", "const": "rbac_50_roles.json" },
+        "source_version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
+        "cible_rbac_roles": { "type": "integer", "const": 50 },
+        "counts": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["role", "custom_docperm", "doctypes_uniques"],
+          "properties": {
+            "role": { "type": "integer", "minimum": 50, "maximum": 50 },
+            "custom_docperm": { "type": "integer", "minimum": 1 },
+            "doctypes_uniques": { "type": "integer", "minimum": 1 }
+          }
+        },
+        "custom_doctypes_a_confirmer": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string", "minLength": 1 }
+        }
+      }
+    },
+    "role": {
+      "type": "array",
+      "minItems": 50,
+      "maxItems": 50,
+      "items": { "$ref": "#/definitions/role" }
+    },
+    "custom_docperm": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/definitions/custom_docperm" }
+    }
+  },
+  "definitions": {
+    "flag": { "type": "integer", "enum": [0, 1] },
+    "role": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["doctype", "name", "role_name", "desk_access", "disabled"],
+      "properties": {
+        "doctype": { "type": "string", "const": "Role" },
+        "name": { "type": "string", "pattern": "^OTO " },
+        "role_name": { "type": "string", "pattern": "^OTO " },
+        "desk_access": { "$ref": "#/definitions/flag" },
+        "disabled": { "$ref": "#/definitions/flag" },
+        "two_factor_auth": { "$ref": "#/definitions/flag" },
+        "restrict_to_domain": { "type": ["string", "null"] }
+      }
+    },
+    "custom_docperm": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "doctype",
+        "parent",
+        "parenttype",
+        "parentfield",
+        "role",
+        "permlevel",
+        "if_owner",
+        "select",
+        "read",
+        "write",
+        "create",
+        "delete",
+        "submit",
+        "cancel",
+        "amend",
+        "report",
+        "export",
+        "import",
+        "print",
+        "email",
+        "share",
+        "set_user_permissions"
+      ],
+      "properties": {
+        "doctype": { "type": "string", "const": "Custom DocPerm" },
+        "parent": { "type": "string", "minLength": 1 },
+        "parenttype": { "type": "string", "const": "DocType" },
+        "parentfield": { "type": "string", "const": "permissions" },
+        "role": { "type": "string", "pattern": "^OTO " },
+        "permlevel": { "type": "integer", "minimum": 0 },
+        "if_owner": { "$ref": "#/definitions/flag" },
+        "select": { "$ref": "#/definitions/flag" },
+        "read": { "$ref": "#/definitions/flag" },
+        "write": { "$ref": "#/definitions/flag" },
+        "create": { "$ref": "#/definitions/flag" },
+        "delete": { "$ref": "#/definitions/flag" },
+        "submit": { "$ref": "#/definitions/flag" },
+        "cancel": { "$ref": "#/definitions/flag" },
+        "amend": { "$ref": "#/definitions/flag" },
+        "report": { "$ref": "#/definitions/flag" },
+        "export": { "$ref": "#/definitions/flag" },
+        "import": { "$ref": "#/definitions/flag" },
+        "print": { "$ref": "#/definitions/flag" },
+        "email": { "$ref": "#/definitions/flag" },
+        "share": { "$ref": "#/definitions/flag" },
+        "set_user_permissions": { "$ref": "#/definitions/flag" }
+      }
+    }
+  }
+}